| domain | campanha1-api[.]ef971a42[.]workers[.]dev | 1 | 2026-05-14 |
| domain | doccompartilhe[.]com | 1 | 2026-05-14 |
| domain | documentos-online[.]com | 1 | 2026-05-14 |
| url | hxxps://campanha1-api[.]ef971a42[.]workers[.]dev/api/campaign | 1 | 2026-05-14 |
| url | hxxps://campanha1-api[.]ef971a42[.]workers[.]dev/api/control | 1 | 2026-05-14 |
| url | hxxps://campanha1-api[.]ef971a42[.]workers[.]dev/api/installs | 1 | 2026-05-14 |
| url | hxxps://campanha1-api[.]ef971a42[.]workers[.]dev/api/progress | 1 | 2026-05-14 |
| url | hxxps://documents[.]ef971a42[.]workers[.]dev/api/update | 1 | 2026-05-14 |
| url | hxxps://documents[.]ef971a42[.]workers[.]dev/api/version | 1 | 2026-05-14 |
| url | hxxps://documents[.]ef971a42[.]workers[.]dev/file | 1 | 2026-05-14 |
| domain | recebamais[.]com | 1 | 2026-05-14 |
| domain | saogeraldoshiping[.]com | 1 | 2026-05-14 |
| url | hxxp://filev2[.]getsession[.]org/file/ | 1 | 2026-05-14 |
| sha256 | 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96 | 1 | 2026-05-14 |
| sha1 | 12ed9a3c1f73617aefdb740480695c04405d7b4b | 1 | 2026-05-14 |
| md5 | 833fd59ebe66a4449982c6d18db656b4 | 1 | 2026-05-14 |
| md5 | b82e54923f7e440664d2d75bd31588ca | 1 | 2026-05-14 |
| sha1 | e7d582b98ca80690883175470e96f703ef6dc497 | 1 | 2026-05-14 |
| domain | filev2[.]getsession[.]org | 1 | 2026-05-14 |
| url | hxxps://git-tanstack[.]com/transformers[.]pyz | 1 | 2026-05-14 |
| url | hxxps://npms[.]io/search?q=ponyfill | 1 | 2026-05-14 |
| sha256 | ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c | 1 | 2026-05-14 |
| domain | sfrclak[.]com | 2 | 2026-05-14 |
| filename | site-packages/litellm_init.pth | 1 | 2026-05-14 |
| url | hxxp://194[.]76[.]226[.]93:8080/iost/income_shit | 1 | 2026-05-14 |
| url | hxxps://github[.]com/latestver/vpn/releases/download/vpn-client2/VPN-CLIENT.zip | 1 | 2026-05-14 |
| domain | ivanti-vpn[.]org | 1 | 2026-05-14 |
| domain | vpn-fortinet[.]com | 1 | 2026-05-14 |
| domain | RAMP4U[.]io | 1 | 2026-05-14 |
| url | hxxp://vectordnticrtmfkcm4alni734tbcrmd5[.][.][.]sp4lqal6noqrgnbyd[.]onion/ | 1 | 2026-05-14 |
| url | hxxps://s3[.]ap-southeast-2[.]wasabisys[.]com/[.][.][.]aders=host | 1 | 2026-05-14 |
| url | hxxp://xpod6h3ngodwb6fhbpaunfr5hmngzlb77[.][.][.]nyid[.]onion | 1 | 2026-05-14 |
| url | hxxps://github[.]com/advisories/GHSA-gpvc-mx6g-cchv | 1 | 2026-05-14 |
| sha256 | 7f1d71e1e079f3244a69205588d504ed830d4c473747bb1b5c520634cc5a2477 | 1 | 2026-05-14 |
| sha256 | c8940de8cb917abe158a826a1d08f1083af517351d01642e6c7f324d0bba1eb8 | 1 | 2026-05-14 |
| sha256 | 2fa987b9ed6ec6d09c7451abd994249dfaba1c5a7da1c22b8407c461e62f7e49 | 1 | 2026-05-14 |
| domain | cloudfront-021[.]s3[.]us-west-2[.]amazonaws[.]com | 1 | 2026-05-14 |
| url | hxxps://service-page-25144-30466-outlook[.]s3[.]us-west-2[.]amazonaws[.]com/update.html?email=<redacted>.com | 1 | 2026-05-14 |
| url | wss://sad4w7h913-b4a57f9c36eb[.]herokuapp[.]com/ws | 1 | 2026-05-14 |
| sha256 | 3dbf64da37616acbe16bc6bd06a320fed416c4c8ec37a04f811a32389af3d46c | 1 | 2026-05-14 |
| sha256 | 4f1628821c13cc27fd4134301cc93a1ad32b2a3f7066c3d90f7ba89e02180754 | 1 | 2026-05-14 |
| sha256 | 81d1a62c00724c1dfbc05a79ac4ae921c459350a2a4a93366c0842fadc40b011 | 1 | 2026-05-14 |
| domain | api[.]desco-gov-bd[.]workers[.]dev | 1 | 2026-05-14 |
| domain | www[.]gov-pk[.]workers[.]dev | 1 | 2026-05-14 |
| registry_key | HKCU:\Software\Microsoft\Windows\CurrentVersion\Run:AppClient | 1 | 2026-05-14 |
| md5 | 039e93b98ef5e329f8666a424237ae73 | 1 | 2026-05-14 |
| ip | 108[.]187[.]37[.]85 | 1 | 2026-05-14 |
| ip | 108[.]187[.]41[.]221 | 1 | 2026-05-14 |
| ip | 108[.]187[.]42[.]63 | 1 | 2026-05-14 |
| md5 | 13669b8f2bd0af53a3fe9ac0490499e5 | 1 | 2026-05-14 |
