APT_CyberCriminal_Campagin_.../2021/2021.01.14.Higaisa_or_Winnti_APT41/hash.txt
cybermonitor 6ecca466ac 2022
2022-04-27 16:20:36 +08:00

181 lines
21 KiB
Plaintext
Executable File

LNK file attacks
1074654a3f3df73f6e0fd0ad81597c662b75c273c92dc75c5a6bea81f093ef81 9b638f77634f535e52527d43ad850133788bfb0c c657e04141252e39b9fa75489f6320f5
0deb252a5048c3371358618750813e947458c77e651c729b9d51363f3d16b583 f50b624ba6eb9d3947f22cf7f95a6f70b7c463d3 a140420e12b68c872fe687967ac5ddbe
8e6945ae06dd849b9db0c2983bca82de1dddbf79afb371aa88da71c19c44c996 5b8e644acc097f7123172d96a3a45bd398661064 93ffd591948223e806c248861735e006
c0a0266f6df7f1235aeb4aad554e505320560967248c9c5cce7409fc77b56bd5 d500cec0ce5358751f3371b69a4a9bc402df8af4 45278d4ad4e0f4a891ec99283df153c3
bcfff6c0d72a8041a37fe3cc5c0233ac4ef8c3b7c3c6bca70d2fcfaed4c5325e 1a33f41d054a2ed2d395b19852583daddd056bb4 177e37ec8d07d6954b2102760c74708a
35a1ff5b9ad3f46222861818e3bb8a2323e20605d15d4fe395e1d16f48189530 0a462e8e3b153e249507b1652d9f6180463e7027 17548fb49ef598901ab83b7c630fbe9a
beaa2c8dcf9fbf70358a8cf71b2acee95146dba79ba37943a939a2145b83b32e acf5f997a16937072a2a72f1ba7704f9703ea27c e5809996b6126a5573623a9010eb4ee2
dca8fcb7879cf4718de0ee61a88425fca9dfa9883be187bae3534076f835a54d db6333f84538a21466e5ffe3c7102e0543cec167 d53daa634260ed28fc2e8610ecf15ad3
4733d1204b06dc95178e83834af61934a423534e1d4edd402b37e226f0f2727f dba010496a7be2e5de1f923ffdfc19bf345b650b 9776f04d9c254a0b67f4dc000369a17c
dcd2531aa89a99f009a740eab43d2aa2b8c1ed7c8d7e755405039f3a235e23a6 281c1b196cd992906d8583e64011dc28d9c52e3c 4a4a223893c67b9d34392670002d58d7
d4df4b58ee241e276ea03235445c04d1a28e48ec8b6e2599a56f6c4b8af3269b 7b6b01e9f726ab0b5f94cd68687d4787008cd7f5 4dcd2e0287e0292a1ad71cbfdf99726e
d064f675765f54ee80392fcfb5d136cd2407d06d0ea8cd7d8632d1a2b24c0439 8b8b1219581555f2d9747b289d57c3e0e274fd07 260eae2912475e51d82534b467e5746b
32705d3d9f7058e688b471e896dce505b3c6543218be28bbac85f6abbc09b791 289b5017f5ee8c915f755b1c7eefffbfb3d2d799 28bfed8776c0787e9da3a2004c12b09a
c613487a5fc65b3b4ca855980e33dd327b3f37a61ce0809518ba98b454ebf68b 0f1f2431ecccb980f7d93b9af52139d0d508510f 997ab0b59d865c4bd63cc55b5e9c8b48
4e5e3762c850536aac6add3a5ac66f54cbd15c37bd8fc72d3ade9dd5e17f420b 21a5bcd916bc61585cfe1d5656240237e24157b9 07254dbd369ba10a1f28ae707ba72dcf
2d182910dade1237f1dd398d1e7af0d6eca3a74a6614089a3af671486420fb2b 0261490fb7f88cc3e9db6aa3fd185d03d7646864 f6886709564630fbb48121d0ccc7c0a6
Shellcode injectors
Payload: Crosswalk
0046df35f66a3b076d9206412be2f1f7ea4641d96574e7b58578c0c0995d1feb b73fcfc423d1bdb4649440689ff4894639b3bd0e 9697d60b744a14b3003559d17cfc2f8f
