Indicators of Compromise

45.142.212.47

colunm.tk

45.144.31.31

mute-pond-371d.zalocdn.workers

185.250.150.22

8c93083440cd9ce5fe4cf58c3348bd85bdf07f6c

procdump64.exe

javaupdate.biguserup.workers.dev

45.142.214.242

dns.exe

taskhosts.exe

vmserver.exe

SecurityHealthSystray.dll

jquery-3.2.2.min.js

stage.cleanup

fofa.su

BadPotatoNet4.exe

jquery-3.3.1.min.js

mute-pond-371d.zalocdn.workers.dev

http-get.verb

http-get.client

http-post.uri

http-post.client

http-get.server.output

http-get.uri

service.exe

imjp14k.dll.dat

COMSysUpdate.exe

dns.txt

Microsoft.NET

4Operational.evtx

mwt.evtx

LxpSvc.exe

install.bat

sqlmap.py

uldrdata.txt

www.eloples.com

152.89.244.185

p.txt

sqluldr.exe

www.digicert.com

auth.json

conn.exe

pe.sections

dbgeng.dll

elf.symtab

59.173.55.109

ThreatFox: Cobalt Strike

185.193.153.57

ThreatFox: Cobalt Strike