infection-cobalt-strike.txt

{docusign}

{http://ecofiltroform.triciclogo.com/swellheaded.php.html}

{base64}

{0524_4109399728218.doc}

{hancitor}

{rundll32.exe c:\users\[username]\appdata\roaming\microsoft\word\startup\ket.t,EUAYKIYBPAX}

{http://euvereginumet.ru/8/forum.php}

{http://gromber6.ru/6hjusfd8.exe}

{ficker stealer}

{cobalt strike}

{google docs}