Simple indicator of observable {20b4eb5787faa00474f7d27c0fea1e4b}


Simple indicator of observable {635864ff270cf8e366a7747fb5996766}


Simple indicator of observable {da745b60b5ef5b4881c6bc4b7a48d784}


Simple indicator of observable {f68b17f1261aaa4460d759d95124fbd4}


Simple indicator of observable {237961bbba6d4aa2e0fae720d4ece439}


Simple indicator of observable {d2949a3c4496cb2b4d204b75e24390d9}


Simple indicator of observable {fc61b985d8c590860f397d943131bfb5}


Simple indicator of observable {04557782d7017f18ec059fc96d7f2dc8}


Simple indicator of observable {awesscholarship.in}


Simple indicator of observable {89.117.188.126}


Simple indicator of observable {parichay.epar.in}


Simple indicator of observable {13.232.102.189}


Simple indicator of observable {oshi.at}


Simple indicator of observable {alfa-aeafa-default-rtdb.firebaseio.com}


Simple indicator of observable {https://rb.gy/gbfsi}


Simple indicator of observable {https://awesscholarship.in/upload/file.zip}


Simple indicator of observable {https://awesscholarship.in/upload/file1.zip}


Simple indicator of observable {https://awesscholarship.in/upload/in.ps1}


Simple indicator of observable {https://awesscholarship.in/upload/upload.php}


Simple indicator of observable {https://awesscholarship.in/upload/Ipr.pdf}


Simple indicator of observable {https://awesscholarship.in/upload/abc009.pdf}


Simple indicator of observable {https://awesscholarship.in/upload/1.pdf}


Simple indicator of observable {https://awesscholarship.in/upload/DSOP-NOM.zip}


Simple indicator of observable {https://awesscholarship.in/ppam/Mail_Check.ps1}


Simple indicator of observable {https://awesscholarship.in/ppam/syscheck.zip}


Simple indicator of observable {https://parichay.epar.in/Win/1.pdf}


Simple indicator of observable {https://parichay.epar.in/Win/Mail_Check.ps1}


Address / used to download Packed.rar and main.exe


main.exe


Packed.rar


cherrytree.exe/CherryLoader


NuxtSharp.Data (Encrypted)


NuxtSharp.Data (Decrypted)


Spof.Data (Encrypted)


Spof.Data/PrintSpoofer (Decrypted)


Juicy.data/JuicyPotatoNG (Encrypted)


Juicy.Data (Decrypted)


User.bat


MrAgent


Mario


Simple indicator of observable {ac79187fd3024fb9cb5d1a872461503c}


C&C server


Simple indicator of observable {0b6f0790c32a16e413c89bf65018ec6d}


Simple indicator of observable {588d01860865256c378715ad728757cf}


Simple indicator of observable {b877636c060e5fb47f467e557acdc9ac}


of Forest64.exe


of DSROLE.dll


of Version.dll


of Readme.md


of proxy tool loader


Staging for 4800-84DC-063A6A41C5C (compromised domain)


Staging for Forest64.exe (compromised domain)


Staging for Version.dll (compromised domain)


Staging for readme.md (compromised domain)


Callback from second-stage PE (compromised domain)


Staging for HazyLoad binary (compromised infrastructure)


C2 (compromised


Simple indicator of observable {Forest64.exe}


Simple indicator of observable {4800-84DC-063A6A41C5C}


Simple indicator of observable {DSROLE.dll}


Simple indicator of observable {Version.dll}


Simple indicator of observable {readme.md}


Simple indicator of observable {wsmprovhost.exe}


Simple indicator of observable {clip.exe}


Simple indicator of observable {temp.exe}


Simple indicator of observable {inetmgr.exe}


Simple indicator of observable {313f2078fa0abb4452daa061ed98eccbfb956dfc76fdb6870cf9ec2a4b534f5a}


Simple indicator of observable {runbll32.dll}


Simple indicator of observable {72721f96599ab1191d2588e1a8001cc76f9bd8968fa4708dff153b1383b37aeb}


Simple indicator of observable {attachment.xls}


Simple indicator of observable {spreadsheet.xls}


Simple indicator of observable {Loader.dll}


Simple indicator of observable {ResetEngine.dll}


Simple indicator of observable {e32f016fe347dd29e263c026c680b9044dcf75340b6fa72b43f1a73a4d7605cf}


Simple indicator of observable {virus_12.07.2024.rar}


Simple indicator of observable {equipment_survey_regions_.xls}


Simple indicator of observable {accounts.xls}


Simple indicator of observable {eca4273d922a66eb943a4bd1fd73ee4bd196289e32fe629cfe4ecf99e4cfadd3}


Simple indicator of observable {66_oborona_PURGED.xls}


Simple indicator of observable {b7ef3c08cea0c50a43a7e3904f386189bd92f5da2920f026febc9f42c4de109d}


Simple indicator of observable {22ba7234715ec7d99656fc6e16c2d75cbb5465c0fb2e5063c6d02baa4837a602}


Simple indicator of observable {eaf3fd4dd5f6ea621ddc1bbccd5626cfa47bd3f8370c254866d9540dfda24374}


Simple indicator of observable {bea3df5f788e60d324f1623a4328dafd9eaa6bb01d0a93343176def708bc002f}


Simple indicator of observable {e89612f017334f1bea536095abda92ded478a56ea4dce5e293222ce99a3e0c91}


Simple indicator of observable {trix.xls}


Simple indicator of observable {ruhbll32.dll}


Simple indicator of observable {9a5a37b16350da20f86553df67eb7edf2142e1d36da1fcf99cacc6a74cc03730}


Simple indicator of observable {411f088c3f997fdddec7a3b153d9526bd2d2d7c55ea25bae32d7b41f36514e04}


Simple indicator of observable {trix2.xls}


Simple indicator of observable {2cde8de330a874020340f2110bd1fd013fab7e93ef884c9006a646b49b567a75}


Simple indicator of observable {b2434817428c6e38e435343db0d758498ba73952703c9d835f8ba62cbd36763d}


Simple indicator of observable {51f6b8dfcbe757f5df935203369da894c45727028d972b1207e449d0a592f7e2}


Simple indicator of observable {a7694687ac179a48f07d306ed1b08cd60e9aa7063ee91ab64b0a50ddd7371378}


Simple indicator of observable {477c198d257a738c945a866b176d9ecf922e3145f86f26154065818be5623fd5}


Simple indicator of observable {accounts2.xls}


Simple indicator of observable {backstagemerch.shop}


Simple indicator of observable {empoweringparents.shop}


Simple indicator of observable {lauramcinerney.shop}


Simple indicator of observable {https://backstagemerch.shop/the-simpsons/mens-freeze.html}


Simple indicator of observable {https://empoweringparents.shop/voorraad/hyundai/ioniq-6}


Simple indicator of observable {https://empoweringparents.shop/voorraad/peugeot/408}


Simple indicator of observable {https://lauramcinerney.shop/a-cumulatively-effective-way-of-dealing-with-worries.html}


C&C server


Simple indicator of observable {50b6aaed93609360f33de4b40b764d3bb0bd45d1}


Simple indicator of observable {f22cceb9c6d35c9119a5791d6fd93bf1484e6747}


Simple indicator of observable {2226d90cce0e6f3e5f1c52668ed5b0e3a97332c1}


Simple indicator of observable {8fe5c43704210d50082bbbaf735a475810a8dbc9}


Simple indicator of observable {7be69e00916c691bbbed6ff9616f974f90234862}


Simple indicator of observable {c07b2c25f926550d804087ac663991cf06bac519}


Simple indicator of observable {c5b16f22397c201a6e06f0049b6f948c648f11b7}


Simple indicator of observable {899ca79e54a2d4af140a40a9ca0b2e03a98c46cb}


Simple indicator of observable {45.141.215.40}


Socks5Systemz C2 Endpoint


Socks5Systemz Proxy Checker App


Socks5Systemz Backconnect Endpoint


Simple indicator of observable {f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58}


Simple indicator of observable {cb97ec024c04150ad419d1af2d1eb66b5c48ab5f345409d9d791db574981a3fb}


Simple indicator of observable {39d7407e76080ec5d838c8ebca5182f3ac4a5f416ff7bda9cbc4efffd78b4ff5}


Simple indicator of observable {cafaa7bc3277711509dc0800ed53b82f645e86c195e85fbf34430bbc75c39c24}


Simple indicator of observable {9863173e0a45318f776e36b1a8529380362af8f3e73a2b4875e30d31ad7bd3c1}


Simple indicator of observable {09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38}


Related


applications containing the Brunhilda dropper


sender address (may be spoofed)


sender


Lumma


Zanubis


Simple indicator of observable {f49ba791814001b3d4101685bfebb635cdaf3103407a08171bb5d6bbe3e79c77}


Simple indicator of observable {f7e8a57b54489b5b3de66a1d21534ced3d2a2fb1ce8d03c69d4672e62aa00dca}


Simple indicator of observable {589d438226abfec8f71ab7724c68011303f82febb6786fd0c57571b0769764f3}


Simple indicator of observable {348ee268ef62af51add78b46df9fe8e2bdf41166d19084af75498333e81e6f3b}


Simple indicator of observable {https://onedrive.live.com/redir?resid=31B302B132DC1EB7!416&authkey=!AIHVM4Etxtu4Hl4&ithint=onenote}

Question: resid=31B302B132DC1EB7!416&authkey=!AIHVM4Etxtu4Hl4&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=3FBB4C466D5C47B%214007&authkey=%21AMAoWtlsRjtgU3s&page=View&wd=target%28Quick%20Notes.one%7C9b74b45d-3dcb-486c-bfa8-1690485577d1%2FNAKED%}

Question: resid=3FBB4C466D5C47B%214007&authkey=%21AMAoWtlsRjtgU3s&page=View&wd=target%28Quick%20Notes.one%7C9b74b45d-3dcb-486c-bfa8-1690485577d1%2FNAKED%


Simple indicator of observable {https://onedrive.live.com/redir?resid=4A2A68C638DBFAD1%21728&authkey=%21AAoJZlYdkU4qM_M&page=View&wd=target%28Quick%20Notes.one%7C79a985b7-6c15-43cf-aac6-a2c70122f021%2FMartina%}

Question: resid=4A2A68C638DBFAD1%21728&authkey=%21AAoJZlYdkU4qM_M&page=View&wd=target%28Quick%20Notes.one%7C79a985b7-6c15-43cf-aac6-a2c70122f021%2FMartina%


Simple indicator of observable {https://onedrive.live.com/redir?resid=4E0D3BBD3561F29%2120527&authkey=%21ABNV5f0-VxuHve4&page=View&wd=target%28Quick%20Notes.one%7C2b938392-c42c-44b7-954c-42737e7cb805%}

Question: resid=4E0D3BBD3561F29%2120527&authkey=%21ABNV5f0-VxuHve4&page=View&wd=target%28Quick%20Notes.one%7C2b938392-c42c-44b7-954c-42737e7cb805%


Simple indicator of observable {https://onedrive.live.com/redir?resid=531CBDB0711FA26E%21635&authkey=%21AIezNqQXzKf1HvM&page=View&wd=target%28Quick%20Notes.one%7C0490e0b3-c320-4f83-8c11-667055e276f6%2FSolar%20%}

Question: resid=531CBDB0711FA26E%21635&authkey=%21AIezNqQXzKf1HvM&page=View&wd=target%28Quick%20Notes.one%7C0490e0b3-c320-4f83-8c11-667055e276f6%2FSolar%20%


Simple indicator of observable {https://onedrive.live.com/redir?resid=6B61A37433C0FFD8%214320&authkey=%21AEwQuZ5OAuQm9aY&page=View&wd=target%28Quick%20Notes.one%7Caa694bfb-16b3-4c1b-909d-140f5bfcd39e%2FStudio%}

Question: resid=6B61A37433C0FFD8%214320&authkey=%21AEwQuZ5OAuQm9aY&page=View&wd=target%28Quick%20Notes.one%7Caa694bfb-16b3-4c1b-909d-140f5bfcd39e%2FStudio%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E98E045C25A9D63F%219773&authkey=%21AAgvN_6yASvZ5u8&page=View&wd=target%28Quick%20Notes.one%7Ce4fa6a0b-a9ca-47e1-80ff-29ec7ea3d43f%2FStadex%}

Question: resid=E98E045C25A9D63F%219773&authkey=%21AAgvN_6yASvZ5u8&page=View&wd=target%28Quick%20Notes.one%7Ce4fa6a0b-a9ca-47e1-80ff-29ec7ea3d43f%2FStadex%


Simple indicator of observable {https://onedrive.live.com/redir?resid=56249906518A0B!283&authkey=!AH4y6GfOPnM-SvI&ithint=onenote}

Question: resid=56249906518A0B!283&authkey=!AH4y6GfOPnM-SvI&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=9B866E89934F86E9%21301&authkey=%21ACM7iv3lZ7k7tU0&page=View&wd=target%28Quick%20Notes.one%7Cad20f96d-515e-4b1c-a675-f30969b3b9f6%2FDavide%}

Question: resid=9B866E89934F86E9%21301&authkey=%21ACM7iv3lZ7k7tU0&page=View&wd=target%28Quick%20Notes.one%7Cad20f96d-515e-4b1c-a675-f30969b3b9f6%2FDavide%


Simple indicator of observable {https://onedrive.live.com/redir?resid=9E42FE8C29238AB1%2115147&authkey=%21AOqiv3AcYY3aMpQ&page=Edit&wd=target%28Quick%20Notes.one%7C1c9129d0-c8bd-48b0-8df2-3c4e154b0891%2FMTS%}

Question: resid=9E42FE8C29238AB1%2115147&authkey=%21AOqiv3AcYY3aMpQ&page=Edit&wd=target%28Quick%20Notes.one%7C1c9129d0-c8bd-48b0-8df2-3c4e154b0891%2FMTS%


Simple indicator of observable {https://onedrive.live.com/redir?resid=AE5A5924C2D9CC14!48410&authkey=!ALfMjOMjP1PxCi8&ithint=onenote}

Question: resid=AE5A5924C2D9CC14!48410&authkey=!ALfMjOMjP1PxCi8&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=B3783CBEB3CBD28E%211178&authkey=%21AP5JEq30FkehUj4&page=View&wd=target%28Quick%20Notes.one%7Cce65b048-b0c5-4ea3-bc3d-0a9084267a0e%2FPROMO%}

Question: resid=B3783CBEB3CBD28E%211178&authkey=%21AP5JEq30FkehUj4&page=View&wd=target%28Quick%20Notes.one%7Cce65b048-b0c5-4ea3-bc3d-0a9084267a0e%2FPROMO%


Simple indicator of observable {https://onedrive.live.com/redir?resid=DB167F6D99BE2335%2157103&authkey=%21AMTkDK3lCKHG-N8&page=View&wd=target%28Quick%20Notes.one%7Ceba8f278-5578-464e-829f-b794f6ba1321%2FFybra%}

Question: resid=DB167F6D99BE2335%2157103&authkey=%21AMTkDK3lCKHG-N8&page=View&wd=target%28Quick%20Notes.one%7Ceba8f278-5578-464e-829f-b794f6ba1321%2FFybra%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E1D28F66AD9ED4A1%211490&authkey=%21AGPrkBNKqNRG3dE&page=View&wd=target%28Quick%20Notes.one%7C5f3e1cce-b367-4d85-9f9c-de4381a6a8b8%}

