Mirrors
/
ioc-collection
mirror of https://github.com/avast/ioc
6
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

GuptiMiner: Added IoCs

This commit is contained in:
Jan Rubín 2024-04-23 09:42:29 +02:00
parent 48396aa24a
commit 8fc421bfa8
12 changed files with 8381 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

160
GuptiMiner/README.md Normal file
View File

@ -0,0 +1,160 @@
# IoC for GuptiMiner
Malware analysis and more technical information at <https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/>
### Table of Contents
* [Samples (SHA-256)](#samples-sha-256)
* [C&Cs](#cnc)
* [Mutexes](#mutexes)
* [PDBs](#pdbs)
## Samples (SHA-256)
#### GuptiMiner binary and related files
```
c3122448ae3b21ac2431d8fd523451ff25de7f6e399ff013d6fa6953a7998fa3
7a1554fe1c504786402d97edecc10c3aa12bd6b7b7b101cfc7a009ae88dd99c6
3515113E7127DC41FB34C447F35C143F1B33FD70913034742E44EE7A9DC5CC4C
e0dd8af1b70f47374b0714e3b368e20dbcfa45c6fe8f4a2e72314f4cd3ef16ee
de48abe380bd84b5dc940743ad6727d0372f602a8871a4a0ae2a53b15e1b1739
8e96d15864ec0cc6d3976d87e9e76e6eeccc23c551b22dcfacb60232773ec049
FF884D4C01FCCF08A916F1E7168080A2D740A62A774F18E64F377D23923B0297
294B73D38B89CE66CFDEFA04B1678EDF1B74A9B7F50343D9036A5D549ADE509A
6305d66aac77098107e3aa6d85af1c2e3fc2bb1f639e4a9da619c8409104c414
357009a70daacfc3379560286a134b89e1874ab930d84edb2d3ba418f7ad6a0b
364984e8d62eb42fd880755a296bd4a93cc071b9705c1f1b43e4c19dd84adc65
4dfd082eee771b7801b2ddcea9680457f76d4888c64bb0b45d4ea616f0a47f21
487624b44b43dacb45fd93d03e25c9f6d919eaa6f01e365bb71897a385919ddd
1c31d06cbdf961867ec788288b74bee0db7f07a75ae06d45d30355c0bc7b09fe
1fbc562b08637a111464ba182cd22b1286a185f7cfba143505b99b07313c97a4
07beca60c0a50520b8dbc0b8cc2d56614dd48fef0466f846a0a03afbfc42349d
f0ccfcb5d49d08e9e66b67bb3fedc476fdf5476a432306e78ddaaba4f8e3bbc4
8446d4fc1310b31238f9a610cd25ea832925a25e758b9a41eea66f998163bb34
74D7F1AF69FB706E87FF0116B8E4FA3A9B87275505E2EE7A32A8628A2D066549
af9f1331ac671d241bf62240aa52389059b4071a0635cb9cb58fa78ab942a33b
31dfba1b102bbf4092b25e63aae0f27386c480c10191c96c04295cb284f20878
b0f94d84888dffacbc10bd7f9983b2d681b55d7e932c2d952d47ee606058df54
f656a418fca7c4275f2441840faaeb70947e4f39d3826d6d2e50a3e7b8120e4e
7f1221c613b9de2da62da613b8b7c9afde2ea026fe6b88198a65c9485ded7b3d
```
## C&Cs
```
_spf.microsoft[.]com
acmeautoleasing[.]net
b.guterman[.]net
breedbackfp[.]com
crl.microsoft[.]com
crl.peepzo[.]com
crl.sneakerhost[.]com
desmoinesreg[.]com
dl.sneakerhost[.]com
edgesync[.]net
espcomp[.]net
ext.microsoft[.]com
ext.peepzo[.]com
ext.sneakerhost[.]com
gesucht[.]net
globalsign.microsoft[.]com
icamper[.]net
m.airequipment[.]net
m.cbacontrols[.]com
m.gosoengine[.]com
m.guterman[.]net
m.indpendant[.]com
m.insomniaccinema[.]com
m.korkyt[.]net
m.satchmos[.]net
m.sifraco[.]com
ns.bretzger[.]net
ns.deannacraite[.]com
ns.desmoinesreg[.]com
ns.dreamsoles[.]com
ns.editaccess[.]com
ns.encontacto[.]net
ns.gravelmart[.]net
ns.gridsense[.]net
ns.jetmediauk[.]com
ns.kbdn[.]net
ns.lesagencestv[.]net
ns.penawarkanser[.]net
ns.srnmicro[.]net
ns.suechiLton[.]com
ns.trafomo[.]com
ns1.earthscienceclass[.]com
ns1.peepzo[.]com
ns1.securtelecom[.]com
ns1.sneakerhost[.]com
p.bramco[.]net
p.hashvault[.]pro
r.sifraco[.]com
spf.microsoft[.]com
widgeonhill[.]com
www.bascap[.]net
```
## Mutexes
```
ESOCESS_
Global\Fri Aug 13 02:17:49 2021
Global\Fri Aug 13 02:22:55 2021
Global\Mon Apr 19 06:03:17 2021
Global\Mon Apr 24 07:19:54 2023
Global\Mon Feb 27 08:11:25 2023
Global\Mon Jun 14 03:22:57 2021
Global\Mon Mar 13 07:29:11 2023
Global\Mon Mar 22 09:16:00 2021
Global\Sun Jun 13 08:22:07 2021
Global\Thu Aug 10 03:25:11 2023
Global\Thu Aug 12 02:07:58 2021
Global\Thu Feb 23 08:37:09 2023
Global\Thu Mar 25 02:03:14 2021
Global\Thu Mar 25 09:31:19 2021
Global\Thu Nov 2 08:21:56 2023
Global\Thu Nov 9 06:19:40 2023
Global\Tue Apr 25 08:32:05 2023
Global\Tue Mar 23 02:37:32 2021
Global\Tue Oct 10 08:07:11 2023
Global\Wed Aug 11 09:16:37 2021
Global\Wed Jan 5 09:15:56 2022
Global\Wed Jun 2 09:43:03 2021
Global\Wed Mar 1 01:29:48 2023
Global\Wed Mar 23 08:56:01 2022
Global\Wed Mar 23 09:06:36 2022
Global\Wed May 10 06:38:46 2023
Global1
GlobalMIVOD_V4
GMCM1
MIVOD_6
MTX_EX01
Mutex_ONLY_ME_V1
Mutex_ONLY_ME_V2
Mutex_ONLY_ME_V3
PROCESS_
SLDV014
SLDV02
SLDV024
SLDV04
SLDV10
SLDV11
SLDV13
SLDV15
SLDV17
SLDV22
SLDV26
```
## PDBs
```
E:\projects\projects\RunCompressedSC\x64\Release\RunCompressedSC.pdb
E:\Projects\putty-src\windows\VS2012\x64\Release\plink.pdb
F:\CODE-20221019\Projects\RunCompressedSC\x64\Release\RunCompressedSC.pdb
F:\Pro\MainWork\Release\MainWork.pdb
F:\Pro\MainWork\x64\Release\MainWork.pdb
F:\Projects\2020-NEW\20200307-NEW\MainWork-VS2017-IPHLPAPI\Release\MainWork.pdb
F:\Projects\2020-NEW\20200307-NEW\MainWork-VS2017-IPHLPAPI\x64\Release\MainWork.pdb
F:\Projects\2020-NEW\20200307-NEW\MainWork-VS2017-nvhelper\Release\MainWork.pdb
F:\Projects\2020-NEW\20200307-NEW\MainWork-VS2017-nvhelper\x64\Release\MainWork.pdb
F:\Projects\RunCompressedSC\x64\Release\RunCompressedSC.pdb
F:\V202102\MainWork-VS2017 – Monitor\Release\MainWork.pdb
F:\V202102\MainWork-VS2017 – Monitor\x64\Release\MainWork.pdb
H:\projects\MainWork\Release\MainWork.pdb
```

BIN
GuptiMiner/extras/PCAP/dns_txt_png_download.pcap Normal file
View File

Binary file not shown.

BIN
GuptiMiner/extras/PCAP/smb_backdoor_networking.pcap Normal file
View File

Binary file not shown.

