INDICATOR1 SOURCE
URL https://bugcheck.xigncodeservice.com/Common/Lib/Common_Include.php
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations and research history in one connected catalog.
131,398Catalog records
62,804File records
147,419Source observations
123Family labels
131,398 MATCHING RECORDS
INDICATOR1 SOURCE
URL https://capec.mitre.org/data/definitions/572.html
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.commandfive.com/papers/C5_APT_SKHack.pdf
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.cfr.org/interactive/cyber-operations/axiom
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://nw.infestexe.com/version/last.php
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign/
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL http://williamshowalter.com/a-universal-windows-bootkit/
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
Indicator published by the cited source.
Collected 2026-10-08 08:01 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1009
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1043
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://bugcheck.xigncodeservice.com/Common/Lib/Common_bsod.php
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://capec.mitre.org/data/definitions/439.html
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordFILE1 SOURCE
SHA1 2830de648bf0a521320036b96ce0d82bef05994c
2830de648bf0a521320036b96ce0d82bef05994cFile hash published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
IP 103.19.3.21
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
IP 122.10.117.206
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
DOMAIN dyn-tracker.com
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/[
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
IP 110.45.146.253
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.welivesecurity.com/2019/10/14/connecting-dots-exposing-arsenal-methods-winnti/
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
DOMAIN mz64x.exe
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
DOMAIN livehost.live
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
IP 154.223.215.116
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL http://www.welivesecurity.com[WeLiveSecurity
Indicator published by the cited source.
Collected 2026-10-08 06:26 UTCOpen evidence recordSource labels and confidence are preserved. A filename or report mention alone does not establish that a file is malicious. Indicator observation dates describe the cited source; collection dates describe this catalog.