Question: resid=E1D28F66AD9ED4A1%211490&authkey=%21AGPrkBNKqNRG3dE&page=View&wd=target%28Quick%20Notes.one%7C5f3e1cce-b367-4d85-9f9c-de4381a6a8b8%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E3CBC738A4D9118B%2115853&authkey=%21ADWYKGPcM4Ck0UU&page=View&wd=target%28Quick%20Notes.one%7C293d7920-3cf2-4338-beec-83627581afc5%2FElbo%}

Question: resid=E3CBC738A4D9118B%2115853&authkey=%21ADWYKGPcM4Ck0UU&page=View&wd=target%28Quick%20Notes.one%7C293d7920-3cf2-4338-beec-83627581afc5%2FElbo%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E7459548557E7DD0%211823&authkey=%21AGh8Y18gIf2LBKk&page=View&wd=target%28Quick%20Notes.one%7C49d9deb6-98cb-45ad-a8d3-708081e249d0%}

Question: resid=E7459548557E7DD0%211823&authkey=%21AGh8Y18gIf2LBKk&page=View&wd=target%28Quick%20Notes.one%7C49d9deb6-98cb-45ad-a8d3-708081e249d0%


Simple indicator of observable {https://onedrive.live.com/redir?resid=62E45C9F0AC9D873!539&authkey=!AHvrEUEeKYZWc&ithint=onenote}

Question: resid=62E45C9F0AC9D873!539&authkey=!AHvrEUEeKYZWc&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=EFB4967AA612AAF7%21517&authkey=%21AAw9pPYWRqS0Xgs&page=View&wd=target%28Quick%20Notes.one%7C1fe14282-98e8-46fa-8f66-ebe00ac0795d%2FMarco%}

Question: resid=EFB4967AA612AAF7%21517&authkey=%21AAw9pPYWRqS0Xgs&page=View&wd=target%28Quick%20Notes.one%7C1fe14282-98e8-46fa-8f66-ebe00ac0795d%2FMarco%


Simple indicator of observable {https://onedrive.live.com/view.aspx?resid=EA104CA31FC03329!142&ithint=onenote&wdo=2&authkey=!AIBTpgciuKI2Yeo}

Question: resid=EA104CA31FC03329!142&ithint=onenote&wdo=2&authkey=!AIBTpgciuKI2Yeo


Simple indicator of observable {9a977571296ae1548c32df94be75eec2a414798bee7064b0bf44859e886a0cfa}


Simple indicator of observable {4d30fd05c3bdac792e0a011892e2cad02818436484e81b6de6a02928149bc92d}


Simple indicator of observable {e27d1bab901c1bb414d0849c5c132faa8c7c6a61357d9627a7d2785270034793}


Simple indicator of observable {31b21de71f2162e8da1be8483f3a5d019b0c817832bc11a9f307b6b36821ca54}


Simple indicator of observable {18d4a3a92b24b2ad75115a44fe2727081316eca346499a4aa00aa13713cf00cb}


Simple indicator of observable {9a96c7b0595f628027c4f4caeece475ef742c420adf2fde8df934c6ce6481fb5}


Simple indicator of observable {d9a8151aff9d1c061826a9812ed9a6600805c74a519df333513fd4a79d2d4e61}


Simple indicator of observable {07fe71b256c1c913b0f3e3fa67e53d21a3d1f499beb4e550597f5743797a77c4}


Simple indicator of observable {1b8b4be020d3350d025c7a245eb0d7166ff2c329dc92af175ef0499cba583071}


Simple indicator of observable {a03e2ca143e867a99e2bc73bd4e5c2dd078a9f671aa0a4ce9611a8bc39a769e2}


Simple indicator of observable {e19dc185e99cfdc0c25f18fb34ffabff2a4877d6d5843e4c67c05ce182f9780e}


Simple indicator of observable {106436a4fafe00112b19b1374456c1746b988950b71d700680088d74494e4936}


Simple indicator of observable {bca6da159bbf6af3ba6adfdb4f1da0e855c6ed2ac9076c98bcc702169dbeab40}


Simple indicator of observable {9d9097e76b04b8e4e53e366a215a6debd8ada6efd0102694bf518da373d25e82}


Simple indicator of observable {299a7888e960b7be5b7dc75e3a4bfd0c38f0f0e7313b630dcca62b6093794535}


Simple indicator of observable {75bf7d3aae0ed409c2c7e4f9b15e49d2f8dac6f9ecc27219d837e806894fe2a0}


Simple indicator of observable {8184a41a1275751c018a7433f1a48a8eb2f271d8f8fef98a90b70926f2755754}


Simple indicator of observable {83a29477939ba8e70f8f401da1fefbaad17b155c194c35a2b328530038b3539b}


Simple indicator of observable {e67c5731bed1e4d8c7947a6f474a161237ca9d795f8e86927b2faf1a17c94a79}


Simple indicator of observable {04241c476f7ff0b86987dbc74f7f236d1bd1fcc05896ad704bd8c152920e2ee9}


Simple indicator of observable {2c726b0bee65f2290c233f84139baf9dfee736d46978f42fcf8033215c1ccd19}


Simple indicator of observable {07dfb5b3e666400469fa451cdca5f29a346a5c9036e00c6587ef2b3b43631f10}


Simple indicator of observable {5264dcb00fd0e7261f95173e44df2023d9842c61befd3a3e5a1677d187331576}


Simple indicator of observable {e42e43e01e2ca96562fa67e58a4d539fcaf50054e631dd259351f95c69672288}


Simple indicator of observable {update.sh}


Simple indicator of observable {025d91fa1609138b30d9f95da41800aa5633913a8598ae54e95f0bc92cab2820}


Simple indicator of observable {d53fe08be9391ed668cdbcccecc4736e9d0e5dbc7cecbd32a7df21487d593232}


Simple indicator of observable {9517212c7f840355ec02f71eb5e4ec87ae869d4b0a8bdd52331677433cca66bf}


Simple indicator of observable {dd83e7b5788588d3a6b806ce0e5ad4acc0343c99548a342bfca9d54ea64625e3}


Simple indicator of observable {f11afd0d02e936e56aad7e5e86f3bc6781a1c67c4abb98fe7b3d831e8d67e312}


Simple indicator of observable {0eb2c98d14fce41db0ac9352484438fc40489d6f40c915b659ecc84342aa83a6}


Simple indicator of observable {30617ff59db71da76e05828bf8eaf4c92553044bcf81870743cb35e1b482b1d8}


Simple indicator of observable {f1aa7cb84e515e6d4818531ecb6cf9241338c68ebcb93e181ab9dfebb6be9123}


Simple indicator of observable {30fd37421f35748b2adb1a45e71e77c38c4b4ebb6854112520bc27726a5d4424}


Simple indicator of observable {5ab7025a477fba68821be7cd3b425b74a5adcccbddbfe90dbce9bbb028cca4c4}


Simple indicator of observable {66b7ce1c90ade1556469c4b9ef868bc6da2faea63987fbbfa4fa320723760a4e}


Simple indicator of observable {cb1993e26580d51a6676890b87e4b3c9a2f8562815a291d9829988f00d616683}


Simple indicator of observable {d89671386dd794996e7fbf57645a6ab8d40dc5d0d634ca9deec235ae31f5c500}


Simple indicator of observable {e38dcc222f770a4d11be0bd31b6d22f69a9f5bce8306c1c96390a0701647c1f3}


Simple indicator of observable {f466ecd2edc5481853f1e4613cf49dd5bd075e246436ad28b3558c2fd4069aca}


Simple indicator of observable {rpc_lan.so}


Simple indicator of observable {fd7298c3be42560f7a7e78903cc7ad5db3a14185eafc76a5bdac9bd2f2bf6bfc}


Simple indicator of observable {b3538ce6d66a8a104f15a3431914da7214b54d1de2594f4ee536a6e7372ed664}


Simple indicator of observable {c67f28a2b85b0b242c2337f8717f9ddda13d471648ea56eccaaf92750b0da4dc}


Simple indicator of observable {6da74c7e2bf3d77ac2f2cfddd114d27d08d01c2131d05d36e9c54de1c2565b2b}


Simple indicator of observable {00625fe8a6573f1774bfd9d58ba4a73d2c6307126271aa9accda89cd4b7270a9}


Simple indicator of observable {7f55c71e064c000906afad1ff649d5c2d3fb6d61d7e84338c9ecf95b4958c7a4}


Simple indicator of observable {d59fcb3e138b9eea0d70a1127f7b9d927f381a133720cae0c4fd5fc803e4b9dd}


Simple indicator of observable {25ff8d416a4158c7401f6c23e040c592ff29855da83ea67340342a3dfacd99a5}


Simple indicator of observable {82746a68612661c699ff2998502c9a252d52f76284a6c623d5c7f45d97dcefba}


Simple indicator of observable {ee8dd2626a4465f49f6d4aaf3b6d3735ca938e5e289304ba0664e4c9fb957672}


Simple indicator of observable {ae6c7656a973c797ad8c3a344da99fbca8452c471d26900a2300364ddeb959b9}


Simple indicator of observable {b21e9a3581497eafbd92a45b670b9e6f18aa09f8375ed8ebb03a199d531b2d39}


Simple indicator of observable {121ab168fd3d59f83d127eb6a049e67ffdea9a3d4cdc6044f92116f4b1beb26d}


Simple indicator of observable {64af32f631c4ace6604ee84e2875c3393a54a0e8ad838a85833c086757d343fe}


Simple indicator of observable {834d7a3ccd82dd51ead09f18d9e466f6b5cb79d3054d12e3c3771e0477e0bc75}


Simple indicator of observable {33e9020a2d6e6604ac0abafaa9427738937a282d3e418723e4857519c9bf99bc}


Simple indicator of observable {494c857b3abe11ab66024c605648dfeb23804d554e32b0411215d83b1bde4434}


Simple indicator of observable {49cda974e0f9fdf1a99c76ab1f02c501cd720700efcc303e05dfb7d1e71f0d16}


Simple indicator of observable {510da6d88ae4dd51d62796023a18b39db08a016ee4ee7178b1afdc91c58f9e1e}


Simple indicator of observable {6cb2979aa1fddd42df2ba596f705ce9bbdb2ec246649218d598d779769857c21}


Simple indicator of observable {1b7d26b2547ceb7f44dc9cabeb54d9c0c90b1ffb354dd1da711e269710f5d75c}


Simple indicator of observable {0d6d89023c7e4d72d8c68d5d7308eb2a58286a0ecc2ddcbe325d78f6b2149680}


Simple indicator of observable {c620742a863ab20ad0f211bf0e7a1be0725f2682af96db15c1a0d610875dd613}


Simple indicator of observable {beacon.net.eu.org}


Simple indicator of observable {c.glb-ru.info}


Simple indicator of observable {claudfront.net}


Simple indicator of observable {maxpatrol.net}


Simple indicator of observable {nsdps.cc}


Simple indicator of observable {rcsmf100.net}


Simple indicator of observable {wmssh.com}


Simple indicator of observable {dw-filter.com}


Simple indicator of observable {net-sensors.net}


Simple indicator of observable {mvs05.zyns.com}


Simple indicator of observable {hlx2ta.ipfs.dweb.link/wetrankfr.zip}


Simple indicator of observable {4q4y.ipfs.w3s.link/myscr649612.js}


Simple indicator of observable {https://estanciaferreira.com.br/wp-includes/TIANJIN-DOC}


Simple indicator of observable {https://dasmake.top/reader/timer.php}


Simple indicator of observable {https://hedam.shop/simple/Enquiry.7z}


Simple indicator of observable {191.101.130.185}


Simple indicator of observable {192.236.232.35}


Simple indicator of observable {stealsmtp@dasmake.xyz}


Simple indicator of observable {hanbox@dasmake.xyz}


Simple indicator of observable {publicsmtp@dasmake.xyz}


Simple indicator of observable {publicbox@dasmake.xyz}


Simple indicator of observable {minesmtp8714@dasmake.xyz}


Simple indicator of observable {minestealer8412@dasmake.xyz}


Simple indicator of observable {minesmtp8714@maternamedical.top}


Simple indicator of observable {minestealer8412@maternamedical.top}


Simple indicator of observable {extensionsmtp@maternamedical.top}


Simple indicator of observable {filelogs@maternamedical.top}


Simple indicator of observable {cookiesmtp@maternamedical.top}


Simple indicator of observable {cooklielogs@maternamedical.top}


Simple indicator of observable {a6c2df5df1253f50bd49e7083fef6cdac544d97db4a6c9c30d7852c4fd651921}


Simple indicator of observable {9e5580d7c3c22e37b589ec8eea2dae423c8e63f8f666c83edabecf70a0948b99}


Simple indicator of observable {9bd3b8d9ac6ad680b0d0e39b82a439feedd87b9af580f37fa3d80d2c252fef8c}


Simple indicator of observable {915bad0e2dbe0a18423c046f84d0ff7232fff4e5ba255cc710783f6e4929ab32}


Simple indicator of observable {64e5c9e7b8dfb8ca8ca73895aa51e585fa7e5414f0e1d10659d3a83b9f770333}


Simple indicator of observable {b343cce5381b8633b3fd3da56698f60db70c75422e120235a00517d519e37d8d}


Simple indicator of observable {32bcbce53bfee33112b447340e7114d6d46be4ccf1a5391ad685431afdc8fb86}


Simple indicator of observable {bee8da411e71547ac765a5e63e177b59582df438432cc3b540b57a6f1a56dd16}


Simple indicator of observable {70ba3d67b476e98419ecbbbb5d81efcb5a07f55a92c96e7b9207176746e3b7a6}


Simple indicator of observable {a2fa6790035c7af64146158f1ed20cb54f4589783e1f260a5d8e4f30b81df70d}


Simple indicator of observable {4cd8c9fa7f5e2484b73ed9c7be55aa859969c3f21ca2834610102231d337841d}


Simple indicator of observable {6670e5c7521966e82d091e7adff4e16335f03f2e2740b653adcc9bfe35c7bf9b}


Simple indicator of observable {dd656953a6844dd9585f05545a513c4e8c2ded13e06cdb67a0e58eda7575a7a4}


Simple indicator of observable {9866934dd2b4e411cdabaa7a96a63f153921a6489f01b0b40d7febed48b02c22}


Simple indicator of observable {e346f6b36569d7b8c52a55403a6b78ae0ed15c0aaae4011490404bdb04ff28e5}


Simple indicator of observable {8e43c97e5bc62211b3673dee13e376a1f5026502ebe9fd9f7f455dc17c253b7f}


Simple indicator of observable {ae2a5a02d0ef173b1d38a26c5a88b796f4ee2e8f36ee00931c468cd496fb2b5a}


Simple indicator of observable {7a9826be22b6d977d6a0e5179f84d8e88b279fe6d9df8f6c93ebc40a6ba70f06}


Simple indicator of observable {18459be33cd4f59081098435a0fbaa649f301f985647a75d21b7fc337378e59b}


Simple indicator of observable {6e7313b6aa37a00b602e620a25a0b71a74503ea967f1814c6c7b8b192535a043}


Simple indicator of observable {222dd76c461e70c3cb330bacfcf465751b07331c4f8a4415c09f4cd7c4e6fcd9}