325430384d642ab2a902fb0e268e85808b6cbf87506ccdc314e116e7d1b8239e 0f2a5bbe03c5b3422609b78ca90fb7f06bfd966b eee464e5ded3f4e37d49c8a91b1eb157
9e27f110fc824d8b85855538c3320e8ea436e82737d686fcecb512b6f872e172 4481c4b0cf2207099c7b5979a6e81a2923d6c698 254ace03b179c6565ac2616dd4d24f85
bec68bcaa80bb00274ef7066ddc8de1b289fb5f8b8e8573f3a961664f41da9d7 cc24843afd627ced74a1d713328078a23db81e54 914151fa49be06ab570bb0db77ce6960
3454d87b2ce0eab44c07774c7b56318710f9a63626d6d2aaf898922178bf2792 e6cd7a9f5b421b80b50e5809c35732c427c6b6d8 fbfeecea5a8c752c9bffdf6b9f7fcf50
1e29e07b404836c82cd9b75e44a3169195a335dc494ba27f744f6605666c26aa a1e0ce3c384945fdde841d91d069505879587217 d19c5c55733244f4a8d5a1af4e6c1250
3a9bbf4ee872904e729466aa50d570b43451b0945a41b5d9d114f8c24683c21e 5d1bada317d596f3dec5b86e4e42639b2f5f71ac 6d967f275beb3855980a80d60ef8023c
faca607b43551044fda3c799ce7e9ce61004100544eeb196734972303f57f2ae 159a5ca55d7c62d0167740f8f5310e18e03a8fd3 4518f25c6307ef6d2ea5c0e66f2b16d1
86100e3efa14a6805a33b2ed24234ac73e094c84cf4282426192607fb8810961 604c5f42eeb015016b35ec1c9019812afc400f5b 7078450715c103056b01ad87787aaed6
Payload: Metasploit
0ad8ee3fe6d45626b28c0051c4c4f83358a03096ad06fc7135621293e95c75ae e8fcd7ca491bffc4838bf9eb6a7aec3f7e4acdc2 a752d48a4433eb2dd56c8946a345ac9e
75d573d1e788590195012a1965cfcaa911c566aee88331b7718ddc638028c175 ca66a779a5b720e5f73e91561bd3434db691e13b 2867ca5c273fbb128504a4e455e862a4
8c962ddbb515e73ecfc5df9db35a54c8c9d15713a04425298f2d89308e2a47bf ce1cb0050662e541e72a24c6a969fa7b51084a60 2555677876b50a03e42420838c1997f1
fb23c7fc2e5e8ae33942734c453961da9ed4659368d19180a8f1ecb3b9b8e853 d03a5b322f3748c9019ca24dd1943507d591165e 9a026082cb80cdba1a68ae1d14f79b9d
012d8d787c6e7a5f3dbe1e9cce7c5da166537a819221e210ef4d108f1a0a24b3 d913285f75a3a1a4f2a6e0f66bfda8efc71fc669 d8ff9eb5582371745ffe1636a89f97ce
420dc77afe28003f14dfe6c09fbf8194ead8a6e8222b6ab126e7ee9bf4b63fd4 ebafff5ff0517ea5c2c783ab7d0cffded468bf4f c024b658471a27ec5201f96f65f0b89a
a02258fcb3694893b900f10f0f9bb1d0d522ed098b1cc8eab59f2f70209b3a0b 9bdd1af6fc74a8a3c2ff0e3bf1378ff290cdb35e bb4155a5add9446b6354d46a78edc8d5
f54cf6d9a5d77a89c4a2d47b02736d746764319e02ad224019db8de78842334a 8413380c19f348ef08051b2d6d8b39598bb05f68 cdddd08982ca2dd76a63cbf603956f1a
Self-contained PL shellcode loaders
Payload: Crosswalk
5841a4302fcbd63f66fc2afd41f8671744454aaa7e1ed834e935bfdb007a9a83 3d0b40b2a6fc691f702237ba5682335e7e74e649 a8bb1d69fb8a9d323bbc5d78f0e62850
e0b675302efc8c94e94b400a67bc627889bfdebb4f4dffdd68fdbc61d4cd03ae 4db6e492a9ef89e116f4da19f97d69cb82e08661 2dc960eb4691a148ece5ee2b24932f03
e398290469966aff01a9e138d45c4655790d7a641950e675785d0a2ab93e7d28 1e494e1cf8df105d95d0e0bb4879223030c48a0c 42a5908ff9b65d3b1a1a9f52ca6f06a5
