Lnk run

https://s3.amazonaws.com/360ossecure/simple/Alpha/installer.exe
https://s3.amazonaws.com/360ossecure/simple/Alpha/simple.exe
http://zvd.us/1
http://qgb.us/view/raw/55f809b0
http://zvd.us/2
http://qgb.us/view/raw/ef3419ec
http://zvd.us/3
http://qgb.us/view/raw/a3e7990e
http://tracker.awesomepush.online/5bc63d002c822c0001ff45fd
http://zrkls.pw/geo/geo.php
http://zrkls.pw/files/svchost.exe
https://2no.co/2VA3u5
http://107.172.196.165:7217/mn.exe

hashes
a990ca526f151fad9c809d02ed7b2e3effcbe3598dd2b835f11030ec0816c427  az.exe
9ab8bb266aebc170bcca0369db64d5e3c4f1c8840c15fe27817c51c18c8999db  geoip.php.exe <- drops az.exe
b5ca22ddb42389eb88c1065808cf8cccb5d1ffe8207fbe52a25efe1dc08add6a  index.html.exe
13698f874b497cb331346542ee8f8ee32ad64e96faae3474aa43bceed0ef0b7f  installer.bin.exe
f14e0a8ba9052db95651c246222f4833853b865b1b80d9acc6fd125f3c2f9663  installer.exe
11d03e391405bdcce0ff39e0b4580e2c20a5c6e64f37484267df83d2da97f1c5  mn.exe <- coinminer