1036
GuptiMiner/extras/mutexes.csv Normal file
View File

File diff suppressed because it is too large Load Diff

6043
GuptiMiner/extras/png_loader.txt Normal file
View File

File diff suppressed because it is too large Load Diff

944
GuptiMiner/extras/puppeteer.txt Normal file
View File

@ -0,0 +1,944 @@
=== puppeteer ===
00e8bc065f6f61ff73ce6e3894cef3444290f3187d24adb44ce3e40bbf1265ba
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
01e7815a561031fe449de0d3593a37dd45889bd80957bc86907299d6bafbb842
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
03b5892f114604ee2677de259112004f706ddaab08bdbd74194e04598d297d0b
RC2_key: Microsoft.com
Timestamp: 5E436889 (2020-02-12 02:52:57)
dynamic_host: r.guterman.net
dynamic_host: www.acmeautoleasing.net
dynamic_mutex: Global\SLDV11
mutex: Global\SLDV11
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
073de0dd6a2d05ec971984255b84e51e8b40fa26356ef4865fe4bbd04809c27b
RC2_key: Microsoft.com
Timestamp: 5CA30D04 (2019-04-02 07:19:32)
cleanup: updll3.dll
dynamic_host: dl.sneakerhost.com
dynamic_host: m.indpendant.com
dynamic_mutex: Global\SLDV014
mutex: Global\SLDV014
type: IMAGE_FILE_MACHINE_AMD64
0908dc4be50c507d45bf8a5c2e87fda7025caa0a5778ab72fa931521c1eabf35
Timestamp: 652568B6 (2023-10-10 15:07:34)
backdoor: net group "domain computers" /domain
dynamic_host: p.cbacontrols.com
dynamic_mutex: Global\Tue Oct 10 08:07:11 2023
mutex: Global\Tue Oct 10 08:07:11 2023
type: IMAGE_FILE_MACHINE_I386
0b4892173f04c8f516fda8e3047983ff7e21bb2e61c9a3e74d90a9dfd57cac6b
Timestamp: 5F89409A (2020-10-16 06:41:30)
dynamic_host: b.guterman.net
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV13
mutex: Global\SLDV13
type: IMAGE_FILE_MACHINE_I386
url: guterman.net
0ddbe6eea02d85fa29653df1e900ec02cb3d1962591b56f8c739d41fc19fffbf
mutex: Global\Thu Aug 10 03:25:11 2023
type: wiped_pe_header
0e15a731ae760a65aa73359d26ad53c97bde202663a72bcba808143078ed005f
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
0e55a978e50a1966a4c06f241b033ef1baa1b38a2b027d4e72fb407c44999437
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
0eb93f2215164539aa275f6e78937700f4ce187194946d47a05b61d095b57fe0
Timestamp: 5DF86193 (2019-12-17 05:03:15)
mutex: Global\SLDV024
type: IMAGE_FILE_MACHINE_AMD64
0f6f9bed970f2b373de41110e04ce2d361673d44a452d60b2f84453db38e67b1
RC2_key: Microsoft.com
mutex: Global\Fri Aug 13 02:22:55 2021
type: wiped_pe_header
url: bramco.net
0fb6fdd0cd00a3ba1f0fd5c64aab96a5f710642572408e6867eb0ea5cfa45646
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
12974702c9edf1d400247e75e4ded1afb14cdacddd724b7b9e4ed590cd7ac327
RC2_key: Microsoft.com
Timestamp: 5E39375D (2020-02-04 09:20:29)
dynamic_mutex: Global\SLDV10
mutex: Global\SLDV10
overlay_size: 393
type: IMAGE_FILE_MACHINE_AMD64
14c2a91c97545f1873da407baad0fb7fa334f211eb224472d0f4c798ccf51fba
RC2_key: Microsoft.com
Timestamp: 6447F28D (2023-04-25 15:32:29)
dynamic_host: m.sifraco.com
dynamic_host: www.widgeonhill.com
dynamic_mutex: Global\Tue Apr 25 08:32:05 2023
mutex: Global\Tue Apr 25 08:32:05 2023
overlay_size: 1024
type: IMAGE_FILE_MACHINE_AMD64
155c978faa587d1c4daf8b8fa6cebffe76f6e86b87ac4dba01e055a331c653ba
RC2_key: Microsoft.com
Timestamp: 6447F28D (2023-04-25 15:32:29)
dynamic_host: m.sifraco.com
dynamic_host: www.widgeonhill.com
dynamic_mutex: Global\Tue Apr 25 08:32:05 2023
mutex: Global\Tue Apr 25 08:32:05 2023
type: IMAGE_FILE_MACHINE_AMD64
181c5f27f22cd4174cd8cc666e02f85e36149247f1778684c582af130b90439b
mutex: Global\Thu Aug 10 03:25:11 2023
type: wiped_pe_header
19279dd1deae40d141105349525f11bd1a9e5b0eb017a1b6ada3fd75fa72c5a1
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
196ee32b59265e0a6000665896b00772854a2bb4207a7346a898c51cd00a3b9f
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
1c0707e320d179e17a74bb21ed8fee2aad76ad950ed7b764ec87ba90c5e1232a
RC2_key: Microsoft.com
Timestamp: 5E5C2A14 (2020-03-01 21:33:08)
dynamic_host: p.guterman.net
dynamic_host: www.acmeautoleasing.net
dynamic_mutex: Global\SLDV13
mutex: Global\SLDV13
type: IMAGE_FILE_MACHINE_I386
url: guterman.net
1c31d06cbdf961867ec788288b74bee0db7f07a75ae06d45d30355c0bc7b09fe
Timestamp: 5E659467 (2020-03-09 00:57:11)
dynamic_mutex: Global\SLDV17
mutex: Global\SLDV17
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
1c4aa00667e9e5da5cc4ff862962d450c4aeab2785a3e0f295e901265382a42d
Timestamp: 604FA57C (2021-03-15 18:20:44)
dynamic_host: r.bramco.net
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV26
mutex: Global\SLDV26
overlay_size: 512
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
1d843ce54d5b4254932fca729d7231e0bb68906637dc0cd78ca6d4a6df6a7d33
RC2_key: Microsoft.com
Timestamp: 5E394994 (2020-02-04 10:38:12)
dynamic_host: r.guterman.net
dynamic_host: www.acmeautoleasing.net
dynamic_mutex: Global\SLDV10
mutex: Global\SLDV10
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
1da58c38357a85c4aaa13611ae985fadb78da9d58f17ce84dced232cf4ffa156
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
1dc0be7a13142b6f370c03c6db4ec6f50c27cc3a1a7e112589342ce646ee2b4e
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
1e09444afcb6edfff6c4dc7a7aa087d37322f83cb4d9fb73ac31ed14543df834
Timestamp: 600ECFEF (2021-01-25 14:04:31)
dynamic_host: r.bramco.net
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV22
mutex: Global\SLDV22
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
1f7ab16cef3b117476f06cb80018fe93dfb23c36ad3c1481adefe84214b9eef9
Timestamp: 623AEE97 (2022-03-23 09:55:35)
dynamic_host: p.kompro.net
dynamic_mutex: Global\Tue Mar 23 02:37:32 2021
mutex: Global\Tue Mar 23 02:37:32 2021
type: IMAGE_FILE_MACHINE_I386
1fbc562b08637a111464ba182cd22b1286a185f7cfba143505b99b07313c97a4
Timestamp: 603CC54F (2021-03-01 10:43:27)
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV23
mutex: Global\SLDV23
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
22a99ac08016e2c00e67c34d4dce9332369e315c2ce9cce8c26f4969a3875c18
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
2482a5b13c0f15648775ec26672846a84bd1e4d3dce546b51fee342c2863837b
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
256a1292206219ec4e98a1a812cbc83ab9f005a30eadf891fee0f28f83ab396e
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
25e445a18cdd68e4b6fa65cf386901d439697e7ff38d3dcd905e2a386861f8e1
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
272a635852004da3940c881b22a6b1b808626b998635b1e5e35b2544fa6322a1
Timestamp: 60C730FA (2021-06-14 10:35:38)
dynamic_host: r.cbacontrols.com
dynamic_mutex: Global\Mon Jun 14 03:22:57 2021
mutex: Global\Mon Jun 14 03:22:57 2021
type: IMAGE_FILE_MACHINE_AMD64
280d1e1ab4ed3f619a726710b050bc4e0a961d387b0b3fd49acb3ca0d7aac737
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
2bd43f0f3a7aea7d33d8b8ff38619c51c2f83a8670e3a7840f62b45ec2f094ad
Timestamp: 63EDF9B0 (2023-02-16 09:38:56)
dynamic_host: r.cbacontrols.com
dynamic_mutex: Global\Wed Feb 15 10:21:13 2023
mutex: Global\Wed Feb 15 10:21:13 2023
type: IMAGE_FILE_MACHINE_AMD64
2fb726405a4314443e93933636c46d98af1497a63bde697c474fa952345f863b
Timestamp: 5F3C9B56 (2020-08-19 03:24:06)
dynamic_host: r.insomniaccinema.com
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV15
mutex: Global\SLDV15
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
33d73604b981912ec0541c6bf8ba80cb8efae2482683a7ba42acfbcb06060dbc
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
364984e8d62eb42fd880755a296bd4a93cc071b9705c1f1b43e4c19dd84adc65
Timestamp: 5C8B7968 (2019-03-15 10:07:36)
cleanup: updll3.dll3
dynamic_host: m.indpendant.com
dynamic_mutex: Global\SLDV01
mutex: Global\SLDV01
type: IMAGE_FILE_MACHINE_AMD64
3ad8a103de995660adfddf2f1be11745b570bba20c468e2c2ca875a7ef9bc47e
RC2_key: Microsoft.com
Timestamp: 5E39375D (2020-02-04 09:20:29)
dynamic_host: r.istrength.net
dynamic_host: www.breedbackfp.com
dynamic_mutex: Global\SLDV10
mutex: Global\SLDV10
type: IMAGE_FILE_MACHINE_AMD64
3ce7f8c66bf39b67c9b3d86d77d3ff773a682013213c71a99747406f3589693c
RC2_key: Microsoft.com
