Overview

overview

10

Static

static

10

Red-Flaged.7z

windows11-ltsc_2024-x64

8

Resubmissions

08/09/2026, 15:38

260908-s27nzagd93

15/08/2026, 21:05

260815-zw6ytat1ez

15/08/2026, 20:50

260815-zmxnsatzgs

15/08/2026, 20:46

260815-zkklfatcnf

15/08/2026, 20:40

260815-zf5e2stcjb

15/08/2026, 20:39

260815-zfqlwstydz

14/08/2026, 18:03

260814-wm9fssyyev

06/08/2026, 22:09

260806-124lbabl4s

06/08/2026, 03:52

260806-efejeaxzax

04/08/2026, 06:18

260804-g2rf7ssgqf

Sharing

Copy URL Twitter E-mail

General

  • Target
    Red-Flaged.7z
  • Size 328.4MB
  • Sample260620-yvxs3sat3x
  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
revoked_codesignupxinstallerstealerbing_mod2m1wiperlimhostbulkavmprotectthemidamayo24rataptlazarusbackdoorransomware.gofingkeyloggertrojanspywarenanocoresupershellaura_stealerpennywiseflyagentbotnetzloaderduplexspyratbabylonratloaderxtinyloaderrevengeratwormcosmumimikatzhacktoolnighthawkamadeyinfostealerredlinesectopratsalatstealerpersistenceneshtabertlynxumbralxwormyureiblacklockhermeticwiperdownloadernwormxredarcanejlockermispaduremcosdtrackxclientmetasploitlockbitwarmcookieblankgrabbersheetratblacknevasquasar

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • computernewb.com:80

  • discord.horse:80

Mutex

  • 4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    discord.horse

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2025-04-03T22:24:52.440913136Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    80

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    computernewb.com

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • aura_stealer

Version

  • 1.5.1

C2

  • https://opencamping.shop

  • https://gamedb.shop

  • https://unknowntool.shop

  • https://browsertools.shop

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_id

    9ffefb7a-f71e-45e1-af6b-e53ae365e1bd

  • human_check

    true

  • run_delay

    5

  • self_del

    true

  • useragents

Extracted

Family

  • zloader

Botnet

  • Bing_Mod2

Campaign

  • M1

C2

  • https://adslstickerni.world

rc4.plain
rsa_pubkey.plain

Extracted

Family

  • redline

Botnet

  • LIM

C2

  • 195.3.223.120:25539

Extracted

Family

  • nworm

Version

  • v0.3.8

C2

  • computernewb.com:80

  • discord.horse:80

Mutex

  • 35f629a5

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • nickman12-46565.portmap.io:46565

  • nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • sheetrat

Version

  • 1.7

Campaign

  • Bulka

C2

  • 95.181.213.48:7777

Extracted

Family

  • umbral

Version

  • v1.3

C2

  • https://discord.com/api/webhooks/1437804446846292199/tv-QDaXWpLAuK3kjN19boqVo_x72Y_ECGK_spjWckXHS3OiiDIJpEFcxVz8mUMFPVWeJ

Extracted

Family

  • metasploit

Version

  • metasploit_stager

C2

  • 8.138.101.146:3002

Extracted

Family

  • revengerat

Botnet

  • MAYO24

C2

  • karmina113.sytes.net:3333

  • karmina117.sytes.net:3333

  • karmina118.sytes.net:3333

  • karmina119.sytes.net:3333

  • nibiru3.duckdns.org:3333

  • nibiru4.duckdns.org:3333

  • nibiru5.duckdns.org:3333

  • nibiru6.duckdns.org:3333

Mutex

  • WSCollect

Extracted

Family

  • warmcookie

C2

  • 170.130.165.112

Attributes
  • mutex

    56c98eb4-723f-4cbd-8b73-862d390eddcb

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • .

C2

  • 147.185.221.31:65393

Mutex

  • 06e364dd-71d5-4f0b-bae4-3e4ca9c73aa5

Attributes
  • encryption_key

    FD9F712FFB55F9983B0F154D69B0813016E50527

  • install_name

    realtekconsole.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Realtek Audio Console

  • subdirectory

    Realtek

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: ArcaneStealer

    Arcane Stealer is a .Net information-stealing malware that is easy to acquire in the dark web.

    ratstealerarcane
  • Family: AuraStealer

    AuraStealer is a malware written in C++.

    stealeraura_stealer
  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat
  • Family: Bert

    Bert is a cross-platform ransomware first seen in 2025.

    ransomwarebert
  • Family: BlackLock

    BlackLock is a Windows ransomware written in Golang.

    ransomwareblacklock
  • Family: BlackNevas

    BlackNevas is a cross-platform ransomware related to the Trigona family.