8add31b6a2828e0d0a5b3ac225f6063f2c67c56036ff3f5099a9ee446459012a 5c11f70345d984391d041b604adfe5bfb5134755 5e3ef894b490d1c931a5f70d44789316
a4b2a737badef32831cbf05bfaa65b5121ddb41463177f4ac0dbc354b3b451d4 8c549d16dc97072f16e4a3114fbd7d47f8bc9726 1bc1df4b946e83f26c878f01145545a4
2fdef9d8896705f468f66eb8c20e5892d161c1d98ab5962aa231326546e25056 7b465b1e0d7be4d84e06a115fd55b97207de768c 221db0f664ea781b4dff81e0a354c63d
Payload: Metasploit
a7df8143a36638de40233b141919d767678b45bf5467e948a637eaafb2820550 be39c3022218ccb3abcfc6c906359b76571f4241 dc758b9ecca41f7f66808258efbfc6cf
283302c43466bdc6524a1e58a0ff9cc223ab8f540a1b0248d1fcffe81b87d5d6 b2bb31ea3b4abaf3f3edbff405e23f2ce442dfe0 3839d37a6a7a29a7af79f102e28b8bc2
b447a7bb633f682058d4b9df5caabbe8c794f087b80bf598d6741a255e925078 3c523a969cc4c273ae27fef32630701516b08873 63584677683b5fbf4f69053a8de9ecbe
01c8cc07a83ffd7ac9ee008685eb360c9934919e86847c50c8843807b9d9c196 37ec3d5be7b535a8a31001815ab275a489e302f5 d92db6b734b1db3874396506613a4962
21dd261e5fe46b86833cd69b299ae5ee5f24da3d4e87de509eddda4d2f63d591 11e86ee44e7c3592c97f7191746e170b62f724bb c8f1aff87d12e0e5c7082b8a565c4abb
Payload: Cobalt Strike BEACON
ba03feb351825029426e84c2f74e314f27b56714a082759650a455dfb1a946eb 8890155c88c690faaf900d1e63998756809273d0 cbccba5f774642c80aacfed20d20435b
06210a1f9bc48128e050df0884f9759e4d202bd103aa78e6b6eb3cec1a58cdb5 a0128edc037a91ce127291edd9d950e7661dd764 64071aaa193ab18722553bf6f573547b
0d6a5183b903b1013367b9a319f21a7a3b7798d9565a0deee52951f62a708227 2d35c342d8fc6f5d018937491e246da2ab293d43 b8b43c4c4207b180ec8be82ff066172a
1bd0f0fbd7df99c41e057f6d6c7107812ef1370609ad215a92227ca79ce6df70 7dcb0d7300aa54ef77eb3347e6204b31d4b9c6db 4922247f9b83341987e0b4e80f5c153f
29233eab65960c2da4962e343a3adab768673012d074db35ebc2abe2142ee73c 1d3dc9bb7acfe8416ac5ab51f24b6648b91eb305 cb682ec885f353bcc51ac350bc015783
79fbb45d0041933dce16325b87b969db12b7a8dedc918929615104835badc80f b13d58f1d24cf5e10a7013f4aeac22e974c74315 407990337eac6582533df5c85528817a
8f0538a18c944e2a98f1415d5528a0dab4367cd8689f598ab2da266c36403252 483c49349d29e11e0d195864e372a210ce5ce856 7e8ebe133a530ea86f179c87fc8e51f7
025e053e329f7e5e930cc5aa8492a76e6bc61d5769aa614ec66088943bf77596 e63646f0089ce3a224d68029eecff72ef0259609 f9fa912e498f20c440dde32fc8a66608
d30dd7d82059dc34e72c3131dd7ea87f427cabe7225bbf59aa69e01cd761a1fe 8be2fccba22fdca0e453855c7428e709186f3e0d c839ae523f04e7859498de1dee570867
81ab37ae3abce3feabdefde6a008dec322e0168ce4f0456ee737135025399400 98d6dffb7e51170a02546eeb07c80f2592d10293 5ed49962d13dcd6e0eab98f966273fca
b55812f35735e4fb601575072f1b314508b2dafdcb65aa6c1245a2e1f9d80bdd 6986b924c58aa90a9e413d9942c25a1419d9aa0e f88416bc9ffcb639f1357ebafe3ae9a7
