Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

qlwOCv0Lm1IFoTHp.exe

malicious

SHA256: e00df97a2e992083e0bac1109aeb59955bc5b9217097be7b81abee6d3f7a0a12

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

1/5

Reads mouse position

1/5

Queries system time

1/5

Monitors mouse movements and clicks

1/5

Monitors keyboard input

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Creates a page with write and execute permissions

1/5

Executes dropped PE file

Virus

IqoUs6Ovc9Tg0gJq.exe

2026-07-21T20:50:58.468

Windows Exe (x86-32)

IqoUs6Ovc9Tg0gJq.exe

malicious

SHA256: ff2171985025dbf8743d3fc1948ac290e0cd15c8e56d859633ed2e3dd95043a6

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Known malicious mutex name is created

3/5

Redirect program startups

2/5

Queries a host's domain name

2/5

Reads network adapter information

2/5

Collects information about services

2/5

Sets up server that accepts incoming connections

1/5

Timestamp manipulation

1/5

Modifies operating system directory

1/5

Modifies application directory

1/5

Content matched by YARA rules

1/5

Creates process with hidden window

1/5

Drops PE file

1/5

Installs system service

1/5

Queries system time

1/5

Executes dropped PE file

Virus

0tNHMn5wEA5oepeC.exe

2026-07-21T20:47:37.423

Windows Exe (x86-32)

0tNHMn5wEA5oepeC.exe

malicious

SHA256: 4024ced8420082f83b5fab8c413e3211bf18da208af141127485d44c066352d9

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Deletes file after execution

1/5

Drops PE file

1/5

Timestamp manipulation

1/5

Drops PE masquerading Filename

1/5

Tries to detect debugger

1/5

Creates a page with write and execute permissions

1/5

Creates process with hidden window

1/5

Possibly does reconnaissance

1/5

Modifies application directory

cHnAdc1nCoHNmp5e.exe

2026-07-21T20:47:02.557

Windows Exe (x86-32)

cHnAdc1nCoHNmp5e.exe

malicious

SHA256: 308d6721012f2662e5487ee755e401b8779d7f934ac9e5a604f0b6daccf333b0

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Modifies native system functions

3/5

Tries to evade debugger

2/5

Makes direct system call to possibly evade hooking based monitoring

2/5

Tries to detect kernel debugger

2/5

Tries to detect virtual machine

1/5

Executes dropped PE file

1/5

Enumerates running processes

1/5

Queries system time

1/5

Drops PE file

1/5

Tries to detect debugger

Trojan

hwDcKIJr94gRJ4ZZ.exe

2026-07-21T20:46:54.717

Windows Exe (x86-32)

hwDcKIJr94gRJ4ZZ.exe

malicious

SHA256: 411b05f95ef6d9f95f168b31c32199610874823925adadcf45f93511b01f82b2

VMRay Threat Identifiers

Severity

Operation

5/5

Adds a hook to a web browser

4/5

Modifies control flow of another process

4/5

Writes into the memory of another process

2/5

Schedules task

2/5

Delays execution

1/5

Executes WMI query

1/5

Resolves API functions dynamically

1/5

Queries system time

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Overwrites code

1/5

Reads system data

1/5

Enumerates running processes

1/5

Enables process privileges

1/5

Creates a page with write and execute permissions

Spyware

Injector