Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve 

◈ Key Findings

• Evidence of follow-on distribution using malicious LNK files contained in ZIP archives identified in Kimsuky-linked attack activity
• Traces of the AI agent "opencode" identified in decoy PDF metadata, showing the continued use of AI and LLMs to mass-produce decoys
• All LNK files configured to launch PowerShell, with encrypted loaders concealed within lengthy execution arguments
• Decoy documents and follow-on PowerShell commands retrieved from GitHub Raw Content paths using a GitHub PAT
• Anti-analysis logic designed to detect analysis tools and virtualization processes and terminate execution when specific conditions are met
• Need to strengthen EDR-based detection and threat hunting for the abuse of LNK files, PowerShell, and GitHub

1. Executive Summary

Genians Security Center continues to track Git-based C2 attacks assessed to be carried out by Kimsuky, collectively known as Operation GitPower. In a previous threat intelligence report, we also disclosed evidence that Kimsuky was using AI and local LLMs to prepare attacks and create decoys.

This report presents a follow-up analysis based on a detailed examination of 13 malicious LNK files collected and identified between August 11 and 19, 2026. The LNK files use filenames disguised as documents related to financial and corporate operations, including fund disbursement, insurance premiums, interest payments, policy funds, certificate renewal, store master data, customer documents, and Visa payments.

This shows that Kimsuky's decoy themes, which previously focused primarily on diplomacy, security, and academia, have expanded to a wider range of targets, including financial institutions and corporate personnel. The 13 malicious samples retain the core tactics identified in previous attacks. Repeated characteristics include abnormally long LNK execution arguments, argument concealment using leading spaces, custom decoders, access to GitHub Raw Content using hardcoded PATs (Personal Access Tokens), registration of hidden scheduled tasks, and task names disguised as legitimate software.

However, this analysis also identified additional signs of evolution that were not covered in the previous report.

First, some variants include analysis-evasion routines that detect analysis and virtualization tools, inspect sandbox usernames, and delete command histories. These routines are assessed as attempts to interfere with both automated analysis environments and manual analysis by security researchers.

Second, Pastebin was observed being used as a second-stage payload delivery channel in addition to GitHub. This is interpreted as the use of an alternative delivery route in parallel with the existing C2 operation method in preparation for blocking or takedown.

Third, the decoy document types have diversified beyond PDF to include XLSX and PNG files. Some variants displayed only an error document without providing an actual decoy document. The possibility that this resulted from a mistake by the threat actor cannot be ruled out.

In particular, this analysis continued to identify evidence that AI and LLMs were used to mass-produce decoy documents. The 29 decoy documents downloaded from the GitHub C2 were classified by hash, revealing 11 unique documents and numerous duplicates in which the same documents were redistributed under different randomized filenames. This shows that the threat actor reuses the same decoy documents across repositories while randomizing only the filenames.

Analysis of the document metadata and content found that some PDFs contained "opencode", an AI coding agent, in the Creator and Producer fields, while the Author field remained set to "anonymous". The content also contained unreplaced placeholders such as "(temporary value)", indicating that LLM-generated document drafts were used in the attacks without sufficient review.

(Note) An unreplaced placeholder is temporary text inserted during document creation for later replacement with an actual value but left unchanged in the final document. If the document had undergone a proper review process, notations such as "(temporary value)" should have been replaced with actual figures or text, or deleted. These traces are therefore assessed as important evidence suggesting that an LLM-generated draft was used as an attack decoy without sufficient review.

Another set of PDFs contained HeadlessChrome and Skia/PDF metadata. This indicates that the threat actor first generated the documents in HTML format and then converted them by automatically executing the PDF save function in a headless Chrome browser. The high degree of similarity in content structure and standardized wording across the documents further supports the evidence that they were mass-produced using a single prompt or HTML template with only the topic changed.

These findings show that Kimsuky is increasing the speed and diversity of decoy document creation using AI and LLMs while retaining its existing GitHub PAT-based C2 and LNK execution framework. In particular, the combined use of AI-generated documents and stolen copies of legitimate documents is assessed as an operational approach intended to selectively adjust the credibility of the decoys according to the target and topic.

This report is not based on a single specific sample. It draws on behaviors, infrastructure, and document creation patterns repeatedly identified across the 13 LNK variants and the decoy documents they download. The findings can also be used to develop detection policies for attacks in the same family and strengthen threat hunting and incident response.