fc5c9c93781fbbac25d185ec8f920170503ec1eddfc623d2285a05d05d5552dc 0902e3c41fb8e0dffc322e6a562f04588b7522a3 6817b7a5d1542eff1cc404a44a31353a
d879b6cac6026a5418df4bf15296890507dbaec5abe56dafda54266975488cf2 11c987cdafec8ea02a77a03d4c979f743138b39a b02057f05f57f3a889a744533001cf7d
6e7052562db5f23c2740e9d094aae2316f77866b366eb4ef59c157e112172206 7fd0d64f54a54aabd04136e4111e2d8a22884324 dda83ca52a9d9dbdc7752db8ed9533a9
9afb78e9be08041f849563c4fd2777a373ffc76c3eccd638b1f6f846b847b968 2b47e9c8946536decba6066f9a57a85f143465c5 482d1c1e2044b0b4d1641f15d82e86b6
8b515bf88b3f7ac77861fdea61f82fb0c941bc5569922cadca254a79a744ae99 e46490394ddc66548067ba540d13fb3cf363c596 2a189598113d436e4b717abb76f1c652
f91f2a7e1944734371562f18b066f193605e07223aab90bd1e8925e23bbeaa1c 0b83939510bd31939c91370c53fab25aa286ba08 5909983db4d9023e4098e56361c96a6f
3d38dfd588fc98de099201fe9f52feb29bb401fc623d6fe03eb8f0c959ffc731 af76d1d293e3e8fe7ad428ca6fe47e68c858587b 284dcb880e68d66cb890ef85d78ea7ae
6a10027dd99f124cd9d2682b6e7b0841d070607ea22a446f3c40c0b9f9725bed f2751dbfe822907ecb69b83e461b48183a485355 0d69dae8f83f09b8671b8552a0acd319
71a965d54c4b60f7ae4a5e46394bfca013d06e888ec64f06d5ec3d8a21eccb55 4b51a8233991d4255fc05d9bbfc242f779b1d31d 5e61778a1e660691dce99ebb8e5e257c
5347c5bbfaec8877c3b909ff80cda82f505c3ef6384a9ecf040c821fc7829736 1530993376416274d04907ff6369a3012694bfa9 62d6fb0f33d0411ea6abd3167118a0e1
de648c21b4fae290855fdf0cd63d9e6807ced0577bdcf5ff50147ba44bf30251 3a0c2aee518b7c003e5eb8aa7094d536b8bf1a94 dbd6a052331365a31f74e2c41d5cd132
7ed5cbeb6c732aa492762381033ff06d0c29f1c731530d4d27704822141a074a 2d0bb1fc0213e4fca5c3b485caaf964dd2da7981 05e1247ff02d50aed81ecd9d0b93c41c
e886caba3fea000a7de8948c4de0f9b5857f0baef6cf905a2c53641dbbc0277c 6b92e6d594fd6e26f9e910f10f388c43017303b2 48bda0c5e53b6d7ee7fb1da6130f325f
External PL shellcode loaders
0041b28d1f076e196af761a536aa800ebe2fcaea9084a8e17d2a43c43765efdd 0cb8ed29268ec9848ff1c7f25f28b620271e61c9 131711477620098191777f93c580ee6c
0756216ea3fea5b394e2fa86e90a75f05c3da2b4b47d61110559bd28f51da8e6 7a1c5e1799bdeebb01527f54a7fd89d0b720dea7 53e2c1eb6b87e92b5f534503f011f6ee
34aeaa89aab983318ed8f6da32556faf3057a92dc045fac1f960f3aaad3a1ba1 a42e6dc7f248794e91e4ec251c2c96164215b7be f02a87562ffdd7a1c941dac4175854b0
40101054d18eb50b65c2ce32b00352d2486008f67c63baec5ef93cac9d5c81ed 11d7145b85fea84aed35c60857560a66dbff5a27 e5271b41cf32892cc16445ac0783f3f7
4665280d4b34c5388edeb51a6d5e808d2942c364017a42d3f1fac186b21eb571 09a3fb96edbd5e143ba3b579cb2c09d0dd9469eb da220930ac3e45a713d9da2e6c1c246a
46f03ddf74c47960a3731de18f123b2110153ed668f9bf6ed3badd7fd099ccb6 90c104dadb5c21b4fca644b37f7043fef7e72d2b 71b250a873a070415fed172759a42b7d