Timestamp: 5E5C2A2A (2020-03-01 21:33:30)
dynamic_host: r.guterman.net
dynamic_host: www.acmeautoleasing.net
dynamic_mutex: Global\SLDV13
mutex: Global\SLDV13
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
40abd042512e22812e40842ba5fb7b5104034e76c245a26a941180dc38e5de36
Timestamp: 652568B6 (2023-10-10 15:07:34)
backdoor: net group "domain computers" /domain
dynamic_host: p.cbacontrols.com
dynamic_mutex: Global\Tue Oct 10 08:07:11 2023
mutex: Global\Tue Oct 10 08:07:11 2023
overlay_size: 512
type: IMAGE_FILE_MACHINE_I386
40e65a3cb214e1ff134347c1d5c502921564df083fd7353d6a7a9c660647178e
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
418a382278e0390a3292d0042b5676f205134257f4fc2b775db6c32c35f74eb1
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
43a463f7a9a5bc968052e1cc09cd8dfbc4c0154cf93b5410470681623ad774fa
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
dynamic_host: r.sifraco.com
dynamic_host: www.bascap.net
dynamic_mutex: Global\Wed Mar 1 01:29:48 2023
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
448097ea0e839af1537079628c2e08d6d6e69e67c225a9db0cc61f4ca3489b9c
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
44d4f13db91f690e9a419c9e68c157863f65d183e45c1253b6c0647d9ac09b6c
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
487624b44b43dacb45fd93d03e25c9f6d919eaa6f01e365bb71897a385919ddd
Timestamp: 655CF177 (2023-11-21 18:05:43)
dynamic_host: m.korkyt.net
dynamic_mutex: Global\Thu Nov 2 08:21:56 2023
mutex: Global\Thu Nov 2 08:21:56 2023
type: IMAGE_FILE_MACHINE_AMD64
49c84411a050356cebbaaaa0fd61e9babf8d0ad895d42adfe58e0f239ebc7437
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
dynamic_mutex: Global\Wed Mar 1 01:29:48 2023
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
4a276bed38b5f79f203339cb57a7e931fa8343ad61dc3069324e23dc03a680df
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
4c943b1f9773c9f99acddb00f809ba260cb0b637863ba4b7029a64246f8edf80
Timestamp: 60B7B6C2 (2021-06-02 16:50:10)
dynamic_mutex: Global\Wed Jun 2 09:43:03 2021
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_AMD64
url: csims
4dfd082eee771b7801b2ddcea9680457f76d4888c64bb0b45d4ea616f0a47f21
RC2_key: Microsoft.com
Timestamp: 5D16DD30 (2019-06-29 03:38:24)
backdoor: net group "domain computers" /domain
cleanup: updll3.dll
dynamic_host: dl.sneakerhost.com
dynamic_host: m.indpendant.com
dynamic_mutex: Global\SLDV017
mutex: Global\SLDV017
type: IMAGE_FILE_MACHINE_AMD64
url: airequipment.net
50f072c5c089b0b87d3f4cd452b45701e9a98c5ecd7fe012a434aac84f13c980
Timestamp: 645B9E76 (2023-05-10 13:39:02)
mutex: Global\Wed May 10 06:38:46 2023
type: IMAGE_FILE_MACHINE_AMD64
51ee17a1f36c0eb3afe9e242ceb9bd8ec27b6cac03e07c53b15d603ff46f038b
Timestamp: 64D4BC28 (2023-08-10 10:30:00)
dynamic_mutex: Global\Thu Aug 10 03:25:11 2023
mutex: Global\Thu Aug 10 03:25:11 2023
overlay_size: 512
type: IMAGE_FILE_MACHINE_I386
53ab78a902d3d858b1101abd6f7745f310c1043b7a35c1aaa34d88cd66e6dce9
Timestamp: 5E16C976 (2020-01-09 06:34:30)
backdoor: net group "domain computers" /domain
dynamic_host: p.guterman.net
dynamic_mutex: Global\SLDV04
mutex: Global\SLDV04
type: IMAGE_FILE_MACHINE_I386
url: airequipment.net
url: guterman.net
5628c3bf55ee51b8a8a2ee161a6464896bb5cd9ba2c3675b9f131547e1109641
RC2_key: Microsoft.com
Timestamp: 5DF8A1A0 (2019-12-17 09:36:32)
dynamic_mutex: Global\SLDV02
mutex: Global\SLDV02
overlay_size: 393
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
570973ea724bdccc0a57fe6bd07fd556fd1f820f375a0486a0862bf201a26ab3
Timestamp: 64D4BBDC (2023-08-10 10:28:44)
dynamic_host: m.satchmos.net
dynamic_mutex: Global\Thu Aug 10 03:25:11 2023
mutex: Global\Thu Aug 10 03:25:11 2023
type: IMAGE_FILE_MACHINE_AMD64
593fda2ef5068125bfd197f0b6b71f012e3a446e26bdf959628e8ec0334da145
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
59845d750b00f4b7a2d9de5b8006d641aab87bc46ca6776eaa9448a432ac07a4
RC2_key: Microsoft.com
Timestamp: 611403A0 (2021-08-11 17:06:40)
dynamic_host: p.insomniaccinema.com
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Wed Aug 11 09:16:37 2021
mutex: Global\Wed Aug 11 09:16:37 2021
type: IMAGE_FILE_MACHINE_I386
598c916c37b148742ae3bb652ea184ab5c395f7a207952ccf70da71f8214f78e
RC2_key: Microsoft.com
Timestamp: 60532E50 (2021-03-18 10:41:20)
dynamic_host: r.csims.net
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Wed Mar 17 03:22:09 2021
mutex: Global\Wed Mar 17 03:22:09 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
url: csims
5b52761e9785271be81c703c777ed7e0e1d57001fe0c19f9d866852486495afb
Timestamp: 61D5D2E9 (2022-01-05 17:18:33)
dynamic_host: r.cbacontrols.com
dynamic_mutex: Global\Wed Jan 5 09:15:56 2022
mutex: Global\Wed Jan 5 09:15:56 2022
type: IMAGE_FILE_MACHINE_AMD64
5c1e759cce8c7b9dbf285c9df9c2e83ec8ca237e7e2b42300f7adc8ac48b7e5e
RC2_key: Microsoft.com
Timestamp: 5E5C2A2A (2020-03-01 21:33:30)
dynamic_mutex: Global\SLDV13
mutex: Global\SLDV13
overlay_size: 393
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
636c3dab16cee11f0cfa627f3df3d13f0df73306fdc1d78f9d373210bb1b853f
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
66a453d07b810d7eb3466bc7fb90575e5f2c699a6578d4320822235a483c9f89
Timestamp: 604FA58C (2021-03-15 18:21:00)
dynamic_host: p.bramco.net
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV26
mutex: Global\SLDV26
type: IMAGE_FILE_MACHINE_I386
url: bramco.net
67043559b1bf13aa158f9d938671e49bfd7eaa6ab060c854789a1012301abc3c
Timestamp: 655CF177 (2023-11-21 18:05:43)
dynamic_host: m.korkyt.net
dynamic_mutex: Global\Thu Nov 2 08:21:56 2023
mutex: Global\Thu Nov 2 08:21:56 2023
type: IMAGE_FILE_MACHINE_AMD64
6ad7bddda1115d3095378c566fcacbe78ba59692805c8a79cf5d5d8b48417f77
RC2_key: Microsoft.com
Timestamp: 6114038B (2021-08-11 17:06:19)
dynamic_host: r.insomniaccinema.com
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Wed Aug 11 09:16:37 2021
mutex: Global\Wed Aug 11 09:16:37 2021
type: IMAGE_FILE_MACHINE_AMD64
6cbdd883bd20d29c9c880c2c7bf56db42120cbbbd79705347a0f5fec3dc893b5
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
6f8ab3443d48142e1efc1fe3cbb0d0bc11885018405561a4a16dbd758897f53a
Timestamp: 623AEED0 (2022-03-23 09:56:32)
dynamic_host: r.kompro.net
dynamic_mutex: Global\Tue Mar 23 02:37:32 2021
mutex: Global\Tue Mar 23 02:37:32 2021
type: IMAGE_FILE_MACHINE_AMD64
73ccc9183ca701ea915ce000c02a65000c5abe3cb023393a3b12d68be90f32af
RC2_key: Microsoft.com
Timestamp: 63FF1C17 (2023-03-01 09:34:15)
dynamic_host: espcomp.net
dynamic_host: r.sifraco.com
dynamic_mutex: Global\Wed Mar 1 01:29:48 2023
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
792fed543f9e88b3580d5cf5262757488a66643710f239bb8a8d2e4e9a95bf7a
Timestamp: 600ECFDA (2021-01-25 14:04:10)
dynamic_host: p.bramco.net
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV22
mutex: Global\SLDV22
type: IMAGE_FILE_MACHINE_I386
url: bramco.net
7cfd8192d340cdc12c0c693680ce141293fa5d4c5655e12c82c31436c2190d22
RC2_key: Microsoft.com
Timestamp: 605DDD50 (2021-03-26 13:10:40)
dynamic_host: r.csims.net
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Fri Mar 26 06:10:27 2021
mutex: Global\Fri Mar 26 06:10:27 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
url: csims
7d74ec4f35f54fae700006b1fd3a146757f9a58c018843208bc2406daaca9fdb
Timestamp: 60C9C297 (2021-06-16 09:21:27)
dynamic_host: r.bramco.net
dynamic_mutex: Global\Wed Jun 2 09:43:03 2021
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
823e5dfe9a07d2c52116ad813d4c48e9b7e8073db0036242b2f951ec18629cd1
Timestamp: 6161664C (2021-10-09 09:52:12)
dynamic_host: r.bramco.net
dynamic_mutex: Global\Wed Jun 2 09:43:03 2021
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
8366a2b206e59e7f89c448eb021b0823d7550a350254d4a4ca7f6fee41da481c
Timestamp: 64D4BBDC (2023-08-10 10:28:44)
mutex: Global\Thu Aug 10 03:25:11 2023
overlay_size: 1015808
type: IMAGE_FILE_MACHINE_AMD64
850d6b12822ccf752e7c9fb07c0eeda38d9da91287c734f365ee9d7dfe87ac3a
RC2_key: Microsoft.com
Timestamp: 6114EC28 (2021-08-12 09:38:48)