[Figure 1-1] Comparison of Placeholders in Decoy Documents

2. Threat Analysis

2-1. Initial Access

Initial access begins with a typical spear phishing attack in which the user extracts a ZIP archive distributed by the threat actor through email or other channels and executes the LNK file contained inside.

The archive contains LNK files with filenames and document icons that can easily be mistaken for legitimate business documents. As shown below, the decoy themes are closely aligned with Korean financial and corporate operations.

[Table 2-1] Comparison of LNK Filenames and Disguise Scenarios

In particular, variants with English filenames, such as "Security_20260811.lnk" and "Security_20260813.lnk", were found to share the same dates and infrastructure as the Korean-language decoys.

This suggests that the same threat actor may have modified the filenames and distributed the variants in parallel to simultaneously target domestic and overseas users or different target groups.

2-2. LNK File Structure and Disguise Characteristics

All 13 samples analyzed share the following disguise characteristics. This strongly suggests that they were generated using the same LNK creation tool or automated generation method.

• All LNK files specify "%ProgramFiles%\Google\Chrome\Application\chrome.exe" as the icon path. This is intended to make users perceive them as legitimate browser executable files.

• The Description field of every LNK file contains the same values shown below. These values exactly match those described in the Operation GitPower report.
• Type: Hangul Document
• Size: 2.84 KB
• Date modified: 10/20/2023 11:23

The actual file format is LNK, and the file sizes range from approximately 319 KB to 8.9 MB. Therefore, the document type, file size, and modification date recorded in the Description field do not match the actual file properties.

• Approximately 300 space characters are inserted before the command-line arguments. As a result, the core command is not immediately visible in the Windows shortcut properties window. This also matches the leading-space technique described in the previous report.

• The commands themselves range from approximately 5,800 to 9,500 characters.

• The analyzed samples can be divided into two groups based on file size. The small variants consist of four files approximately 319 KB in size, while the large variants consist of nine files approximately 8.9 MB in size. However, the actual LNK structures, including the Header, LinkInfo, StringData, and ExtraData sections, are present only within approximately the first 16 KB of each file. The remaining area is filled with pseudorandom alphanumeric padding, as described below.

• • The padding follows a pattern in which letters and numbers alternate. For example, it appears in the form "B0qS7zD5uK2mP9aX6cL3yN8v..." and uses a distinctive character set that excludes certain vowels.
  • Windows ignores data located after the end of the LNK structure. Therefore, the padding is extraneous data that does not affect the execution flow.

[Figure 2-1] Padding Data

This technique can be used to artificially increase the file size and evade detection by some sandbox and anti-malware engines.

2-3. Custom Decoder Analysis

The core data in the execution arguments is not encoded in standard Base64 format.

It consists of a space-delimited decimal array and a custom arithmetic substitution decoder. The array variable name, $VIUSBvejbawf, is identical across all 13 samples.

[Figure 2-2] LNK Execution Arguments

This is a typical loader structure designed to evade static detection by obfuscating the actual payload as a numeric array and then decrypting, saving, and executing it at runtime. The core flow of the decoding routine is as follows.

• If pw_num ≥ the encoded value, output = pw_num - encoded value.
• Otherwise, output = encoded value.
• The key index is applied cyclically.

4) The resulting byte sequence is restored as a UTF-8 string to obtain the second-stage PowerShell script.
5) The restored script is saved to "%AppData%\<random>.ps1" and then executed using Invoke-Expression.

The additive constant +103 is used across all 13 samples. In contrast, the decoder key string is configured differently for each variant. The identified key strings are as follows.

[Table 2-2] Comparison of Decoder Keys and Script Names by Variant

The reuse of the same algorithm, constant, and variable name while changing only the decoder key supports the assessment that multiple variants were generated using the same builder with different parameters.

2-4. Second-Stage PowerShell Loader Behavior

2-4-1. “20260811_자금집행.lnk”

Using "20260811_자금집행.lnk" as an example, the decoded second-stage script typically performs the following operations:

• The script specifies "%TEMP%\자금집행첨부자료.pdf" as the destination path and first deletes any existing file at that location.

• The script loads a hardcoded PAT used to access GitHub Raw Content.

• The URL is split into individual strings, such as "h" + "t" + "t" + "p" + "s" + ..., and assembled at runtime. This technique is intended to evade static string detection. The resulting URL is “https://raw.githubusercontent[.]com/sven5500/firtfirter/main/”.