4f2d8c437d32dc075074f01d10698f6d4dfc4d4bd8a595dabaa2519c6a025c8e e629fda195636d99ac587b354b5c6fc228d65d81 8b2e72f2b13c63a583ae9a9cd474adf6
655c21fc31967282d8517b3c845f775cd0a80595f90c5c85b6027110532a1cf9 5fa5593b52cfc866c51f55e9a56b1adcc9db01d1 318b3661ec5929f069e7821fac537fe0
8f8ee8d2bc6c559a0a09ce3958727dee2f30880c615b2788d757917ca55d43ef b769c9c708f59be0a0d68ddf3076c9d9037b6c27 1d6def7a4bed4a8772e3cae6926d405b
8fb8134bf40ad6bddd60ea77b78c30dab72c736bf29172f89d03505b80c3ae8d 9a17591711383d96f7cc421a71d5d394e322189a 7af8c2055a608c920ba5e5c63fd43207
9bf32bf4a4bc1d13bddaa6402595ad76d2d9fcc91a988313f13ed990ccb1c4c1 68ae7f3d2cb22c70232a35ed59f6fed70fe0f3be fb2ac5049bdee8dd1753fa7e9d007e6b
9c3280bc1ebc239de86523a7046b45e9bb7ce7a40a869dda6ea92fcee727366a cf90d0b4ac09dc97f675fb3cfbc8eba89db211e8 bb6b9a60c3b4062669bac3608ca7b0c1
bfe2673b02c54be9093cff8fd564b630109175c608f07d94e4a2ac65028a6eae 59c4f47b1135f21a8814c8a838277f4cfa46f2e5 fcceb7a3bc3b0c48c8d9c91eb0b896ab
c93999f7622caf63cbcfb26966ff11719a4e26bca7d90a843461f44a3c982a30 0a8fbc71a936d2e7f2830fae3d57a2f1e8e43266 36fe1e0db5e74ed3e6adc039720c54d6
d0686f44fb7e77ce0f68cc91c4cef12dbd691bb99b0b7be77103b7b17eec3753 0b09ac7691cb9b8b7b5a2e453984bc75edbc8aeb b5605f71d18cc255dbbd910ac008ae6e
d6a05e20da5012c0cfc491b0044f7fded9322f5bbc664092c4b481709c3472e0 735e97688a70d24d922cf9a3951c5e23a91cbcb1 4a89eb933fa87d85542488df6ae20d82
e7f5a30d4bf7915cc97374e0f6a29573d4640961166b5c9b942030e8c10949d8 c224763846f8f61442e893cb8e9070ce67be5dc8 63c1b74c829ee362730ff37d6101d276
e935699b31707ecf9e006940f31f09514688cb45e078a66724603ee7fadf84db 5ba9f7cd51e8eac88f870e340c8262683d92563d 99b86e64d76d21b2a5bfeb48b89e3935
f36a0b99973a837d5e4d542edd739df7cac10e207be538d47a106c4edf7cff54 fde9357e8d6a3336dbd82d2e22dbc0772640f63f 0133bd3f26788732a580115218d98273
f69c6e8fe1188a461bfe249ba7afefbd7a787fcd0777c008f9580f6976118898 d3d4c7cf257f9fe97bdf31a4b0e3f66726fb1b6f 3d09dee9bc20abf33b64bcb4c6d3130f
fad80dc36a59d1cc67f3c4f5deb2650ca7f5abac43858bf38b46f60d6bb4b196 119b92462a91f9cc8b24dfbd84fb88ef47ecab97 247c48b8758a9eba48bfe39c53ff9e6e
0187d3fae2dfc1629e766d5df38bdabf5effcb4746befceb1aaf283e9fe063a1 648594c25aebf3865c35ce6057e36b42e9e3be31 dbc30db0ed5ba1ea3b2e500823448c6c
45d175f3c1cb6067f60ea90661524124102f872830a78968f46187d6bc28f70d 418fab494383e2ae0d94900344853cc0bc6d5385 337171764c99b7ae87c030e11cda00c6
ca0f235b67506ed5882fe4b520fd007f59c0970a115a61105a560b502745ac6a 1c265ed6b5875a619a427db1663f48fe7db01d88 2a3e63fdbcbbad9b4be8b35a180ea0d4
abac7a72b425ff38f8a7d8b66178da519525dc2137ca8904b42301fb46a8983e d9b692d84bdc134f90b54ac2a30f6832d70e730b 211db7515faa09aa0623b327bd1530f1
