ioc-collection/HackBoss/README.md

# IOC for HackBoss

Malware analysis and more technical information at <https://decoded.avast.io/romanalinkeova/hackboss-a-cryptocurrency-stealing-malware-distributed-through-telegram/>


### Table of Contents
* [Samples (SHA-256)](#samples-sha-256)
* [Network indicators](#network-indicators)
* [File names](#file-names)
* [Mutexes](#mutexes)


## Samples (SHA-256)
#### Archives
```
4C916853CCD9E7337AF557385FD5EF2E05A62F501B0CF4D7BBC3F9153D206350 - AirbnbCom.rar
50D6A87FB43C486D4171DAE91A2897A8652ABC27D9067418ED48A2AE725AD5FE - Amazon_gift_card_gen.rar
59F9AE970FFA26E31A8131A047C5C1415A1EB17B4BCA76095282CA146932C61B - Amex.rar
65AC1AB8C60EC8BDD45F59AE07103E218A7C307AFDD2BA92E3F687100914399A - Badoo.rar
DFB9ACD09E1303BAADE8C6D71E96489486F4B0471DFB42EA759E09919B717C6F - Badoo_BruteChecker.rar
C3AE43680C910239EA81CD2EAB6A450425C310DE54889BEBF96E48121CAD3BEF - BankCom.rar
B428B9CB3E8AB619FEAB2AF246A96791E3469621478A676A93C2D55906644135 - BankComb.rar
2771DDF380B065F4887F4DF271DBB5ECAEAC845EFE817D55676D41F09BE81C78 - BankCombain.rar
BA50C97E9CA718407AD3AA5195C461F5AAD73FD79685B704686C129772D5AE62 - BankCombain2021.rar
8BE15479F95785054F28F65FE9898C7CEC8DAF29E14F737172E85C1DC3DDD15F - BankCracker.rar
E32A4F828C556AB385A2BF66589BF8854EA9F370C5DFDD0E605911E8CAAAB73E - BankTop.rar
26E17367A3276321CBD553A194A296B6A53EC5C107EED26C12F6A66D2BF8A1E6 - Benaughty.com.rar
FB225C7902D5C876C9BBF4F4A48B047EB4E074838B8C8A4D6B9AD342C920710B - BitcoApp.zip
D2610FE83CED2C92C42DC36365819D54B9BA6FDD77C7E7B728E37858547B9554 - BitcoApp.zip
C6476784FF00D5FB5607716B225D4AB697F762E3D8AADD9C6A75320C13FC7734 - BitcoApp.zip
1772628DF187D1EA56F2D0FCE1B257F2E19DB1C03416F1C22FDF0841BBA2BA6E - BrutePrivKey_Cracker.zip
DDA2A8EE0B13E12ECFA37BA850ED6F91AC8AF0383A6384EEF59D91CA7828C5A4 - BuildBTC.rar
F78927E884724D7DF3E274724F340AEB655E3BD6C6D88B9BC1CBA36E56BEF0D4 - Builder_Stealer.rar
21BCB9F01C0CC8BE4FC5455F0C30314DDCC6F799F9476682B048BBCF1C068B45 - Chase.rar
90AD6734824FA251E03CE8363E629D6CF3D3A9FA7F30C4859DF4DB15ABD46345 - Chime_Brute$Checker.rar
77231FCCE5AF7F66DD1F94580150E0BEA08C21119D81C4A831F38799B7076CAA - Citizens.rar
8428F06EE038688FA3B024C53C51DAA216B128D3D06166068811DFACA6FE7BBC - CombineBA.rar
D7D7765B51B7E793AC221A61BF2C9A34C614EC1B46D922CFEA6BF71ABE7891D1 - ComboCreat.rar
805D4E8CF09FE2E8CCEA7A7EE3AFE1641FD0B9EBCAB501AD906BEEA0B7CABB3F - Cracker Bitcoin private key.rar
D54D41BE67625E3298B906B93C7A9811242FE4C2C8BF6B81D7974239052FFD8D - DatinG0.rar
68BEF2AF94A61A5A2195035CBA23DBA3DE834FDF26603F6CDA6B0856E776BB1E - DatinGo.rar
