不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様9社 -
2025/01/06
※2025/01/06 更新
マルウェア感染させると考えられるURLを検知（2025/01/06）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://185[.]43[.]5[.]145/ServerUniversaluploadsDatalife/voiddb/cpupython/LocalDefaultsecureMariadb/Local/UpdateGame/providerEternalpacketupdateBigloaddefaultbaselinux[.]php hxxp://048038cm[.]renyash[.]ru/pipepacketprocessGeneratordownloads[.]php hxxp://500817cm[.]renyash[.]top/externaltoupdateDefaultFlowerasynctrafficWordpresspublic[.]php hxxps://ksmarjaa[.]cloud/WiFiManager[.]exe hxxp://250345cm[.]renyash[.]ru/sqltemp[.]php hxxp://185[.]239[.]51[.]56/externalVmpacketlongpollSqldbFloweruniversalCentral[.]php hxxp://891781cm[.]renyash[.]ru/ProcessorServerdefaultsqltrafficuniversalwpprivate[.]php hxxp://487997cm[.]renyash[.]top/VideoFlowergeneratorTestpublic[.]php hxxp://101349cm[.]renyash[.]ru/VideovmGamedefaultTestuniversalwp[.]php hxxp://126987cm[.]renyash[.]ru/VmpipeJavascript_HttpauthLongpollMultiWordpressDle[.]php hxxp://pw334[.]castledev[.]ru/L1nc0In[.]php hxxp://62[.]109[.]1[.]101/PhpLine/Defaultbaselocal/BigloadProviderlowLine/multiline5Game/MultiupdateVm6/Secure1/Linuxdumpdownloads/asyncwordpressVoiddb8/universalexternallow/dump0Linux/1GeoPublicLow/flower0temporary/9cpu/PythonPacketgame[.]php hxxp://797441cm[.]n9shteam2[.]top/Videouploads[.]php hxxp://193[.]58[.]121[.]137/privateDownloadsvideoLocal/videoWordpressPythonwindows/Game/localTrackcpu/7Game/servermariadbvideodownloads/imageVideorequestSecureProcesstrackwpcentral[.]php hxxp://86[.]110[.]194[.]28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic[.]php hxxp://unasnetds[.]ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary[.]php hxxp://52952cm[.]darkproducts[.]ru/L1nc0In[.]php hxxp://206[.]188[.]197[.]24/Process6cdn/3ImageLongpollDump/geoDefaultMultiProcess/lowLine/Processdumpmulti/LinejsProcessauthFlowerTestLocal[.]php hxxp://495112cm[.]renyash[.]ru/vmLineMultiUniversalwp[.]php hxxp://62[.]109[.]6[.]177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase[.]php hxxp://154[.]29[.]71[.]9/eternalCpuImage/PublicTo7Poll/BetterPacketWindowsApi/83/asyncPublicvideo6/7protect/6Linux/TracklowBigload/sqlVoiddbprivateTraffic/PublicDlelongpoll/DbCdn[.]php hxxp://31[.]177[.]109[.]24/wpLongpoll/voiddbimage8/mariadb0Auth3/javascriptProcessor/AsyncImage/Packet/ProtonTolocal/Low0Lowsql/9Public8/vmrequestGeogeneratorWplocal[.]php |
DCRat |