• Using authentication headers (Authorization: token <PAT> and Accept: application/vnd.github.v3.raw) and a meaningless custom header (aohvcoehfg=oxhdvshbrsregst), the script downloads the remote decoy file "xnciuegwpo.pdf". It then saves the file to "%TEMP%\자금집행첨부자료.pdf" and opens it immediately, leading the victim to believe that a legitimate document has been opened.

• The script creates "%AppData%\mlxchjvose.ps1". When executed, this script downloads the follow-on payload "SqpmvihdrgS.txt" from the same repository and saves it to "%AppData%\qpmvixibrg.ps1". It then launches PowerShell without displaying a window using the following command format: conhost.exe --headless powershell.exe -ExecutionPolicy Bypass -File <path>.

• The script registers a hidden scheduled task named "BitLockor Encrypter All Drives_102974298364124_skillerty". Although the name resembles BitLocker, a legitimate Windows feature, it uses the misspelling "BitLockor" as a form of masquerading. The task is configured to run for the first time five minutes after registration and subsequently at 10-minute intervals. The -Hidden option is also applied, making the task more difficult for users to notice.

• The script deletes itself using the command Remove-Item -Path $MyInvocation.MyCommand.Path -Force.

Launching PowerShell through conhost.exe --headless without displaying a window is a concealment technique intended to hide subsequent stages from the user.

The scheduled task names are also designed to resemble legitimate system tasks associated with BitLocker, MATLAB, and .NET Framework NGEN. Minor spelling variations are used across the variants, indicating an attempt to evade static signature-based detection.

2-5. Analysis Evasion Routines

2-5-1. “20260819_고객서류_No01.lnk”

This variant was found to contain analysis evasion code at the beginning of the first-stage script that was not described in the previous report. Its primary behaviors are as follows.

• The script checks for processes associated with VGAuthService, vmtoolsd (VMware Tools), ProcessHacker, x64dbg, PE-bear, CFF Explorer, Autoruns, procexp, procexp64, Procmon, Procmon64, tcpview, Dbgview, portmon, and other tools.
• The script records the Get-Process output in "%AppData%\1.txt" and searches it for the name of each tool. If any of these names are found, the script terminates execution.

• If the value of $env:username is Bruno, the script immediately deletes itself. Bruno is presumed to be a username used in an analysis environment.

• If an analysis environment is detected, the script deletes the PowerShell command history file "%AppData%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt". It then removes temporary files and terminates execution.

• If the analysis evasion checks are passed, the script uses the XLSX document "영수증.xlsx" as the decoy file. The remote filename is "NWfie.xlsx".

These behaviors indicate that the threat actor is enhancing its capabilities to counter automated analysis environments and reverse engineering tools.

They also reaffirm the limitations of determining whether content poses a threat based solely on the quality of the decoy document or the results observed when it is opened.

2-6. Pastebin-Based Alternative C2

2-6-1. “Visa5499.lnk”

This variant downloads and opens the PNG decoy file "Visa_5499.png" from GitHub Raw.

• The persistence script created at "%AppData%\p5234fop.ps1" retrieves remote code from Pastebin using the following URL.
• https://pastebin[.]com/raw/gybpx38s
• If the received code is not empty, the script immediately executes it in memory using iex (Invoke-Expression).

• The scheduled task is named "MATLAB R2022bsdugbvr Startup Acceleratorsdpvishdgreg" to make it appear to be a legitimate MATLAB-related task. The task is configured to run for the first time five minutes after registration and subsequently at 35-minute intervals.

Rather than relying solely on GitHub as a single channel, this variant also uses Pastebin, a legitimate text-sharing service, as a delivery channel for the second-stage payload.

This is assessed to be a channel diversification strategy intended to make it difficult to disable all C2 communications by blocking a specific domain alone.

2-7. Variant Classification and Infrastructure Correlation

The characteristics of the 13 malicious LNK files are summarized below. All samples were found to contain the same description in their properties.

2-8-2. Classification by Authoring Tool

Metadata analysis of the 11 documents identified four distinct families based on the authoring tools used.

[Figure 2-3] opencode Interface

These values are not typically generated by conventional document authoring software and strongly suggest that the documents were generated programmatically through an AI agent rather than manually created using document authoring tools. The Author field is also set to anonymous across all of these documents, indicating that the tool's default value was left unchanged.

The body text of the opencode family documents contains unreplaced placeholder text that appears to have been generated by an LLM.