dynamic_host: r.insomniaccinema.com
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Thu Aug 12 02:07:58 2021
mutex: Global\Thu Aug 12 02:07:58 2021
type: IMAGE_FILE_MACHINE_AMD64
86b8be6736ea19a671974349571c04725b223984ae1b255712376ec2de6b84fd
Timestamp: 64D4BC28 (2023-08-10 10:30:00)
dynamic_mutex: Global\Thu Aug 10 03:25:11 2023
mutex: Global\Thu Aug 10 03:25:11 2023
type: IMAGE_FILE_MACHINE_I386
8742ce176b3cdfaa212e97a98b855c9c3deb5d292e26911bef49bf5fc91b606c
Timestamp: 604FA57C (2021-03-15 18:20:44)
dynamic_mutex: Global\SLDV26
mutex: Global\SLDV26
overlay_size: 393
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
8774622ffeb82472856fde24985b7e4148927b7c2b26d52ae0328a06d64fbfa0
RC2_key: Microsoft.com
Timestamp: 611638EE (2021-08-13 09:18:38)
dynamic_host: p.bramco.net
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Fri Aug 13 02:17:49 2021
mutex: Global\Fri Aug 13 02:17:49 2021
type: IMAGE_FILE_MACHINE_I386
url: bramco.net
8bd87ad7b1148c3020b8663591b991c3333f19f9ffe355736186ec1cf1514c45
RC2_key: Microsoft.com
Timestamp: 5CA30D04 (2019-04-02 07:19:32)
cleanup: updll3.dll
dynamic_host: dl.sneakerhost.com
dynamic_host: m.indpendant.com
dynamic_mutex: Global\SLDV014
mutex: Global\SLDV014
overlay_size: 1024
type: IMAGE_FILE_MACHINE_AMD64
8ce1ecdefd64066b901d39c91978a27c233346600a5736bd785bc73e754dbc3a
RC2_key: Microsoft.com
Timestamp: 6447F28D (2023-04-25 15:32:29)
mutex: Global\Tue Apr 25 08:32:05 2023
overlay_size: 2506752
type: IMAGE_FILE_MACHINE_AMD64
8e2b89216cf6c3b5ae55a1a0eed310a8cf9b2eb14db90750744995c8577cd85e
RC2_key: Microsoft.com
Timestamp: 607D8F4A (2021-04-19 14:10:18)
dynamic_host: r.kompro.net
dynamic_host: www.edgesync.net
dynamic_mutex: Global\Mon Apr 19 06:03:17 2021
mutex: Global\Mon Apr 19 06:03:17 2021
type: IMAGE_FILE_MACHINE_AMD64
8ee5c850558209b4532c73ba5cce6b071ddbcf610a5ea5c37691eeb38d7b46f5
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
908151ddee11b5200871595ec40148ce2c08bed608529c150e94b22e9115fef3
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
914f6f6bc5d351726546a269100949431077bbf13f7262ef484795382a77de9a
Timestamp: 604FA57C (2021-03-15 18:20:44)
dynamic_host: r.bramco.net
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV26
mutex: Global\SLDV26
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
94f1c7bc6708cc6b4bde83239c6d5cb5e36499903d75ab0d8d663c3b41125d3c
RC2_key: Microsoft.com
Timestamp: 6446901D (2023-04-24 14:20:13)
dynamic_host: r.sifraco.com
dynamic_host: www.widgeonhill.com
dynamic_mutex: Global\Mon Apr 24 07:19:54 2023
mutex: Global\Mon Apr 24 07:19:54 2023
type: IMAGE_FILE_MACHINE_AMD64
94fb53590bd3f4a7d53742988c5a83e39a08c475f71124afc114c57acb4adcfd
RC2_key: Microsoft.com
Timestamp: 611685CF (2021-08-13 14:46:39)
dynamic_host: p.bramco.net
dynamic_host: www.desmoinesreg.com
dynamic_mutex: Global\Fri Aug 13 02:22:55 2021
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_I386
url: bramco.net
9538d89551a36879f0bdb530cd56a2eab5a0d9bd7ed51d4eb8c9a73c755ce769
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
9571d8688702a8a9ccf92c100d2b808930074833c33d4355e4f7fe2805b02f5a
RC2_key: Microsoft.com
Timestamp: 5DF8A1A0 (2019-12-17 09:36:32)
dynamic_host: r.guterman.net
dynamic_host: www.acmeautoleasing.net
dynamic_mutex: Global\SLDV02
mutex: Global\SLDV02
type: IMAGE_FILE_MACHINE_AMD64
url: guterman.net
95bea0562efc8fa3e43361c56ef0a20b5675f2121ac163c83e666dc493c00f6e
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
95feddb84a42dab8119676b4317a7b5576296617f483271023ad4a71c73d9448
RC2_key: Microsoft.com
Timestamp: 6447F28D (2023-04-25 15:32:29)
mutex: Global\Tue Apr 25 08:32:05 2023
type: IMAGE_FILE_MACHINE_AMD64
9836663b04ec62e112d7e821d1992516d6701d5a37c97d56d4bdd472dc4643b2
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
98aebd99e0fa1c4f69fbe0bceba64470e31793c6c2cc9e64d0a47ba5ca41df80
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
dynamic_host: r.sifraco.com
dynamic_host: www.bascap.net
dynamic_mutex: Global\Wed Mar 1 01:29:48 2023
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
9a7278e8db656feeff257e05925344f2403de45e60c6267f3d6018b37ef5544d
Timestamp: 6046330C (2021-03-08 14:22:04)
dynamic_host: r.bramco.net
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV25
mutex: Global\SLDV25
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
9d1037c35c24527fcb1cb09c7171984307a56098b43b1d3367acc7b32b04b216
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
9e401a2dd3487c1d1ad46567aef56b40273f11ff8a6d7bac9406aacd8a4a07dd
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
a0bc7b441a1a9f602e8d6c7e04f6e15841eb31a19867622f8c0852a7214467ae
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
a137df47fcd9fea5ae2c8e9107c8bf4d060b092ecfef84b23d29a2cea2ac1928
Timestamp: 652568F4 (2023-10-10 15:08:36)
backdoor: net group "domain computers" /domain
dynamic_host: m.cbacontrols.com
dynamic_mutex: Global\Tue Oct 10 08:07:11 2023
mutex: Global\Tue Oct 10 08:07:11 2023
overlay_size: 1024
type: IMAGE_FILE_MACHINE_AMD64
a2ee522e7d2656c212d80cac14ffffa48aca241a86434565ce34fbf5d0218bcc
RC2_key: Microsoft.com
Timestamp: 611638CA (2021-08-13 09:18:02)
dynamic_host: r.bramco.net
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Fri Aug 13 02:17:49 2021
machine_type: IMAGE_FILE_MACHINE_AMD64
mutex: Global\Fri Aug 13 02:17:49 2021
type: 523
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
a707395de967df05b59aef3aa4ef789a4ff372a987b7d3ae5c56d12c47f2726a
RC2_key: Microsoft.com
Timestamp: 607D8F60 (2021-04-19 14:10:40)
dynamic_host: p.kompro.net
dynamic_host: www.edgesync.net
dynamic_mutex: Global\Mon Apr 19 06:03:17 2021
mutex: Global\Mon Apr 19 06:03:17 2021
type: IMAGE_FILE_MACHINE_I386
a8caa2bff412bc695ea7863e49ac7cc2777634429605c4b1b74d7601ca6f08db
RC2_key: Microsoft.com
Timestamp: 6447F28D (2023-04-25 15:32:29)
dynamic_host: www.widgeonhill.com
dynamic_mutex: Global\Tue Apr 25 08:32:05 2023
mutex: Global\Tue Apr 25 08:32:05 2023
type: IMAGE_FILE_MACHINE_AMD64
a9bc23644b8da0f522d8de3cc76ed5d1ee746cbe87ee3ff3b44cf3aa6f0e2af0
RC2_key: Microsoft.com
Timestamp: 623C4F0E (2022-03-24 10:59:26)
dynamic_host: r.kompro.net
dynamic_host: www.espcomp.net
dynamic_mutex: Global\Thu Mar 24 03:57:52 2022
mutex: Global\Thu Mar 24 03:57:52 2022
type: IMAGE_FILE_MACHINE_AMD64
aa1b1c5c4ff7575f3029baf16f14fd6d47a7b81f253d3155fa4a34648055c756
Timestamp: 60B7B6A6 (2021-06-02 16:49:42)
dynamic_host: p.csims.net
dynamic_mutex: Global\Wed Jun 2 09:43:03 2021
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_I386
url: csims
aeb5270a9da29cd11b98b203f5316ef74f7b89ec22ae20ed3050e3082cdecd80
Timestamp: 640F334A (2023-03-13 14:29:30)
dynamic_host: m.sifraco.com
dynamic_mutex: Global\Mon Mar 13 07:29:11 2023
mutex: Global\Mon Mar 13 07:29:11 2023
type: IMAGE_FILE_MACHINE_AMD64
afddfee9658a39429efb67ef33ef7743e82c143e265cc10b06d4c5ea1b31430b
Timestamp: 5E6DD58B (2020-03-15 07:13:15)
dynamic_host: r.insomniaccinema.com
dynamic_mutex: Global\LOADPERF_MUTEX
dynamic_mutex: Global\SLDV13
mutex: Global\SLDV13
type: IMAGE_FILE_MACHINE_AMD64
b02c869c15840dce09882a0d3c5d0b2f3415221ea73d971b95ff3ccaa33884dd
Timestamp: 63F91B9D (2023-02-24 20:18:37)
dynamic_host: r.sifraco.com
dynamic_mutex: Global\Thu Feb 23 08:37:09 2023
mutex: Global\Thu Feb 23 08:37:09 2023
type: IMAGE_FILE_MACHINE_AMD64
b08b140961f5e1b3714b1a24fd67e904b3c0125ac58f7191e3630e8713886b07
RC2_key: Microsoft.com
Timestamp: 6114EC87 (2021-08-12 09:40:23)
dynamic_host: p.insomniaccinema.com
dynamic_host: w.gesucht.net
dynamic_mutex: Global\Thu Aug 12 02:07:58 2021
mutex: Global\Thu Aug 12 02:07:58 2021
type: IMAGE_FILE_MACHINE_I386
b14f42701ee9df43fc9b186b0b641440f0988f3686db8e1067ba191dfd6e4aaf
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
b280a43721b7d94aaf5e296b59756381faef680c11c6a25348854c0f41f617d7
Timestamp: 5E16C976 (2020-01-09 06:34:30)
backdoor: net group "domain computers" /domain
dynamic_mutex: Global\SLDV04
mutex: Global\SLDV04
overlay_size: 955
