| url | hxxp://62[.]60[.]178[.]163/ce369e7324834845.php | 1 | 2026-05-13 |
| domain | investarmco[.]com | 1 | 2026-05-13 |
| domain | meetdatefind[.]com | 1 | 2026-05-13 |
| filename | amd_mem_encrypt.ko | 1 | 2026-05-13 |
| filename | hide_ss.bpf.o | 1 | 2026-05-13 |
| filename | vl_stealth.ko | 1 | 2026-05-13 |
| domain | assetsbundle[.]com | 1 | 2026-05-13 |
| domain | bundlefeedback[.]com | 1 | 2026-05-13 |
| domain | jquerybootstrap[.]com | 1 | 2026-05-13 |
| domain | newassetspro[.]com | 1 | 2026-05-13 |
| domain | redsysgate[.]com | 1 | 2026-05-13 |
| url | hxxps://t[.]me/team_pcp | 1 | 2026-05-13 |
| url | hxxps://gist[.]github[.]com/pitybugak/5d16b75e8bd071e15b04cc9c06dcfafa.js | 1 | 2026-05-13 |
| domain | pitybux[.]com | 1 | 2026-05-13 |
| url | h=gPath%5B%60 | 1 | 2026-05-13 |
| filename | /mi/tomcat/webapps/mifs/403.jsp | 1 | 2026-05-13 |
| url | =theValue%20%20 | 1 | 2026-05-13 |
| domain | alababababa[.]cloud | 1 | 2026-05-13 |
| domain | gologpoint[.]com | 1 | 2026-05-13 |
| domain | nobovcs[.]com | 1 | 2026-05-13 |
| domain | octopox[.]com | 1 | 2026-05-13 |
| sha256 | 0e7802eeaca406ead3740d2eeacbb786b75e026212ec0c65e0f2f89561940d2b | 1 | 2026-05-13 |
| url | 1395054734787743834 | 1 | 2026-05-13 |
| filename | %SystemRoot%\System32\drivers\BlueSkyInject.dat | 1 | 2026-05-13 |
| filename | /usr/local/bin/.deepseek_* | 1 | 2026-05-13 |
| domain | caBLE[.]ua5v[.]com | 1 | 2026-05-13 |
| domain | enclave[.]ua5v[.]com | 1 | 2026-05-13 |
| filename | %LocalAppData%\Google\Chrome\User Data\<Profile>\passkey_enclave_state | 1 | 2026-05-13 |
| filename | %LocalAppData%\Google\Chrome\User Data\<Profile>\Sync Data\LevelDB | 1 | 2026-05-13 |
| url | wss://enclave[.]ua5v[.]com/enclave | 1 | 2026-05-13 |
| sha256 | 18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a | 1 | 2026-05-13 |
| domain | scan[[.]]aquasecurtiy[[.]]org | 1 | 2026-05-13 |
| filename | /tmp/krb5cc_* | 1 | 2026-05-13 |
| sha256 | 3111f4d7d4fac55103453c4c8adb742def007b96b7c8ed265347df97137fbee0 | 1 | 2026-05-13 |
| sha256 | 6a6aaeed4a6bbe82a08d197f5d40c2592a461175f181e0440e0ff45d5fb60939 | 1 | 2026-05-13 |
| filename | C:\ProgramData\OEM\Firmware\OemHwUpd.sys | 1 | 2026-05-13 |
| filename | /var/log/auth.log | 1 | 2026-05-13 |
| filename | C:\MOVEitDMZ\wwwroot\human2.aspx | 1 | 2026-05-13 |
| filename | C:\MOVEitDMZ\wwwroot\human.aspx | 1 | 2026-05-13 |
| email | [email protected] | 1 | 2026-05-13 |
| sha1 | 002573D80091F7F8167BCBDA3A402B85FA915F19 | 1 | 2026-05-13 |
| sha1 | 083F604377D74C4377822EF35021E34AD7DACEEA | 1 | 2026-05-13 |
| sha1 | 148C0CDE4F2EF807AEA77D7368F00F4C519F47EF | 1 | 2026-05-13 |
| sha1 | 468121E7D6952799F92940677268937C4C5F92ED | 1 | 2026-05-13 |
| sha1 | 54547180A99474B0DBA289D92C4A8F3EEA78B531 | 1 | 2026-05-13 |
| sha1 | 5D6B9E80E12BFC595D4D26F6AFB099B3CB471DD4 | 1 | 2026-05-13 |
| sha1 | 65C2388B0AFB1D1F1860BB887456D8D6CD8B5645 | 1 | 2026-05-13 |
| sha1 | 711C95FEAD2215E9AC59E32E6E3B0D71AD5C5AA5 | 1 | 2026-05-13 |
| sha256 | 1539dab6099d860add8330bf2a008a4b6dc05c71f7b4439aebf431e034e5b6ff | 1 | 2026-05-13 |
| sha256 | 35efc4b75a1d70c38513b4dfe549da417aaa476bf7e9ebd00265aaa8c7295870 | 1 | 2026-05-13 |