| URL | hxxp://157[.]90[.]248[.]141/d9e00e90e18cf915/vcruntime140[.]dll hxxp://95[.]215[.]207[.]195/86fcb855254ff44e/vcruntime140[.]dll hxxp://157[.]90[.]248[.]141/d9e00e90e18cf915/msvcp140[.]dll hxxp://95[.]215[.]207[.]195/86fcb855254ff44e/mozglue[.]dll hxxp://95[.]215[.]207[.]195/86fcb855254ff44e/msvcp140[.]dll hxxp://157[.]90[.]248[.]141/d9e00e90e18cf915/freebl3[.]dll hxxp://157[.]90[.]248[.]141/d9e00e90e18cf915/softokn3[.]dll hxxp://157[.]90[.]248[.]141/d9e00e90e18cf915/mozglue[.]dll hxxp://95[.]215[.]207[.]195/86fcb855254ff44e/softokn3[.]dll hxxp://95[.]215[.]207[.]195/86fcb855254ff44e/sqlite3[.]dll hxxp://178[.]22[.]31[.]96/cb8373ac6348bc41/sqlite3[.]dll hxxp://93[.]123[.]39[.]135/129edec4272dc2c8[.]php hxxp://185[.]216[.]71[.]4/feed7c30357659ed[.]php hxxp://185[.]216[.]71[.]4/01210a7d1761b27e/softokn3[.]dll hxxp://185[.]216[.]71[.]4/01210a7d1761b27e/sqlite3[.]dll hxxp://185[.]216[.]71[.]4/01210a7d1761b27e/freebl3[.]dll hxxp://185[.]216[.]71[.]4/01210a7d1761b27e/mozglue[.]dll hxxp://185[.]216[.]71[.]4/01210a7d1761b27e/nss3[.]dll hxxp://185[.]216[.]71[.]4/01210a7d1761b27e/msvcp140[.]dll hxxp://185[.]216[.]71[.]4/01210a7d1761b27e/vcruntime140[.]dll hxxp://162[.]248[.]227[.]2/c978b91b47469f3f[.]php hxxp://31[.]41[.]244[.]11/files/UnitedError/random[.]exe hxxp://31[.]41[.]244[.]11/files/7837761420/HWf8n69[.]exe hxxp://162[.]248[.]227[.]2/de64a059f7fa0776/vcruntime140[.]dll hxxp://162[.]248[.]227[.]2/de64a059f7fa0776/freebl3[.]dll hxxp://162[.]248[.]227[.]2/de64a059f7fa0776/mozglue[.]dll hxxp://162[.]248[.]227[.]2/de64a059f7fa0776/softokn3[.]dll hxxp://162[.]248[.]227[.]2/de64a059f7fa0776/sqlite3[.]dll hxxp://162[.]248[.]227[.]2/de64a059f7fa0776/nss3[.]dll hxxp://162[.]248[.]227[.]2/de64a059f7fa0776/msvcp140[.]dll hxxp://91[.]211[.]250[.]231/1337268cc1cad308[.]php hxxp://91[.]211[.]250[.]231/b0fce2118167e296/nss3[.]dll hxxp://91[.]211[.]250[.]231/b0fce2118167e296/msvcp140[.]dll hxxp://91[.]211[.]250[.]231/b0fce2118167e296/mozglue[.]dll hxxp://91[.]211[.]250[.]231/b0fce2118167e296/softokn3[.]dll hxxp://91[.]211[.]250[.]231/b0fce2118167e296/freebl3[.]dll hxxp://91[.]211[.]250[.]231/b0fce2118167e296/vcruntime140[.]dll hxxp://91[.]211[.]250[.]231/b0fce2118167e296/sqlite3[.]dll hxxp://185[.]237[.]165[.]47/9b5e67be63d48ab6/nss3[.]dll hxxp://185[.]237[.]165[.]47/9b5e67be63d48ab6/msvcp140[.]dll hxxp://185[.]237[.]165[.]47/9b5e67be63d48ab6/freebl3[.]dll hxxp://185[.]237[.]165[.]47/9b5e67be63d48ab6/vcruntime140[.]dll hxxp://185[.]237[.]165[.]47/9b5e67be63d48ab6/softokn3[.]dll hxxp://185[.]237[.]165[.]47/9b5e67be63d48ab6/mozglue[.]dll hxxp://185[.]237[.]165[.]47/9b5e67be63d48ab6/sqlite3[.]dll hxxp://185[.]215[.]113[.]206/68b591d6548ec281/freebl3[.]dll? hxxps://80[.]85[.]241[.]225/ef05b005854373ec[.]php hxxps://81[.]19[.]137[.]220/72e62e029dc81ebf[.]php hxxps://94[.]228[.]169[.]55/7baff47bec0ff5db[.]php hxxps://77[.]73[.]131[.]100/a2f524d70db7d1a7[.]php hxxps://185[.]106[.]94[.]206/4e815d9f1ec482dd[.]php