type: IMAGE_FILE_MACHINE_I386
url: airequipment.net
url: guterman.net
b4f9b5b54525084561120116cf07b1da75d2919d3fecc74485a4c1a7cca9d1f4
Timestamp: 645B9E76 (2023-05-10 13:39:02)
dynamic_host: m.troudet.com
dynamic_mutex: Global\Wed May 10 06:38:46 2023
mutex: Global\Wed May 10 06:38:46 2023
type: IMAGE_FILE_MACHINE_AMD64
ba3e893dded89227f6d3d5b57ece0c5453532a4111b292f303956e0848e94e07
Timestamp: 60B7B6A6 (2021-06-02 16:49:42)
dynamic_mutex: Global\Wed Jun 2 09:43:03 2021
mutex: Global\Wed Jun 2 09:43:03 2021
overlay_size: 955
type: IMAGE_FILE_MACHINE_I386
url: csims
bad721323b4ab5282c0f0b97315aff122d05ae26588b9e4c8ad28f5aac3e34fb
Timestamp: 605C51F0 (2021-03-25 09:03:44)
dynamic_host: r.csims.net
dynamic_mutex: Global\Thu Mar 25 02:03:14 2021
mutex: Global\Thu Mar 25 02:03:14 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
url: csims
baef22a9ac48d18a83cbc2e9a009d6356f43295e40e102a5941752cc4d6ba0b0
RC2_key: Microsoft.com
dynamic_host: w.gesucht.net
mutex: Global\Fri Aug 13 02:22:55 2021
type: wiped_pe_header
url: bramco.net
bc33bd4a1642936f9066df73d5e7407d4ec15bdc6f266a574859dd0ca30e76f1
Timestamp: 60B7B6C2 (2021-06-02 16:50:10)
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_AMD64
url: csims
bcf8b7515bef7f167ba7388cc021d33bfea0b8d6b50bee1e72ac90e663ab3062
RC2_key: Microsoft.com
mutex: Global\Fri Aug 13 02:22:55 2021
type: wiped_pe_header
url: bramco.net
bd09ea8ee8bdf6f72556732184e27d92875e2d16077430631fac307eb011bf5f
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
bd2ea1bad58a55deb854d6d859dc2b283e9bfea64d41ad57badbfe8b730e817a
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
bdec71316c5bf74969082aab2121d93bee59d14978eb4882067f3e6ce2ecc76c
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
bf22112d088b077cc5e2b8ef9325bd6b18a0fb7341ac7d1330dd7b5fa68783ec
Timestamp: 5E16C9A2 (2020-01-09 06:35:14)
backdoor: net group "domain computers" /domain
dynamic_host: r.guterman.net
dynamic_mutex: Global\SLDV04
mutex: Global\SLDV04
type: IMAGE_FILE_MACHINE_AMD64
url: airequipment.net
url: guterman.net
bfd2603d9fad8e707bed2fd05bb0209db2618a46ca0a873f0631f94570ffd4cd
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
c048a93e2591023a60e79a4eeaaafad4402c5b79be048ecb8fd1e1fcab32dcff
RC2_key: Microsoft.com
Timestamp: 63FF1B2B (2023-03-01 09:30:19)
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
c11c5176ceb34d511bcac3c3ed012ffac174d179084d38f86cf8f31518b8c2db
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
c15a539b006341391e4ac6db09d4f15e6f0a4ed141418deed60b119c266d3c66
RC2_key: Microsoft.com
mutex: Global\Fri Aug 13 02:22:55 2021
type: wiped_pe_header
url: bramco.net
c34c1dfc481968ebec37f5617e5190d679b0d9fb04060a916060f57d9c59de38
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
c433816cf00c6406f0a1c892636c4d6499f690feb797777f3eabf73555ba4c07
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
c640621f089bb2ac6bd95c8a6f6f5f2793ff3a9f857d6b2a701f946580564cc4
RC2_key: Microsoft.com
Timestamp: 5DFAEAA5 (2019-12-19 03:12:37)
dynamic_host: p.guterman.net
dynamic_host: www.acmeautoleasing.net
dynamic_mutex: Global\SLDV02
mutex: Global\SLDV02
type: IMAGE_FILE_MACHINE_I386
url: guterman.net
cc94d328e8961451f1976a871f7d8d44d0f50a62e53c000bc1d231e3e09df024
Timestamp: 60C9C2A6 (2021-06-16 09:21:42)
dynamic_mutex: Global\Wed Jun 2 09:43:03 2021
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_I386
url: bramco.net
cfddbddb99db4eecc9d4724ef42444bafab895c20ef43907e9fee9ca5036c13e
Timestamp: 6161665D (2021-10-09 09:52:29)
dynamic_host: p.bramco.net
dynamic_mutex: Global\Wed Jun 2 09:43:03 2021
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_I386
url: bramco.net
d02ede31e8cbf212acb7ea0141a58a20634cedeec3cf988b4c2337d6ec46228d
mutex: Global\Wed Jun 2 09:43:03 2021
type: wiped_pe_header
url: bramco.net
d83183c3233df4a121ab1238386632d06c8aa3019b8afcef5397d5138663fe23
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
da8c00e48c5721bf2c3cb7beb85e8f9f1afc55c22bd88a513708cf6f475ed073
mutex: Global\SLDV024
type: wiped_pe_header
db7d6e77d19c86c47e77d9a9149aaaa806b5ed78074ed731bc9bb29996365475
Timestamp: 655CF177 (2023-11-21 18:05:43)
dynamic_host: m.korkyt.net
dynamic_mutex: Global\Thu Nov 2 08:21:56 2023
mutex: Global\Thu Nov 2 08:21:56 2023
overlay_size: 512
type: IMAGE_FILE_MACHINE_AMD64
e0bb1b9e70d4dc09f0f15a5030b760be890c090096d86293f6cb7d38a9f7b114
Timestamp: 5E659483 (2020-03-09 00:57:39)
dynamic_host: p.guterman.net
dynamic_mutex: Global\SLDV17
mutex: Global\SLDV17
type: IMAGE_FILE_MACHINE_I386
url: guterman.net
e0e41b26a7e191fb356f57dccda9dd1e8ac3f5b6cafe4211e89b1d1381854743
RC2_key: Microsoft.com
dynamic_host: w.gesucht.net
mutex: Global\Fri Aug 13 02:22:55 2021
type: wiped_pe_header
url: bramco.net
e2b6cfd3c50ecbecefa7088936029e29e6191357205a4911e81777d3dba4c295
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
dynamic_host: r.bramco.net
dynamic_host: www.desmoinesreg.com
dynamic_mutex: Global\Fri Aug 13 02:22:55 2021
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
e68c99d0426d5227d7e4288d8eaf91d888ae5ac4e027ed4f9a72b7c5cce41f42
RC2_key: Microsoft.com
Timestamp: 5E394977 (2020-02-04 10:37:43)
dynamic_mutex: Global\SLDV10
mutex: Global\SLDV10
type: IMAGE_FILE_MACHINE_I386
url: guterman.net
e82ea9432cee56ad43a76e96fe191ef1b1c2d59c3097911ab1f67d219a27ef36
Timestamp: 5E16C9A2 (2020-01-09 06:35:14)
backdoor: net group "domain computers" /domain
dynamic_mutex: Global\SLDV04
mutex: Global\SLDV04
overlay_size: 905
type: IMAGE_FILE_MACHINE_AMD64
url: airequipment.net
url: guterman.net
e8d5b9d5993ca1c357c9dc3cad6266f03af0baf8378c43f4c54c987dceb0512c
Timestamp: 60C62513 (2021-06-13 15:32:35)
dynamic_host: p.cbacontrols.com
dynamic_mutex: Global\Sun Jun 13 08:22:07 2021
mutex: Global\Sun Jun 13 08:22:07 2021
type: IMAGE_FILE_MACHINE_I386
f0ccfcb5d49d08e9e66b67bb3fedc476fdf5476a432306e78ddaaba4f8e3bbc4
Timestamp: 652568F4 (2023-10-10 15:08:36)
backdoor: net group "domain computers" /domain
dynamic_host: m.cbacontrols.com
dynamic_mutex: Global\Tue Oct 10 08:07:11 2023
mutex: Global\Tue Oct 10 08:07:11 2023
type: IMAGE_FILE_MACHINE_AMD64
f2271b550fcd03e63f3b8b3f3e0b13d9e2ee3e05ca25ffa899b3995830418a4a
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
f31fbab5396c2dc852e700332a7a90dd63ee3144e820e94ee412d977c40b7606
Timestamp: 60B7B6C2 (2021-06-02 16:50:10)
mutex: Global\Wed Jun 2 09:43:03 2021
type: IMAGE_FILE_MACHINE_AMD64
url: csims
f3de56ce7c1461b671539ebe4eda9b01172befd4ff0e5651a90adefa7f886b32
RC2_key: Microsoft.com
Timestamp: 63FF1C17 (2023-03-01 09:34:15)
dynamic_host: espcomp.net
dynamic_host: r.sifraco.com
dynamic_mutex: Global\Wed Mar 1 01:29:48 2023
mutex: Global\Wed Mar 1 01:29:48 2023
type: IMAGE_FILE_MACHINE_AMD64
f65fd09f4f759d241d457c7198c60c38901e989423ce1f7fc127e689d71adbba
dynamic_host: cs.espcomp.net
dynamic_host: r.kompro.net
dynamic_mutex: Global\Thu Apr 1 02:21:51 2021
f9d7ebea938311627b05572a47049b70ef1628ecd442bd71b8ab53d90d68d7aa
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
overlay_size: 2514944
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
fb094d0f47aa54773d18c2e7fd576f67db0f699d010d33964e5e3fda2d2369bf
Timestamp: 605C525B (2021-03-25 09:05:31)
dynamic_host: p.csims.net
dynamic_mutex: Global\Thu Mar 25 02:03:14 2021
mutex: Global\Thu Mar 25 02:03:14 2021
type: IMAGE_FILE_MACHINE_I386
url: bramco.net
url: csims
fc225ca2330ef2e641a9f0934fef12edf019d22a96e4baa66810aa3cecc9e878
RC2_key: Microsoft.com
mutex: Global\Wed Mar 1 01:29:48 2023
type: wiped_pe_header
fdc83e899b7c5e68e263ae9ad5edd1a43cdd1f3cb04d86663986ac8f8eadd108
RC2_key: Microsoft.com
Timestamp: 6116861F (2021-08-13 14:47:59)
mutex: Global\Fri Aug 13 02:22:55 2021
type: IMAGE_FILE_MACHINE_AMD64
url: bramco.net
ff1129559c3fe1838b11ef21b5352c3ab0ae0310476c57e7f0ab299fd7d3f757
Timestamp: 61D5D2BA (2022-01-05 17:17:46)
dynamic_host: p.cbacontrols.com
dynamic_mutex: Global\Wed Jan 5 09:15:56 2022
mutex: Global\Wed Jan 5 09:15:56 2022
type: IMAGE_FILE_MACHINE_I386

