Threat Feed
NOTEPAD.exe
2026-11-13T00:30:17.923
malicious
Windows Exe (x86-64)
Close
NOTEPAD.exe
malicious
SHA256:
2d5534f719e3cf98227ff60371cfc10fe4fc2f02c2272989a305c739d9031849
VMRay Threat Identifiers
Close
Severity
Operation
4/5
Malicious host or URL detected via reputation
4/5
Writes into the memory of another process
4/5
Malicious file detected via reputation
4/5
Modifies control flow of another process
3/5
Obscures a file's origin
2/5
Executes downloaded executable with hidden window
2/5
Peripheral Device Discovery
1/5
Content is served from a user home directory
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Downloads executable
1/5
Enumerates running processes
1/5
Creates a page with write and execute permissions
1/5
Creates process with hidden window
1/5
Tries to detect debugger
1/5
Queries system time
1/5
Peripheral Device Discovery
1/5
Reads system data
1/5
Reads installed applications
1/5
Content matched by YARA rules
Downloader
Injector
gitlосitу64-v.exe
2026-11-13T00:21:30.757
malicious
Windows Exe (x86-64)
Close
gitlосitу64-v.exe
malicious
SHA256:
e94e3854db4dd36cf8aa084136cdc99c2fb72591c8b4dd89aff786a6048b373d
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
3/5
Modifies native system functions
3/5
Uses HTTP to upload a large amount of data
2/5
Tries to detect virtual machine
2/5
Delays execution
1/5
Peripheral Device Discovery
1/5
Queries system time
1/5
Enumerates running processes
1/5
Tries to detect application sandbox
1/5
Content matched by YARA rules
1/5
Reads system data
1/5
Resolves API functions dynamically
1/5
Unusual large memory allocation
1/5
Creates mutex
Spyware
8HxBlQShcbROjxXs.exe
2026-11-13T00:13:31.171
malicious
Windows Exe (x86-64)
Close
8HxBlQShcbROjxXs.exe
malicious
SHA256:
c920ee11c68632f1bbf68431ed8bd59692352812b123cef8765a93a235ff33bd
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows configuration discovery
5/5
Malicious content matched by YARA rules
4/5
Malicious host or URL detected via reputation
4/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
3/5
Bypasses PowerShell execution policy
2/5
Searches for sensitive browser data
2/5
Delays execution
2/5
Creates an unusually large number of processes
2/5
Sets up server that accepts incoming connections
2/5
Suspicious content matched by YARA rules
2/5
Executes PowerShell without default profile
2/5
Queries a host's domain name
2/5
Reads network adapter information
2/5
Query OS Information
2/5
Collects hardware properties
2/5
Collects BIOS properties
2/5
Tries to detect virtual machine
1/5
Reads installed applications
1/5
Peripheral Device Discovery
1/5
Unusual large memory allocation
1/5
Reads system data
1/5
Content matched by YARA rules
1/5
Queries system time
1/5
Tries to connect using an uncommon port
1/5
Connects to remote host
1/5
Reads from memory of another process
1/5
Creates process with hidden window
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
Hacktool
VWToncN90MRA14Nz.exe
2026-11-13T00:12:04.814
malicious
Windows Exe (x86-64)
Close
VWToncN90MRA14Nz.exe
malicious
SHA256:
211b599e47a992b27b4a91b0b59a3db8fecc48080bb279ca199c31c3088e64c3
VMRay Threat Identifiers
Close
Severity
Operation
4/5
Creates elevated child process
4/5
Monitors clipboard content
4/5
Malicious file detected via reputation
3/5
Captures clipboard data
3/5
Bypasses PowerShell execution policy
2/5
Schedules task
2/5
Hides files
2/5
Executes PowerShell with hidden window
1/5
Tries to detect debugger
1/5
Creates process with hidden window
1/5
Installs system startup script or application
1/5
Content matched by YARA rules
1/5
Modifies operating system directory
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
Timestamp manipulation
1/5
Unusual large memory allocation
1/5
Reads system data
1/5
Accesses physical drive
Keylogger
KYxEuQNULlo1aOZs.exe
2026-11-13T00:09:53.124
malicious
Windows Exe (x86-32)
Close
KYxEuQNULlo1aOZs.exe
malicious
SHA256:
e900627917cb05e366e91e9d01f86df9121394ea5f7db5c735d6d2417ac1d56b
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Known malicious mutex name is created
4/5
Writes into the memory of another process
4/5
Malicious file detected via reputation
4/5
Bypasses Windows User Account Control (UAC)
4/5
Modifies control flow of another process
3/5
Changes security-related browser settings
3/5
All network connection attempts failed
3/5
Modifies system configuration
3/5
Disables a system tool
2/5
Disables security related notifications
2/5
Delays execution
2/5
Modifies Windows Firewall configuration
2/5
Sets up server that accepts incoming connections
1/5
Timestamp manipulation
1/5
Unusual large memory allocation
1/5
Modifies application directory
1/5
Creates mutex
1/5
Query OS Information
1/5
Modifies operating system directory
1/5
Creates a page with write and execute permissions
1/5
Enumerates running processes
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Enables process privileges
1/5
Queries system time
1/5
Drops PE file
1/5
The binary file was created with a packer
Virus
Injector