    ransomwareblacknevas
  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu
  • Family: Dtrack, Preft, TroyRAT

    Dtrack aka Preft TroyRAT is RAT developed by Lazarus group written in C++.

    ratdtrack
  • Family: DuplexSpyRAT

    DuplexSpyRAT is an open-source Remote Access Tool written in C#.

    ratduplexspyrat
  • Family: FlyAgent

    FlyAgent is a backdoor written in C++.

    backdoorflyagent
  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Family: HermeticWiper

    HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.

    wiperhermeticwiper
  • Family: JLocker

    JLocker, also known as JRansomware, is a new Rust based ransomware.

    ransomwarejlocker
  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Family: Lynx

    Lynx is a Windows ransomware which operates using a ransomware-as-a-service model.

    ransomwarelynx
  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Family: Mispadu

    Mispadu is a stealer written in Delphi.

    stealermispadu
  • Family: NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Nighthawk

    Nighthawk is a C2 framework.

    hacktoolnighthawk
  • Family: PennyWise

    PennyWise is a stealer written in C#.

    stealerpennywise
  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Family: RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Family: Supershell

    Supershell is a cross-platfrom reverse shell written in Golang.

    backdoorsupershell
  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral
  • Family: Warmcookie, Badspace

    Warmcookie aka Badspace is a backdoor written in C++.

    backdoorwarmcookie
  • Family: XClient

    XClient is a trojan written in C#.

    trojanxclient
  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Family: Yurei

    Yurei is a Golang based ransomware family derived from PrincessLocker.

    ransomwareyurei
  • Family: Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Babylon RAT payload 1 IoCs
  • Detect HermeticWiper 1 IoCs

    Detect HermeticWiper Payload.

    wiper
  • Detect Neshta payload 1 IoCs
  • Detect SalatStealer payload 1 IoCs
  • Detect XClient Payload 1 IoCs
  • Detect Xworm Payload 1 IoCs
  • Detects Amadey x86-bit Payload 1 IoCs
  • Detects ArcaneStealer in memory. 1 IoCs
  • Detects AuraStealer stealer 1 IoCs
  • Detects Bert Ransomware Windows Version 1 IoCs
    ransomware
  • Detects BlackLock ransomware 1 IoCs
  • Detects Cosmu payload 1 IoCs

    Cosmu is a worm written in C++.

  • Detects Dtrack RAT 1 IoCs

    Dtrack aka Preft TroyRAT is RAT developed by Lazarus group written in C++.T

    rataptlazarus
  • Detects DuplexSpyRAT 1 IoCs
  • Detects FlyAgent Backdoor 1 IoCs
  • Detects JLocker ransomware. 1 IoCs
  • Detects Lynx Ransomware 1 IoCs
  • Detects Mispadu 1 IoCs
  • Detects Nighthawk C2 framework loader 1 IoCs
  • Detects PennyWise 1 IoCs
    stealer
  • Detects Sheetrat Obfuscated Payload 1 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Umbral payload 4 IoCs
  • Detects Windows variant of BlackNevas ransomware 2 IoCs
  • Detects Yurei ransomware 1 IoCs
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs
  • Quasar payload 1 IoCs
  • RedLine payload 1 IoCs
  • RevengeRat Executable 1 IoCs
    stealer
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • SectopRAT payload 1 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 3 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • HeartCrypt Windows executable packer 1 IoCs

    HeartCrypt is a packer-as-a-service (PaaS) that injects malicious code into otherwise legitimate binaries

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Revoked Certificate in Chain 2 IoCs

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

    revoked_codesign
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Codesign digest Mismatch 7 IoCs

    File was altered after it was signed.

  • ConfuserEx .NET packer 2 IoCs

    Detects ConfuserEx .NET packer.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 109 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 3 IoCs

    Codesigned file was signed by an untrusted entity.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • NSIS installer 3 IoCs
    installer