645b14df1bd5e294ec194784bc2bd13e0b65dac33897c9b63ad9ed35ec6df3a8 6d3643bfdd1bd85cfdfe4b05eaf2939bbf4b22f0 359f5615dcf2f75bc74146afad630427
6b4b9cf828f419298cd7fda95db28c53fc53627124224d87d2ad060185767957 59208d32dd7440bbe4142882b8ad1ac033f08918 bae0fc6f570ca12a9b2980dd00bc673c
7fd19347519ec15ab8dbce66722b28a917b87ad034282ef90851e1b994463644 c4467556640ad45fb8e56d1fb95c93e57b209924 086186c935a68e7167113da46a17fa80
8308e54055b45eb63dc6c4c6a4112310a45dec041c1be7deb55bec548617136f c44934f47c98c7cde7ba5978ca315a5e9099d0c8 cf13bdefb622fc90dcda39e20e45d636
adf52650ce698e17d5ff130bc975a82b47c6c175ad929083d757ec0fe7c4b205 bed84d4ef7bd8c5fb683eab51d849c891328b4d4 08393f7d6e0ee2b7472173f4419a602d
fb707094673a48408f9ba5240019cb502b9367fb380bb1734e0243e90b9399c3 e452227d134fe14df3ca35cd2abf7f1e922aa5d6 d761c07911138e605723f891965035b8
4da733bbf7d585ee5b5a58c0ad77047ce640a4512a84502ad5ae9240ee2fcdb0 ff362a3d5d873f8fd0f7c2f150582dab9251cf2c 5eab890242e8b811865e1bd3a7fd7868
bef3f87c6582813e23b0c8c8db9ca9ed65bc802445187378f4e62a7246133ae2 27e4115041c059dce22322e0242002353ab14814 6d33db967323d822ba3239dcdfcb555c
b83534071bbcacc175449faadbb1d6b0852fe58521da0fefd5398a4a9b1fb884 26ca2262f31dcc1fd6ad56f1f371a363163ba7f2 d12013fb90a60869cfdaaffe1a18467d
adf52650ce698e17d5ff130bc975a82b47c6c175ad929083d757ec0fe7c4b205 bed84d4ef7bd8c5fb683eab51d849c891328b4d4 08393f7d6e0ee2b7472173f4419a602d
e4df8634f5f231fae264684e63b3e0c6497b98dd24ba1b0c6f85c156d33a079c e3e7b719fa1bb3fd12bb82592f85c3e4c3b1d7fa 03275b5b1f9d11b1731d5746827d00b1
afb5e3f05d2eedf6e0e7447a34ce6fd135a72dad11660cf21bec4178d0edc15b c67ad0bb292ed20dbe9ba980e71d223249632252 38857fb40e0655495df270777043b813
1968f29b67920fc59e54eba7852a32f20ecbf3f09481c09ddbee1dedc37f296e b49679280a2c5b01d0126fc835cc29e4fdc5900d 468c5c3f46299c67366727a58e3322e4
be70b599e8d7272e8debf49e6bf6e5d8d9f1965812f387a9f1e75aa34788a7c7 88282f8c93d61fd0caaec8807448e96f90101901 db394163c7e6e511d0e4046ff34d67e2
PL shellcode: Metasploit
f6085075e906a93a9696d9911577d16e2b5a92bc6b7c514d62992c14d5999205 4a0b8e9a56876c11c667b9ce77b371d2c6d07891 8849cf257c383044c006beb8e66d3add
PL shellcode: Cobalt Strike Beacon
43fe07f9adeb32b20e21048e9bb41d01e6b3559d98088ac8cd8ab0fad766b885 30dee2118fc28bb0b2804275c92daf58236824e5 2a2a50ec29f741faecbff0bcf705da0a
6867f3d853de5dfe8adbd761576c29ad853611d8d1c7fdd15b07125fd05321f8 7420afe3c0c91442fac0c6df5dd1cfedd76503de 69b9d1fc0edb0a67909847e43ac79ccf
0c6c6ba92661c119168a5486faa1af94673bd4d770c13c2b49d7a0651f798857 cb552c22718ca9eaf16792c1ecc583c09f1f19e1 b67ff211420c9f5647df2de02e771864
be7ba33fcb2a19bb2d1fe746f49c39fb1b8bd5d9e46d5b6610f8a2ad3f60b248 7849dcf58fbb930a1327635e13e9970d4bdc7121 9a478e85f1aed628e3fc1f7c8fdeae82