hxxps://185[.]219[.]81[.]135/de4fe4f133a5af6f/vcruntime140[.]dll hxxp://5[.]42[.]66[.]25/287dbd4538093b9e/vcruntime140[.]dll hxxp://91[.]107[.]196[.]27/88e91184e089da83/vcruntime140[.]dll hxxps://46[.]8[.]238[.]240/11f084e893b710ed/vcruntime140[.]dll hxxp://147[.]45[.]47[.]72/9f244f7bc6ab2605/vcruntime140[.]dll hxxps://77[.]83[.]175[.]91/18e58bd9b3a5293b/mozglue[.]dll hxxps://77[.]83[.]175[.]91/18e58bd9b3a5293b/sqlite3[.]dll hxxps://185[.]219[.]81[.]132/40b6c4848ca5e8ed/sqlite3[.]dll hxxps://185[.]219[.]81[.]132/40b6c4848ca5e8ed/vcruntime140[.]dll hxxps://185[.]219[.]81[.]132/40b6c4848ca5e8ed/mozglue[.]dll hxxps://185[.]219[.]81[.]135/de4fe4f133a5af6f/mozglue[.]dll |
Stealc |
| URL | hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]arm hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]mpsl hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]m68k hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]arc hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]sh4 hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]x86_64 hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]ppc hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]mips hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]x86 hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]spc hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]arm7 hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]arm5 hxxp://5[.]230[.]229[.]51/tt/armv5l hxxp://5[.]230[.]229[.]51/tt/armv6l hxxp://5[.]230[.]229[.]51/tt/armv4l hxxp://5[.]230[.]229[.]51/tt/armv7l hxxp://5[.]230[.]229[.]51/tt/armv4eb hxxp://5[.]230[.]229[.]51/vv/sh4 hxxp://5[.]230[.]229[.]51/tt/sh4 hxxp://141[.]95[.]84[.]4:1594/jackmymips hxxp://141[.]95[.]84[.]4:1594/gtop[.]sh hxxp://141[.]95[.]84[.]4:1594/jackmyarmv5 hxxp://141[.]95[.]84[.]4:1594/jackmym86k hxxp://141[.]95[.]84[.]4:1594/jackmymipsel hxxp://141[.]95[.]84[.]4:1594/jackmyi686 hxxp://141[.]95[.]84[.]4:1594/jackmyarmv4tl hxxp://141[.]95[.]84[.]4:1594/jackmyx86 hxxp://141[.]95[.]84[.]4:1594/jackmyarmv6 hxxp://141[.]95[.]84[.]4:1594/jackmypowerpc hxxp://141[.]95[.]84[.]4:1594/jackmysparc hxxp://141[.]95[.]84[.]4:1594/jackmyi486 hxxp://141[.]95[.]84[.]4:1594/jackmysh4 hxxp://141[.]95[.]84[.]4:1594/jackmymips64 hxxp://141[.]95[.]84[.]4:1594/jackmyarmv4 hxxp://141[.]95[.]84[.]4:1594/jackmyi586 hxxp://83[.]222[.]191[.]146/mips hxxp://83[.]222[.]191[.]146/arm4 hxxp://83[.]222[.]191[.]146/x86_64 hxxp://83[.]222[.]191[.]146/arm7 hxxp://83[.]222[.]191[.]146/linnn hxxp://5[.]230[.]227[.]80/vv/mips hxxp://5[.]230[.]227[.]86/vv/riscv32 hxxp://5[.]230[.]227[.]80/tt/sh4 hxxp://5[.]230[.]227[.]80/vv/sparc hxxp://5[.]230[.]227[.]80/tt/riscv32 hxxp://5[.]230[.]227[.]86/vv/armv5l