• Payment schedule: Monthly payment date (placeholder)
• Payment grace period: 14 days from the payment date (placeholder)
• Working capital: Up to KRW 100 million per company at a fixed annual interest rate of 2.0% (placeholder)

This indicates that during the document generation process, the model marked figures it could not determine as placeholders and that the threat actor distributed the documents without replacing them with actual values. This suggests that little or no subsequent human review was performed during document production. It also represents a key artifact that directly indicates AI-based automated generation.

The timestamp information further supports the possibility that the documents were generated in a batch rather than created individually. The CreationDate values of all identified opencode family documents are identical down to the second at 2026-08-16 03:00:00 UTC, and no separate ModDate values were identified. When converted to Korea Standard Time (KST, UTC+09:00), the timestamp corresponds to 2026-08-16 12:00:00.

The fact that multiple documents have creation timestamps that are identical down to the second differs from a typical workflow in which a user creates or edits each document sequentially. This suggests that multiple documents may have been generated in a batch through a single automated process or script.

[Figure 2-4] opencode Entry in PDF Properties

Text similarity analysis of the HeadlessChrome family documents found that some documents were more than 80% identical. Comparison of the actual sentences shows that only the topic keywords were replaced, while the sentence structure remained unchanged.

• 이자 납부와 관련하여 처리 완료된 납부 내역을 안내드리오니, 각 담당자께서는 해당 내용을 확인하여 주시기 바랍니다.(We are providing details of the completed interest payments. Each person in charge is requested to review the relevant information.)

• 보험료 자동이체와 관련하여 처리 완료된 입금 내역을 안내드리오니, 각 담당자께서는 해당 내용을 확인하여 주시기 바랍니다.
  (We are providing details of the completed automatic insurance premium transfer deposits. Each person in charge is requested to review the relevant information.)

[Figure 2-5] Comparison of HeadlessChrome Family Decoy Documents

Common boilerplate phrases such as "prepared for internal review and business management purposes," "request for confirmation," and "each person in charge is requested to review the relevant information" also appear identically across multiple documents. This is assessed to be a typical pattern of mass generation in which only the topic is changed within a single prompt or document template.

HeadlessChrome-based PDF generation is commonly used in AI and LLM-based document automation pipelines. An LLM generates the document body and HTML/CSS formatting based on natural language instructions, and Headless Chrome renders the HTML without displaying a screen and saves it as a PDF.

[Figure 2-6] Metadata of the Interest Payment Notice PDF Document

Therefore, when PDF metadata contains the values Creator: HeadlessChrome and Producer: Skia/PDF, it suggests that an HTML document generated by an LLM or script may have been converted to PDF through browser automation rather than being manually created using a conventional document editor.

The identical creation and modification timestamps, which indicate no subsequent editing, and the sequential generation of multiple documents within approximately 18 minutes further support the use of automation.

This family uses a table-based official document format and is more polished than the opencode family. No exposed artifacts such as "(placeholder)" were identified. This suggests that document quality was improved through a two-stage pipeline in which AI generated the HTML formatting and a browser rendered it.

For the two XLSX documents, both the author and last modified by fields in "docProps/core.xml" are recorded as AzureUser. AzureUser is a default administrator account name commonly used on Microsoft Azure virtual machines, suggesting that the threat actor may have created the documents in a cloud VM environment. This is also consistent with the common operational practice of state-sponsored threat groups using cloud instances to evade tracking.

The pattern of using AI to create decoy documents, identified in last month's report, is more clearly demonstrated in this campaign. In particular, the following three findings were newly identified.

• Identification of the Tool
• Previously, the use of AI was inferred only from the writing style and document structure. In this analysis, however, the AI coding agent opencode is recorded directly in the PDF Producer field, explicitly identifying the tool used.

• Two Distinct Production Pipelines
• Simple AI generation through direct opencode output and a two-stage AI plus rendering process involving HTML generation followed by Headless Chrome conversion are used in parallel. The latter produces more polished documents, indicating that the threat actor is improving its production pipeline to enhance quality.

• Lack of Review
• The "(placeholder)" text remained in the distributed documents as many as nine times. Although AI enabled greater production speed and volume, the documents were distributed without adequate quality review.

3. Threat Attribution

3-1. Same Threat Actor as the Operation GitPower Cluster

Based on the following evidence, this campaign is assessed to have been conducted by the same threat actor behind Kimsuky's Operation GitPower.

• The Chrome icon, the forged "Hangul Document / 2.84 KB / 10/20/2023 11:23" property description, and approximately 300 leading spaces exactly match the fingerprints described in the Operation GitPower report.