File Explorer

  • Red-Flaged.7z
    .7z 328.4MB
  • Red-Flaged/028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe
    .exe 4.1MB
  • Red-Flaged/02WLPQTDGE.msi
    .msi 9.5MB
  • Red-Flaged/03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe
    .exe 733KB
  • Red-Flaged/04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595.exe
    .exe 95KB
  • Red-Flaged/0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe
    .exe 1.0MB
  • Red-Flaged/0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe
    .exe 202KB
  • Red-Flaged/12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434.exe
    .exe 942KB
  • Red-Flaged/1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe
    .exe 7.1MB
  • Red-Flaged/1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe
    .exe 2.7MB
  • Red-Flaged/2025-07-15_9fdd329535a395b3287bf94308c76785_elex_stealc_stop_tofsee_upatre.exe
    .exe 600KB
  • Red-Flaged/2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe
    .exe 8.7MB
  • Red-Flaged/2025-11-10_423504692acf78cecd61922d89b87a1d_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
    .exe 208KB
  • Red-Flaged/2025-11-11_895016d46d81fa30da9122e4abab6660_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
    .exe 365KB
  • Red-Flaged/2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
    .exe 661KB
  • Red-Flaged/2025-11-12_6ab017c1b7d68321880fed7736122a20_cobalt-strike_conti.exe
    .exe 585KB
  • Red-Flaged/2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
    .exe 14.2MB
  • Red-Flaged/2025-11-12_a787c0932def56cc7b85e6888e67bb87_amadey_elex_smoke-loader_stealc_stop_vidar.exe
    .exe 583KB
  • Red-Flaged/2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
    .exe 23.4MB
  • Red-Flaged/2025_Cotizacion Noviembre.exe
    .exe 1.3MB
  • Red-Flaged/2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188.exe
    .exe 1.0MB
  • Red-Flaged/374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
    .exe 456KB
  • Red-Flaged/3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5.exe
    .exe 418KB
  • Red-Flaged/3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe
    .exe 728KB
  • Red-Flaged/439ff2060a600d666dafcf86f7ef8fea5ee0cca7e39521c986a3181d99ede61d.exe
    .zip 10.0MB
  • Red-Flaged/4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe
    .exe 6.8MB
  • Red-Flaged/51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe
    .exe 14.2MB
  • Red-Flaged/53fb999c4ef195a5c37e80ad4208f7d3bd02951672462339cafd5c0463a6f2aa.exe
    .exe 6.6MB
  • Red-Flaged/556eaf27dd7c9d5b1949766151b83035625e11dabcfe0259f7a927fb80f0145e.exe
    .exe 1.8MB
  • Red-Flaged/55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe
    .exe 754KB
  • Red-Flaged/57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
    .exe 1.1MB
  • Red-Flaged/57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe
    .exe 3.9MB
  • Red-Flaged/5a765351046fea1490d20f25.exe
    .exe 377KB
  • Red-Flaged/5ec9325b6998e8749bc0465890f201e3d8fddb767b2eeebb4f84fd7cf942930a.exe
    .exe 84KB
  • Red-Flaged/6377d2686feb3c4b20e53085a379e9d2381adeaafc698f56373c1548a74a6fa1.exe
    .exe 1.4MB
  • Red-Flaged/6669cfeba5619b6f4d80b1281adfe69c87d845ebaaf9e83c25efa01a8267e751.exe
    .exe 3.3MB
  • Red-Flaged/680a883430e5955b4349ad21e23fc330e74f7c05e1d61ffd25c9970acd303677.exe
    .exe 5.0MB
  • Red-Flaged/7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782.exe
    .exe 6.0MB
  • Red-Flaged/85699c7180ad77f2ede0b15862bb7b51ad9df0478ed394866ac7fa9362bf5683.exe
    .exe 165KB
  • Red-Flaged/885ef9a1ef4ae7b212628622f6b72e29381a8c8bb5abf667e7da6f537493a0be.exe
    .exe 3.8MB
  • Red-Flaged/8e9a8026a844ae290cfe223e820894324bc2eb12339c04091d97fcdc227fd1f6.exe
    .exe 428KB
  • Red-Flaged/9eda7cc4737b03e47696ef02f8b0c687a6b75a08ba3a7e2ee2941ff9cf05d5b7.exe
    .exe 14.3MB
  • Red-Flaged/ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
    .exe 783KB
  • Red-Flaged/Azorult 3.3 Cracked.exe
    .exe 1.3MB
  • Red-Flaged/BQT.exe
    .exe 8.5MB
  • Red-Flaged/BadRabbit.exe
    .exe 431KB
  • Red-Flaged/BorisFX_v7_0_serial_keygen_by_orion.exe
    .exe 4.7MB
  • Red-Flaged/ChileLocker_d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe
    .exe 69KB
  • Red-Flaged/ChromeSetup_v1.3.87.370.exe
    .exe 1.2MB
  • Red-Flaged/CoronaVirus.exe
    .exe 1.0MB
  • Red-Flaged/CrimsonRAT.exe
    .exe 84KB
  • Red-Flaged/CryptoLocker.exe
    .exe 338KB
  • Red-Flaged/DanaBot.exe
    .exe 2.7MB
  • Red-Flaged/DiscordTimerEditor2.1.exe