51
GuptiMiner/extras/xmrig.txt Normal file
View File

@ -0,0 +1,51 @@
=== xmrig ===
050f75a3a1163bde1e4d638410abfaa065a42dabaea1693e1eb3915e63b81ad3
091a6dd393c5ed96f89eab359ba120bf5e8eca537bf38c6e59a4aefb9ece4986
0a2dd3938acc48c99d84a8eb3f0e1f980915bc1366b713a42968eedf7a7949b6
0a82f8a52dbb984c6242c454ee42f501772d91e71f5db0fa2761e7a416107960
15f55abbb31a9f5f7c147c142ae3d8c3e6dd4aedc0a6561cb8e1543828b83a6a
16cbe7c78de58646b47c8bfab541cbbe1f6ff891b9fd4da4b465ee895d10ae9b
17f18e28df090371034c04017d706fabc967f2912effb147b217310b82b0a290
1d5be91ccc8f8db16d04ed97d706997b9b31971d4baf53707c11fa6b6242bffb
1e81114fd67337f405e3fc80992512fee14a7a22f5f59d44c45a64bc95275ee1
28b546a73b477f4f10e94bc741e22e96f732a1cbd625bf778d8632d8aea3b84a
294aa8c732e5fc519b1481715a807d20aa41393dd607ebe85834290ea0c66c63
39c3972284b87c72475c8dede8a3da14ece5edebeaef25103afc3ee12f4af8cb
3ffff78065b25e7195852e2dde7f66540017093cc5ef8d4e99ba31f4efdc967d
42b96d3a930fa00d3b22c6fdf5f530da765630c4297e0ff3606362879a3dcf5e
4a656c145e98d07c01b3d5e1b339efc1472a1e17db9889a44eda8e54b0f728df
4f0cc3ba1cbe508c32255b24b841541ec430c9445bb86c6155a02bcd9fb3a740
51fc356d06ce190efb39b9ca6b115335216f1795ba5566ca7b2491b56ef2d4ca
59ad17d284b72e23b7ecfc05763ad4dee130d24804ae7d1896d45dfdb49492fd
651de5318700b1b24798699c5cc19bbc4588939d99678cd2c28319414f33ebf2
739f1db51b8c18f21cca3a69484c60866aa636bd738a6dff17da97f45bc7560e
76685b13f61d997808a4a07da479fda72f99932113cae7e6f112bb62e2cac36b
78a452a6e1a3951dc367f57ace90711202c824b68835c5db86814f5b41486947
7cf51d518204e92cd51605052280b230558428e951f71b59826cb636716c76aa
836a98e1d6727d1aa16c1c172e0b2221579ef3f3767117facb3b156b5df90234
87046a0e46d1fc5352f7e7920cde14e2b9647616f1fc56a8d7205008ac52c24f
8707da9edd70227ddf6c1bb61cf1f04d5e1509f08d31112e755b82fcae342e75
875ece717950e875185e360423201f68a9d8631d4cfa3dd7f313a7b992c72f4a
88b039f48045d10643048f5d642340d014ca1b78b914771b28ec69bc31e5b1ee
8fa54118c71d139515f6a53ccd1f2357b4520053b55616ab820ce435bcc0178e
904a01354716fcf82db750b759c1de6f361c346b5067a2c80a355d91e7b1cd7c
911d754845390178b6aba65c35d83cbbb29f92f56f66a627ec3dd76bb0ade6eb
a842ac93f962833bf3bcf2f25568aeba0df344f9058f249df18b3a2821b7f41d
aacc49be23fbf3f11fc857a27a9e73090d3b140fd2e42ae007a5f7d8914eca42
ae521b3a3a42373401202720a4542f0b0e31d80e80a65a9a23aa1211a290b655
aea6e489a42531e99460f808487251eae4a486c7188421d848b3b3b8fafa003b
b40a082b32b70d12e0f4ef202129c7b6c867a3cab01e282960ec582b7f5c692a
b79d113472dd315bb348fe3ef4dd9365dac27aeb5ff2575d0cf45f249877526a
b85826642308a274463f19c93c28fcebb0f26a5ea08fecce2bd259419bf7a0e4
b97780c2788ae59d4606ed7313991c0fa5129cba85fd460d7a71702a41240fbb
bab13ca7c83e6c7e1959d6e29272886dbf26d63f54da3c3abe4024114a8cd43c
bf563fba2a2e049b7c96929a8e509373c36e4f8dba73853467e4837f43d3f0c9
c30e64dbdc0f975cb4bde3d3895bf651975cf6bb4109b35aa60057929c777db9
ca9b36e407cf1868dd330a2254117d7d24876774f6c6f6f47f2da1c68caf610e
cb6d3553c8e088840021aad2bdd0fa2166118de9717131e9504c5dfed72e3363
e25ade7d4ab176efec13dc68bd0aae0560a21a52863f4ad0f515d7244c3663a7
e9d016eb85ec8333e4e1d39b89b438b3d006b7f6204d1038de0e1f0a30eed089
ea2d25a15c0a1e12ceac1dd435345ca6c2681ce24519745099342c886a0a7b53
eedbee785aaba117050858a59fbfdb83279e61cdc1472dc1b8a35228c47f363a
ffae08718829e9e91cd03c803ae6bd2e2669dbcf0e99ae9a3ac8281173532a98