d1a548b9ad6b4468ee3c5f6e1aaaa515021255fb13e45ff34fbff5ad88bf4de2 93404b4005e7ab0e8c9282ced20c16820378792b eff6e2a93e60fe017e9f082cd6d3fac9
9ad808caa0b6a60a584566f3c172280617e36699326e7425356795b221af41dc f3093ae9f6633449c1d4f35804d1166dcbe09ece abb6e606a5fd22abfaefb1dbf970ce2f
eb9c850b1e8d8842eb900fa78135b518fb69da49c72304b5b3b4b6f4fa639e57 6c34f4f29cb3d8cc8f55a707d255de50caa67e8f b80d303171db4adb554e656aaba15fc9
e10046b86fe821d8208cb0a6824080ea6cd47a92d4f6e22ce7f5c4c0d9605e4b 1cc16e3a6185b790875e3f00b68ec87feddcf93f cd43240098f60c5d65290ef93ebdf6de
a783edae435c6fdf55e937b3246b454ed3b85583184b6ffc1b2faba75c9165cf aed326228551a4736012c1921d3be7079541c29e 07377cf8abcabcf4ec87e9dde67672d6
CHM file attack
b6685eb069bdfeec54c9ac349b6f26fb8ecf7a27f8dfd8fcdb09983c94aed869 db190af369fdc654af39a54c44f37d5e5712fda8 06f945c39870743d51ca887efb32d649
5d549155b1a5a9c49497cf34ca0d6d4ca19c06c9996464386fc0ed696bf355a2 7dabbd292f8bb8b600439a9c1b2fa69eeecbcb88 46d3773e0e306b8a1ede7932b83fb034
02f5cb58a57d807c365edf8df5635263f428b099a38dff7fe7f4436b84efbe71 9c921a278ba4647269b45a5716b47ee47b6de24f e8c21f8f50bc5720b1713322db4a9022
3c8049bd7d2c285acc0685d55b73e4339d4d0a755acffad697d5a6806d95bb28 201eac040aa2693042efa7539a88e2676dcf89af e93bdab9e64bcce94f70a91e0ee115da
fcbd7ab82939b7e0aff38f48a1797ac2efdb3c01c326a2dcf828a500015e0e83 8a503147831499778b2d50f8337677c249c99846 21aa8aa3a92ebca1963595a328061843
3c6d304c050607a9b945b9c7e80805fc5d54ced16f3d27aaa42fce6434c92472 1e75cfd3db2cc4b0091e271a7533b828632f399c 951c5f08eef4ef8acc3352a44c7c0e80
4d3ad3ff281a144d9a0a8ae5680f13e201ce1a6ba70e53a74510f0e41ae6a9e6 9c1d4db37c2d72ac9761dd342feb8a31bc636d6d b22b232381ea465aeb81fb7077141d06
FunnySwitch
23dfce597a6afef4a1fffd0e7cf89eba31f964f3eabcec1545317efeb25082ed 6dd15c03ffd3762a20b0f51faf31724d5dbf1466 2b0c692d9eafed5e24f2b52234ea0fa2
2063fae36db936de23eb728bcf3f8a5572f83645786c2a0a5529c71d8447a9af c1e31f72adba9d5e2801e6766a24eb8d37807e9d 7e1948326ff96a1b6f8e8d6dee152e28
fbc56623dd4cdfdc917a9bb0fbe00fa213c656069c7094fe90ba2c355f580670 69b961af528eac458942dc1787f32dc432a328d9 2902f54dbd1f143784dfcb170dfc170d
fb0fdd18922977263f78becdedddab7a03c8de16a5431c7b4602e5be13110fa3 6e3d0537cd52965e52b06b984155191c41fe0a18 30684061b51971698984b531205429ca
b45baac2ae9c5fdfbf56131451962826a95d56f641af8ca1b74738c2eb939a76 4f0402e2638831d6259a366cf605eadb8c7fd478 5fcf6562217dd1bb21003a9613739aff
ff0527ea2f8545c86b8dfdef624362ed9e6c09d3f8589f873b1e08a895ef9635 ed8cc92b5a04620b01fcc4365e8f2ffe0c49eb30 f5b3106f2ff44bf860d077e77a1992e3
931ea6a2fc0d5b4c5c3cf2cba596a97eaa805981414c9cda4b26c8c47bf914df ebb08480d3d94d6d3a8d85894d297db996d57b4f b6953b1d1c78770a6d4b3e0c9d146d9b