• The abnormally long command-line arguments and the method of combining URL fragments in the form of "ht"+"t"+"ps" represent the same evasion tactics.

• The use of an arithmetic substitution-based custom decoder instead of the standard FromBase64String function is a recurring characteristic observed within the same cluster.

• The Accept: application/vnd.github.v3.raw header, token <PAT> authentication, and insertion of meaningless custom headers are identical to the C2 operation methods used in Operation GitPower.

• The registration of scheduled tasks masquerading as legitimate software such as BitLocker, MATLAB, and .NET, followed by deletion of the original script, represents the same persistence and trace removal routine.

• While maintaining the existing pattern of masquerading as financial, legal, and business documents, the decoy themes have become more specialized to target Korean financial and retail business operations.

4-1. Threat Campaign Conclusions

The intrusion chain used in this campaign is identical to that of Kimsuky's existing Operation GitPower. However, this analysis shows that the cluster is not static and continues to evolve toward greater evasion and diversification.

The introduction of analysis evasion routines, the use of Pastebin as an alternative C2 channel, and the diversification of decoy formats all demonstrate a clear intent to increase the cost of detection and analysis. In particular, when combined with the trend highlighted in the previous report involving improvements in decoy quality through the use of AI, defensive approaches that rely solely on assessing the decoy content itself are no longer sufficient.

The focus of defense should therefore shift toward behavior-based correlation detection. We recommend connecting and analyzing the following sequential anomalies within a single attack context.

• Execution of an LNK file created immediately after archive extraction
• PowerShell execution initiated by an LNK file, with abnormally long command-line arguments containing thousands of characters and a large number of leading spaces
• Custom decoding using variable names similar to $VIUSBvejbawf and space-delimited numeric arrays
• Execution of PowerShell without a visible window through "conhost.exe" using the --headless option
• Creation and immediate execution of randomly named .ps1 files in the "%AppData%" and "%TEMP%" directories
• Registration of hidden scheduled tasks masquerading as legitimate software such as BitLocker, MATLAB, and .NET, with repeated execution at intervals of 5 to 35 minutes
• Use of the Authorization: token ghp_... and Accept: application/vnd.github.v3.raw headers when accessing raw.githubusercontent[.]com
• Combined Invoke-RestMethod and iex calls to pastebin[.]com/raw/...
• Evasion activities such as enumerating analysis tool processes and deleting "ConsoleHost_history.txt"
• Self-deletion of the original script or LNK file

4-2. Key Indicators for Threat Hunting

AI is improving the quality of decoy documents and accelerating attack preparation, while evasion techniques continue to become more sophisticated. However, it remains difficult to completely conceal the execution, persistence, C2 communication, and payload-loading activities that occur on endpoints.

An EDR-centered integrated response framework is therefore required to continuously incorporate the latest indicators of compromise, analyze correlations between attack stages, and rapidly block anomalous behavior.

• Files with an LNK property description matching the following values
• Type: Hangul Document
• Size: 2.84 KB
• Date modified: 10/20/2023 11:23
• LNK files with an icon masquerading as "chrome.exe" while the actual target is "powershell.exe" or "cmd.exe"
• LNK command-line arguments containing at least 300 leading spaces
• PowerShell processes accessing raw.githubusercontent[.]com using GitHub PATs unrelated to legitimate business operations
• Scheduled task name pattern hunting
• Tasks with slight spelling variations resembling legitimate task names or with meaningless numeric strings of at least 10 digits appended to the end of the task name

4-3. Integrated Response Strategy Based on Genian Insights E

This campaign is a multi-stage attack that gains initial access using malicious LNK files and decoy documents assessed to have been created with the AI agent opencode and HeadlessChrome. It then executes obfuscated PowerShell through a custom decoder, establishes persistence using hidden scheduled tasks masquerading as legitimate software, and communicates with C2 infrastructure through GitHub PATs and Pastebin.

Some variants also include analysis evasion capabilities such as analysis tool detection and command history deletion. The following sequential anomalies should therefore be connected and analyzed within a single attack context.

Genian Insights E is an integrated endpoint security platform that correlates various endpoint events, including process trees, command lines, file creation, scheduled tasks, and network connections. This makes it possible to visualize LNK execution, PowerShell activity, connections to GitHub and Pastebin, and subsequent payload execution as a single attack flow, even when individual events may appear legitimate in isolation.