51
GuptiMiner/network.txt Normal file
View File

@ -0,0 +1,51 @@
_spf.microsoft[.]com
acmeautoleasing[.]net
b.guterman[.]net
breedbackfp[.]com
crl.microsoft[.]com
crl.peepzo[.]com
crl.sneakerhost[.]com
desmoinesreg[.]com
dl.sneakerhost[.]com
edgesync[.]net
espcomp[.]net
ext.microsoft[.]com
ext.peepzo[.]com
ext.sneakerhost[.]com
gesucht[.]net
globalsign.microsoft[.]com
icamper[.]net
m.airequipment[.]net
m.cbacontrols[.]com
m.gosoengine[.]com
m.guterman[.]net
m.indpendant[.]com
m.insomniaccinema[.]com
m.korkyt[.]net
m.satchmos[.]net
m.sifraco[.]com
ns.bretzger[.]net
ns.deannacraite[.]com
ns.desmoinesreg[.]com
ns.dreamsoles[.]com
ns.editaccess[.]com
ns.encontacto[.]net
ns.gravelmart[.]net
ns.gridsense[.]net
ns.jetmediauk[.]com
ns.kbdn[.]net
ns.lesagencestv[.]net
ns.penawarkanser[.]net
ns.srnmicro[.]net
ns.suechiLton[.]com
ns.trafomo[.]com
ns1.earthscienceclass[.]com
ns1.peepzo[.]com
ns1.securtelecom[.]com
ns1.sneakerhost[.]com
p.bramco[.]net
p.hashvault[.]pro
r.sifraco[.]com
spf.microsoft[.]com
widgeonhill[.]com
www.bascap[.]net

25
GuptiMiner/samples.csv Normal file
View File

@ -0,0 +1,25 @@
sha256,md5,sha1
07beca60c0a50520b8dbc0b8cc2d56614dd48fef0466f846a0a03afbfc42349d,ca3dabc60d856998e019be2bda60493f,ff8678cdc62494f84b5b8755ef8201502c345fa4
1c31d06cbdf961867ec788288b74bee0db7f07a75ae06d45d30355c0bc7b09fe,ee85e173ae8624365dbcd16d55f25588,9b15c85e31eff8b269b4155f642d2eea36fef99c
1fbc562b08637a111464ba182cd22b1286a185f7cfba143505b99b07313c97a4,cf87d566bc28f8bf36bf1ded84d69c1f,cc4c217ea65467ba4430951c7fb356ab7bc18b59
294b73d38b89ce66cfdefa04b1678edf1b74a9b7f50343d9036a5d549ade509a,243bc2e3ac74d4516cc5874b3c78038f,6155c5fd915b6eaecd78d2f082979c5c8f346cb0
31dfba1b102bbf4092b25e63aae0f27386c480c10191c96c04295cb284f20878,de4c57d614a482aa25df320992767cc1,57753f0a38b802c49d5b6880253dbbe28ce13adc
3515113e7127dc41fb34c447f35c143f1b33fd70913034742e44ee7a9dc5cc4c,43f5a32fa972b786b47d18f54381b1f6,778b8461ec4c3da0c370feb9c467591617719959
357009a70daacfc3379560286a134b89e1874ab930d84edb2d3ba418f7ad6a0b,5c6dee012a248ae3d37ab670772197f5,2f8e6f072498b8e1e7da4cad93a289205341fb79
364984e8d62eb42fd880755a296bd4a93cc071b9705c1f1b43e4c19dd84adc65,f2701c1fc6f412c07020ca7e1e964966,183ec331a9ea2a5366693c4d4ca308bf3e185f19
487624b44b43dacb45fd93d03e25c9f6d919eaa6f01e365bb71897a385919ddd,85c07f796669fafca131040fdb1c3475,ae17a91c02be20129bd1714103b07a008dbcd364
4dfd082eee771b7801b2ddcea9680457f76d4888c64bb0b45d4ea616f0a47f21,756f0ba9fe8f47bd4963d3f4c0b975df,e89bbe49bc648d36c2fbff5ab232bd9afafe8bbf
6305d66aac77098107e3aa6d85af1c2e3fc2bb1f639e4a9da619c8409104c414,331c9ae049b2ede6a42fc1fdf5c1c06f,4204fefa87ff3e5f04b18432976c46b6fe36500a
74d7f1af69fb706e87ff0116b8e4fa3a9b87275505e2ee7a32a8628a2d066549,78857b4821d9590d406b3d1b6bc0bd9b,a78d792f9ab2e94ccd7710a43ad4bf2bb0cbf4b2
7a1554fe1c504786402d97edecc10c3aa12bd6b7b7b101cfc7a009ae88dd99c6,4c8b7db2184d2952d3e4dabd94220fd3,47d7135b31d9b4cfd000e0634c5bfe8a96968861
7f1221c613b9de2da62da613b8b7c9afde2ea026fe6b88198a65c9485ded7b3d,43227a02000a75182cbbe1b7711a7689,ffafeeb8f49b1b21cab986fbad2e628ef031fe0f
8446d4fc1310b31238f9a610cd25ea832925a25e758b9a41eea66f998163bb34,6890e6e6ecfcd14e5ccd269e885a4c1c,c902785e312ad1a28a7719dd2edef7d2168a5100
8e96d15864ec0cc6d3976d87e9e76e6eeccc23c551b22dcfacb60232773ec049,4bc0036b556116ad030296d8fae96925,0c06df39db322bf4650efbf6f8e5fbafe1936ef9
af9f1331ac671d241bf62240aa52389059b4071a0635cb9cb58fa78ab942a33b,2968c77d176140925689df4d9aeedc7a,fbc5986ca3d9448501d9453ed4fbb7b4ccb52a48
b0f94d84888dffacbc10bd7f9983b2d681b55d7e932c2d952d47ee606058df54,d34d74d4849fe6bdb48b0ba230d6cd8c,23c76feb4adc5f9422b06383c1f90b84ae3fdcc5
c3122448ae3b21ac2431d8fd523451ff25de7f6e399ff013d6fa6953a7998fa3,74c285f86406dfa87673a95a41900dc3,4bd7f794815a61b57a33d71ca745e9221d65f7a4
de48abe380bd84b5dc940743ad6727d0372f602a8871a4a0ae2a53b15e1b1739,8c0f558e8f0481331d66b54b8e82dec1,5aab2fe102b757a0dbaa66a54b4d31fb110e5e4f
e0dd8af1b70f47374b0714e3b368e20dbcfa45c6fe8f4a2e72314f4cd3ef16ee,572b5b1e9b84adc60655c4b8c7c3e6af,4e8c22ee9539a7f0d42e12bcef16a5d7e1191534
f0ccfcb5d49d08e9e66b67bb3fedc476fdf5476a432306e78ddaaba4f8e3bbc4,30f9e0d5c865b56c6f48741146e4464e,ff36cf1076331bd55a44410904e82c4ecf53de6e
f656a418fca7c4275f2441840faaeb70947e4f39d3826d6d2e50a3e7b8120e4e,431f11acfde99c9f15dda9ea16bd5391,411abaf231cc6141f185e6aaaa1f5857f0487809
ff884d4c01fccf08a916f1e7168080a2d740a62a774f18e64f377d23923b0297,f5326de87f0d4669f591ddae3dca8ea4,7dd2534d5c1600072acd8c4d5c41a3ba6a3c6112
1 sha256 md5 sha1
2 07beca60c0a50520b8dbc0b8cc2d56614dd48fef0466f846a0a03afbfc42349d ca3dabc60d856998e019be2bda60493f ff8678cdc62494f84b5b8755ef8201502c345fa4
3 1c31d06cbdf961867ec788288b74bee0db7f07a75ae06d45d30355c0bc7b09fe ee85e173ae8624365dbcd16d55f25588 9b15c85e31eff8b269b4155f642d2eea36fef99c
4 1fbc562b08637a111464ba182cd22b1286a185f7cfba143505b99b07313c97a4 cf87d566bc28f8bf36bf1ded84d69c1f cc4c217ea65467ba4430951c7fb356ab7bc18b59
5 294b73d38b89ce66cfdefa04b1678edf1b74a9b7f50343d9036a5d549ade509a 243bc2e3ac74d4516cc5874b3c78038f 6155c5fd915b6eaecd78d2f082979c5c8f346cb0
6 31dfba1b102bbf4092b25e63aae0f27386c480c10191c96c04295cb284f20878 de4c57d614a482aa25df320992767cc1 57753f0a38b802c49d5b6880253dbbe28ce13adc
7 3515113e7127dc41fb34c447f35c143f1b33fd70913034742e44ee7a9dc5cc4c 43f5a32fa972b786b47d18f54381b1f6 778b8461ec4c3da0c370feb9c467591617719959
8 357009a70daacfc3379560286a134b89e1874ab930d84edb2d3ba418f7ad6a0b 5c6dee012a248ae3d37ab670772197f5 2f8e6f072498b8e1e7da4cad93a289205341fb79
9 364984e8d62eb42fd880755a296bd4a93cc071b9705c1f1b43e4c19dd84adc65 f2701c1fc6f412c07020ca7e1e964966 183ec331a9ea2a5366693c4d4ca308bf3e185f19
10 487624b44b43dacb45fd93d03e25c9f6d919eaa6f01e365bb71897a385919ddd 85c07f796669fafca131040fdb1c3475 ae17a91c02be20129bd1714103b07a008dbcd364
11 4dfd082eee771b7801b2ddcea9680457f76d4888c64bb0b45d4ea616f0a47f21 756f0ba9fe8f47bd4963d3f4c0b975df e89bbe49bc648d36c2fbff5ab232bd9afafe8bbf
12 6305d66aac77098107e3aa6d85af1c2e3fc2bb1f639e4a9da619c8409104c414 331c9ae049b2ede6a42fc1fdf5c1c06f 4204fefa87ff3e5f04b18432976c46b6fe36500a
13 74d7f1af69fb706e87ff0116b8e4fa3a9b87275505e2ee7a32a8628a2d066549 78857b4821d9590d406b3d1b6bc0bd9b a78d792f9ab2e94ccd7710a43ad4bf2bb0cbf4b2
14 7a1554fe1c504786402d97edecc10c3aa12bd6b7b7b101cfc7a009ae88dd99c6 4c8b7db2184d2952d3e4dabd94220fd3 47d7135b31d9b4cfd000e0634c5bfe8a96968861
15 7f1221c613b9de2da62da613b8b7c9afde2ea026fe6b88198a65c9485ded7b3d 43227a02000a75182cbbe1b7711a7689 ffafeeb8f49b1b21cab986fbad2e628ef031fe0f
16 8446d4fc1310b31238f9a610cd25ea832925a25e758b9a41eea66f998163bb34 6890e6e6ecfcd14e5ccd269e885a4c1c c902785e312ad1a28a7719dd2edef7d2168a5100
17 8e96d15864ec0cc6d3976d87e9e76e6eeccc23c551b22dcfacb60232773ec049 4bc0036b556116ad030296d8fae96925 0c06df39db322bf4650efbf6f8e5fbafe1936ef9
18 af9f1331ac671d241bf62240aa52389059b4071a0635cb9cb58fa78ab942a33b 2968c77d176140925689df4d9aeedc7a fbc5986ca3d9448501d9453ed4fbb7b4ccb52a48
19 b0f94d84888dffacbc10bd7f9983b2d681b55d7e932c2d952d47ee606058df54 d34d74d4849fe6bdb48b0ba230d6cd8c 23c76feb4adc5f9422b06383c1f90b84ae3fdcc5
20 c3122448ae3b21ac2431d8fd523451ff25de7f6e399ff013d6fa6953a7998fa3 74c285f86406dfa87673a95a41900dc3 4bd7f794815a61b57a33d71ca745e9221d65f7a4
21 de48abe380bd84b5dc940743ad6727d0372f602a8871a4a0ae2a53b15e1b1739 8c0f558e8f0481331d66b54b8e82dec1 5aab2fe102b757a0dbaa66a54b4d31fb110e5e4f
22 e0dd8af1b70f47374b0714e3b368e20dbcfa45c6fe8f4a2e72314f4cd3ef16ee 572b5b1e9b84adc60655c4b8c7c3e6af 4e8c22ee9539a7f0d42e12bcef16a5d7e1191534
23 f0ccfcb5d49d08e9e66b67bb3fedc476fdf5476a432306e78ddaaba4f8e3bbc4 30f9e0d5c865b56c6f48741146e4464e ff36cf1076331bd55a44410904e82c4ecf53de6e
24 f656a418fca7c4275f2441840faaeb70947e4f39d3826d6d2e50a3e7b8120e4e 431f11acfde99c9f15dda9ea16bd5391 411abaf231cc6141f185e6aaaa1f5857f0487809
25 ff884d4c01fccf08a916f1e7168080a2d740a62a774f18e64f377d23923b0297 f5326de87f0d4669f591ddae3dca8ea4 7dd2534d5c1600072acd8c4d5c41a3ba6a3c6112