Knight ransomware dropper location


Knight ransomware


Knight ransomware dropper


Simple indicator of observable {b8a4c1792ce2ec15611932437a4a1a7e43b7c3783870afebf6eae043bcfade30}


Simple indicator of observable {a3fe80540363ee2f1216ec3d01209d7c517f6e749004c91901494fb94852332b}


Simple indicator of observable {01ca7070bbe4bfa6254886f8599d6ce9537bafcbab6663f1f41bfc43f2ee370e}


Simple indicator of observable {7248d66dea78a73b9b80b528d7e9f53bae7a77bad974ededeeb16c33b14b9c56}


Simple indicator of observable {e68ff1087c45a1711c3037dad427733ccb1211634d070b03cb3a3c7e836d210f}


Simple indicator of observable {f47f78b5eef672e8e1bd0f26fb4aa699dec113d6225e2fcbd57129d6dada7def}


Simple indicator of observable {9a4bc647c09775ed633c134643d18a0be8f37c21afa3c0f8adf41e038695643e}


Simple indicator of observable {a75399f9492a8d2683d4406fa3e1320e84010b3affdff0b8f2444ac33ce3e690}


Simple indicator of observable {27bb3968cc18fb0df5b14e6d1b805552}


Simple indicator of observable {a7fe45cc57afb3dba91ab77483fffa0a}


Simple indicator of observable {396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6}


ZIP


HTML


JS


EXE


XLSX


JAR


DLL


Simple indicator of observable {178.18.246.136}


Simple indicator of observable {86.38.225.106}


Simple indicator of observable {57.128.165.176}


Simple indicator of observable {bc1acdca196f1ff72722243be2afe1429b88122afb9d4852d6d6e57689411d3d}


Simple indicator of observable {81038a217237afd16d80da7fc9219cbd145f9698bb512e2b625559a47ba73fec}


Simple indicator of observable {d777bcb6fba73faf96cb422383404c3b81a8afa5aebbc8ed70076081de7daa0c}


Simple indicator of observable {37f20f232aa86316901baccbb44af1668b1d868c1ca9aba8fcb36584352b3e0f}


Simple indicator of observable {93fb036e65c0683af5ffb98e2b61e30499dec068a4e15bf3bec8066d3e246852}


Simple indicator of observable {902e087711ab8e612bd7cea9864bbadbe20a3500ba57f26f6eeb0b5b20b803ec}


Simple indicator of observable {4a81bb3f9f9fe8a10002c043210ff537c2fd4a879a694d0f18468c70eaf65cfe}


Malicious sites


Malicious


SideCopy C&C


Action RAT C&C


Payload


ReverseRAT C&C


Simple indicator of observable {9ea494b525c4676e63f943e2d1dba751c377b9138613003c80d14ddfaed6883e}


Distribution


Malicious TAR Archive


Simple indicator of observable {764c7b0cdc8a844dc58644a32773990e}


Simple indicator of observable {59cd91c8ee6b9519c0da27d37a8a1b31}


Simple indicator of observable {fa17ed2eabff8ac5fbbbc87f5446b9ca}


Simple indicator of observable {71094ef9f2cf685e6c7d11fe310e5efb}


Simple indicator of observable {https://bitbucket.org/noelvisor/burdennetted/downloads/OAQDDI32.bmp}


Simple indicator of observable {https://bitbucket.org/poppedboy/bovrilchant/downloads/32.bmp}


Simple indicator of observable {https://c.statcounter.com/12830663/0/0ee00a3c/1/}


Simple indicator of observable {https://bitbucket.org/noelvisor/burdennetted/downloads/}


Simple indicator of observable {82.118.27.129}


Initial “C2” address (target for finger command)


Source from where ScreenConnect instance was downloaded (PowerShell command)


Simple indicator of observable {95.179.241.10}


Known Malicious


SaferVPN


Simple indicator of observable {ab3b9ec7bdd2e65051076d396d0ce76c1b4d6f3f00807fa776017de88bebd2f3}


Simple indicator of observable {3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac}


Simple indicator of observable {949cfa6514e499e28aa32feba800181558e60455b971206aa5aa601ea1f55605}


Simple indicator of observable {710f67d0561c659aecc56b94ee3fc82c967a9647c08451ed35ffa757020167fb}


qoakeifm-unknown.txt


C2 (Victims)


202401 202408


C2 / United States California Los Angeles AS834 IPXO LLC


C2 / Japan Osaka Osaka AS34985 ASN block not managed by the RIPE NCC


Simple indicator of observable {ff620bd560485c13a58a0de941bd3e52943036e6a05306e928f7c626998822fb}


Simple indicator of observable {fc9bb03998a89524ce5a0f859feb45806983aa4feb5f4d436107198ca869ff6f}


Simple indicator of observable {e2a940c7d19409e960427749519dc02293abe58a1bef78404a8390f818e40d08}


Simple indicator of observable {de42155e14a3c9c4d919316d6ba830229533de5063fcd110f53e2395ef3aa77a}


Simple indicator of observable {db6e75987cabdbfc21d0fdcb1cdae9887c492cab2b2ff1e529601a34a2abfd99}


Simple indicator of observable {da6d9c837c7c2531f0dbb7ce92bfceba4a9979953b6d49ed0862551d4b465adc}


Simple indicator of observable {d8f065d264b1112d6ee3cf34979289e89d9dcb30d2a3bd78cc797a81d3d56f56}


Simple indicator of observable {ceb59dbaf58a8de02f9d5e9b497321db0a19b7db4affd5b8d1a7e40d62775f96}


Simple indicator of observable {c8c11f9b308ea5983eebd8a414684021cc4cc1f67e7398ff967a18ae202fb457}


Simple indicator of observable {c5a73896dc628c23a0b6210f50019445e2b8bfc9770f4c81e1fed097f02dfade}


Simple indicator of observable {c547b80e1026d562ac851be007792ae98ddc1f3f8776741a72035aca3f18d277}


Simple indicator of observable {blocktestingto.com}


Simple indicator of observable {b833f40b2f3439f317cf95980b29bddd2245d2acc2d5c11e9690dd2fa4289585}


Simple indicator of observable {b5f151f0a4288e148fd10e19c78399f5b7bdff2ad66940fadd20d6eae4b7518b}


Simple indicator of observable {ab198c5a79cd9dedb271bd8a56ab568fbd91984f269f075d8b65173e749a8fde}


Simple indicator of observable {a2f8de3c5f5f6ecbf29c15afd43a7c13a5bf60023ecb371d39bcca6ceef1d2b7}


Simple indicator of observable {9ae24a1912e4b0bab76ae97484b62ea22bdc27b7ea3e6472f18bf04ca66c87de}


Simple indicator of observable {9867f99a66e64f6bce0cfca18b124194a683b8e4cb0ced44f7cb09386e1b528d}


Simple indicator of observable {92aeea4c32013b935cd8550a082aff1014d0cd2c2b7d861b43a344de83b68129}


Simple indicator of observable {845d7978682fa19161281a35b62f4c447c477082a765d6fedb219877d0c90f31}


Simple indicator of observable {7f8bb754f84a06b3e3617dd1138f07a918d11717cc63acaef8eb5c6d10101377}


Simple indicator of observable {7b718a46ae4de09ed4f2513df6e989afe1fbb1a0f59511a4689fac5e1745547d}


Simple indicator of observable {785f65f1853a08b0e86db5638fbd76e8cad5fe1359655716166a76035261c0be}


Simple indicator of observable {75f9f99295f86de85a8a2e4d73ed569bdb14a56a33d8240c72084f11752b207e}


Simple indicator of observable {72ebfe69c69d2dd173bb92013ab44d895a3367f91f09e3f8d18acab44e37b26d}


Simple indicator of observable {709820850127201a17caab273e01bb36ce185b4c4f68cd1099110bb193c84c42}


Simple indicator of observable {700a582408cbda7ee79723b3969b8d10d67871ea31bb17c8ca3c0d94b481aa8c}


Simple indicator of observable {6b3fce8f2dad7e803418edd8dfc807b0252705c11ec77114498b01766102e849}


Simple indicator of observable {67.203.7.163}


Simple indicator of observable {6465f7ddc9cf8ab6714cbbd49e1fd472e19818a0babbaf3764e96552e179c9af}


Simple indicator of observable {61dff5cbad45b4fe0852ac95b96b62918742b9c90dd47c672cbe0d1dafccb6c5}


Simple indicator of observable {617c62da1c228ec6d264f89e375e9a594a72a714a9701ed3268aa4742925112b}


Simple indicator of observable {592769457001374fac7a44379282ddf28c2219020c88150e32853f7517896c34}


Simple indicator of observable {4f50051ae3cb57f10506c6d69d7c9739c90ef21bfb82b14da6f4b407b6febac0}


Simple indicator of observable {4c605c6ef280b4ed5657fe97ba5b6106b10c4de02a40ae8c8907683129156efd}


Simple indicator of observable {4c465e6c8f43f7d13a1b887ff26d9a30f77cf65dd3b6f2e9f7fe36c8b6e83003}


Simple indicator of observable {444f56157dfcf9fc2347911a00fe9f3e3cb7971dccf67e1359d2f99a35aed88e}


Simple indicator of observable {41a912d72ba9d5db95094be333f79b60cae943a2bd113e20cc171f86ebcb86cf}


Simple indicator of observable {40645f9052e03fed3a33a7e0f58bc2c263eeae02cbc855b9308511f5dc134797}


Simple indicator of observable {39e7f94684129efce4d070d89e27508709f95fa55d9721f7b5d52f8b66b95ceb}


Simple indicator of observable {35434e903bc3be183fa07b9e99d49c0b0b3d8cf6cbd383518e9a9d753d25b672}


Simple indicator of observable {305de20b24e2662d47f06f16a5998ef933a5f8e92f9ecadf82129b484769bbac}


Simple indicator of observable {2d8a5b637a95de3b709780898b7c3957f93d72806e87302f50c40fe850471a44}


Simple indicator of observable {2d300410a3edb77b5f1f0ff2aa2d378425d984f15028c35dfad20fc750a6671a}


Simple indicator of observable {276863ee7b250419411b39c8539c31857752e54b53b072dffd0d3669f2914216}


Simple indicator of observable {2618a067e976f35f65aee95fecc9a8f52abea2fffd01e001f9865850435694cf}


Simple indicator of observable {1f9169492d18bffacebe951a22495d5dec81f35b0929da7783b5f094efef7b48}


Simple indicator of observable {1c905fa3a108f4c9bc0578882ce7af9682760b80af5232f130aa4f6463156b25}


Simple indicator of observable {1b21556fc8ecb9f8169ba0482de857b1f8a5cb120b2f1ac7729febe76f1eea83}


Simple indicator of observable {147.124.214.237}


Simple indicator of observable {147.124.214.131}


Simple indicator of observable {147.124.214.129}


Simple indicator of observable {12c0f44a931b9d0d74a2892565363bedfa13bec8e48ff5cd2352dec968f407ee}


Simple indicator of observable {121ca625f582add0527f888bb84b31920183e78c7476228091ff2199ec5d796b}


Simple indicator of observable {1123fea9d3a52989ec34041f791045c216d19db69d71e62aa6b24a22d3278ef9}


Simple indicator of observable {104926c2c937b4597ea3493bccb7683ae812ef3c62c93a8fb008cfd64e05df59}


Simple indicator of observable {0ce264819c7af1c485878ce795fd4727952157af7ffdea5f78bfd5b9d7806db1}


Simple indicator of observable {09a508e99b905330a3ebb7682c0dd5712e8eaa01a154b45a861ca12b6af29f86}


Simple indicator of observable {03185038cad7126663550d2290a14a166494fdd7ab0978b98667d64bda6e27cc}


Simple indicator of observable {https://cloudov-interview-series-projects.vercel.app/Osobn%c3%ad.html}


Simple indicator of observable {interview.serveftp.com}


Simple indicator of observable {interviewportal.ddns.net}


Simple indicator of observable {recruitment-interview.org}


Simple indicator of observable {https://interview.az/at-corrupti/documents.zip}


Simple indicator of observable {http://interviewsetup.com/rag.php}


Simple indicator of observable {cloudov-interview-series-projects.vercel.app}


SpyNote (CERTIFCATO)


SpyNote (CertApp)


Simple indicator of observable {37.120.141.144}


Simple indicator of observable {37.120.141.140}


Simple indicator of observable {2effd68ca29fb310fbe40749eb566d0e}


output.exe


Simple indicator of observable {f362f6f1dd0d9521752008cb1789a699}


array.dll—


Simple indicator of observable {mail.agagroup.lv}


Simple indicator of observable {info@agagroup.lv}


Simple indicator of observable {remiset@remisat.com.uy}


Simple indicator of observable {https://api.ipify.org}


Simple indicator of observable {remchukwugixiemu4.duckdns.org}


Simple indicator of observable {remchukwugix231fgh.duckdns.org}


Simple indicator of observable {122.176.133.66}


Simple indicator of observable {43.230.202.33}


Simple indicator of observable {107.175.229.139}


Simple indicator of observable {money001.duckdns.org}


Simple indicator of observable {104.250.180.178}


Simple indicator of observable {185.70.104.90}


Simple indicator of observable {77.105.132.70}


Simple indicator of observable {69192821f8ce4561cf9c9cb494a133584179116cb2e7409bea3e18901a1ca944}


Simple indicator of observable {0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e}


Simple indicator of observable {38a5659c98ca7353b656e3542ec336a1e7ecab71febd35491344aca304275a0e}


Simple indicator of observable {ebbd88b3ba1b0750cd8f0326dbabd94ed97cccd83baed2121e6ceaefa7f7eb1b}


Simple indicator of observable {c61a3b75e95ea37acb0d7653126ce080c807caf182c5002d2a2185e87f533dd6}


Simple indicator of observable {645a18f737bd6d810a48c4a47ace62c196eb1ef285f8ca9bea6218b312fff16e}


Simple indicator of observable {2bd509669c694baeb1234cc20b362e3b9a5d7619e200d949a0c9fd425e206ef3}


Simple indicator of observable {252968fd0fd5d2ab59ce391f4fccb031e3da691667165ef5f5002f007106a9fc}


Simple indicator of observable {55864f80ff6cd650dbdec3087a877f2198a7c48188456c0c81b53707cabaad6a}


Simple indicator of observable {660ff544cb4ffa2d32b0b8eb8c2d6945dd465b6b46aa55b0b4a042bf9a86ab1c}


Simple indicator of observable {41143b2e4bbb9279ba0bbb375748530cc4887cc965967e5c0cc9a39dc44937d6}


Simple indicator of observable {a7516a15e1857996373191795c79244c8f5c8deb1f17ba5dbadeac28e18ec1c7}


Simple indicator of observable {80304da1e333ed581378797ad8b0b8d81a8ac5928b83423702f0de30f1616225}


Spearphishing domain IPv4


JS downloader


Likely next-stage executable Java8Runtime.exe / unknown


File


C2 Servers


Dropper Distribution


Malicious Microsoft OneNote


Hidden File Objects


Simple indicator of observable {9437c89a5f9a51a4ff6d6076083fa6c9}


Simple indicator of observable {147.124.220.237}


Zip Archive


Simple indicator of observable {b89d6be0bcfb915492beb7ae726f815dcf289a284e650c200bda4faf5db60fa1}


Simple indicator of observable {4c37f3db024afd425301666e318c03e34f8813d21d90d95efb4018b3196d07b8}


Simple indicator of observable {5f0642383ca70a3fd2c4491b2826002763e90ca25a7413869fd824e7745d0465}


Simple indicator of observable {59c49f31b5f389c1c0109b0e603e2679c4f63c3f5c64432e820a50f50b80124f}


Simple indicator of observable {51d758fc04d05b997c651f658cdd30819ef5cf795d4498fad919e75a320e72ea}


Simple indicator of observable {4cb1e5ca257c709154b38704c34f4f0ade5305263fb21e6142c90c10a5764d52}


Simple indicator of observable {09fee43f923faaa30857a09c74d96fca9354653835165a01b274cad4c24460c7}


Simple indicator of observable {590353941bab80f38d77b2139bc7da6888b3dff9c8817c4b7e058f50173288bf}


Simple indicator of observable {9b9a3da9c602bf70a60cdb9b2bca6f4472222e8431b6b5ecf82b010fe274bba3}


Simple indicator of observable {f96631cdffa6ae69e5432c38778f3b93e5335a935f62939cd0094e5ccb886460}


Simple indicator of observable {8955585100f75c59472e4c2c77fcddd7422400f745ae75132c81c6144aa86824}


Simple indicator of observable {7bb7ca87149b6407e1e7c11c1a528a2e2147d3096337e3da6f6be130f76ff6ac}


Post-ex PowerShell script


Gzip payload


Simple indicator of observable {b9c3113bc5b603809dac2515dd03e9fa}


CMD file


Simple indicator of observable {topsoft.space}


Simple indicator of observable {idserver.xyz}


Simple indicator of observable {wmiprvse.xyz}


Simple indicator of observable {winhost.xyz}


Simple indicator of observable {rundll.xyz}


Some of the Phishing Emails


Simple indicator of observable {https://cloudflare-ipfs.com/ipfs/bafybeigau6t6s53l7meec6bsy6stztdbsdculi2qdne5dtbcncj7fscsgu/zoomeme.html#[victim’s}


Simple indicator of observable {https://office365.d3v75h3be08pv.amplifyapp.com/?cfg=[victim’s}

Question: cfg=[victim’s


Simple indicator of observable {https://micrrosoft.dveb5l061783j.amplifyapp.com/?cfg=[victim’s}

Question: cfg=[victim’s


Phishing server


inside PDF

Question: resid=720FBFD017217E31%21118&authkey=!ACD7ldpnneZUBtc&a=[4


JavaScript Downloading MSI


Screenshotter C2


of the Document.js hosted on the OneDrive


of ms.msi


of WasabiSeed script TermServ.vbs contained inside ms.msi


of MSI payload (Screenshotter) downloaded by WasabiSeed


of “index.js” Screenshotter component


of “snap.exe” Screenshotter component (legitimate IrfanView)


of “app.js” Screenshotter component


Control servers


Stage 0 Exploit


Stage1 Dropper, downloader


Bash script unxored


Ddss – decryption binary


Stage 2 Updater, Orchestrator


update-file


update.plist


The Core (C40F0D27 file)


C40F0D27 XOR-decoded


WifiList


LanDevices


CameraShot


FileManage


AudioRecorder


KeyChains


ScreenRecorder


ProcessAndApp


BrowserHistory


ShellCommand


GammaLoad C2


IPv4 / GammaLoad C2


Downloads GammaLoad.PS


Downloads GammaInfo


Downloads ReverseShell


IPv4 / GammaInfo Exfil


Downloads GammaSteel


GammaSteel C2


IPv4 / GammaSteel C2


GammaLoad.PS C2


Simple indicator of observable {5.252.178.181}


2024 рік 02.01.2024р.doc


Розмістити_Підвищення кваліфікації.docінф 3ї.doc


Simple indicator of observable {f38382b2386fdd27dc1e131a66c2f7e0c57711c99014ba243c20746dd4ed5358}


Untitled Lure Document


Супровід в прокурат_.doc


Щодо фактів вимагання коштів з боку співробітника Служби безпеки України.hta


7ZIP / Archive File


Simple indicator of observable {xmlschemeformat.com}


Simple indicator of observable {updatesagent.com}


Simple indicator of observable {apiregis.com}


Simple indicator of observable {185.247.209.255}


Simple indicator of observable {139.28.36.222}


Simple indicator of observable {9549d3d2b8e8b4e8f163a8b9fa3b02b8a28d78e4b583baccb6210ef267559c6e}


Simple indicator of observable {436994d4a5c8d54acb2b521d0847d77e6af6c2c0e40468248b1dd019c6dafa84}

The importance of and outlook for the Czech Republic in NATO.pdf.lnk


Simple indicator of observable {ace33243994a9da0797601bdd4191e25967a1da2644f0d0b530e26c71854d5d9}


Simple indicator of observable {a05d053174b52a9b158a5ec841c1a7633b9368c4ac2da371a11a9364f8a8dc60}


Simple indicator of observable {1dbcade04333b9dc81ba0746bc604d12489da49b9b65fcb5b1f61d139dc5949c}


Simple indicator of observable {38da8d1576bdd0a03e649e8e6543594b35a423aa5b0a0c4081fc477c8e487e09}


Simple indicator of observable {b29ed89e0428ba476459adabb5630c8d29f7fee5905c5de10d792fe3a02e52a6}


Simple indicator of observable {6e0d12cd0252599fd1dec7aa460cae7a12a1b2e322b6664e64c773c23627d1b4}


Simple indicator of observable {ed6775184051ef36c3049e24167471ab42bd4301e99631c8423d4d753cdad455}


Simple indicator of observable {https://206.188.197.113/}


Simple indicator of observable {https://195.123.225.88/}


Simple indicator of observable {fda71a7de6d473826465bb83210107501e66a5d96e533772444b3b24806286fd}

The importance of and outlook for the Czech Republic in NATO.pdf


Simple indicator of observable {8820e0c249305ffa3d38e72a7f27c0e2195bc739d08f5d270884be6237eea500}


Simple indicator of observable {https://vivaciousdqugilew.shop}


Simple indicator of observable {https://sturdyregularrmsnhw.shop}


Simple indicator of observable {https://understanndtytonyguw.shop}


Simple indicator of observable {https://stickyyummyskiwffe.shop}


Simple indicator of observable {https://standingcomperewhitwo.shop}


Simple indicator of observable {https://slamcopynammeks.shop}


Simple indicator of observable {https://sideindexfollowragelrew.pw}


Simple indicator of observable {https://relaxtionflouwerwi.shop}


Simple indicator of observable {https://patternapplauderw.shop}


Simple indicator of observable {https://messtimetabledkolvk.shop}


Simple indicator of observable {https://macabrecondfucews.shop}


Simple indicator of observable {https://lamentablegapingkwaq.shop}


Simple indicator of observable {https://innerverdanytiresw.shop}


Simple indicator of observable {https://horsedwollfedrwos.shop}


Simple indicator of observable {https://greentastellesqwm.shop}


Simple indicator of observable {https://distincttangyflippan.shop}


Simple indicator of observable {https://detailbaconroollyws.shop}


Simple indicator of observable {https://deprivedrinkyfaiir.shop}


Simple indicator of observable {https://considerrycurrentyws.shop}


Simple indicator of observable {https://github.com/bludmooncutie2/bludmooncutie2/releases/t}


Simple indicator of observable {https://github.com/witch12138/test/releases/tag/lat}


Simple indicator of observable {https://github.com/soulkeeper500/soulkeeper500/releases/tag/l}


Simple indicator of observable {https://github.com/xumuk71discoatoh/xumuk71discoatoh/relea}


Simple indicator of observable {https://goo.su/gisof1sda}


Simple indicator of observable {https://github.com/zigzagcharming643/zigzagcharming643/relea}


Simple indicator of observable {ab59a8412e4f8bf3a7e20cd656edacf72e484246dfb6b7766d467c2a1e4cdab0}


Simple indicator of observable {a484fa09be45608e23d8e67cd28675fa3e3c4111af396501385256ce34ff1d95}


Simple indicator of observable {98b7488b1a18cb0c5e360c06f0c94d19a5230b7b15d0616856354fb64929b388}


Simple indicator of observable {8d8d7eb1180c13ed629dceac6c399c656692a6476c49047e0822bec6156a253a}


Simple indicator of observable {64a49ff6862b2c924280d5e906bc36168112c85d9acc2eb778b72ea1d4c17895}


Simple indicator of observable {385ebe3d5bd22b6a5ae6314f33a7fa6aa24814005284c79edaa5bdcf98e28492}


Simple indicator of observable {2f5624dcda1d58a45491028acc63ff3f1f89f564015813c52eebd80f51220383}


Simple indicator of observable {2ebf051f6a61fa825c684f1d640bfb3bd79add0afcff698660f83f22e6544cba}


Simple indicator of observable {2b6c8aa2ac917d978dfec53cef70eaca36764a93d01d93786cc0d84da47ce8e6}


Simple indicator of observable {148c456e83e746a63e54ec5abda801731c42f3778e8eb0bf5a5c731b9a48c45d}


Simple indicator of observable {060de3b4cf3056f24de882b4408020cee0510cb1ff0e5007c621bc98e5b4bdf3}


Simple indicator of observable {185.172.128.95}


Simple indicator of observable {147.45.44.73}


Simple indicator of observable {147.45.47.64}


Simple indicator of observable {147.78.103.199}


Simple indicator of observable {89.23.98.116}


polyswarm link list -t CosmicLeopard


Simple indicator of observable {f745d6e3c811c9c06acb2ebc45a174ba}


Simple indicator of observable {5dd05f94ebdeb7afb494b541b317eb8c}


Simple indicator of observable {60cb0e31510a9cd747daae323d28f489}


Simple indicator of observable {0a62afe0dfe369b5280c432533671aa0}


Simple indicator of observable {fb848fcf49054871f62bbf9b5f5c9282}


Simple indicator of observable {669190300c47c141c35ea3867061512e}


Simple indicator of observable {54a4302989bf0f3ae42d2aeddca50e1a}


Simple indicator of observable {3e38a347b3914893cb5fb92d12558003}


Simple indicator of observable {bibigreen.ru}


Simple indicator of observable {/wp-content/energia/wp/}


Simple indicator of observable {/up/up.php}


Simple indicator of observable {hesheflowershop.ru}


Simple indicator of observable {/wp/up.php}


Simple indicator of observable {94.156.174.121}


Simple indicator of observable {/wp/521/patch.png}


Simple indicator of observable {/wp/521up.php}


Simple indicator of observable {185.243.112.18}


Simple indicator of observable {5.9.242.126}


Simple indicator of observable {/521/patch.gif}


active Germany linked to Aeza International LTD inactive linked to Russia-based Aeza Group Ltd


Cryptominer Unpacked Cryptominer Tsunami Malware


VBS


MSI


CAB


DLL


Shellcode


Loader


Shellcode to restart DarkGate


DarkGate


Simple indicator of observable {80.66.88.145}


Simple indicator of observable {5.188.87.58}


Simple indicator of observable {185.8.106.231}


Simple indicator of observable {5.34.178.21}


Simple indicator of observable {89.248.193.66}


Simple indicator of observable {167.114.199.65}


Simple indicator of observable {107.181.161.200}


Simple indicator of observable {149.248.0.82}


Simple indicator of observable {45.89.65.198}


Simple indicator of observable {179.60.149.3}


Simple indicator of observable {185.39.18.170}


Simple indicator of observable {bikeontop.shop}


Simple indicator of observable {xfirecovery.pro}


Simple indicator of observable {naserviceebaysmman.shop}


Simple indicator of observable {reactervnamnat.com}


Simple indicator of observable {private-edinmarketing.com}


Simple indicator of observable {msteamseyeappstore.com}


Simple indicator of observable {sanibroadbandcommunicton.duckdns.org}


Simple indicator of observable {positivereview.cloud}


Simple indicator of observable {drkgatevservicceoffice.net}


Simple indicator of observable {https://onedrive.live.com/redir?resid=31B302B132DC1EB7!416&authkey=!AIHVM4Etxtu4Hl4&ithint=onenote}

Question: resid=31B302B132DC1EB7!416&authkey=!AIHVM4Etxtu4Hl4&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=3FBB4C466D5C47B%214007&authkey=%21AMAoWtlsRjtgU3s&page=View&wd=target%28Quick%20Notes.one%7C9b74b45d-3dcb-486c-bfa8-1690485577d1%2FNAKED%}

Question: resid=3FBB4C466D5C47B%214007&authkey=%21AMAoWtlsRjtgU3s&page=View&wd=target%28Quick%20Notes.one%7C9b74b45d-3dcb-486c-bfa8-1690485577d1%2FNAKED%


Simple indicator of observable {https://onedrive.live.com/redir?resid=4A2A68C638DBFAD1%21728&authkey=%21AAoJZlYdkU4qM_M&page=View&wd=target%28Quick%20Notes.one%7C79a985b7-6c15-43cf-aac6-a2c70122f021%2FMartina%}

Question: resid=4A2A68C638DBFAD1%21728&authkey=%21AAoJZlYdkU4qM_M&page=View&wd=target%28Quick%20Notes.one%7C79a985b7-6c15-43cf-aac6-a2c70122f021%2FMartina%


Simple indicator of observable {https://onedrive.live.com/redir?resid=4E0D3BBD3561F29%2120527&authkey=%21ABNV5f0-VxuHve4&page=View&wd=target%28Quick%20Notes.one%7C2b938392-c42c-44b7-954c-42737e7cb805%}

Question: resid=4E0D3BBD3561F29%2120527&authkey=%21ABNV5f0-VxuHve4&page=View&wd=target%28Quick%20Notes.one%7C2b938392-c42c-44b7-954c-42737e7cb805%


Simple indicator of observable {https://onedrive.live.com/redir?resid=531CBDB0711FA26E%21635&authkey=%21AIezNqQXzKf1HvM&page=View&wd=target%28Quick%20Notes.one%7C0490e0b3-c320-4f83-8c11-667055e276f6%2FSolar%20%}

Question: resid=531CBDB0711FA26E%21635&authkey=%21AIezNqQXzKf1HvM&page=View&wd=target%28Quick%20Notes.one%7C0490e0b3-c320-4f83-8c11-667055e276f6%2FSolar%20%


Simple indicator of observable {https://onedrive.live.com/redir?resid=6B61A37433C0FFD8%214320&authkey=%21AEwQuZ5OAuQm9aY&page=View&wd=target%28Quick%20Notes.one%7Caa694bfb-16b3-4c1b-909d-140f5bfcd39e%2FStudio%}

Question: resid=6B61A37433C0FFD8%214320&authkey=%21AEwQuZ5OAuQm9aY&page=View&wd=target%28Quick%20Notes.one%7Caa694bfb-16b3-4c1b-909d-140f5bfcd39e%2FStudio%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E98E045C25A9D63F%219773&authkey=%21AAgvN_6yASvZ5u8&page=View&wd=target%28Quick%20Notes.one%7Ce4fa6a0b-a9ca-47e1-80ff-29ec7ea3d43f%2FStadex%}

Question: resid=E98E045C25A9D63F%219773&authkey=%21AAgvN_6yASvZ5u8&page=View&wd=target%28Quick%20Notes.one%7Ce4fa6a0b-a9ca-47e1-80ff-29ec7ea3d43f%2FStadex%


Simple indicator of observable {https://onedrive.live.com/redir?resid=56249906518A0B!283&authkey=!AH4y6GfOPnM-SvI&ithint=onenote}

Question: resid=56249906518A0B!283&authkey=!AH4y6GfOPnM-SvI&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=9B866E89934F86E9%21301&authkey=%21ACM7iv3lZ7k7tU0&page=View&wd=target%28Quick%20Notes.one%7Cad20f96d-515e-4b1c-a675-f30969b3b9f6%2FDavide%}

Question: resid=9B866E89934F86E9%21301&authkey=%21ACM7iv3lZ7k7tU0&page=View&wd=target%28Quick%20Notes.one%7Cad20f96d-515e-4b1c-a675-f30969b3b9f6%2FDavide%


Simple indicator of observable {https://onedrive.live.com/redir?resid=9E42FE8C29238AB1%2115147&authkey=%21AOqiv3AcYY3aMpQ&page=Edit&wd=target%28Quick%20Notes.one%7C1c9129d0-c8bd-48b0-8df2-3c4e154b0891%2FMTS%}

Question: resid=9E42FE8C29238AB1%2115147&authkey=%21AOqiv3AcYY3aMpQ&page=Edit&wd=target%28Quick%20Notes.one%7C1c9129d0-c8bd-48b0-8df2-3c4e154b0891%2FMTS%


Simple indicator of observable {https://onedrive.live.com/redir?resid=AE5A5924C2D9CC14!48410&authkey=!ALfMjOMjP1PxCi8&ithint=onenote}

Question: resid=AE5A5924C2D9CC14!48410&authkey=!ALfMjOMjP1PxCi8&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=B3783CBEB3CBD28E%211178&authkey=%21AP5JEq30FkehUj4&page=View&wd=target%28Quick%20Notes.one%7Cce65b048-b0c5-4ea3-bc3d-0a9084267a0e%2FPROMO%}

Question: resid=B3783CBEB3CBD28E%211178&authkey=%21AP5JEq30FkehUj4&page=View&wd=target%28Quick%20Notes.one%7Cce65b048-b0c5-4ea3-bc3d-0a9084267a0e%2FPROMO%


Simple indicator of observable {https://onedrive.live.com/redir?resid=DB167F6D99BE2335%2157103&authkey=%21AMTkDK3lCKHG-N8&page=View&wd=target%28Quick%20Notes.one%7Ceba8f278-5578-464e-829f-b794f6ba1321%2FFybra%}

Question: resid=DB167F6D99BE2335%2157103&authkey=%21AMTkDK3lCKHG-N8&page=View&wd=target%28Quick%20Notes.one%7Ceba8f278-5578-464e-829f-b794f6ba1321%2FFybra%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E1D28F66AD9ED4A1%211490&authkey=%21AGPrkBNKqNRG3dE&page=View&wd=target%28Quick%20Notes.one%7C5f3e1cce-b367-4d85-9f9c-de4381a6a8b8%}

Question: resid=E1D28F66AD9ED4A1%211490&authkey=%21AGPrkBNKqNRG3dE&page=View&wd=target%28Quick%20Notes.one%7C5f3e1cce-b367-4d85-9f9c-de4381a6a8b8%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E3CBC738A4D9118B%2115853&authkey=%21ADWYKGPcM4Ck0UU&page=View&wd=target%28Quick%20Notes.one%7C293d7920-3cf2-4338-beec-83627581afc5%2FElbo%}

Question: resid=E3CBC738A4D9118B%2115853&authkey=%21ADWYKGPcM4Ck0UU&page=View&wd=target%28Quick%20Notes.one%7C293d7920-3cf2-4338-beec-83627581afc5%2FElbo%


Simple indicator of observable {https://onedrive.live.com/redir?resid=E7459548557E7DD0%211823&authkey=%21AGh8Y18gIf2LBKk&page=View&wd=target%28Quick%20Notes.one%7C49d9deb6-98cb-45ad-a8d3-708081e249d0%}

Question: resid=E7459548557E7DD0%211823&authkey=%21AGh8Y18gIf2LBKk&page=View&wd=target%28Quick%20Notes.one%7C49d9deb6-98cb-45ad-a8d3-708081e249d0%


Simple indicator of observable {https://onedrive.live.com/redir?resid=62E45C9F0AC9D873!539&authkey=!AHvrEUEeKYZWc&ithint=onenote}

Question: resid=62E45C9F0AC9D873!539&authkey=!AHvrEUEeKYZWc&ithint=onenote


Simple indicator of observable {https://onedrive.live.com/redir?resid=EFB4967AA612AAF7%21517&authkey=%21AAw9pPYWRqS0Xgs&page=View&wd=target%28Quick%20Notes.one%7C1fe14282-98e8-46fa-8f66-ebe00ac0795d%2FMarco%}

Question: resid=EFB4967AA612AAF7%21517&authkey=%21AAw9pPYWRqS0Xgs&page=View&wd=target%28Quick%20Notes.one%7C1fe14282-98e8-46fa-8f66-ebe00ac0795d%2FMarco%


Simple indicator of observable {https://onedrive.live.com/view.aspx?resid=EA104CA31FC03329!142&ithint=onenote&wdo=2&authkey=!AIBTpgciuKI2Yeo}

Question: resid=EA104CA31FC03329!142&ithint=onenote&wdo=2&authkey=!AIBTpgciuKI2Yeo


Malicious


MetaStealer C2s


Payload


Savvy Seahorse secondary TDS


Subdomain used as CNAME record for parked


Subdomain used as CNAME record for inactive


Subdomains used as CNAME records for active campaigns


Subdomains for active Savvy Seahorse campaigns


Fake trading websites the user is redirected to in some campaigns


Payment processing to collect victim’s financial information


Savvy Seahorse base


BlotchyQuasar sample


Paste containing the encrypted C2 of BlotchyQuasar


BlotchyQuasar C2 for the analyzed sample


Additional BlotchyQuasar C2


C&C Server


Initial Sample


Emotet C&Cs


Indicator – Type – Description / C2 Endpoint


Indicator – Type – Description / File Payload


Payload, Indicator – Type – Description


Indicator – Type – Description / address C2 Endpoint


Indicator – Type – Description


1101991775 / /Collect/union/QXMY8BHNIPH7


1101991775 / /Detect/devs/NJYO2MUY4V


1101991775 / /safebrowsing/d4alBmGBO/UaIzXMVGvV3tS2OJiKxSzyzbh4u1


1101991775 / /safebrowsing/fDeBjO/2hmXORzLK7PkevU1TehrmzD5z9


1101991775 / /restore/how/3RG4G5T87


1101991775 / /safebrowsing/bsaGbO6l/ybGoI3wmK2uF9w9aL5qKmnS8IZIWsJqhp


1101991775 / /safebrowsing/3Tqo/UMskN3Lh0LyLy8BfpG1Bsvp


1101991775 / /safebrowsing/dfKa/B58qAhJ0AEF7aNwauoqpAL8


1101991775 / /safebrowsing/dfKa/9T1BuXpqEDg9tx53mQRU6


1101991775 / /safebrowsing/bsaGbO6l/dl1sskHxt1uGDGUnLDB5gxn4vYZQK1kaG6


1101991775 / /functionalStatus/cjdl-CLe4j-XHyiEaDqQx


1101991775 / /safebrowsing/d4alBmGBO/HafYg4QZaRhMBwuLAjVmSPc


1101991775 / /functionalStatus/qPprp9dtVhrGV3R3re5Xy4M2cfQo4wB


1101991775 / /safebrowsing/dfKa/GgVYon5zhYu5L7inFbl1MZEv7RGOnsS00b


1101991775 / /apply/admin_/99ZSSAHDH


1101991775 / /safebrowsing/d4alBmGBO/EB-9sfMPmsHmH-A7pmll9HbV0g


1101991775 / /safebrowsing/d4alBmGBO/mr3lHbohEvZa0mKDWWdwTV5Flsxh


1101991775 / /safebrowsing/fDeBjO/CGZcHKnX3arVCfFp98k8


1580103824 / /safebrowsing/7IAMO/hxNTeZ8lBNYqjAsQ2tBRS


1580103824 / /safebrowsing/eMUgI4Z/3RzgDBAvgg3DQUn8XtN8l


1580103824 / /safebrowsing/d5pERENa/3tPCoNwoGwXAvV1w1JAS-OOPyVYxL1K2styHFtbXar7ME


1580103824 / /safebrowsing/TKc3hA/DzwHHcc8y8O9kAS7cl4SDK0e6z0KHKIX9w7


1580103824 / /safebrowsing/sj0IWAb/YhcZADXFB3NHbxFtKgpqBtK9BllJiGEL


1580103824 / /safebrowsing/Jwjy4/mzAoZyZk7qHIyw3QrEpXij5WFhIo1z8JDUVA0N0


1580103824 / /safebrowsing/TKc3hA/t-nAkENGu9rpZ9ebRRXr79b


1580103824 / /safebrowsing/AvuvAkxsR/8I6ikMUvdNd8HOgMeD0sPfGpwSZEMr


1580103824 / /safebrowsing/d5pERENa/f5oBhEk7xS3cXxstp6Kx1G7u3N546UStcg9nEnzJn2k


1580103824 / /safebrowsing/eMUgI4Z/BOhKRIMsJsuPnn3IQvgrEc3XLQUB3W


1580103824 / /safebrowsing/dpNqi/nXeFgGufr9VqHjDdsIZbw-ZH0


1580103824 / /safebrowsing/dpNqi/F3QExtY65SvTVK1ewA26


1580103824 / /safebrowsing/dpNqi/7CtHhF-isMMQ6m7NmHYNb0N7E7Fe


1580103824 / /safebrowsing/fBm1b/JbcKDYjMWcQNjn69LnGggFe6mpjn5xOQ


1580103824 / /safebrowsing/Jwjy4/cmr4tZ7IyFGbgCiof2tHMO


1580103824 / /safebrowsing/b0kKKIjr/AzX9ZHB37oJfPsUBUaxBJjzzi132cYRZhUZc81g


1580103824 / /safebrowsing/IsXNCJJfH/5x0rUIrn–r85sLJIuEY7C9q


206546002 / /functionalStatus/qPprp9dtVhrGV3R3re5Xy4M2cfQo4wB


Simple indicator of observable {172.233.238.215}


Simple indicator of observable {96.126.111.127}


Simple indicator of observable {23.239.11.145}


Simple indicator of observable {45.33.98.254}


Simple indicator of observable {45.79.199.4}


Simple indicator of observable {45.56.105.98}


Simple indicator of observable {198.58.119.214}


Simple indicator of observable {45.66.248.99}


Simple indicator of observable {172.232.172.128}


Simple indicator of observable {172.232.172.110}


Simple indicator of observable {172.232.172.125}


Simple indicator of observable {0bbf1a3a8dd436fda213bc126b1ad0b8704d47fd8f14c75754694fd47a99526c}


Simple indicator of observable {ab7cab5192f0bef148670338136b0d3affe8ae0845e0590228929aef70cb9b8b}


Simple indicator of observable {0e8458223b28f24655caf37e5c9a1c01150ac7929e6cb1b11d078670da892a5b}


Simple indicator of observable {4420bd041ae77fce2116e6bd98f4ed6945514fad8edfbeeeab0874c84054c80a}


Simple indicator of observable {0f07c23f7fe5ff918ee596a7f1df320ed6e7783ff91b68c636531aba949a6f33}


Simple indicator of observable {43308bde79e71b2ed14f318374a80fadf201cc3e34a887716708635294031b1b}


Simple indicator of observable {a3cb53ddd4a5316cb02b7dc4ccd1f615755b46e86a88152a1f8fc59efe170497}


Simple indicator of observable {e85a2e8995ef37acf15ea79038fae70d4566bd912baac529bad74fbec5bb9c21}


Simple indicator of observable {a403b82a14b392f8485a22f105c00455b82e7b8a3e7f90f460157811445a8776}


Simple indicator of observable {e0c0491e45dda838f4ac01b731dd39cc7064675a6e1b79b184fff99cdce52f54}


Simple indicator of observable {a5fc8d9f9f4098e2cecb3afc66d8158b032ce81e0be614d216c9deaf20e888ac}


Simple indicator of observable {a9ea85481e178cd35ae323410d619e97f49139dcdb2e7da72126775a89a8464f}


Simple indicator of observable {c7accad7d8da9797788562a3de228186290b0f52b299944bec04a95863632dc0}


Simple indicator of observable {ac232e7594ce8fbbe19fc74e34898c562fe9e8f46d4bfddc37aefeb26b85c02b}


Simple indicator of observable {cef1a88dfc436dab9ae104f0770a434891bbd609e64df43179b42b03a7e8f908}


Simple indicator of observable {acdaac680e2194dd8fd06f937847440e7ab83ce1760eab028507ee8eba557291}


Simple indicator of observable {b96d4400e9335d80dedee6f74ffaa4eca9ffce24c370790482c639df52cb3127}


Simple indicator of observable {ae148315cec7140be397658210173da372790aa38e67e7aa51597e3e746f2cb2}


Simple indicator of observable {f245b2bc118c3c20ed96c8a9fd0a7b659364f9e8e2ee681f5683681e93c4d78b}


Simple indicator of observable {aeecc65ac8f0f6e10e95a898b60b43bf6ba9e2c0f92161956b1725d68482721d}


Simple indicator of observable {797abd3de3cb4c7a1ceb5de5a95717d84333bedcbc0d9e9776d34047203181bc}


Simple indicator of observable {b062dd516cfa972993b6109e68a4a023ccc501c9613634468b2a5a508760873e}


Simple indicator of observable {122b77fd4d020f99de66bba8346961b565e804a3c29d0757db807321e9910833}


Simple indicator of observable {b10db109b64b798f36c717b7a050c017cf4380c3cb9cfeb9acd3822a68201b5b}


Simple indicator of observable {902d29871d3716113ca2af5caa6745cb4ab9d0614595325c1107fb83c1494483}


Simple indicator of observable {b1d1a972078d40777d88fb4cd6aef1a04f29c5dd916f30a6949b29f53a2d121c}


Simple indicator of observable {0581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426}


Simple indicator of observable {b1f3f1c06b1cc9a249403c2863afc132b2d6a07f137166bdd1e4863a0cece5b1}


Simple indicator of observable {e63807daa9be0228d90135ee707ddf03b0035313a88a78e50342807c27658ff2}


Simple indicator of observable {b4c746e9a49c058ae3843799cdd6a3bb5fe14b413b9769e2b5a1f0f846cb9d37}


Simple indicator of observable {063191c49d49e6a8bdcd9d0ee2371fb1b90f1781623827b1e007e520ec925445}


Simple indicator of observable {b4f37f13a7e9c56ea95fa3792e11404eb3bdb878734f1ca394ceed344d22858f}


Simple indicator of observable {b956c5e8ec6798582a68f24894c1e78b9b767aae4d5fb76b2cc71fc9c8befed8}


Simple indicator of observable {6fc283acfb7dda7bab02f5d23dc90b318f4c73a8e576f90e1cac235bf8d02470}


Simple indicator of observable {b99ba2449a93ab298d2ec5cacd5099871bacf6a8376e0b080c7240c8055b1395}


Simple indicator of observable {96fab57ef06b433f14743da96a5b874e96d8c977b758abeeb0596f2e1222b182}