22F34A53AB5D2BB554159E695F336FE75DD4C8817721835E549251BFE11B7D7E - DatingIco.rar
83107AA69DDECA9B2B70E49AB2CA91468A3EE07C5AACF7B035B56CEC10B536E0 - DatingMix.rar
D33571435803D75846F9CA0EBB81A1E2C2B859F2E5C4A709DAC0571AAAC9F348 - Ebay Brute&Checker.rar
796BAB707BC08F7B79494A804A1C0C2D6C952BC4858F1D8DAF8786767617AE8F - Epay.rar
FA839F81049E00CE9981DCE117DF171939ECBD1C4EDE2C47514387026D8FD9D6 - FaceBook.rar
5249AD1C26AFFA3B15BC2B73DA39126621C4E426308BB4FD357D4CDA4123BA1E - GeneratorAndBrutePrivKeyBTC.rar
3D490959CAB777506C83EF1FDF4D273B992CB693E6A691B4AF66C61F61583C12 - HappyChase.rar
A7776AF49A25664E6CB1478CC6E8BC460DACDDE95D3797E3ED35286D3C4ED604 - MatchCheck.rar
5BD9A9113302E5AD7A866BCC95E81C931CB04B07B4CC00A5033376654E4C3422 - MatchUS.rar
1CE5E30E8A74E5244BB8ACEED2ABA13A05CAFB0D2612BFC3EE8D5A3921F9DB88 - MegaApi.rar
5B6D1A5A7C4A7D2485BDBEFD396F276C1C89E423A7C595F6ABFE231F28A504E2 - Ourtime.rar
01753BBD00642CC37E3BA5664B0DBDDBE8FFA493E70988D599512D8668A12D0F - ParserLink.rar
3243C113916D6EF4C44887329D8EC573F2F2D7EB3B061EB74976452282CC8825 - PayFast.rar
2A76003A2C7E733F6BFD0468E267D32ACE438B42DC6712E94BE7A0E5F02BBA87 - PayPal_Brute_v2.rar
6235FCC30C58AC7855447FF924C132A04E1B11F658CD27622CF9BA52E2B0A182 - Paypal.rar
E55AAFB86D3178CA43E67D730D643ADB77BF055CE5779DD735DFD1B411879352 - Pof (by LulzSec).rar
13FD093CA563B252A48940DD1880754F3B2BBCA54CB7B997FDE1452DF02E99F6 - PofFullChecker.rar
B3BF515DCCF58ECBA7F44F8DF4DC6E25D280E9FA1AF8082510F61F0CFA37F2FA - ProxyScrape.rar
DEC28A54F8B014AA5DBED1CE034A1DC3B7ACFCB950266418C0743E217292F0DF - SQLi Dumper v.9.7 [Cracked By PC-RET].rar
2983FA1D672D4DAB194ED1D4CAD1A0EA2A1DEE6A76F9AA38253078F896174851 - Smtp_Cracker(Brute).zip
F91005CF0286818D29812780A9C02E80CB8C4A9F9CC498A0B5A1CF3A5C2CAD10 - TelegramSender.rar
C1B8B512FB9445BBE515C194DE5E371EC5EEDC980204629A32111E35B576104C - VisualStudioKey.rar
5C1B26C12DE1517A105BB09EED20FF0624B6D60BC700025649E17715B6B4650A - WishShop.rar
4C46D0B5BE84E91480C8B61CB7762EA8EB75D6878764D1AEEFA4572E440A2E65 - Zoosk.rar
60EF02CBA512E9908111BBB860D0CCD240D6AEC8899A418FF67753632EF9FD15 - bank_Onpointcu.rar
442DEA1F0A964706CF6B1C94F39509289C0AD0B72918770D5993464F4B97E849 - bank_andrewsfcu.rar
F420F45B0EFF9234D715F23B4081D4C3248558F90D9066E8D4533063C1E38D31 - kitco.rar
B5D9580EE9C6302E0EEE173C5CFF384A490813BB863BD2506718C75194B1E0BA - mate1.rar
31B90D8B0D4D24D2932784585BEC20BD3E24CD4CCC7E9C8FDD03180B585F7C5F - ny.gov.rar
```
#### Executable files
```
FC9F06517E92E119692D946CE97069D1948E35E224840598DF56F71D8AE044D4 - Airbnb.exe
363EF27F603D6CF5E843BBF44E6EA4EEC112E97F9577D1BE703FB89E484E433B - Airbnb.exe
4370FB6EB93D35A7AB15EA312F94371172F1E05065833EFAE335AC8CA904849B - Amazon_gift_card_gen.exe
22764E629E6778155D8F8358726FD837B282BA1A16773844FCB10B4B8704D8C9 - Amex.exe
6D5C3D3BE26D4A333D52C6C876BAC64DC96C40D1F93DBB9580135AAB94610BAA - Badoo.exe
C373B1B88EE6CCCF38B50D5CAE2B43FF3C4042319FC2518B2B8D9EA28D5EB5C8 - Badoo2.exe
57E40581C5B12F5F0ED7D7C23C717C95653C573337B4A326367E24305089E78E - bank_andrewsfcu.exe
399921E9DCED6491223AE31E4F56530310DC22E90B4241FF39C28C8B25FA841A - bank_Onpointcu.exe
57A859CF8D19C90623ED8598C282D94EAD4CAAC81E4A27082F9C1AE44526F67C - BankCom.exe
7B41D2106EBD53CE23C0D50A245EC307108FB686664F7DF310CF78975FAA38CC - BankComb.exe
064B3A2BA31B755E3FB0699E40219D9700330C7D459B2C9E88AEB172B3BE1810 - BankComb.exe
28799F0FEEB0214EC31DC0615A3526AEA7A2F68B692BC30B2A362F163077EA17 - BankCombain.exe
4386742E3238E6E347B394AE8B1D9DFD7070B63C06A91745DBB6C7825D866FBC - BankCracker.exe
7466BF1FA87C77A3C7197D582D361BE5E057D5286BA66962E03C56D515BA1336 - BankTop.exe
908663AEFB1EA1EE6FCEACB99FFDD5595C247779278612A08B58F44BBF385085 - Benaughty.com.exe
3EB8556E29DA422B183D657E1CFF09FF6ABC66EDD26AEA6B87CFE710C8746502 - BitcoApp.exe
DB7832DA08A75A827960F84974E18571D23BC698C80D239D8D126D11D70C8805 - BitcoApp.exe
C038CF88206371D35A0E89612D8781CDFA69CC37FC5391A8E92D252AC6B9F0B1 - BitcoinFakeTransaction.exe
B97F51C35CEF3C2325BBAAED3C38AA19513AA240864C506B83130D0BCAF686B9 - BitcoinFakeTransaction.exe
CCDEC5EB1E04A4B988B5BA71053B5957C2C88A258F5CC8816E27651491F950E4 - Brute.exe
DDFB1F2638EDE0A8CEDA6136E99802B29FE8E5E3342EDB14B21835434C194B95 - BrutePrivKey.exe
C19A11F392B69827DE83BA06761EFF059741D084F0EC92C83D06BD4B794326A9 - BuildBTC.exe
CCB5ED92E25AF56433933BBACFFA1586D422C20A610B48A5E89C0344017E2748 - Builder_Stealer.exe
0E7614A4C207E6E0504F57FFE014447CA79127B5AE995B1A09AF0ADB427F2AC4 - Chase.exe
4C566CFBF8A37FDEFA304CF0D3DC9A4C871D37D454991C51AFBB2BD5EE22CCA1 - chime.exe
A79AC2F2A09A62FACDC7EE9E21BB109A80EC6C082E13D85D705ACDD21B4A387F - Citizens.exe
161C3AB9AB8C066109580E2BFDAE1037EA0B567537A5B9A5E6278E219CA533BC - coinoco.exe
47804FBB6BB7877CFDF15DE99FD5B18F21EA6F9542BA2BC6E129563DF8B7C2C0 - Combine.exe
3D06C30853F8BB370A2ECD7865F77F0B22932B6C7855C79D10CFB46EB7866766 - Combine.exe
A359A72B0A53AA21B52521B8128A2932B276947E33BDC01EA6CB5D8019E4CB71 - ComboCreat.exe
2498572B0A767B4135DC8E8232C7EC7B546C933ED434E20EC8DF3F3F45AC57FC - Cracker Bitcoin private key.exe
3530FE5DC925B9568CA485C70893C57424E917D6F4E22E15EA4CCF24EAB460CF - DatinG0.exe
BFFC1199592463F2229B9AE48EE901BDC0515C955215BC9A171631D326CB409E - DatingIco.exe
B1A878E39A4C2CD12BED9B1FC53D571104004841303CCEE5C4DCD67B7E198D80 - DatingMix.exe
AAF35ADE093448C42C6D8BBE58D920584FD320EA91D879486186EF34622D7EA7 - DatinGo.exe
09BD02E180FD3F92FB0115F6F768CD1AF0B37EE1176B10E007F4BFEC0D77E936 - Ebay Brute&Checker.exe
D78F1228DBA14133045707880CDD09BD5A4743703667286A41E1B43650E6065A - Epay.exe
7BA5855901A108E1F958B8D2683599E8BEF82D7CFB2AAC6C040D688D20534FE6 - FaceBook.exe
5EA5DA6F2E52526A63258FE73973B9672E7D10055832DDF28C35204706143A5D - GeneratorAndBrutePrivKeyBTC.exe
199FF1923C908A8BC639CD80B5B0FE642222EA2DD58D64B4E2DBC5A01037C0AD - GeneratorAndBrutePrivKeyBTC.exe
F1461C68D1A2D73533671BA7D1CF11F40AB33F62C8E6EEAE773A4DA35C0E1FF4 - HappyChase.exe
38F33C2B9C2D676A230B3F71AB021ABF1DD5572108E3679D8EA9A6BD95307ED9 - IAmazom.exe
DAC381361F911EEF5AD9BB0FFCDF3D5A0A96C6D70E3F7AD15D3E729A417446F8 - IBCbank.exe
063DDC9AF98E118677C1D40344BCEA135390367F8E65D84A706E55CE103D4F5C - IControl.exe
93FD746D55DCB8EDD4F9095DAC240E32680D15E663227E155516C035904D282F - MatchCheck.exe
E0222BD72FDC1FFA3241EDF43D265852B0EDCDB3D1BF003DC05B827AE1EF7042 - MatchUS.exe
3454444960BA3E8099F1FA9B6DB24A018EB282DBA22DC69DD5D2E8F19BD0ACFB - mate1.exe
A0DF556E936BE91D4F61400616A3FC8DCAFD6712EE467FCCAAF12E7A12C1A0C7 - MegaApi.exe
D7628E77C593254925F3EA507D4C526B047FBC9C25D3EBDF716504B873DFDEAB - MultiDating.exe
D8F254CADFE601F63D569F53E3BEA5592974A786C1F2B0C49D569063D4FED390 - ny.gov.exe
C8316F6A7409EADE1D93D891243B6EDE9D80E7C8E5D5957363A66B52DD59503E - Ourtime.exe
21534511EC6BBA6D02259F885353C81EF2330787F20481140496DCA1AD84EC8F - ParserLink.exe
763570AD58A8F0EF340343A02363F1CB49B7DB75F02CA51A42608DC594472B3D - PayFast.exe
8AD5E0246FC81AAF2F3083829AA1D8419C281549B783BF2B97132A6388D559C5 - Paypal.exe
2DB410056AD808F6BD12721EFBEE012BE5772CC9B72FC341058104C33C450059 - Pof.exe
628435017444A119136D053E08F8A572A2B0AF6CD55F06E329CDE77D638CB647 - PofFullChecker.exe
54C48DC70286B7106EB985C7AE3A5F02DF1E7B3229E7D0A74051B3E8A67B32E4 - ProxyScrape.exe
81D407F1AD372CCDED9CA12CB5090A3AF11FB402CD8B29491A78DA693625A14C - SendTelegram.exe
FE70E72F8BB0D202D5C26CF5C1319842A8830A76F6D727BFDC0D2B52C6438A63 - SmptSender.exe
60342CDF85D553D1BEE6E4B8D55B8E4E4417C792AE5F4C0D28211EB6767E3FBB - Smtp_Cracker(Brute).exe
3998E2BA6588279A49570F61DAEF37D108E446DB960B7A41A3C0BC8CFBFA271F - SQLi Dumper v.9.7.exe
104C8236A281E03423DE1A1CBF566EB41CE33B7A42651461F61CCC82AA8DF538 - v2.exe
EE39590D55C8145534C30F5FFEC1AE66F8CA8E31A319A1CB061B18587F6DF7CE - VisualStudioKeyGen.exe
F502E00CE95D2374C0BF98D259C97BC360C9112A61C36412F2ABD7389486CDEA - Wish.exe
BC08A9F9D7517BB53E62EFFDD012F6357ADAE47FFDA41EA9206C772E24ADC43F - WishShop.exe
853B97F7C3B9F01850E83AA8C57A21FD5F896FFC97F05034D6C8CD625A77A190 - Zoosk.exe
```
#### Encrypted malicious payloads
```
956FCAA432FB7BE2B8BCF863B1998D125A1E0E490518BED3C7B77BE9CC9B7192 - Ce1oJl2u.exe
D4904F755764752EAE7E8B58C927E9D8ED6807AE4D6B4B9CB1D2C0144DE29C13 - Defender.exe
A42794BA75CC315F624F1DF37B51F9981229B551873C73560545CC17F27D385C - DefenderUpdate.exe
775AE003277F3E6A10D47F9412A469C0AE38671572228B867D2568868F9DBC30 - FlashPlayer.exe
7F442358CFDEFD99F3346099B0318F95CAE3BA8FA0C3C00188273AD3F877E50D - FlashPlayer.exe
C41247F10F43D254B1134C4A360E193DC9D2B30532571A298219F8DE9B4445CC - FlashPlayer.exe
C039B400D495D1901F4F7D9E716CE30912A8146510BB884CA5FC88BDEB6BC62A - MSASCui.exe
C4499F2A4D4509084D8EEFEB7516665810D2224454C1E0005DCB80A656D648FF - Net.dll
D45865A5818C168CC16A8623AF5EC0A41CC3AE04A9B221163B5CC6D4FFF1B3AF - Runtime Broker.exe
5D6CF49E65C9A09396A8D76E55841D1110D66DB5ECF4A25705F1E349DAB7221A - RuntimeBroker.exe
BF7B3E1A9369468A4A6C037F0132317CF3D30316D1EDB82BF560A1550281CE4A - RuntimeBroker.exe
EC30FEF4785A86BE5F56DA1FD37C127EDF3D5336C10E855862CE9F99F50115F7 - SecurityHealth.exe
A58CA04EEA862FDD4149F3D238821B5945211A3A323B6548A897C6E65337502F - SecurityHealthSystray.exe
E0E99E28383285C8A3A87DD432FF4BDE9BA671FC426F08C3B768BCE893C230D6 - SecurityHealthSystray.exe
720910B3043A665C42D74988440DFDEBAE706B53674294032B6AD86E966E6F06 - Upexee.exe
079FE5844D3F58A77B3B724505E68C1D57CF99718E3940D44AF024BFDC8828F0 - User.exe
4FBC9F6640D87DED0407F757F9465893B582B27B2226E4130E6C9BB07AE75C79 - UserAccountControlSettings.exe
FCED6B6F3F4EFEC8821F12E536D29358C5CCE0F30FF41F39AE52C68C2FD2EDC1 - UserAccountControlSettings.exe
5731FFE3792C43FA59B3EE0AE88B82C360BAB08ECD476C316C4EF1CACFDD9EB3 - WmiPrvSE.exe
5B125D99BB9DADCC5C718F55DF65EE9065446B0D935D28E31DECBD4271E5D34B - WmiPrvSE.exe
74BE37B8E2715407353CF35A56316F09156817CA9D8D5E4A537821DF4AB88664 - WmiPrvSE.exe
C8720DDA36C403BF6424E27DCE4CAEEDF650B79DBE24B4BD48BFE47AC75F2842 - cssr.exe
4281BBC6A8F13FA8491202F99BDAA4CB51C4AE649D9135CBF230769188D1C998 - splwow.exe
E7C582BE6C599AE1EF3A93DC6EE90154EE6230A177637E3A3BE66614EBA50673 - splwow.exe
E29AE405C09E400B1FD7A5F230839B0FF30D5714C0C9B88A5F3783AF03230BAE - vbgujr7v .exe
6F51F7C331D38BA9B8F6BDBE1C3B599E3A8705BB946224608ECBDD4B66B1EE52 - vbgujr7v.exe
```


## Network indicators
#### Url links containing malicious payload
```
2no.co/2OTXs3
2no.co/2uJGT5
2no[.]co/2QEF66
anonfile[.]com/B9g2H307of/Citizens_rar
anonfile[.]com/Zcx7N9r8oa/Chime_Brute_Checker_rar
anonfiles[.]com/15Kfs7C4of/FaceBook_rar
anonfiles[.]com/15Kfs7C4of/FaceBook_rar 
anonfiles[.]com/74kb9064qc/Chase_rar
anonfiles[.]com/B7I4icecpc/GeneratorAndBrutePrivKeyBTC_2_0_zip
anonfiles[.]com/B7I4icecpc/GeneratorAndBrutePrivKeyBTC_2_0_zip 
anonfiles[.]com/F5y1ReA4oa/BankCom_rar
anonfiles[.]com/H0J53ck9p7/PofFullChecker_rar
anonfiles[.]com/Jbf808k7p5/ProxyScrape_rar
anonfiles[.]com/Jbf808k7p5/ProxyScrape_rar 
anonfiles[.]com/LeS9t5J9o5/AirbnbCom_rar
anonfiles[.]com/T9Gf41Tcoa/DatinG0_rar
anonfiles[.]com/V4s3B0H9pb/Amazon_gift_card_gen_rar
anonfiles[.]com/Xbpf05k8p8/Wish_rar
anonfiles[.]com/ZdT0a6lep8/BankCracker_rar
anonfiles[.]com/b8GaC1A3o4/Badoo_BruteChecker_rar
anonfiles[.]com/b8GaC1A3o4/Badoo_BruteChecker_rar 
anonfiles[.]com/h5l84aFao9/mate1_rar
anonfiles[.]com/l4Ccn34ao5/PayFast_rar
anonfiles[.]com/l4Ccn34ao5/PayFast_rar»
anonfiles[.]com/neK7WaD6o5/BankTop_rar
anonfiles[.]com/r3ffadg9pf/MatchCheck_rar
anonfiles[.]com/taW231Bco4/ComboCreat_rar
anonfiles[.]com/vdJ1D4U5o5/CombineBA_rar
ezstat[.]ru/2uNGT5
mega[.]nz/file/0Uh1FQxa#H28pgAJpnnuu2VmzZpUOJtUFmYnLP9cJEvK6ElltJUc
mega[.]nz/file/0hgWwBSC#iIVnAImaF6CkA-IzGvmNulS8enc0XTAotAgvJ4aOjOU
mega[.]nz/file/0t4zDKTL#hpGw259NX2Y1TNeEd1aSjPn2gNI1DNTDU_zmHSeuQY4
mega[.]nz/file/1ohS3A4Q#D3IqYeVhT40JWyCfMPSeavKL5k0WW6MIQ7hRSxJdwps
mega[.]nz/file/4gpCBCAZ#h9T8eS71CwXVfLRLwWt4exP9MWYoCBI89exeCL1GLIo
mega[.]nz/file/4hhk1Kyb#9TxYVzWR1oTBvcjLBHfPWC1xUmuk8ZXksjK00BWBVVs
mega[.]nz/file/4lAQ3A7K#xTauQrfLt-YtBwvAmXDtFrxjMEEQJGnqXhJ_9ZWas_M
mega[.]nz/file/4xRkjRCZ#4lTp9wbjH7luLlLbRYnZWPni1SSXqxhs5e2i52owqF0
mega[.]nz/file/5wRzhAoY#rWL97o8gLv4SDXajQW-rOYjc6WHQDvI8i8nq6mR8uqQ
mega[.]nz/file/8l9U2I7S#Z-6pTRYsTP_V-DG9QGi5ro_VuVmN98fGHwH3ai-xQnQ
mega[.]nz/file/8swQQYpZ#Hn7zudXDTMd2e4_keEKkZdnFO4I1sijP7DQMY0Lyaf8
mega[.]nz/file/9lhCkACa#s4GSXbIkkQJ9eNNnb7F26bCLLnBypTxuQJb2_uDxAc8
mega[.]nz/file/AxJzTSxQ#VZg_YvwP912OBAOJmUs4Ynfricl93IbvGVzrGGCbUzo
mega[.]nz/file/B1QgjASD#_sntWOSQO1SqJ54ia4lHK87wIdExpfwoO2VepA1DppA
mega[.]nz/file/BNo3iY6J#pSQapX4q-ZOCccf-8ktUNMCIjbM5ctVsUg7GaD8tdE4
mega[.]nz/file/BlhTAYgY#jaTpHRlOU2roIeWeS6aYGNUmSm-ncxILmN303Ucgy_Y
mega[.]nz/file/E4Ym2RSQ#oE8iWSNt9Sfb0sR4_mIzYDy58Af6j4h92cOnp2_gpW4
mega[.]nz/file/FJgmSaSR#QeAn5MWmq8JWFXMhGq3ELVQbqsRaH3Z3j2wrmTj6nTw
mega[.]nz/file/I1RFTQrZ#UD9lW1FeAccIRNNt3Wp1l5fKFtRPHEWdnYY78FBnTU0
mega[.]nz/file/IsgEXQSQ#mEN1W88KuV2ffEvD-XYkLXzwFPxgHHgRddZ_ylMeh1k
mega[.]nz/file/JF5BTKpQ#wrOtkfNswmy_g8Jpta9ARln_mJMzALOIxUYpas1dxnc
mega[.]nz/file/MphFWQAL#VA5_7WwtG16236gFu8LuDnD5Hefu5sZ5rgRKpbSA8jc
mega[.]nz/file/Nl9hmKbD#sLCTbv6zsAzIPfnz9G7suYYe_JB81XJW0MP2-UnknR0
mega[.]nz/file/NsxiQbgS#vgZIX9m93fZ13erCT9wEvUX3Mp7Qf7pxyGrD08hDpG4
mega[.]nz/file/QMpnhYQT#t-viTJ-7V7_iMGmXrikGb7F-162wTdgJ8bZJHO90d0A
mega[.]nz/file/QURACQhY#Vk3W73HapLoiaVd1wH9QVGuy7c69wK8pSf9ZAqnr-lA
mega[.]nz/file/QkAFDQhR#QC_l-5MWf9zqt9l3wfFUg2joicLlzR3rGrF7Ab1ELk4
mega[.]nz/file/R8hE2aSJ#8-dRV0iIblfY3BFv8DnR3r6WhgjqFLXtAsdzY8lmNB4
mega[.]nz/file/RsYyDAzJ#rrtWuY1mtC5xy6V13dSdt6yo7nGmNjEluAEQ23udDIY
mega[.]nz/file/UsZnUAhA#3YCXr96qdzMLa00adGYKpiUlwsvcuuyWl6HR5OV1MLA
mega[.]nz/file/V84CBI5J#2OYUKgsYKHGNCvUL6uVzumEd1Ctn2EvqIPPdZCR8iXE
mega[.]nz/file/VMxHSZiT#0aAoz2IluNYHeTmYEOrSb-nqM20Mxc5Lj76r4248T2o
mega[.]nz/file/VhxlACrB#7pNbRtsR2LWonGl_cjkfXh-BUkexBfiAHW8W-80vLR8
mega[.]nz/file/VwRXHKhR#pWZDGJgQLTRTgXzRVh9rgFCrmTLAyTpLnmL7YsdlWOE
mega[.]nz/file/Ys5FmYxS#-0kvjCIBQXqDtGOVP-KAjSK7KNdeLDObncg_DJF-2Xo
mega[.]nz/file/YtFTUITZ#WEeyPncAUVSVjrMs_FnsPgVKfCMX1hCFafWS4q1nuzQ
mega[.]nz/file/ZNg3zCzQ#38bODDuobfEgxCh-jOdcNX3C8UPd6pLCcX639CJJI4U
mega[.]nz/file/ctV2hZTD#koV0C9nv260KWV42OQ9FanR4WdeZTuXKaATM8nee7yk
mega[.]nz/file/cwoXyJRL#kKEZhHP5kvPEGL6ahtctDqSbP9zzX5KnoOYzIPP6kvE
mega[.]nz/file/dBwSXDpC#arKlgBo1114m2PyDOj5xb0BhzPBhqe2wis9KNxtk5aY
mega[.]nz/file/h1lmDDwS#zbgpouBDfw-przmSlD-wlVfwcYxaR41KAgHwUPWGwJM
mega[.]nz/file/hlUm2ZJZ#VSk18Z0E1R46wxq48ETQ1itMXXxFuDzywFwCGNlt35k
mega[.]nz/file/hp4G1aaT#X4DZzEj1PElYzvbptLotEcAmtNihacoRgqRgx4zlWDM
mega[.]nz/file/kFo1yCBD#7nzTGzcTZapq9qZbpiQ4iZklgz5ee6q7yWr-IDQbUd4
mega[.]nz/file/kdAzgCzB#fe74hjumIo2KyeYCw0h0anSedODn-VJC8j1isfBIHEY
mega[.]nz/file/lNgyWTza#SOBvCixV0OOsO8E4rvwpOmUg-i_cZ4vB0tdvJTURiPA
mega[.]nz/file/loYQTKaT#vf_X682ecst_vz4hQjLJ89SZmUVVhugqVTwQgeMO7sc
mega[.]nz/file/o5h2CAzT#iLrtcoRlYtzm6GPYmipJPIGEX7qE-P50yj-ybBU9anI
mega[.]nz/file/p05QwaRT#bqtNVfWKBLtJPNJ9sFOjXRNtjKapwMAk4IwB-eYvNAA
mega[.]nz/file/p05QwaRT#bqtNVfWKBLtJPNJ9sFOjXRNtjKapwMAk4IwB-eYvNAA 
mega[.]nz/file/p8kWwTqT#oSTRJloI5oMLhL9FLvmWDsCjwW9CiUD4FIPuP4VWaiI
mega[.]nz/file/ppZEkKaK#B-urCiubVnRNGrLXQ_1lM4OLYNqI-Q4oBDPGRtVwUls
mega[.]nz/file/s4BBGSwT#r_bAc22nLVkjQJU53xnBY9_DRPLxFMbL27vL0-3MSkU
mega[.]nz/file/sBYgSZjZ#F1qjBoGZY_rJEL_wq_sbTNcnKsBCwehzvwcIIcekrMo
mega[.]nz/file/towmjLzI#LzcRgAEL7RN8jwSFOnI6_TU5qV4CfqFqphjQGs0FLvg
mega[.]nz/file/twRCATyZ#5xTdZgrbCxb4HBvN6AM_79Tvg02H_nLLiCwDM95h-KM
mega[.]nz/file/w5oU1LZY#OMW_MbBnpheNlPVZsBECpvDr5K2cWyiiXO1_UHdeHEM
mega[.]nz/file/x8oRAaYY#52wO4k6ENmhZJIqAvxlRlN7YbL-BZRHRq9r_DVrUS-M
