Files named explorer.exe

118.190.202.64 · explorer.exe

China · Hangzhou Alibaba Advertising Co.,Ltd.

SHA1: 7814849517349b271b3aace1cbfe7081924fac66
SHA256: 0b4afaac6f39cad050d9b9277fa83fe826fe9c679593799d9e12885e94fec957
application/octet-stream
2.84MB
1970-01-01 00:00:00 +0000 UTC

node2.swift-byte.de · explorer.exe

/6625a0fd-b528-45de-b619-75b844ec72e3/Steam/steamapps/compatdata/2278520/pfx/drive_c/windows/

Germany · Hetzner Online GmbH

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 79517fbf942950989cb3799d82fb9016071cb5fe
SHA256: 2d843f4031c9722f3a8747f7160e171f049e4fc5f2b1898826d821538bbbc694
application/octet-stream
371.42KB
2025-11-03 20:34:15 +0000 UTC

node2.swift-byte.de · explorer.exe

/6625a0fd-b528-45de-b619-75b844ec72e3/Steam/steamapps/compatdata/2278520/pfx/drive_c/windows/syswow64/

Germany · Hetzner Online GmbH

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: a825de077de448af53f2c555ee6ec7c6d3d3414e
SHA256: e2b077420c2471c0c64627cbec4b5941f0b673f07d8506815d1e4f3408a14af0
application/octet-stream
347.69KB
2025-11-03 20:34:16 +0000 UTC

node2.swift-byte.de · explorer.exe

/6625a0fd-b528-45de-b619-75b844ec72e3/Steam/steamapps/compatdata/2278520/pfx/drive_c/windows/system32/

Germany · Hetzner Online GmbH

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 79517fbf942950989cb3799d82fb9016071cb5fe
SHA256: 2d843f4031c9722f3a8747f7160e171f049e4fc5f2b1898826d821538bbbc694
application/octet-stream
371.42KB
2025-11-03 20:34:16 +0000 UTC

node2.swift-byte.de · explorer.exe

/6625a0fd-b528-45de-b619-75b844ec72e3/Steam/steamapps/compatdata/2278520/pfx/dosdevices/c:/windows/

Germany · Hetzner Online GmbH

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 79517fbf942950989cb3799d82fb9016071cb5fe
SHA256: 2d843f4031c9722f3a8747f7160e171f049e4fc5f2b1898826d821538bbbc694
application/octet-stream
371.42KB
2025-11-03 20:34:15 +0000 UTC

node2.swift-byte.de · explorer.exe

/6625a0fd-b528-45de-b619-75b844ec72e3/Steam/steamapps/compatdata/2278520/pfx/dosdevices/c:/windows/syswow64/

Germany · Hetzner Online GmbH

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: a825de077de448af53f2c555ee6ec7c6d3d3414e
SHA256: e2b077420c2471c0c64627cbec4b5941f0b673f07d8506815d1e4f3408a14af0
application/octet-stream
347.69KB
2025-11-03 20:34:16 +0000 UTC

node2.swift-byte.de · explorer.exe

/6625a0fd-b528-45de-b619-75b844ec72e3/Steam/steamapps/compatdata/2278520/pfx/dosdevices/c:/windows/system32/

Germany · Hetzner Online GmbH

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 79517fbf942950989cb3799d82fb9016071cb5fe
SHA256: 2d843f4031c9722f3a8747f7160e171f049e4fc5f2b1898826d821538bbbc694
application/octet-stream
371.42KB
2025-11-03 20:34:16 +0000 UTC

dwkk44oow8sws8c4w0ksk0gc.rx2.nodes.gkloud.eu · explorer.exe

/PC Seed/RedDeadRedemption_Linux/wine/lib/wine/x86_64-windows/

France · Scaleway S.a.s.

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 47ba40245fc90e0ac90c2fea60c3898a25365aa5
SHA256: 3c014434a498c2031f0cb980b21b1f7cd1b57bd97d2995a594158f1d65bc9d3c
application/octet-stream
286.26KB
2025-10-28 16:07:36 +0000 UTC

dwkk44oow8sws8c4w0ksk0gc.rx2.nodes.gkloud.eu · explorer.exe

/PC Seed/GTA_Trilogy_Definitive_Linux/GTAVC_DE/wine/lib/wine/x86_64-windows/

France · Scaleway S.a.s.

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 12bbe8031c9882d7059c3c9a6f85eabb5995c30b
SHA256: 617583b299aaf4f91742c4d40814948b15711f5419ad26c70a85fa86b837c890
application/octet-stream
286.26KB
2025-10-28 16:18:56 +0000 UTC

dwkk44oow8sws8c4w0ksk0gc.rx2.nodes.gkloud.eu · explorer.exe

/PC Seed/GTA_Trilogy_Definitive_Linux/GTASA_DE/wine/lib/wine/x86_64-windows/

France · Scaleway S.a.s.