    .exe 71.5MB
  • Red-Flaged/EpsilonApp.exe
    .exe 147KB
  • Red-Flaged/FT24249304-Monthly_GST_Invoice-PAYOUT.pdf.bat.exe
    .exe 590KB
  • Red-Flaged/Fake ID Cards Creator (NEW 2025).exe
    .exe 9.0MB
  • Red-Flaged/Fantom.exe
    .exe 261KB
  • Red-Flaged/HermeticWiper.exe
    .exe 114KB
  • Red-Flaged/Implosions.exe
    .exe 95KB
  • Red-Flaged/InfinityCrypt.exe
    .exe 211KB
  • Red-Flaged/JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe
    .exe 938KB
  • Red-Flaged/JaffaCakes118_30f515392358142b507a486d7ab379d2.exe
    .exe 70KB
  • Red-Flaged/JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe
    .exe 625KB
  • Red-Flaged/Jigsaw.exe
    .exe 283KB
  • Red-Flaged/Locky.exe
    .exe 180KB
  • Red-Flaged/MuckModLoaderSetup2.1.1.exe
    .exe 84.7MB
  • Red-Flaged/MyDoom.A.exe
    .exe 22KB
  • Red-Flaged/N-W0rm.exe
    .exe 16KB
  • Red-Flaged/Petya.A.exe
    .exe 225KB
  • Red-Flaged/Product Sample pdf.exe
    .exe 612KB
  • Red-Flaged/Remcos.exe
    .exe 92KB
  • Red-Flaged/Rensenware.exe
    .exe 96KB
  • Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe
    .exe 1.2MB
  • Red-Flaged/Synaptics.exe
    .exe 764KB
  • Red-Flaged/Uniformitarian.exe
    .exe 357KB
  • Red-Flaged/VerifierImGui.exe
    .exe 4.5MB
  • Red-Flaged/WannaCrypt0r.exe
    .exe 3.4MB
  • Red-Flaged/WarzoneRAT.exe
    .exe 321KB
  • Red-Flaged/Xeno.exe
    .exe 482KB
  • Red-Flaged/XenoUI.exe
    .exe 183KB
  • Red-Flaged/YnGOp-loader.exe
    .exe 229KB
  • Red-Flaged/_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe
    .exe 12.4MB
  • Red-Flaged/_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe
    .exe 17.0MB
  • Red-Flaged/_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe
    .exe 772KB
  • Red-Flaged/_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe
    .exe 16KB
  • Red-Flaged/_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe
    .exe 102KB
  • Red-Flaged/_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe
    .exe 68KB
  • Red-Flaged/a0630e2a81775e8334ea9f8cac73cebf1b9a70507ea3347c0c2eba82c80219a6.exe
    .exe 1.8MB
  • Red-Flaged/a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
    .exe 139KB
  • Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
    .exe 782KB
  • Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
    .exe 689KB
  • Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe
    .exe 147KB
  • Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe
    .exe 1.1MB
  • Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe
    .exe 11.1MB
  • Red-Flaged/b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637.exe
    .exe 151KB
  • Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
    .exe 2.8MB
  • Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
    .exe 820KB
  • Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe
    .exe 167KB
  • Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
    .exe 436KB
  • Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
    .exe 181KB
  • Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe
    .exe 1.3MB
  • Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
    .exe 1.2MB
  • Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
    .exe 1.1MB
  • Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
    .exe 4.6MB
  • Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
    .exe 418KB
  • Red-Flaged/e62684a48067d8bf5f219f007bb5908301ca3303b9c57a2f0c3212cf0eb8d7b7.exe
    .exe 139KB
  • Red-Flaged/f2dc218ea8e2caa8668e54bae6561afd9fbf035a40b80ce9e847664ff0809799.exe
    .exe 12KB
  • Red-Flaged/f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe
    .exe 1.6MB
  • Red-Flaged/f56f6b9c3ae43c09b288066f6030c19ee9e014194ce11af015b8847426346a13.exe
    .exe 2.0MB
  • Red-Flaged/fe62016faf3115405dd81353fd9077d183c2c38553a6aa8fe0261da4cf45ff0e.exe
    .exe 804KB
  • Red-Flaged/ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe
    .exe 822KB
  • Red-Flaged/file.exe
    .exe 687KB
  • Red-Flaged/hive.exe
    .exe 764KB
  • Red-Flaged/jqqvLru0VAiH3z.exe
    .exe 2.2MB
  • Red-Flaged/mCa4SRR.exe
    .exe 272KB
  • Red-Flaged/rPO-25-063.exe
    .exe 834KB
  • Red-Flaged/rWaybillNo_4630813235.exe
    .exe 1.1MB
  • Red-Flaged/realtek.exe
    .exe 3.1MB
  • Red-Flaged/setup.exe
    .exe 17.6MB
  • Red-Flaged/uncext.exe
    .exe 6.8MB
  • Red-Flaged/µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe
    .exe 5.8MB

Red-Flaged.7z

  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected