hash22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67
domainC:\Temp\psexec.exe
ipv40.0.1.0
domainC:\Temp
hash078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
hashfe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68
hash025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a
hash2ed9494e9b7b68415b4eb151c922c82c0191294d0aa443dd2cb5133e6bfe3d5d
hash3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235
hash48d9b2ce4fcd6854a3164ce395d7140014e0b58b77680623f3e4ca22d3a6e7fd
hash62c2c24937d67fdeb43f2c9690ab10e8bb90713af46945048db9a94a465ffcb8
hash860a6177b055a2f5aa61470d17ec3c69da24f1cdf0a782237055cba431158923
hash87d25d0e5880b3b5cd30106853cbfc6ef1ad38966b30d9bd5b99df46098e546c
hash8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db
hash91415e0b9fe4e7cbe43ec0558a7adf89423de30d22b00b985c2e4b97e75076b1
hash994d6d1edb57f945f4284cc0163ec998861c7496d85f6d45c08657c9727186e3
hash9f61ff4deb8afced8b1ecdc8787a134c63bde632b18293fbfc94a91749e3e454
hasha7a19cab7aab606f833fa8225bc94ec9570a6666660b02cc41a63fe39ea8b0ad
hashb67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6
hashc46b5a18ab3fb5fd1c5c8288a41c75bf0170c10b5e829af89370a12c86dd10f8
hashc7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73
hashec368ae0b4369b6ef0da244774995c819c63cffb7fd2132379963b9c1640ccd2
hashefaf8e7422ffd09c7f03f1a5b4e5c2cc32b05334c18d1ccb9673667f8f43108f
hashf736be55193c77af346dbe905e25f6a1dee3ec1aedca8989ad2088e4f6576b12
hashfc75ed2159e0c8274076e46a37671cfb8d677af9f586224da1713df89490a958
hash1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c
hash5dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca
hash788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19
domainRansomware.live
domainHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
ipv481.177.215.15
domaindomain.com
domainhttps://live.sysinternals.com/PsExec.exe
domainHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
domainC:\Windows\Prefetch\*.*
domainC:\ProgramData\Microsoft\Windows
domainC:\$Recycle.Bin
domainkaspersky.com
hash3B46A729DB7AE6AF8B19711C9452194D
hash02944C8A5535CDB5B2CBB893DB2D5ACF
hash10CA9A4040001560D053B7E7885C1B95
hash3C471EBC947CDF32240A90FFADF49B13
hash4BE8BB62F0EBBCF4CE52C35AB6F794F5
hash53C616677BC7E2A0A03127F19166D007
hash5C3B9821FC82A9028CB63B9671950919
hash5F0B2C6D9F442754258BF4DD841C8341
hash608FAF58353B65C45EF9833358AC3787
hash6AE7C9A7EA0B8C40A64225734F6BD01D
hash846DC77C1246DB20D976346E0E359502
hashADAC9984B3CC43D66A0D33079BBEC299
hashAE0E536766788478263BF448A9381641
hashB3E418D30312C1B2C58A791286868F42
hashC2764744DCB4B0E1DB79CA1E8BF65368
hashD12A5B36DD00586CC374A1CAE43EFED4
hashD2F72897E8986303D5567EB2384932B8
hashDE1522F9219497632F30F8A6E72F26B6
hashFDAE2BEB813778B4540A997706862096
hashB9986A0F1F1F1A798DC3F0C59A80A1A3
hash554E699C96B332468F1AE69C1AE81EF9
hash5761BD63DA03686FC480245DA7BD1E9F
hashB6B51508AD6F462C45FE102C85D246C8
hash8F0577D28C4FF5F71B149F444BFABA8E
hash525EF6014F0EF20E44FE47C1D9980B69
hash407B6A136BBAA7172EB44EF9D08BB58A
hash9321A61A25C7961D9F36852ECAA86F55
hash73F0A8C3EA794A04E80C32038249F044
hashEEF8A950952696B018AA9C6DA2F5D7AD
hashEDB1C480295250DD1A38F3AA1357DEAE
hash5537C708EDB9A2C21F88E34E8A0F1744
domainC:\Sharing
domainC:\Netlogon
domainC:\Windows\sysvol\domain\scripts