Simple indicator of observable {b9e313e08b49d8d2ffe44cb6ec2192ee3a1c97b57c56f024c17d44db042fb9eb}


Simple indicator of observable {bc238b3b798552958009f3a4ce08e5ce96edff06795281f8b8de6f5df9e4f0fe}


Simple indicator of observable {191566d8cc119cd6631d353eab0b8c1b8ba267270aa88b5944841905fa740335}


Simple indicator of observable {bcd64a8468762067d8a890b0aa7916289e68c9d8d8f419b94b78a19f5a74f378}


Simple indicator of observable {c113e8a1c433b4c67ce9bce5dea4b470da95e914de4dc3c3d5a4f98bce2b7d6c}


Simple indicator of observable {c1261f57a0481eb5d37176702903025c5b01a166ea6a6d42e1c1bdc0e5a0b04b}


Simple indicator of observable {189b7afdd280d75130e633ebe2fcf8f54f28116a929f5bb5c9320f11afb182d4}


Simple indicator of observable {c149792a5e5ce4c15f8506041e2f234a9a9254dbda214ec79ceef7d0911a3095}


Simple indicator of observable {c2046d64bcfbab5afcb87a75bf3110e0fa89b3e0f7029ff81a335911cf52f00a}


Simple indicator of observable {d048001f09ad9eedde44f471702a2a0f453c573db9c8811735ec45d65801f1d0}


Simple indicator of observable {c3509ba690a1fcb549b95ad4625f094963effc037df37bd96f9d8ed5c7136d94}


Simple indicator of observable {c3cfbede0b561155062c2f44a9d44c79cdb78c05461ca50948892ff9a0678f3f}


Simple indicator of observable {bcb32a0f782442467ea8c0bf919a28b58690c68209ae3d091be87ef45d4ef049}


Simple indicator of observable {c79ab271d2abd3ee8c21a8f6ad90226e398df1108b4d42dc551af435a124043c}


Simple indicator of observable {749d061acb0e584df337aaef26f3b555d5596a96bfffc9d6cd7421e22c0bacea}


Simple indicator of observable {cab95dc6d08089dcd24c259f35b52bca682635713c058a74533501afb94ab91f}


Simple indicator of observable {cea5c060dd8abd109b478e0de481f0df5ba3f09840746a6a505374d526bd28dc}


Simple indicator of observable {759ac6e54801e7171de39e637b9bb525198057c51c1634b09450b64e8ef47255}


Simple indicator of observable {cfa604765b9d7a93765d46af78383978251486d9399e21b8e3da4590649c53e4}


Simple indicator of observable {57acdb7a22f5f0c6d374be2341dbef97efbcc61f633f324beb0e1214614fef82}


Simple indicator of observable {d1afca36f67b24eae7f2884c27c812cddc7e02f00f64bb2f62b40b21ef431084}


Simple indicator of observable {f570bd331a3d75e065d1825d97b922503c83a52fc54604d601d2e28f4a70902b}


Simple indicator of observable {d1b6671fc0875678ecf39d737866d24aca03747a48f0c7e8855a5b09fc08712d}


Simple indicator of observable {d3d48aa32b062b6e767966a8bab354eded60e0a11be5bc5b7ad8329aa5718c76}


Simple indicator of observable {60905c92501ec55883afc3f6402a05bddfd335323fdc0144515f01e8da0acbda}


Simple indicator of observable {d3eab2a134e7bd3f2e8767a6285b38d19cd3df421e8af336a7852b74f194802c}


Simple indicator of observable {2fd38f6329b9b2c5e0379a445e81ece43fe0372dec260c1a17eefba6df9ffd55}


Simple indicator of observable {d439f941b293e3ded35bf52fac7f20f6a2b7f2e4b189ad2ac7f50b8358110491}


Simple indicator of observable {18a9eafb936bf1d527bd4f0bfae623400d63671bafd0aad0f72bfb59beb44d5f}


Simple indicator of observable {dac00ec780aabaffed1e89b3988905a7f6c5c330218b878679546a67d7e0eef2}


Simple indicator of observable {adc73af758c136e5799e25b4d3d69e462e090c8204ec8b8f548e36aac0f64a66}


Simple indicator of observable {db62152fe9185cbd095508a15d9008b349634901d37258bc3939fe3a563b4b3c}


Simple indicator of observable {7f71d316c197e4e0aa1fce9d40c6068ada4249009e5da51479318de039973ad8}


Simple indicator of observable {db81e91fc05991f71bfd5654cd60b9093c81d247ccd8b3478ab0ebef61efd2ad}


Simple indicator of observable {dd42c1521dbee54173be66a5f98a811e5b6ee54ad1878183c915b03b68b7c9bb}


Simple indicator of observable {d988a867a53c327099a4c9732a1e4ced6fe6eca5dd68f67e5f562ab822b8374b}


Simple indicator of observable {e0888b80220f200e522e42ec2f15629caa5a11111b8d1babff509d0da2b948f4}


Simple indicator of observable {915503b4e985ab31bc1d284f60003240430b3bdabb398ae112c4bd1fe45f3cdd}


Simple indicator of observable {e30503082d3257737bba788396d7798e27977edf68b9dba7712a605577649ffb}


Simple indicator of observable {df01b0a8112ca80daf6922405c3f4d1ff7a8ff05233fc0786e9d06e63c9804d6}


Simple indicator of observable {e521cad48d47d4c67705841b9c8fa265b3b0dba7de1ba674db3a63708ab63201}


Simple indicator of observable {40cac28490cddfa613fd58d1ecc8e676d9263a46a0ac6ae43bcbdfedc525b8ee}


Simple indicator of observable {e62f5fc4528e323cb17de1fa161ad55eb451996dec3b31914b00e102a9761a52}


Simple indicator of observable {19e7bb5fa5262987d9903f388c4875ff2a376581e4c28dbf5ae7d128676b7065}


Simple indicator of observable {ebafb35fd9c7720718446a61a0a1a10d09bf148d26cdcd229c1d3d672835335c}


Simple indicator of observable {5cb2683953b20f34ff26ddc0d3442d07b4cd863f29ec3a208cbed0dc760abd04}


Simple indicator of observable {ebf40e12590fcc955b4df4ec3129cd379a6834013dae9bb18e0ec6f23f935bba}


Simple indicator of observable {d99bac48e6e347fcfd56bbf723a73b0b6fb5272f92a6931d5f30da76976d1705}


Simple indicator of observable {ef7ff2d2decd8e16977d819f122635fcd8066fc8f49b27a809b58039583768d2}


Simple indicator of observable {efbffc6d81425ffb0d81e6771215c0a0e77d55d7f271ec685b38a1de7cc606a8}


Simple indicator of observable {47bd5fd96c350f5e48f5074ebee98e8b0f4efb8a0cd06db5af2bdc0f3ee6f44f}


Simple indicator of observable {f08fdb0633d018c0245d071fa79cdc3915da75d3c6fc887a5ca6635c425f163a}


Simple indicator of observable {f3bfd8ab9e79645babf0cb0138d51368fd452db584989c4709f613c93caf2bdc}


Simple indicator of observable {cd7135c94929f55e19e5d66359eab46422c3c59d794dde00c8b4726498e4e01a}


Simple indicator of observable {f58de1733e819ea38bce21b60bb7c867e06edb8d4fd987ab09ecdbf7f6a319b9}


Simple indicator of observable {19eae7c0b7a1096a71b595befa655803c735006d75d5041c0e18307bd967dee6}


Simple indicator of observable {f7fa532ad074db4a39fd0a545278ea85319d08d8a69c820b081457c317c0459e}


Simple indicator of observable {fce9de0a0acf2ba65e9e252a383d37b2984488b6a97d889ec43ab742160acce1}


Simple indicator of observable {ffb255e7a2aa48b96dd3430a5177d6f7f24121cc0097301f2e91f7e02c37e6bf}


Simple indicator of observable {5af6626a6bc7265c21adaffb23cc58bc52c4ebfe5bf816f77711d3bc7661c3d6}


Simple indicator of observable {1a50c358fa4b725c6e0e26eee3646de26ba38e951f3fe414f4bf73532af62455}


Simple indicator of observable {8f1cc6ab8e95b9bfdf22a2bde77392e706b6fb7d3c1a3711dbc7ccd420400953}


Simple indicator of observable {1be3397c2a85b4b9a5a111b9a4e53d382df47a0a09065639d9e66e0b55fe36fc}


Simple indicator of observable {3f28a055d56f46559a21a2b0db918194324a135d7e9c44b90af5209a2d2fd549}


Simple indicator of observable {1d058302d1e747714cac899d0150dcc35bea54cc6e995915284c3a64a76aacb1}


Simple indicator of observable {02b1bd89e9190ff5edfa998944fd6048d32a3bde3a72d413e8af538d9ad770b4}


Simple indicator of observable {3760db55a6943f4216f14310ab10d404e5c0a53b966dd634b76dd669f59d2507}


Simple indicator of observable {2cf125d6f21c657f8c3732be435af56ccbe24d3f6a773b15eccd3632ea509b1a}


Simple indicator of observable {2f2e62c9481ba738a5da7baadfc6d029ef57bf7a627c2ac0b3e615cab5b0cfa2}


Simple indicator of observable {39ed516d8f9d9253e590bad7c5daecce9df21f1341fb7df95d7caa31779ea40f}


Simple indicator of observable {3bc8ce92409876526ad6f48df44de3bd1e24a756177a07d72368e2d8b223bb39}


Simple indicator of observable {20e43f60a29bab142f050fab8c5671a0709ee4ed90a6279a80dd850e6f071464}


Simple indicator of observable {3dffb7f05788d981efb12013d7fadf74fdf8f39fa74f04f72be482847c470a53}


Simple indicator of observable {8e78ad0ef549f38147c6444910395b053c533ac8fac8cdaa00056ad60b2a0848}


Simple indicator of observable {3f6e3e7747e0b1815eb2a46d79ebd8e3cb9ccdc7032d52274bc0e60642e9b31e}


Simple indicator of observable {3fff407bc45b879a1770643e09bb99f67cdcfe0e4f7f158a4e6df02299bac27e}


Simple indicator of observable {4b3cd3aa5b961791a443b89e281de1b05bc3a9346036ec0da99b856ae7dc53a8}


Simple indicator of observable {4faf362b3fe403975938e27195959871523689d0bf7fba757ddfa7d00d437fd4}


Simple indicator of observable {5d72cc2e47d3fd781b3fc4e817b2d28911cd6f399d4780a5ff9c06c23069eae1}


Simple indicator of observable {9a08d2db7d0bd7d4251533551d4def0f5ee52e67dff13a2924191c8258573024}


Simple indicator of observable {5ea74bca527f7f6ea8394d9d78e085bed065516eca0151a54474fffe91664198}


Simple indicator of observable {be314279f817f9f000a191efb8bcc2962fcc614b1f93c73dda46755269de404f}


Simple indicator of observable {5fc79a4499bafa3a881778ef51ce29ef015ee58a587e3614702e69da304395db}


Simple indicator of observable {3d2499e5c9b46f1f144cfbbd4a2c8ca50a3c109496a936550cbb463edf08cd79}


Simple indicator of observable {06cd6391b5fcf529168dc851f27bf3626f20e038a9c0193a60b406ad1ece6958}


Simple indicator of observable {6a7ae217394047c17d56ec77b2243d9b55617a1ff591d2c2dfc01f2da335cbbf}


Simple indicator of observable {1e3b373f2438f1cc37e15fdede581bdf2f7fc22068534c89cb4e0c128d0e45dd}


Simple indicator of observable {6e75a9266e6bbfd194693daf468dd86d106817706c57b1aad95d7720ac1e19e3}


Simple indicator of observable {4adf3875a3d8dd3ac4f8be9c83aaa7e3e35a8d664def68bc41fc539bfedfd33f}


Simple indicator of observable {7e61498ec5f0780e0e37289c628001e76be88f647cad7a399759b6135be8210a}


Simple indicator of observable {7f7b9f40eea29cfefc7f02aa825a93c3c6f973442da68caf21a3caae92464127}


Simple indicator of observable {8b6eb2853ae9e5faff4afb08377525c9348571e01a0e50261c7557d662b158e1}


Simple indicator of observable {8d53dc0857fa634414f84ad06d18092dedeb110689a08426f08cb1894c2212d4}


Simple indicator of observable {8e6c0d338f201630b5c5ba4f1757e931bc065c49559c514658b4c2090a23e57b}


Simple indicator of observable {f2329ae2eb28bba301f132e5923282b74aa7a98693f44425789b18a447a33bff}


Simple indicator of observable {8f9289915b3c6f8bf9a71d0a2d5aeb79ff024c108c2a8152e3e375076f3599d5}


Simple indicator of observable {f89cfbc1d984d01c57dd1c3e8c92c7debc2beb5a2a43c1df028269a843525a38}


Simple indicator of observable {9c5c9d35b7c2c448a610a739ff7b85139ea1ef39ecd9f51412892cd06fde4b1b}


Simple indicator of observable {13c7f28044fdb1db2289036129b58326f294e76e011607ca8d4c5adc2ddddb16}


Simple indicator of observable {19b0db9a9a08ee113d667d924992a29cd31c05f89582953eff5a52ad8f533f4b}


Simple indicator of observable {19d4a7d08176119721b9a302c6942718118acb38dc1b52a132d9cead63b11210}


Simple indicator of observable {22e65a613e4520a6f824a69b795c9f36af02247f644e50014320857e32383209}


Simple indicator of observable {028da30664cb9f1baba47fdaf2d12d991dcf80514f5549fa51c38e62016c1710}


Simple indicator of observable {37b6fce45f6bb52041832eaf9c6d02cbc33a3ef2ca504adb88e19107d2a7aeaa}


Simple indicator of observable {42beac1265e0efc220ed63526f5b475c70621573920968a457e87625d66973af}


Simple indicator of observable {43c1ee0925ecd533e0b108c82b08a3819b371182e93910a0322617a8acf26646}


Simple indicator of observable {44ce7403ca0c1299d67258161b1b700d3fa13dd68fbb6db7565104bba21e97ae}


Simple indicator of observable {f3b0357562e51311648684d381a23fa2c1d0900c32f5c4b03f4ad68f06e2adc1}


Simple indicator of observable {49ba10b4264a68605d0b9ea7891b7078aeef4fa0a7b7831f2df6b600aae77776}


Simple indicator of observable {0603cf8f5343723892f08e990ae2de8649fcb4f2fd4ef3a456ef9519b545ed9e}


Simple indicator of observable {54c7c153423250c8650efc0d610a12df683b2504e1a7a339dfd189eda25c98d4}


Simple indicator of observable {58fdee05cb962a13c5105476e8000c873061874aadbc5998887f0633c880296a}


Simple indicator of observable {73baa040cd6879d1d83c5afab29f61c3734136bffe03c72f520e025385f4e9a2}


Simple indicator of observable {17392d830935cfad96009107e8b034f952fb528f226a9428718669397bafd987}


Simple indicator of observable {78d93b13efd0caa66f5d91455028928c3b1f44d0f2222d9701685080e30e317d}


Simple indicator of observable {83c121db96d99f0d99b9e7a2384386f3f6debcb01d977c4ddca5bcdf2c6a2daa}