568298593d406bd49de42688365fdc16f4a5841198583527a35f6a7d518a6b0e 425e6c8e89f45a8fe57a27d1eacdc850b2286099 bbeca57f7993a34e6296c8dedb996b76
ShadowPad
03b7b511716c074e9f6ef37318638337fd7449897be999505d4a3219572829b4 147529e1a8b00a62fa2371600988b17487260448 a26d2c6f7df4b74b56f9376a2d234661
5a151aa75fbfc144cb48595a86e7b0ae0ad18d2630192773ff688ae1f42989b7 ea43dbef69af12404549bc45fda756bfefcb3d88 493698b1d7acfbf57848b964b4b0ae97
3b70be53fd7421d77f14041046f7484862e63a33ec4b82590d032804b1565d0d ebcb044373550b787553a9b9cd297f4b8c330cd3 652c44a6b5d09bf4c749a4b4d1bae895
ae000f5cef11468dde774696423ca0186b46e55781a4232f22760a0bfbfb04f0 ee4744c4e74aa9933f3a5c340d9b739f8399b7f2 4001d217c9a77d5839fbc033937f7ed4
5f1a21940be9f78a5782879ad54600bd67bfcd4d32085db7a3e8a88292db26cc f6f6f352fa58d587c644953e4fd1552278827e14 52c28bdb6b1fc4d77b1ea58dc8c1c810
e93a9e59ee2c1a18cee75eedcbe968ed552d5c62ec6546c8a1c1f1ae2019844e 1a654b4191a3196353801d37a1de21535eb7a41c eb763c30f69c4f438be7545e2a1ca76c
1f64194a4e4babe3f176666ffd8ee0d76d856825c19bfcd783aec1bacb74fd05 801b756019c075ef6a20c8219157fe8f92deebc1 791f92ce878c8327337eb8e35675a715
531e54c055838f281d19fed674dbc339c13e21c71b6641c23d8333f6277f28c0 6966687463365f08cfb25fd2c47c6e9a27af22b0 4ad23aae3409c31d3d72e1d10e9d957d
a1fa8cad75c5d999f1b0678fa611009572abf03dd5a836f8f2604108b503b6d2 c1af22e0d0585f6c6a2deab22a784717ee33f36d 882a60c3173e252469eb4731af3342bd
37be65842e3fc72a5ceccdc3d7784a96d3ca6c693d84ed99501f303637f9301a 05a2b848965d77fa154ca24fa438b8e5390c21f5 e542c6fabe80af604d31ef8eaaf94053
PlugX
94ea23e7f53cb9111dd61fe1a1cbb79b8bbabd2d37ed6bfa67ba2a437cfd5e92 14c1e3dd30ef1e22e6ebadd65fb883d3e0354d47 329ecc81b222a796f46859d16bd4813c
ac5b4378a907949c4edd2b2ca7734173875527e9e8d5b6d69af5aea4b8ed3a69 2293a7510101ccfd83db4bd6429db2f9d406859a d55e9a302203c8800ca89b757b0588ed
e54b7d31a8dd0fbab1fa81081e54b0b9b07634c13934adaf08b23d2b6a84b89a c40acafac6c1c3ba1d1cf5497bfaf5f682f9884a a7542a2dc4dd52bd4c9b08741dc32ad7
b59a37f408fcfb8b8e7e001e875629998a570f4a5f652bcbb533ab4d30f243f7 d1cf03da461f81822287465be5942931ac29737d d3ef032a67242789316e364f7e798ff4
ccdb8e0162796efe19128c0bac78478fd1ff2dc3382aed0c19b0f4bd99a31efc 22bac40e845ec6551396b77e6257f50634993883 7affcfb9857cc14dcc07fb8d226f03e0
4dad1e908604c2faa4ad9d9ef3dcebc3a163e97398d41e5e398788fe8da2305b 7cbaa1757bafa3a6be0793b959feac1ea73d88ff f749aa99a08fdc737f90813f174abb30
4a89a4d9fa22f42c6d3e51cf8dca0881e34763fe0448b783599bfc00984fd2ee bd31d8bad119b9da702889b44854b054f15e2f47 4489d5077c5d2396e3a94d652adae1ca
18a14cec1abcb9c02c1094271d89f428dec1896924a949ed760d38cd0dea7217 a2e88dfb93c23ba7cd38a820b2e64f14192079c2 8d6737d573ef70b47fd39a4c5a552e0f