mega[.]nz/file/xNAUjSQS#WufFv-cdrc45BL2TrUdeNa3ijAo8CxoDoZImCon-RMQ
mega[.]nz/folder/ogBBnCYD#8dsYu-ikNdnM-uDAjutoMg
progs[.]su
sendspace[.]com/file/061inf
sendspace[.]com/file/0prar9
sendspace[.]com/file/2vxjkh
sendspace[.]com/file/6cuxdb
sendspace[.]com/file/91b1l8
sendspace[.]com/file/azfe6l
sendspace[.]com/file/blhldl
sendspace[.]com/file/buti2l
sendspace[.]com/file/cbzy9i
sendspace[.]com/file/cbzy9i
sendspace[.]com/file/dr1xxh
sendspace[.]com/file/dsilg9
sendspace[.]com/file/e87sfs
sendspace[.]com/file/eq6sea
sendspace[.]com/file/eq6sea
sendspace[.]com/file/fkziff
sendspace[.]com/file/fu4u7g
sendspace[.]com/file/fu4u7g
sendspace[.]com/file/hl3g7v
sendspace[.]com/file/kg0m46
sendspace[.]com/file/otxi12
sendspace[.]com/file/plwz9u
sendspace[.]com/file/qfjn7e
sendspace[.]com/file/s0ltvx
sendspace[.]com/file/s0ltvx
sendspace[.]com/file/vk3zjv
sendspace[.]com/file/xw8ldd
sendspace[.]com/file/zepg6n
sendspace[.]com/file/zepg6n​
vk[.]progs[.]su
```


## File names
```
%APPDATA%\Local\Temp\1qw23.exe
%APPDATA%\Local\Temp\DavzZL\MSASCui.exe
%APPDATA%\Local\Temp\MSASCui.exe
%APPDATA%\Local\Temp\RuntimeBroker.exe
%APPDATA%\Local\Temp\SecurityHelth.exe
%APPDATA%\Local\Temp\vbgujr7v.exe
%APPDATA%\Roaming\AdobeX\UserAccountControlSettings.exe
%APPDATA%\Roaming\AdobeX\flashplayer.exe
%APPDATA%\Roaming\Defender\DefenderUpdate.exe
%APPDATA%\Roaming\Defender\MSASCui.exe
%APPDATA%\Roaming\FlashPlayer\FlashPlayer.exe
%APPDATA%\Roaming\Health\SecurityHealthSystray.exe
%APPDATA%\Roaming\NVIDIA\SecurityHealth.exe
%APPDATA%\Roaming\Protect\WmiPrve.exe
%APPDATA%\Roaming\Realtek\SearchProtocolHost.exe
%APPDATA%\Roaming\Realtek\SecurityHealth.exe
%APPDATA%\Roaming\Security\SecurityHealth.exe
%APPDATA%\Roaming\System\DXCpl.exe
%APPDATA%\Roaming\System\splwow.exe
%APPDATA%\Roaming\WIND0WS\Explorer.exe
%APPDATA%\Roaming\WIND0WS\FlashPlayer.exe
%APPDATA%\Roaming\WIND0WS\User.exe
%APPDATA%\Roaming\WIND0WS\UserAccountControlSettings.exe
%APPDATA%\Roaming\WINDDWS\Winserv.exe
%APPDATA%\Roaming\WinSecurityHealth\SecurityHealth.exe
%APPDATA%\Roaming\WmiPrv\WmiPrvSE.exe
%APPDATA%\Roaming\dftmp\SecurityHealth.exe
%APPDATA%\Roaming\p60fhh\Flash.exe
```


## Mutexes
```
0kezHr8NVFLmGsLePNFaEYm7FPxK9L9yn
3C35FH8hKAuPv8jYboeJXnysvZqUt3f3q
AyxTVEBaJDByEHaGYTW3FG56zf1s5P6gx
GI8Pu5K9UQSNmuJiM3CPvVbSOdYQjCDvwsMWxkXXGrybkBvMRzUJbqWcVjB3u4TS
Vs3xjr1pNeqf3f32CU1Qf2uLQNRY7QHuT
WBU7punCFmjK4sZCZc592RnzYpJr2APgZ
uf7UX2VR3HPhtOKAHyn33pDN4v716mEjB
x1jh28RpFlszLbjvp8A8GzBBA3Vm7DQy5
x1jh28RpFlszLbjvp8A8GzBBA3VmDQy5
x1jh28RpFlszLbjvp8A8GzBBA3VmDQy578
```