hxxp://5[.]230[.]227[.]86/vv/i686 hxxp://5[.]230[.]227[.]86/vv/mips64 hxxp://5[.]230[.]227[.]86/ss/armv4eb hxxp://5[.]230[.]227[.]80/ss/armv5l hxxp://5[.]230[.]227[.]80/vv/mips64 hxxp://5[.]230[.]227[.]86/tt/armv5l hxxp://5[.]230[.]227[.]86/vv/mipsel hxxp://5[.]230[.]227[.]86/vv/armv4l hxxp://5[.]230[.]227[.]80/tt/sparc hxxp://5[.]230[.]227[.]80/ss/armv4l hxxp://5[.]230[.]227[.]80/vv/riscv32 hxxp://5[.]230[.]227[.]86/tt/mips hxxp://5[.]230[.]227[.]86/tt/armv4eb hxxp://5[.]230[.]227[.]80/vv/i686 hxxp://5[.]230[.]227[.]80/ss/armv6l hxxp://5[.]230[.]227[.]80/tt/armv6l hxxp://5[.]230[.]227[.]86/tt/armv6l hxxp://5[.]230[.]227[.]86/vv/powerpc hxxp://5[.]230[.]227[.]80/tt/powerpc hxxp://5[.]230[.]227[.]86/tt/mipsel hxxp://5[.]230[.]227[.]80/tt/armv7l hxxp://5[.]230[.]227[.]80/ss/armv4eb hxxp://5[.]230[.]227[.]80/ss/armv7l hxxp://5[.]230[.]227[.]86/tt/sparc hxxp://5[.]230[.]227[.]86/ss/armv7l hxxp://5[.]230[.]227[.]80/vv/armv4l hxxp://5[.]230[.]227[.]80/vv/armv6l hxxp://5[.]230[.]227[.]80/vv/arc hxxp://5[.]230[.]227[.]80/tt/armv4l hxxp://5[.]230[.]227[.]86/vv/mips hxxp://5[.]230[.]227[.]80/tt/mipsel hxxp://5[.]230[.]227[.]80/tt/armv5l hxxp://5[.]230[.]227[.]80/tt/mips64 hxxp://5[.]230[.]227[.]86/ss/armv5l hxxp://5[.]230[.]227[.]86/tt/armv7l hxxp://5[.]230[.]227[.]86/vv/armv4eb hxxp://5[.]230[.]227[.]80/vv/powerpc hxxp://5[.]230[.]227[.]80/vv/armv5l hxxp://5[.]230[.]227[.]86/tt/armv4l hxxp://5[.]230[.]227[.]86/ss/armv6l hxxp://5[.]230[.]227[.]86/ss/armv4l hxxp://5[.]230[.]227[.]80/vv/mipsel hxxp://5[.]230[.]227[.]86/vv/armv7l hxxp://5[.]230[.]227[.]86/vv/sparc hxxp://5[.]230[.]227[.]80/tt/arc hxxp://5[.]230[.]227[.]86/tt/arc hxxp://5[.]230[.]227[.]80/tt/armv4eb hxxp://5[.]230[.]227[.]86/vv/sh4 hxxp://5[.]230[.]227[.]86/tt/mips64 hxxp://5[.]230[.]227[.]80/vv/armv4eb hxxp://5[.]230[.]227[.]80/vv/sh4 hxxp://5[.]230[.]227[.]80/tt/mips hxxp://5[.]230[.]227[.]86/vv/arc hxxp://5[.]230[.]227[.]86/tt/powerpc hxxp://5[.]230[.]227[.]86/tt/riscv32 hxxp://5[.]230[.]227[.]86/vv/armv6l hxxp://5[.]230[.]227[.]80/vv/armv7l hxxp://5[.]230[.]227[.]86/tt/sh4 hxxp://5[.]230[.]227[.]86/v hxxp://5[.]230[.]227[.]86/p hxxp://5[.]230[.]227[.]80/t hxxp://5[.]230[.]227[.]86/t hxxp://5[.]230[.]227[.]80/v hxxp://5[.]230[.]227[.]80/p hxxp://176[.]123[.]166[.]244/dss hxxp://176[.]123[.]166[.]244/586 hxxp://98[.]159[.]236[.]221/powerpc hxxp://98[.]159[.]236[.]221/armv5l hxxp://176[.]123[.]166[.]244/co hxxp://176[.]123[.]166[.]244/mipsel hxxp://98[.]159[.]236[.]221/x86_64 hxxp://98[.]159[.]236[.]221/i686 hxxp://176[.]123[.]166[.]244/arm61 hxxp://98[.]159[.]236[.]221/armv4l hxxp://176[.]123[.]166[.]244/dc hxxp://176[.]123[.]166[.]244/sh4 hxxp://98[.]159[.]236[.]221/m68k hxxp://98[.]159[.]236[.]221/i586 