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 12bbe8031c9882d7059c3c9a6f85eabb5995c30b
SHA256: 617583b299aaf4f91742c4d40814948b15711f5419ad26c70a85fa86b837c890
application/octet-stream
286.26KB
2025-10-28 18:08:21 +0000 UTC

dwkk44oow8sws8c4w0ksk0gc.rx2.nodes.gkloud.eu · explorer.exe

/PC Seed/GTA_Trilogy_Definitive_Linux/GTA3_DE/wine/lib/wine/x86_64-windows/

France · Scaleway S.a.s.

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 12bbe8031c9882d7059c3c9a6f85eabb5995c30b
SHA256: 617583b299aaf4f91742c4d40814948b15711f5419ad26c70a85fa86b837c890
application/octet-stream
286.26KB
2025-10-28 14:52:49 +0000 UTC

dwkk44oow8sws8c4w0ksk0gc.rx2.nodes.gkloud.eu · explorer.exe

/PC Seed/CrashBandicoot4_Linux/wine/lib/wine/x86_64-windows/

France · Scaleway S.a.s.

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: d29d17e93251f3213f8893342f79d1d3f5992369
SHA256: d2c7434b8b9f626a589a6cc3bb1ce8b9de7ac353458163d37cac7e7baff66343
application/octet-stream
277.37KB
2025-10-28 18:22:52 +0000 UTC

121.18.80.70 · explorer.exe

/

China · CHINA UNICOM China169 Backbone

SHA1: 4755e010a468b61f2788cf85be43dc4d90ad6dba
SHA256: a009c68a28192846fb7320512c8535fd53cd2ba47f1ebcbd628cb1102f0d1195
application/octet-stream
4.11MB
1970-01-01 00:00:00 +0000 UTC

mmmma.nz.waw.pl · explorer.exe

/c/$Root/WINDOWS/system32/dllcache/

Poland · Play

SHA1: 9d2bf84874abc5b6e9a2744b7865c193c08d362f
SHA256: 1e675cb7df214172f7eb0497f7275556038a0d09c6e5a3e6862c5e26885ef455
application/x-msdos-program
1009.50KB
2013-08-21 18:04:08 +0000 UTC

mmmma.nz.waw.pl · explorer.exe

/c/$Root/WINDOWS/

Poland · Play

SHA1: 9d2bf84874abc5b6e9a2744b7865c193c08d362f
SHA256: 1e675cb7df214172f7eb0497f7275556038a0d09c6e5a3e6862c5e26885ef455
application/x-msdos-program
1009.50KB
2013-08-21 18:04:08 +0000 UTC

cbserviceslondon.com · explorer.exe

/Greg/

Canada · ROGERS-COMMUNICATIONS

SHA1: 9d2bf84874abc5b6e9a2744b7865c193c08d362f
SHA256: 1e675cb7df214172f7eb0497f7275556038a0d09c6e5a3e6862c5e26885ef455
application/x-msdos-program
1009.50KB
2010-10-23 16:21:46 +0000 UTC

159.89.22.71 · explorer.exe

/webdav/

Germany · DIGITALOCEAN-ASN

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: ed13af4a0a754b8daee4929134d2ff15ebe053cd
SHA256: 58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f
application/x-msdos-program
27.00KB
2025-04-28 09:03:14 +0000 UTC

159.89.22.71 · explorer.exe

/webdav/DavWWWRoot/webdav/

Germany · DIGITALOCEAN-ASN

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: ed13af4a0a754b8daee4929134d2ff15ebe053cd
SHA256: 58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f
application/x-msdos-program
27.00KB
2025-06-03 07:53:29 +0000 UTC

185.115.97.158 · explorer.exe

/boot/iso/flash/programs/erdcmd/

Russia · Federal State Unitary Enterprise of the Order of the Red Banner of Labour Russian Broad-cast

Yara explorer_ANOMALY From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3d9173e3e65ef7a13f39d00f2337c3d415a2c20e
SHA256: b1c99f8bf57ec420a06e9de346be8e156ade577117d14b4bbefd7f774ed88f73
application/octet-stream
172.00KB
2004-06-09 13:49:04 +0000 UTC

185.115.97.158 · explorer.exe

/boot/iso/flash/minint/

Russia · Federal State Unitary Enterprise of the Order of the Red Banner of Labour Russian Broad-cast

SHA1: b03daff7cb2df10c27e53827e23679a45d21da30
SHA256: 6267af9d65243d9c6fe796567054b07d733f54ff2073545e450faae0f793b78c
application/octet-stream
1.02MB
2004-08-17 08:04:48 +0000 UTC