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-169-1024x142.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-169-300x42.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-169-768x107.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-169.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-131.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-164.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-147.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-146-1024x155.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-146-300x45.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-146-768x116.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-146.webp
domainhttps://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/05/image-143.webp
hash03860d116701cdc9d9bf9c45099bb3d3
hash11e7baca7e652995b2364fdab0d362b7
hash2cd4eb358c45ca783a20ec854a5a860c
hash2e5d1a352885a6efd84dbc0387cbc79e
hash3b7b4f2d33bdfb8a31b480d0eb2815cd
hash4a94d2b730a5a63e6cd54a9b0bb4ea71
hash4e0c37cbf4dde9683943c8a738e5b00a
hash51dec3e170f8a181cc9aea8dcc90c7ab
hash583fe1c1a39f6b873a5c0997bea1f657
hash697f182826495662427ca49edbb345fc
hash71d503709af88821c183a1d0b7ae06ec
hash721606b3659f2c2d80a196ed3cd60053
hash735069890a414869f0113de820ba9afb
hash74ea100b581ec32ea6c2ac2a0030a9f6
hash776e86c13433747299a4e5f9f22e3415
hash7aae8fd9187c88dd0292cce1abd050e2
hash82160a7da5fc4c935e6f48d38a5aaaa6
hash893f735e9a8cc9814dc6eccd5579561c
hash8fceea4fd9ce32dd620ccd580297c7c5
hash92d8bd2a6ee7f6d5c84e037066ce0539
hasha023a6b15419600dc3f6b93e11761dfe
hasha73526d89e5fb7b57f50d8da340e53e9
hashabd11823ddcc3d746ad8621e677a93eb
hashb5b42ac289581b3387ebf120129a19a6
hashb68e019efb39b85f5a0326e22fd4498a
hashbc6b87c79bc71a78da623d031ec1a958
hashd75246d230f22b1da6bbf5fceeed2ef2
hashda9cff1b478b64d47b68d50330e96c60
hashead0d7a8ae0a6ffb7f0a5873fec4ff5e
domainhttps://github.com/jxroot/ZeroPulse
domainhttps://github.com/angristan/wireguard-install
domainhttps://github.com/angristan/openvpn-install
domainhttps://github.com/pizdatiigus/Double-VPN-with-OpenVPN
domainhttps://github.com/depthsecurity/RelayKing-Depth
domainhttps://github.com/trustedsec/Titanis
domainhttps://gist.github.com/gitgotgitgotit/81a578e065da1ccd8c81a8e90c309275
domainchamd5.org
hash1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f
hash1af419b36a5edefef387409e2b3248c9223f7dc49a4f7b15ea095d371c3a70b2
hash24ac3588fb8cfbff63b7fdfcbc7dec1f3c60e54e6f949dd69d68e89e0c89d966
hash3c2182cb0bc7528829ef03f1b1745a92bcc47d917eb8870862488f21fdf1a6d6
hash4a175eed927c0a477eafb8aa35a93c191748acaa78ac7aecd8ea3c4cd868887c
hash51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2
hash6a3ab9e984a759d55af4e84487d1fc44683065cc9a1089d5aa4ad1c0e4e84a63
hash8aa0cb69ca2777001e0f4ba0eaab0841592710e4cc5ccd6b0b526d78bbd8bfba
hashdce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70
hashdfe696ff713318c53fb17731bd4a6585a02c085b590149b19847990b324a0be6
ipv445.86.230.112
ipv491.107.247.163
domainhttp://[REDACTED_DOMAIN_CONTROLLER]:8080/grand.exe
domainHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal
domainHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
domainHKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters
domainHKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa
hash992c951f4af57ca7cd8396f5ed69c2199fd6fd4ae5e93726da3e198e78bec0a5
hashcc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
domainx.com
Top 141 by how many reports mention them.