hxxp://98[.]159[.]236[.]221/sh4 hxxp://176[.]123[.]166[.]244/m68k hxxp://98[.]159[.]236[.]221/mpsel hxxp://176[.]123[.]166[.]244/mips hxxp://98[.]159[.]236[.]221/arm6l hxxp://98[.]159[.]236[.]221/mips hxxp://5[.]230[.]227[.]87/tt/sh4 hxxp://5[.]230[.]227[.]87/vv/sh4 hxxp://5[.]230[.]227[.]87/tt/armv4l hxxp://5[.]230[.]227[.]87/tt/armv5l hxxp://5[.]230[.]227[.]87/tt/armv4eb hxxp://5[.]230[.]227[.]87/tt/armv7l hxxp://5[.]230[.]227[.]87/tt/armv6l hxxp://5[.]230[.]227[.]87/p hxxp://5[.]230[.]227[.]87/t hxxp://5[.]230[.]227[.]87/v hxxp://154[.]213[.]190[.]251/penis/x86_64 hxxp://34[.]58[.]44[.]108/bot[.]m68k hxxp://87[.]120[.]113[.]63/rebirth[.]m68 hxxp://87[.]120[.]113[.]88/rebirth[.]arm5 hxxp://31[.]13[.]224[.]110/sh4 hxxp://87[.]120[.]113[.]63/rebirth[.]arm5 hxxp://87[.]120[.]113[.]63/rebirth[.]x86 hxxp://87[.]120[.]113[.]63/rebirth[.]sh4 hxxp://87[.]120[.]113[.]63/rebirth[.]spc hxxp://87[.]120[.]113[.]88/rebirth[.]mpsl hxxp://23[.]95[.]72[.]235/rebirth[.]arm6 hxxp://154[.]216[.]18[.]27/arm hxxp://185[.]142[.]53[.]43/sh4 hxxp://87[.]120[.]113[.]63/rebirth[.]arm4t hxxp://31[.]13[.]224[.]110/m68k hxxp://185[.]142[.]53[.]43/mpsl hxxp://87[.]120[.]113[.]63/rebirth[.]mips hxxp://87[.]120[.]113[.]88/rebirth[.]m68 hxxp://87[.]120[.]113[.]63/rebirth[.]mpsl hxxp://87[.]120[.]113[.]88/rebirth[.]mips hxxp://23[.]95[.]72[.]235/rebirth[.]sh4 hxxp://31[.]13[.]224[.]110/ppc hxxp://23[.]95[.]72[.]235/rebirth[.]x86 hxxp://87[.]120[.]113[.]63/rebirth[.]ppc hxxp://31[.]13[.]224[.]110/co hxxp://87[.]120[.]113[.]88/rebirth[.]arm6 hxxp://23[.]95[.]72[.]235/rebirth[.]arm4t hxxp://87[.]120[.]113[.]63/rebirth[.]arm6 hxxp://23[.]95[.]72[.]235/rebirth[.]ppc hxxp://23[.]95[.]72[.]235/rebirth[.]mips hxxp://23[.]95[.]72[.]235/rebirth[.]m68 hxxp://87[.]120[.]113[.]63/rebirth[.]i686 hxxp://31[.]13[.]224[.]110/arm61 hxxp://87[.]120[.]113[.]88/rebirth[.]arm4t hxxp://154[.]216[.]18[.]27/mpsl hxxp://23[.]95[.]72[.]235/rebirth[.]spc hxxp://87[.]120[.]113[.]63/rebirth[.]arm4 hxxp://87[.]120[.]113[.]88/rebirth[.]i686 hxxp://23[.]95[.]72[.]235/rebirth[.]mpsl hxxp://23[.]95[.]72[.]235/rebirth[.]arm4 hxxp://23[.]95[.]72[.]235/rebirth[.]arm5 hxxp://23[.]95[.]72[.]235/rebirth[.]i686 hxxp://31[.]13[.]224[.]110/586 hxxp://31[.]13[.]224[.]110/dc hxxp://31[.]13[.]224[.]110/dss hxxp://154[.]216[.]18[.]27/arm5 hxxp://154[.]216[.]18[.]27/spc hxxp://154[.]216[.]18[.]27/x86 hxxp://154[.]216[.]18[.]27/m68k hxxp://154[.]216[.]18[.]27/sh4 hxxp://154[.]216[.]18[.]27/arm6 hxxp://154[.]216[.]18[.]27/mips hxxp://154[.]216[.]18[.]27/ppc hxxp://154[.]216[.]18[.]27/arm7 hxxp://82[.]156[.]193[.]24/backdoor/emips hxxp://82[.]156[.]193[.]24/empsl hxxp://82[.]156[.]193[.]24/tp/emips hxxp://82[.]156[.]193[.]24/backdoor/empsl