Simple indicator of observable {39323f9c0031250414cb4683662e1c533960dea8a54d7a700f77c6133a59c783}


Simple indicator of observable {84b245fce9e936f1d0e15d9fca8a1e4df47c983111de66fcc0ad012a63478c8d}


Simple indicator of observable {d961e9db4a96c87226dbc973658a14082324e95a4b30d4aae456a8abe38f5233}


Simple indicator of observable {84b2d16124b690d77c5c43c3a0d4ad78aaf10d38f88d9851de45d6073d8fcb65}


Simple indicator of observable {0091186459998ad5b699fdd54d57b1741af73838841c849c47f86601776b0b33}


Simple indicator of observable {85d3f81a362a3df9ba2f0a00dd12cd654e55692feffc58782be44f4c531d9bb9}


Simple indicator of observable {96e8b44ec061c49661bd192f279f7b7ba394d03495a2b46d3b37dcae0f4892f1}


Simple indicator of observable {6f7d7da247cac20d5978f1257fdd420679d0ce18fd8738bde02246129f93841b}


Simple indicator of observable {96ebacf48656b804aed9979c2c4b651bbb1bc19878b56bdf76954d6eff8ad7ca}


Simple indicator of observable {113c9e7760da82261d77426d9c41bc108866c45947111dbae5cd3093d69e0f1d}


Simple indicator of observable {149c3d044abc3c3a15ba1bb55db7e05cbf87008bd3d23d7dd4a3e31fcfd7af10}


Simple indicator of observable {307fc7ebde82f660950101ea7b57782209545af593d2c1115c89f328de917dbb}


Simple indicator of observable {356efe6b10911d7daaffed64278ba713ab51f7130d1c15f3ca86d17d65849fa5}


Simple indicator of observable {394ce0385276acc6f6c173a3dde6694881130278bfb646be94234cc7798fd9a9}


Simple indicator of observable {60e2fe4eb433d3f6d590e75b2a767755146aca7a9ba6fd387f336ccb3c5391f8}


Simple indicator of observable {396dce335b16111089a07ecb2d69827f258420685c2d9f3ea9e1deee4bff9561}


Simple indicator of observable {541eab9e348c40d510db914387068c6bfdf46a6ff84364fe63f6e114af8d79cf}


Simple indicator of observable {4e2a011922e0060f995bfde375d75060bed00175dc291653445357b29d1afc38}


Simple indicator of observable {745a3dcdda16b93fedac8d7eefd1df32a7255665b8e3ee71e1869dd5cd14d61c}


Simple indicator of observable {753f77134578d4b941b8d832e93314a71594551931270570140805675c6e9ad3}


Simple indicator of observable {863de84a39c9f741d8103db83b076695d0d10a7384e4e3ba319c05a6018d9737}


Simple indicator of observable {3a1e65d7e9c3c23c41cb1b7d1117be4355bebf0531c7473a77f957d99e6ad1d4}


Simple indicator of observable {902fa7049e255d5c40081f2aa168ac7b36b56041612150c3a5d2b6df707a3cff}


Simple indicator of observable {397c08f5cdc59085a48541c89d23a8880d41552031955c4ba38ff62e57cfd803}


Simple indicator of observable {927e04371fa8b8d8a1de58533053c305bb73a8df8765132a932efd579011c375}


Simple indicator of observable {2e0767958435dd4d218ba0bc99041cc9f12c9430a09bb1222ac9d1b7922c2632}


Simple indicator of observable {2043d7f2e000502f69977b334e81f307e2fda742bbc5b38745f6c1841757fddc}


Simple indicator of observable {02239cac2ff37e7f822fd4ee57ac909c9f541a93c27709e9728fef2000453afe}


Simple indicator of observable {4257bf17d15358c2f22e664b6112437b0c2304332ff0808095f1f47cf29fc1a2}


Simple indicator of observable {6558ac814046ecf3da8c69affea28ce93524f93488518d847e4f03b9327acb44}


Simple indicator of observable {8450ed10b4bef6f906ff45c66d1a4a74358d3ae857d3647e139fdaf0e3648c10}


Simple indicator of observable {9120f929938cd629471c7714c75d75d30daae1f2e9135239ea5619d77574c1fe}


Simple indicator of observable {647e992e24e18c14099b68083e9b04575164ed2b4f5069f33ff55f84ee97fff0}


Simple indicator of observable {28561f309d208e885a325c974a90b86741484ba5e466d59f01f660bed1693689}


Simple indicator of observable {30628bcb1db7252bf710c1d37f9718ac37a8e2081a2980bead4f21336d2444bc}


Simple indicator of observable {13f23b5db4a3d0331c438ca7d516d565a08cac83ae515a51a7ab4e6e76b051b1}


Simple indicator of observable {53121c9c5164d8680ae1b88d95018a553dff871d7b4d6e06bd69cbac047fe00f}


Simple indicator of observable {67136ab70c5e604c6817105b62b2ee8f8c5199a647242c0ddbf261064bb3ced3}


Simple indicator of observable {0aecd621b386126459b39518f157ee240866c6db1885780470d30a0ebf298e16}


Simple indicator of observable {79982f39ea0c13eeb93734b12f395090db2b65851968652cab5f6b0827b49005}


Simple indicator of observable {152455f9d970f900eb237e1fc2c29ac4c72616485b04e07c7e733b95b6afc4d8}


Simple indicator of observable {87269a95b1c0e724a1bfe87ddcb181eac402591581ee2d9b0f56dedbaac04ff8}


Simple indicator of observable {f3d42e4c1a47f0e1d3812d5f912487d04662152c17c7aa63e836bef01a1a4866}


Simple indicator of observable {89196b39a0edebdf2026053cb4e87d703b9942487196ff9054ef775fdcad1899}


Simple indicator of observable {91446c6d3c11074e6ff0ff42df825f9ffd5f852c2e6532d4b9d8de340fa32fb8}


Simple indicator of observable {96823bb6befe5899739bd69ab00a6b4ae1256fd586159968301a4a69d675a5ec}


Simple indicator of observable {3b3bdd819f4ee8daa61f07fc9197b2b39d0434206be757679c993b11acc8d05f}


Simple indicator of observable {315217b860ab46c6205b36e49dfaa927545b90037373279723c3dec165dfaf11}


Simple indicator of observable {427481ab85a0c4e03d1431a417ceab66919c3e704d7e017b355d8d64be2ccf41}


Simple indicator of observable {595153eb56030c0e466cda0becb1dc9560e38601c1e0803c46e7dfc53d1d2892}


Simple indicator of observable {812263ea9c6c44ef6b4d3950c5a316f765b62404391ddb6482bdc9a23d6cc4a6}


Simple indicator of observable {1358156c01b035f474ed12408a9e6a77fe01af8df70c08995393cbb7d1e1f8a6}


Simple indicator of observable {b916749963bb08b15de7c302521fd0ffec1c6660ba616628997475ae944e86a3}


Simple indicator of observable {73162738fb3b9cdd3414609d3fe930184cdd3223d9c0d7cb56e4635eb4b2ab67}


Simple indicator of observable {343728792ed1e40173f1e9c5f3af894feacd470a9cdc72e4f62c0dc9cbf63fc1}


Simple indicator of observable {384408659efa1f87801aa494d912047c26259cd29b08de990058e6b45619d91a}


Simple indicator of observable {824914bb34ca55a10f902d4ad2ec931980f5607efcb3ea1e86847689e2957210}


Simple indicator of observable {49925637250438b05d3aebaac70bb180a0825ec4272fbe74c6fecb5e085bcf10}


Simple indicator of observable {danagroupegypt.com}


Simple indicator of observable {92.118.112.100}


Simple indicator of observable {shchiswear.com}


Simple indicator of observable {104.238.60.11}


Simple indicator of observable {futuretechfarm.com}


Simple indicator of observable {149.154.158.243}


Simple indicator of observable {sms-atc.com}


Simple indicator of observable {104.243.33.161}


Simple indicator of observable {makethumbmoney.com}


Simple indicator of observable {104.243.33.129}


Simple indicator of observable {vectorsandarrows.com}


Simple indicator of observable {138.124.180.241}


Simple indicator of observable {pacatman.com}


Simple indicator of observable {94.131.101.58}


Simple indicator of observable {personmetal.com}


Simple indicator of observable {185.174.101.53}


Simple indicator of observable {aviditycellars.com}


Simple indicator of observable {185.45.195.30}


Simple indicator of observable {bureaudecreationalienor.com}


Simple indicator of observable {185.250.151.145}


Simple indicator of observable {bitscoinc.com}


Simple indicator of observable {23.227.194.115}


Simple indicator of observable {boxofficeseer.com}


Simple indicator of observable {88.119.175.140}


Simple indicator of observable {thesheenterprise.com}


Simple indicator of observable {88.119.175.137}


Simple indicator of observable {remontisto.com}


Simple indicator of observable {37.1.214.162}


Simple indicator of observable {visioquote.com}


Simple indicator of observable {88.119.175.104}


Simple indicator of observable {cannabishang.com}


Simple indicator of observable {45.66.248.13}


Simple indicator of observable {turanmetal.com}


Simple indicator of observable {92.118.112.8}


Simple indicator of observable {lucasdoors.com}


Simple indicator of observable {37.1.211.150}


Simple indicator of observable {displaymercials.com}


Simple indicator of observable {185.72.8.219}


Simple indicator of observable {digtupu.com}


Simple indicator of observable {82.117.253.168}


Simple indicator of observable {avblokhutten.com}


Simple indicator of observable {104.238.60.112}


Simple indicator of observable {hom4u.com}


Simple indicator of observable {173.44.141.34}


Simple indicator of observable {rosevalleylimousine.com}


Simple indicator of observable {170.130.165.140}


Simple indicator of observable {boezgrt.com}


Simple indicator of observable {5.8.63.79}


Simple indicator of observable {hatchdesignsnh.com}


Simple indicator of observable {162.248.224.56}


Simple indicator of observable {formulaautoparts.com}


Simple indicator of observable {185.174.101.13}


Simple indicator of observable {ivermectinorder.com}


Simple indicator of observable {23.152.0.193}


Simple indicator of observable {szdeas.com}


Simple indicator of observable {192.169.6.200}


Simple indicator of observable {licencesolutions.com}


Simple indicator of observable {194.87.32.85}


Simple indicator of observable {motorrungoli.com}


Simple indicator of observable {185.45.195.205}


Simple indicator of observable {2683ad74bb37bceec19abc557d2aa7fb}


C2 Server


MoonWalk backdoor (related to DodgeBox loader with d72f202c1d684c9a19f075290a60920f)


Utility plugin


C2 plugin


MoonWalk backdoor (related to DodgeBox loader with 393065ef9754e3f39b24b2d1051eab61)


Simple indicator of observable {45.90.89.50}


Simple indicator of observable {76.76.21.22}


Simple indicator of observable {76.76.21.93}


Simple indicator of observable {76.76.21.164}


Simple indicator of observable {178.237.33.50}


Simple indicator of observable {192.3.176.174}


Simple indicator of observable {http://geoplugin.net/json.gp}


Simple indicator of observable {https://slug.vercel.app/wyiqkf}


Simple indicator of observable {https://host.colocrossing.com}


Simple indicator of observable {http://45.90.89.50/100/JNN.txt}


Simple indicator of observable {http://45.90.89.50/xampp/ien/INET.hta}


Simple indicator of observable {http://servidorwindows.ddns.com.br/Files/vbs.jpeg}


Simple indicator of observable {http://45.90.89.50/100/instantflowercaseneedbeautygirlsherealways.gIF}


vbs.jpeg


instantflowercaseneedbeautygirlsherealways[1].gz


JNN.txt


Remcos


Simple indicator of observable {https://karmelinanoonethousandbaby.net/YzI4MGFhZjI2MmM5/}


Simple indicator of observable {https://185.198.69.111/NTBiZmM4ZDQ2MWY2/}


Simple indicator of observable {https://2.57.149.150/ZTIwNDEzZjM4YjYw/}


Simple indicator of observable {https://2istanbullu2586.xyz/ZTIwNDEzZjM4YjYw/}


Simple indicator of observable {https://83.97.73.195/MzZhMGJjZTJkOGI3/}


Simple indicator of observable {https://o3c31x4fqdw2.lt/MTU2OWE0NzJjNGY5/}


Simple indicator of observable {https://0n75w55jyk66.pw/MTU2OWE0NzJjNGY5/}


Simple indicator of observable {https://91.240.118.224/NjQyNDcyMjE3ZWU3/}


Simple indicator of observable {https://sanagerekkalmaz1453.shop/MTFiMzQ4NGQ2MWU4/}


Simple indicator of observable {https://185.122.204.122/MDViMDU3NDYwMTBm/}


MD5s / Metasploit Stager (meteran.exe)


MD5s / PrintSpoofer (PrintSpoofer.exe)


MD5s / PrintSpoofer (ps.exe)


