| url | hxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]dev/download | 1 | 2026-05-14 |
| filename | sysv.jsp | 1 | 2026-05-14 |
| sha256 | 436cfce71290c2fc2f2c362541db68ced6847c66a73b55487e5e5c73b0636c85 | 1 | 2026-05-14 |
| sha256 | 69908f05b436bd97baae56296bf9b9e734486516f9bb9938c2b8752e152315d4 | 1 | 2026-05-14 |
| sha256 | 6eb31006ca318a21eb619d008226f08e287f753aec9042269203290462eaa00d | 1 | 2026-05-14 |
| sha256 | c1f278f88275e07cc03bd390fe1cbeedd55933110c6fd16de4187f4c4aaf42b9 | 1 | 2026-05-14 |
| cve | CVE-2026-41702 | 1 | 2026-05-14 |
| cve | CVE-2026-8053 | 1 | 2026-05-14 |
| ip | 161[.]97[.]129[.]25 | 1 | 2026-05-14 |
| ip | 161[.]97[.]135[.]154 | 1 | 2026-05-14 |
| ip | 161[.]97[.]163[.]87 | 1 | 2026-05-14 |
| ip | 161[.]97[.]186[.]175 | 1 | 2026-05-14 |
| ip | 161[.]97[.]187[.]42 | 1 | 2026-05-14 |
| ip | 193[.]187[.]129[.]143 | 1 | 2026-05-14 |
| ip | 213[.]136[.]80[.]73 | 1 | 2026-05-14 |
| ip | 38[.]242[.]204[.]245 | 1 | 2026-05-14 |
| ip | 38[.]242[.]237[.]196 | 1 | 2026-05-14 |
| ip | 38[.]242[.]245[.]147 | 1 | 2026-05-14 |
| ip | 83[.]171[.]249[.]231 | 1 | 2026-05-14 |
| domain | cdn[.]cloudfront-js[.]com | 1 | 2026-05-14 |
| url | hxxps://cdn[.]cloudfront-js[.]com:8443/u | 1 | 2026-05-14 |
| url | hxxps://spm-cdn-assets-dist-2026[.]s3[.]us-east-2[.]amazonaws[.]com | 1 | 2026-05-14 |
| domain | lastpass-login-help[.]com | 1 | 2026-05-14 |
| filename | /var/lib/.spm/monitor.py | 1 | 2026-05-14 |
| filename | /var/tmp/apt-daily-upgrade | 1 | 2026-05-14 |
| domain | baidu[.]com | 1 | 2026-05-14 |
| url | /api/cached-asset?url=hxxp://baidu.com/ | 1 | 2026-05-14 |
| domain | storage[.]googleapis[.]com | 1 | 2026-05-14 |
| registry_key | HKEY_CURRENT_USER\Software\Remcos-{ID} | 1 | 2026-05-14 |
| url | hxxps://storage[[.]]googleapis[[.]]com/com-bid/GoogleDrive[.]html | 1 | 2026-05-14 |
| sha256 | d422f6f5310af1e72f6113a2a592916f58e3871c58d0e46f058d4b669a3a0fd8 | 1 | 2026-05-14 |
| sha256 | 45b6b4db1be6698c29ffde9daeb8ffaa344b687d3badded2f8c68c922cdce6e0 | 1 | 2026-05-14 |
| domain | smartvault[.]im | 1 | 2026-05-14 |
| domain | irs-doc[.]com | 1 | 2026-05-14 |
| domain | tax-statments2025[.]com | 1 | 2026-05-14 |
| domain | taxationstatments2025[.]com | 1 | 2026-05-14 |
| ip | 90[.]156[.]215[.]111 | 1 | 2026-05-14 |
| domain | *a*o*[.]com | 1 | 2026-05-14 |
| domain | best-shop43[.]com | 1 | 2026-05-14 |
| domain | *h*t*[.]com | 1 | 2026-05-14 |
| domain | *i*s*[.]com | 1 | 2026-05-14 |
| domain | *n*p*[.]xyz | 1 | 2026-05-14 |
| domain | *n*s*[.]com | 1 | 2026-05-14 |
| domain | *o*r*[.]com | 1 | 2026-05-14 |
| domain | *o*t*[.]com | 1 | 2026-05-14 |
| domain | *w*a*[.]com | 1 | 2026-05-14 |
| domain | rti[.]cargomanbd[.]com | 1 | 2026-05-14 |
| url | hxxps://snippet[[.]]host/efguhk/raw | 1 | 2026-05-14 |
| url | hxxps://pastebin[[.]]com/raw/mcwWi1Ue | 1 | 2026-05-14 |
| url | github[.]com/leaked-claude-code/leaked-claude-code | 1 | 2026-05-14 |