LnkTarget information can also be used to identify the targets and commands referenced or executed by an LNK file from the initial stage. This allows the masquerading characteristics of this campaign, including abnormally long command-line arguments and leading spaces, to be identified early. Subsequently created scripts, child processes, persistence activity, and external communications can then be correlated and tracked.

This visibility provides a foundation for effectively responding to attacks that abuse legitimate cloud services and development platforms such as GitHub and Pastebin for C2 communications or attempt to evade detection by terminating execution when an analysis environment is detected.

Ultimately, even if AI improves the quality and volume of decoy documents and accelerates attack preparation, it cannot conceal all execution, persistence, communication, and payload activity occurring on endpoints. Effective response to this campaign therefore requires an EDR-centered integrated response framework that continuously incorporates the latest indicators of compromise, analyzes correlations between attack stages, and rapidly blocks anomalous behavior.

 

[Figure 4-1] Malicious LNK Detection Using EDR

Genian Insights E's Attack Storyline feature enables the rapid detection of malicious LNK files created when ZIP files delivered through spearphishing are extracted and provides visibility into the associated sequence of activities.

This allows malicious activity to be identified early during the initial stage of a threat intrusion and helps effectively prevent further damage and threat propagation through a rapid response.

[Figure 4-2] Analysis of an Obfuscated PowerShell Command Line

When a malicious LNK file is executed, an associated PowerShell process is launched, followed by a sequence of malicious activities, including the execution of additional commands through an obfuscated command line.

Genian Insights E analyzes these process execution flows and behavior-based events in real time. It also provides intuitive visibility into obfuscated command lines executed through PowerShell, allowing attack activity to be rapidly identified and addressed.

[Figure 4-3] GitHub C2 Connection via PowerShell

After the PowerShell command is executed, the attacker uses persistence mechanisms such as scheduled tasks in Task Scheduler to configure malicious activities to run repeatedly at regular intervals. The infected system then periodically communicates with the GitHub-based C2 server to receive additional commands or payloads and continuously performs subsequent malicious activities intended by the threat actor.

Genian Insights E can correlate and analyze scheduled task creation and execution history, process behavior involving PowerShell and other processes, and recurring external network communication patterns.

This enables the identification of anomalous communication and execution flows that differ from legitimate GitHub usage. It also helps security administrators rapidly recognize C2 communication and persistence activities and take the necessary response measures, including blocking threats and preventing further propagation.

[Figure 4-4] Dedicated Analysis Interface in Genian Insights E

Through its dedicated Analysis interface, Genian Insights E provides intuitive access to key information about detected threats and anomalous behavior identified through XBA. Rather than simply listing individual events, it allows the primary processes, behaviors, and network activities associated with an attack flow to be understood at a glance.

In particular, XBA-based anomaly detection results can be reviewed visually, allowing anomalous execution patterns and suspicious behavior to be quickly distinguished from normal activity. Correlations between related events also enable efficient analysis of the cause and progression of a threat.

This allows security administrators to rapidly understand the severity and context of a detected threat and perform the necessary actions more quickly and efficiently, from detailed analysis and impact assessment to blocking and follow-up response.

5. IoC (Indicator of Compromise)

5-1. MD5 Hash

10780939962b54addc9d31f57d80edfc

1523a2fcc901965ab4568d9fe829e4af

500e0bc0d7579fb338912770964076fe

685bfc6b2c29fbc16cfad908894add55

7a53089053b1381742856a5cf2b95f8b

8db2f20b719dcb7029d6296505622093

900e832c10d851bbdef3fb191a15db0e

a2015665a3e18bf0ef86e3931245c7e6

bb88940e915b11f6330b7446f6037f5b

ce5932b88f879f26006df81f2fa7667e

d0894d4626aae0f96d6b84ca3bb71a36

e50f2ae7fb03675a1ef58b1cf9cda6d1

f648bdd3c2cd902e239149de86d43e8f

5-2. GitHub Accounts

github[.]com/sven5500

github[.]com/montry111

github[.]com/jamjack2026

github[.]com/urusa4400

github[.]com/jamestony88

github[.]com/baras6600P

github[.]com/choemiyang

github[.]com/jeni534

5-3. Pastebin

pastebin[.]com/raw/gybpx38s

5-4. E-Mail

baras6600@proton[.]me

choemiyang@hotmail[.]com

dustinharrise91@outlook[.]com

jackal3300@proton[.]me

jametony8@outlook[.]com

jamjack2026@proton[.]me

montry111@proton[.]me

sven5500@proton[.]me

taini7700@outlook[.]com

urusa4400@proton[.]m