| sha256 | 077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de | 1 | 2026-05-13 |
| sha256 | 24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14 | 1 | 2026-05-13 |
| sha256 | 2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5 | 1 | 2026-05-13 |
| sha256 | aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1f | 1 | 2026-05-13 |
| user_agent | PentestAgent | 1 | 2026-05-13 |
| registry_key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareWks | 1 | 2026-05-13 |
| registry_key | HKLM\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin | 1 | 2026-05-13 |
| registry_key | HKLM\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehavior | 1 | 2026-05-13 |
| registry_key | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential | 1 | 2026-05-13 |
| sha256 | 6ddbfd3a96834087501f0c9415a925cafdb92cb8ff34685f138833b4795416d6 | 1 | 2026-05-13 |
| sha256 | d6ed94589b0e6a7c3e1a6052e18f3962ca78c385c78036972d5ea72c07a5772c | 1 | 2026-05-13 |
| sha256 | d8378cf105146217e6ded438187c4ea0edcadb6cf27f5eeddda3fd80cce76d72 | 1 | 2026-05-13 |
| url | hxxp://144[.]172[.]105[.]122:8085/api/file/1/ | 1 | 2026-05-13 |
| domain | botshield[.]vu | 1 | 2026-05-13 |
| sha256 | fa767391b99865f8533efc1fe6dfa6175215718679fb00ca85fc13c3bd4ae4b7 | 1 | 2026-05-13 |
| domain | kiamatka[.]com | 1 | 2026-05-13 |
| filename | /proc/modules | 1 | 2026-05-13 |
| filename | /sys/kernel/debug/kprobes/list | 1 | 2026-05-13 |
| url | hxxps://branch[.]cricomai[[.]]sa[[.]]com/b@GrBOPttIrJA/*EMAIL_ADDRESS | 1 | 2026-05-13 |
| url | hxxps://immutable[.]nathacha[[.]]digital/T@uWhi6jqZQH7/#?EMAIL_ADDRESS | 1 | 2026-05-13 |
| url | hxxps://mock[.]zuyistoo[[.]]today/pry1r75TisN5S@8yDDQI/$EMAIL_ADDRESS | 1 | 2026-05-13 |
| url | hxxps://mysql[.]vecedoo[[.]]online/JB5ow79@fKst02/#EMAIL_ADDRESS | 1 | 2026-05-13 |
| url | hxxps://qonnfp[.]wnrathttb[[.]]ru/Fe2yiyoKvg3YTfV!/$EMAIL_ADDRESS | 1 | 2026-05-13 |
| sha256 | 4f93be0c46a53701b1777ab8df874c837df3d8256e026f138d60fc2932e569a8 | 1 | 2026-05-13 |
| sha256 | 5ad857df8976523cb3ad2fdf30e87c0e7daa64135716b139ffdcd209b98e1654 | 1 | 2026-05-13 |
| filename | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe.config | 1 | 2026-05-13 |
| sha256 | e3b016f2fc865d0f53f635f740eb0203626517425ed9a2908058f96a3bcf470d | 1 | 2026-05-13 |
| domain | onedriveconsole[[.]]com | 1 | 2026-05-13 |
| domain | zhydromet[[.]]com | 1 | 2026-05-13 |
| sha256 | a493ce9509c5180e997a04cab2006a48202afbb8edfa15149a4521067191ead7 | 1 | 2026-05-13 |
| domain | helper[.]leuleu[.]net | 1 | 2026-05-13 |
| email | [email protected] | 1 | 2026-05-13 |
| filename | {sys_get_temp_dir}/wvIjjnDMRaomchPprDBzzVSpzh61RCar.lock | 1 | 2026-05-13 |
| sha256 | 2a9d21ca07244932939c6c58699448f2147992c1f49cd3bc7d067bd92cb54f3a | 1 | 2026-05-13 |
| sha256 | 6eafd742f58db21fbaf5fd7636e6653446df04b4a5c9bca9104e5dfad34f547c | 1 | 2026-05-13 |
| url | hxxp://cdn[[.]]uacounter[[.]]com/stat[[.]]html | 1 | 2026-05-13 |
| url | hxxps://3v5w1km5gv[[.]]xyz/group[[.]]html | 1 | 2026-05-13 |
| domain | vvri8ocl4t3k8n6[.]xyz | 1 | 2026-05-13 |
| domain | dry[.]za[.]com | 1 | 2026-05-13 |
| url | hxxps://dry[.]za[.]com/if1/ | 1 | 2026-05-13 |
| url | hxxp://t[.]ly/KwKzQ | 1 | 2026-05-13 |
| email | [email protected] | 1 | 2026-05-13 |
| domain | 1[.]9[.]5[.]0[.]9[.]1[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa | 1 | 2026-05-13 |
| domain | 5[.]2[.]1[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa | 1 | 2026-05-13 |
| domain | 8[.]1[.]9[.]5[.]0[.]9[.]1[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa | 1 | 2026-05-13 |
| domain | 9[.]a[.]d[.]0[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa | 1 | 2026-05-13 |
| domain | d[.]d[.]e[.]0[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa | 1 | 2026-05-13 |
| url | hxxp://lemurinfo[.]com/content/fragments/combine.html?fragmentOneContents= | 1 | 2026-05-13 |
| url | hxxp://lemurinfo[.]com/content.html | 1 | 2026-05-13 |
| domain | lemurinfo[.]com | 1 | 2026-05-13 |