Simple indicator of observable {34.124.148.215}


Download


Simple indicator of observable {02s.co}


Simple indicator of observable {06g.co}


Simple indicator of observable {09a.co}


Simple indicator of observable {2-gis.kz}


Simple indicator of observable {astanapark.com}


Simple indicator of observable {beroxe.com}


Simple indicator of observable {buildneeds.net}


Simple indicator of observable {bw-guardian.com}


Simple indicator of observable {cabinet-salyk.kz}


Simple indicator of observable {centent-management.net}


Simple indicator of observable {clazc.com}


Simple indicator of observable {coazoa.com}


Simple indicator of observable {copy-note.net}


Simple indicator of observable {corporatebusinesssolution.net}


Simple indicator of observable {dzhabarzan.com}


Simple indicator of observable {e-kgd.kz}


Simple indicator of observable {ehudaldaa.com}


Simple indicator of observable {escortbabesluxo.com}


Simple indicator of observable {eventnews.live}


Simple indicator of observable {fast-notify.com}


Simple indicator of observable {fastnews.biz}


Simple indicator of observable {fr-monde.com}


Simple indicator of observable {gabzmus.com}


Simple indicator of observable {get-location.com}


Simple indicator of observable {get-location.net}


Simple indicator of observable {highclub.life}


Simple indicator of observable {informationrank.net}


Simple indicator of observable {jumia-egy.com}


Simple indicator of observable {kapital-news.com}


Simple indicator of observable {kejoranews.net}


Simple indicator of observable {kollesa.com}


Simple indicator of observable {krisha-kz.com}


Simple indicator of observable {kroal.com}


Simple indicator of observable {ladiesclubhouse.com}


Simple indicator of observable {lusofonia-mundo.com}


Simple indicator of observable {magnum-kz.com}


Simple indicator of observable {mastershop.biz}


Simple indicator of observable {mb-ph.net}


Simple indicator of observable {mmegi.co}


Simple indicator of observable {msbsck.com}


Simple indicator of observable {mujmbosnoticias.com}


Simple indicator of observable {mundodenoticias.online}


Simple indicator of observable {myfawry.net}


Simple indicator of observable {nospam.kz}


Simple indicator of observable {notify-service.biz}


Simple indicator of observable {nur-news.com}


Simple indicator of observable {olimpbets.kz}


Simple indicator of observable {ongsworld.com}


Simple indicator of observable {pelovkin.com}


Simple indicator of observable {people-beeline.com}


Simple indicator of observable {plastictoysworld.com}


Simple indicator of observable {plinkypong.com}


Simple indicator of observable {post-notify.info}


Simple indicator of observable {qazsporttv.com}


Simple indicator of observable {rcuples.com}


Simple indicator of observable {rozavetrovv.com}


Simple indicator of observable {schedulefestival.com}


Simple indicator of observable {shoxtek.com}


Simple indicator of observable {soccer-bw.com}


Simple indicator of observable {spacsaver.info}


Simple indicator of observable {sportnow.news}


Simple indicator of observable {suarapapua.co}


Simple indicator of observable {sustanbuild.com}


Simple indicator of observable {thintank.co}


Simple indicator of observable {tickets-kz.com}


Simple indicator of observable {tobupmi.com}


Simple indicator of observable {tohna.net}


Simple indicator of observable {ulstur.co}


Simple indicator of observable {vendaswebs.com}


Simple indicator of observable {vestinfo.net}


Simple indicator of observable {vestinfo.org}


Simple indicator of observable {vestinfos.net}


Simple indicator of observable {vinho-online.com}


Simple indicator of observable {vlast-news.com}


Simple indicator of observable {walatparez.com}


Simple indicator of observable {weekendcool.com}


Simple indicator of observable {yo-um7.com}


Simple indicator of observable {zakorn.com}


Simple indicator of observable {zikolo.net}


Simple indicator of observable {ztb-news.com}


Simple indicator of observable {2.58.15.58}


Simple indicator of observable {5.39.221.36}


Simple indicator of observable {5.39.221.47}


Simple indicator of observable {5.39.221.48}


Simple indicator of observable {5.255.88.172}


Simple indicator of observable {23.137.248.95}


Simple indicator of observable {37.120.222.115}


Simple indicator of observable {45.129.0.125}


Simple indicator of observable {45.148.244.5}


Simple indicator of observable {45.86.163.77}


Simple indicator of observable {45.86.163.93}


Simple indicator of observable {46.246.97.245}


Simple indicator of observable {46.249.49.230}


Simple indicator of observable {46.30.190.98}


Simple indicator of observable {79.110.52.179}


Simple indicator of observable {79.110.52.196}


Simple indicator of observable {79.137.199.216}


Simple indicator of observable {79.141.175.146}


Simple indicator of observable {84.247.51.14}


Simple indicator of observable {84.247.51.18}


Simple indicator of observable {85.17.9.21}


Simple indicator of observable {85.17.9.73}


Simple indicator of observable {85.17.9.74}


Simple indicator of observable {85.239.34.174}


Simple indicator of observable {87.121.45.29}


Simple indicator of observable {87.121.45.42}


Simple indicator of observable {87.121.45.45}


Simple indicator of observable {88.119.161.135}


Simple indicator of observable {91.241.93.165}


Simple indicator of observable {95.141.34.222}


Simple indicator of observable {98.142.254.112}


Simple indicator of observable {101.99.75.197}


Simple indicator of observable {141.94.122.19}


Simple indicator of observable {146.70.158.144}


Simple indicator of observable {146.70.161.50}


Simple indicator of observable {158.58.172.3}


Simple indicator of observable {164.215.103.143}


Simple indicator of observable {164.215.103.20}


Simple indicator of observable {169.239.128.137}


Simple indicator of observable {169.239.129.48}


Simple indicator of observable {169.239.129.63}


Simple indicator of observable {169.239.129.76}


Simple indicator of observable {169.255.59.98}


Simple indicator of observable {176.124.198.52}


Simple indicator of observable {176.124.198.55}


Simple indicator of observable {185.113.8.67}


Simple indicator of observable {185.113.8.83}


Simple indicator of observable {185.117.91.165}


Simple indicator of observable {185.117.91.237}


Simple indicator of observable {185.130.227.29}


Simple indicator of observable {185.130.227.88}


Simple indicator of observable {185.130.227.95}


Simple indicator of observable {185.130.45.34}


Simple indicator of observable {185.130.46.165}


Simple indicator of observable {185.130.46.202}


Simple indicator of observable {185.156.172.17}


Simple indicator of observable {185.156.172.20}


Simple indicator of observable {185.156.172.48}


Simple indicator of observable {185.158.248.131}


Simple indicator of observable {185.158.248.85}


Simple indicator of observable {185.196.9.76}


Simple indicator of observable {185.212.47.75}


Simple indicator of observable {185.219.220.99}


Simple indicator of observable {185.219.221.30}


Simple indicator of observable {185.62.58.107}


Simple indicator of observable {185.66.140.112}


Simple indicator of observable {192.46.237.163}


Simple indicator of observable {193.168.143.111}


Simple indicator of observable {193.168.143.116}


Simple indicator of observable {193.168.143.184}


Simple indicator of observable {193.168.143.185}


Simple indicator of observable {193.233.161.137}


Simple indicator of observable {193.233.161.163}


Simple indicator of observable {193.29.104.13}


Simple indicator of observable {193.29.104.5}


Simple indicator of observable {193.29.104.83}


Simple indicator of observable {193.29.59.171}


Simple indicator of observable {193.42.36.106}


Simple indicator of observable {193.42.36.84}


Simple indicator of observable {212.237.217.127}


Simple indicator of observable {213.252.246.152}


kit


Retrieval of the internal and transport configurations


Processing of an operator's commands


Monitoring of the file system


Protocol for communication between GoRed and its C2


Connecting to a data exfiltration server


Collecting system information


Various auxiliary utilities


Data packing


Proxy mode operation


Reverse shell mode operation


DNS tunneling implementation


ICMP tunneling implementation


Simple indicator of observable {67b7a8fad28dcc40c0889e5c4e40aef9348441c64bba74bd6db885d88ce6d246}


Simple indicator of observable {f43c99ef85166774ed47cad96c70b8273aa82c313e55bb08d9c74e2b3f59b000}


Simple indicator of observable {f91c9fd27bf0e3a7e82998721946ee70735ec46ee672ca80e3062aa2d5195447}


Simple indicator of observable {be246cdf932aa5b1c2ada0d74c8d1eca4028538b28fb61d7a8d930b4266fd55c}


Simple indicator of observable {ec36fcd64432843292d16f601a758ba4091ada906c5c4c4e540e326676911141}


Simple indicator of observable {41d35016c78f86eee8972808c7de8c200ff24625639adff5b9d0ab8773fff6b4}


Simple indicator of observable {aca34d7c3832879f6f7ebe8f7c59160896909574c94d1d12d7c71b6f7918bc50}


Simple indicator of observable {8d055f3ad4d01f601df24a7c20ded981005adef7e6d26750415d1f95a471c2e3}


Simple indicator of observable {17e57c5e71b99a386b18728eac4a27e83415756071c9e85859940da41e94976b}


Simple indicator of observable {32d76f2fe1188a131cb3219356639e83c60d47a703e40b8801a364d98e37128f}


Simple indicator of observable {f3bb44d52e43477ce43c91eb8d9830e356fc105b96377edd6b190fcccda61e2f}


Simple indicator of observable {ab801eaa9ad11199e1382a124d6024f9551a5a33ca1b9e5cafc0098621abb91f}


Simple indicator of observable {e2b2ebe1b82d1c122dc2750f318f2484fe5361fcd964bfdcdcae631cf32f8d37}


Simple indicator of observable {4561a38ff34cc71cc73d54e2adfbd378f58d54596b012ff1841fdd7fc42063c3}


Simple indicator of observable {f56b7fbc5dda7e46aff1b7753a1edb1f6fad5c8953dd3dbff30b3d8675b1dbd3}


Simple indicator of observable {9bad8f88be8f143e37616556b9331af69a806281019b8a336ee6e14cd04b3c0e}


Simple indicator of observable {5a3a44d5482bb9b632d0a9da47e5ae7d27cd397ca08d764bdf1ed636565ef5e7}


Simple indicator of observable {8c545687a21481969ea4299e997cfc527a16503d042c2116801ee08f14ec6595}


Simple indicator of observable {f6e8220dbf407300fbc78d823004de5d0c4d2816218b8e2b5f8993e97f1e6a32}


Simple indicator of observable {017e03f9185e24c30de6b94bd6a36d48788d0b72134235e3f3dd1322dca426c9}


Simple indicator of observable {9ec7495bb6d3a7d3bfd5d5ae9e704d0f42f3136166652a5576f15d0379126d75}


Simple indicator of observable {7d2ae888fd06b811f6ba880c1fec3f37d49d50e0716de1b28f978240abe7795e}


Simple indicator of observable {0ac2f15f3a36e67b8e03f69685193480edf3e3b10fc69ccbec76d3d5878c708c}


Simple indicator of observable {f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1}


Simple indicator of observable {c287956c4eb683e1ee62bc9ddb739d3d1c9c5dad7a73be3977bc53468665c7f7}


Simple indicator of observable {37affeab7fb06a052413e9cc9272ea9cb2fd160fd204b506620d4303b06298c4}


Simple indicator of observable {6262558adf132ae3c67d6f241c7abd62f987ce2881d459a66332234971e49e95}


Simple indicator of observable {c738d594d09c651109c4422acbecad23a461bab6cd4eafc41546f036816533a0}


Simple indicator of observable {c0cd580d83f4171b34b956d0c29dbc8fcafba8889594d85d471c14d7cf33be79}


Simple indicator of observable {22ab2abda59edc1b6ba733fc140ab0c6b0c503b726a377a2e2ee6e6c95644aae}


Simple indicator of observable {211a73ab3fb49957277a2efb50ad3140673b65df577961a58c3c9c90791e961e}


Simple indicator of observable {1b96adc3c129e7e41f7c67f0d56dc05d6cdee31f69ff85f27e6a90270cfefdcf}


Simple indicator of observable {bc159721bbe192f9c5cd24d3e9356a28f5b0c6b182de9fecf0b0ac28035f566a}


Simple indicator of observable {1807c7a44da958f15e4dcb77cab78e92eeb96b3ace91d6923c2022d646d5593c}


Simple indicator of observable {a5e61987676b7aed2c6d6d32c657f9351c2daa7c36365db20713dd42a03b1504}


Simple indicator of observable {86bd9caab7526f2cd7e468d692ee2bac571465d25eb0619a10b0b46ae9a5b8e2}


Simple indicator of observable {91136b3145a52b66a3f5edd7d8a8d06698666300f24861074df1308491f50ba5}


Simple indicator of observable {895988088f25c89295f1a17f222a4553eafb2137b115f2ad4a0a25d273eb6521}


Simple indicator of observable {a6dfef8616959969c06b65685e39929630f2819e6d5920498cdb1e89185ab7cd}


Simple indicator of observable {20927a1fc3441668264673d77c81652818a630f3b2055545b0e0938c523827c3}


Simple indicator of observable {a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd}


Simple indicator of observable {7e8bde3e34fbf9b99b7915e12de42f6b806153e44b6aaf68b172db50e18e3b9e}


Simple indicator of observable {ac0906ff674c555e102f076100d0c12ea4a4aa7d74cc15f67c4038a84100f4cf}


Simple indicator of observable {8fe0ba1cb68225ab9a2cb11c1419f52adb03898c5f11d2221ba9765843443d24}


Simple indicator of observable {pkg.collect.net.in}


Simple indicator of observable {leo.rpm-bin.link}


Simple indicator of observable {lib.rest}


Simple indicator of observable {45.146.7.26}


Simple indicator of observable {rosm.pro}


Simple indicator of observable {193.37.71.75}


Simple indicator of observable {sula.rpm-bin.link}


Simple indicator of observable {45.146.7.16}


Simple indicator of observable {get.upd-rkn.net}


Simple indicator of observable {rls.upd-rkn.net}


Simple indicator of observable {94.131.113.95}


Simple indicator of observable {mtp.upd-rk.net}


Simple indicator of observable {get.upd-rk.net}


Simple indicator of observable {src.setup.mom}


Simple indicator of observable {45.147.200.165}


Simple indicator of observable {wired.setup.mom}


Simple indicator of observable {188.127.225.231}


Simple indicator of observable {get.rpm-bin.link}


Simple indicator of observable {75.119.130.76}


Simple indicator of observable {135.125.107.221}


Simple indicator of observable {45.87.247.239}


Simple indicator of observable {ci.upd-rkn.net}


Simple indicator of observable {base.upd-rkn.net}


Simple indicator of observable {mtp.upd-rkn.net}


Simple indicator of observable {bot.upd-rkn.net}


Simple indicator of observable {narwhal.rpm-bin.link}


Simple indicator of observable {unicorn.rpm-bin.link}


Simple indicator of observable {ci.rpm-bin.link}


Simple indicator of observable {ops.rpm-bin.link}


Simple indicator of observable {lib.rpm-bin.link}


Simple indicator of observable {rhl.rpm-bin.link}


Simple indicator of observable {source.rpm-bin.link}


Simple indicator of observable {chifa.rpm-bin.link}


Simple indicator of observable {get.setup.mom}


Simple indicator of observable {trust.setup.mom}


Simple indicator of observable {d5a8b6635240cc190bc869a2a41bc437a48bfbfcce0d218b879d9768d85d1d6f}


Simple indicator of observable {f1f6bb1bdf41217d26ec33e00e1e52fbc479e636b5d43671736905210fc4d734}


Simple indicator of observable {a5a0bee3304c77bdb5b6dcc4edafbfc941cdc0b5153e3d82e2689150e83b1329}


Simple indicator of observable {6b13519a3aea8747400932191048d5dab7daccb3fd45a3f5e0ffd34c32aed35d}


Simple indicator of observable {d465f6da893f2f76cdfb7089c3b9292d09a201e7d0faefb0f88a8b8ba5fd3fba}


Simple indicator of observable {dd657a7a3688d039f0a208f39b1128ec447689ee664c6695d5c7e384dcdc1014}


Simple indicator of observable {e15ee2e8ed2c3f37c1b47bf67e81aa2e89b0ce7b3159918a32da2e30420e6819}


Simple indicator of observable {info.gtjas.site}


Simple indicator of observable {fc6847a8b62af02c2d1eff1d77f7d8b90cbd34654aff38c671d86194d351cd6e}


Simple indicator of observable {4c750b8471bfec0ed2dcf1a856163601fc140eb892710b8415d505a9088bd7f3}


Simple indicator of observable {http://123.60.168.69:443/jquery-3.3.2.slim.min.js}


Simple indicator of observable {f7cc627464981b8918347487bdc73c2026b645fd31a1fbab4d5fcc03cbe88901}


Simple indicator of observable {256357877ae60db9ad247aef686aa3aaecb7de0fdb84ed35ea91b28be9725e36}


Simple indicator of observable {7ee465b6132819063b741d7f60246a539a1624e0667098bb162e22de0d06cf2e}


Indicators of Compromise (IoCs) for FrostyGoop AKA BUSTLEBERM


Simple indicator of observable {https://hsdiagnostico.com/readme.php}


Simple indicator of observable {https://core-click.net/TVFrontend/NSM.zip}


Simple indicator of observable {https://core-click.net/TVFrontend/remcmdstub.zip}


Simple indicator of observable {https://core-click.net/TVFrontend/DLAA1view.zip}


Simple indicator of observable {https://core-click.net/TVFrontend/mock/}


Simple indicator of observable {helasirasi.com}


Simple indicator of observable {geo.netsupportsoftware.com}


Simple indicator of observable {hsdiagnostico.com}


Simple indicator of observable {core-click.net}