24
GuptiMiner/samples.md5 Normal file
View File

@ -0,0 +1,24 @@
ca3dabc60d856998e019be2bda60493f
ee85e173ae8624365dbcd16d55f25588
cf87d566bc28f8bf36bf1ded84d69c1f
243bc2e3ac74d4516cc5874b3c78038f
de4c57d614a482aa25df320992767cc1
43f5a32fa972b786b47d18f54381b1f6
5c6dee012a248ae3d37ab670772197f5
f2701c1fc6f412c07020ca7e1e964966
85c07f796669fafca131040fdb1c3475
756f0ba9fe8f47bd4963d3f4c0b975df
331c9ae049b2ede6a42fc1fdf5c1c06f
78857b4821d9590d406b3d1b6bc0bd9b
4c8b7db2184d2952d3e4dabd94220fd3
43227a02000a75182cbbe1b7711a7689
6890e6e6ecfcd14e5ccd269e885a4c1c
4bc0036b556116ad030296d8fae96925
2968c77d176140925689df4d9aeedc7a
d34d74d4849fe6bdb48b0ba230d6cd8c
74c285f86406dfa87673a95a41900dc3
8c0f558e8f0481331d66b54b8e82dec1
572b5b1e9b84adc60655c4b8c7c3e6af
30f9e0d5c865b56c6f48741146e4464e
431f11acfde99c9f15dda9ea16bd5391
f5326de87f0d4669f591ddae3dca8ea4

24
GuptiMiner/samples.sha1 Normal file
View File

@ -0,0 +1,24 @@
ff8678cdc62494f84b5b8755ef8201502c345fa4
9b15c85e31eff8b269b4155f642d2eea36fef99c
cc4c217ea65467ba4430951c7fb356ab7bc18b59
6155c5fd915b6eaecd78d2f082979c5c8f346cb0
57753f0a38b802c49d5b6880253dbbe28ce13adc
778b8461ec4c3da0c370feb9c467591617719959
2f8e6f072498b8e1e7da4cad93a289205341fb79
183ec331a9ea2a5366693c4d4ca308bf3e185f19
ae17a91c02be20129bd1714103b07a008dbcd364
e89bbe49bc648d36c2fbff5ab232bd9afafe8bbf
4204fefa87ff3e5f04b18432976c46b6fe36500a
a78d792f9ab2e94ccd7710a43ad4bf2bb0cbf4b2
47d7135b31d9b4cfd000e0634c5bfe8a96968861
ffafeeb8f49b1b21cab986fbad2e628ef031fe0f
c902785e312ad1a28a7719dd2edef7d2168a5100
0c06df39db322bf4650efbf6f8e5fbafe1936ef9
fbc5986ca3d9448501d9453ed4fbb7b4ccb52a48
23c76feb4adc5f9422b06383c1f90b84ae3fdcc5
4bd7f794815a61b57a33d71ca745e9221d65f7a4
5aab2fe102b757a0dbaa66a54b4d31fb110e5e4f
4e8c22ee9539a7f0d42e12bcef16a5d7e1191534
ff36cf1076331bd55a44410904e82c4ecf53de6e
411abaf231cc6141f185e6aaaa1f5857f0487809
7dd2534d5c1600072acd8c4d5c41a3ba6a3c6112

23
GuptiMiner/samples.sha256 Normal file
View File

@ -0,0 +1,23 @@
07beca60c0a50520b8dbc0b8cc2d56614dd48fef0466f846a0a03afbfc42349d
1c31d06cbdf961867ec788288b74bee0db7f07a75ae06d45d30355c0bc7b09fe
1fbc562b08637a111464ba182cd22b1286a185f7cfba143505b99b07313c97a4
294b73d38b89ce66cfdefa04b1678edf1b74a9b7f50343d9036a5d549ade509a
31dfba1b102bbf4092b25e63aae0f27386c480c10191c96c04295cb284f20878
3515113e7127dc41fb34c447f35c143f1b33fd70913034742e44ee7a9dc5cc4c
357009a70daacfc3379560286a134b89e1874ab930d84edb2d3ba418f7ad6a0b
364984e8d62eb42fd880755a296bd4a93cc071b9705c1f1b43e4c19dd84adc65
487624b44b43dacb45fd93d03e25c9f6d919eaa6f01e365bb71897a385919ddd
4dfd082eee771b7801b2ddcea9680457f76d4888c64bb0b45d4ea616f0a47f21
74d7f1af69fb706e87ff0116b8e4fa3a9b87275505e2ee7a32a8628a2d066549
7a1554fe1c504786402d97edecc10c3aa12bd6b7b7b101cfc7a009ae88dd99c6
7f1221c613b9de2da62da613b8b7c9afde2ea026fe6b88198a65c9485ded7b3d
8446d4fc1310b31238f9a610cd25ea832925a25e758b9a41eea66f998163bb34
8e96d15864ec0cc6d3976d87e9e76e6eeccc23c551b22dcfacb60232773ec049
af9f1331ac671d241bf62240aa52389059b4071a0635cb9cb58fa78ab942a33b
b0f94d84888dffacbc10bd7f9983b2d681b55d7e932c2d952d47ee606058df54
c3122448ae3b21ac2431d8fd523451ff25de7f6e399ff013d6fa6953a7998fa3
de48abe380bd84b5dc940743ad6727d0372f602a8871a4a0ae2a53b15e1b1739
e0dd8af1b70f47374b0714e3b368e20dbcfa45c6fe8f4a2e72314f4cd3ef16ee
f0ccfcb5d49d08e9e66b67bb3fedc476fdf5476a432306e78ddaaba4f8e3bbc4
f656a418fca7c4275f2441840faaeb70947e4f39d3826d6d2e50a3e7b8120e4e
ff884d4c01fccf08a916f1e7168080a2d740a62a774f18e64f377d23923b0297