hxxp://82[.]156[.]193[.]24/tp/empsl hxxp://82[.]156[.]193[.]24/emips hxxp://217[.]28[.]130[.]77/tt/armv4l hxxp://217[.]28[.]130[.]77/vv/sh4 hxxp://217[.]28[.]130[.]77/tt/armv7l hxxp://217[.]28[.]130[.]77/tt/armv5l hxxp://217[.]28[.]130[.]77/tt/armv6l hxxp://217[.]28[.]130[.]77/v hxxp://217[.]28[.]130[.]77/t hxxp://217[.]28[.]130[.]77/p hxxp://217[.]28[.]130[.]77/rrrr hxxp://217[.]28[.]130[.]77/tt/armv4eb hxxp://217[.]28[.]130[.]77/tt/sh4 hxxp://216[.]9[.]227[.]143/I586 hxxp://216[.]9[.]227[.]143/ARMV6L hxxp://83[.]222[.]191[.]90/linnn hxxp://83[.]222[.]191[.]90/n hxxp://83[.]222[.]191[.]90/dvr hxxp://83[.]222[.]191[.]90/ruck hxxp://83[.]222[.]191[.]90/aaa hxxp://83[.]222[.]191[.]90/nsh hxxp://83[.]222[.]191[.]90/t hxxp://185[.]142[.]53[.]43/wget[.]sh hxxp://185[.]142[.]53[.]190/mips hxxp://217[.]28[.]130[.]78/vv/sh4 hxxp://217[.]28[.]130[.]78/tt/armv4l hxxp://217[.]28[.]130[.]78/tt/armv6l hxxp://217[.]28[.]130[.]78/tt/armv5l hxxp://217[.]28[.]130[.]78/tt/sh4 hxxp://217[.]28[.]130[.]78/tt/armv4eb hxxp://217[.]28[.]130[.]78/tt/armv7l hxxp://185[.]142[.]53[.]43/c/j hxxp://31[.]13[.]224[.]110/sex[.]sh hxxp://212[.]64[.]215[.]71/spc hxxp://212[.]64[.]215[.]71/x86 hxxp://212[.]64[.]215[.]71/arm5 hxxp://212[.]64[.]215[.]71/sh4 hxxp://212[.]64[.]215[.]71/mips hxxp://212[.]64[.]215[.]71/ipc hxxp://212[.]64[.]215[.]71/arm4 hxxp://212[.]64[.]215[.]71/arm6 hxxp://212[.]64[.]215[.]71/ppc hxxp://212[.]64[.]215[.]71/mpsl hxxp://212[.]64[.]215[.]71/m68k hxxp://212[.]64[.]215[.]71/arm7 hxxp://212[.]64[.]199[.]97/shell hxxp://141[.]11[.]33[.]73/hiddenbin/boatnet[.]spc hxxp://141[.]11[.]33[.]73/hiddenbin/boatnet[.]m68k hxxp://141[.]11[.]33[.]73/hiddenbin/boatnet[.]sh4 hxxp://94[.]156[.]227[.]135/tt/sh4 hxxp://94[.]156[.]227[.]135/tt/armv4eb hxxp://94[.]156[.]227[.]135/tt/armv4l hxxp://94[.]156[.]227[.]135/vv/sh4 hxxp://94[.]156[.]227[.]135/tt/armv6l hxxp://94[.]156[.]227[.]135/tt/armv7l hxxp://94[.]156[.]227[.]135/tt/armv5l hxxp://216[.]9[.]227[.]143/X86_64 hxxp://185[.]157[.]247[.]12/vv/sh4 hxxp://185[.]157[.]247[.]12/f hxxp://185[.]157[.]247[.]12/sh hxxp://185[.]157[.]247[.]12/m hxxp://185[.]157[.]247[.]12/e hxxp://185[.]157[.]247[.]12/tt/armv4l hxxp://185[.]157[.]247[.]12/tt/armv7l hxxp://185[.]157[.]247[.]12/tt/armv5l hxxp://185[.]157[.]247[.]12/tt/armv6l hxxp://185[.]157[.]247[.]12/tt/sh4 hxxp://185[.]157[.]247[.]12/tt/armv4eb hxxp://185[.]157[.]247[.]12/t hxxp://185[.]157[.]247[.]12/d hxxp://185[.]157[.]247[.]12/j hxxp://176[.]119[.]150[.]11/i hxxp://185[.]142[.]53[.]43/weed hxxp://185[.]142[.]53[.]43/gocl hxxp://176[.]119[.]150[.]11/wget[.]sh hxxp://176[.]119[.]150[.]11/curl[.]sh hxxp://185[.]142[.]53[.]43/r[.]sh hxxp://185[.]142[.]53[.]43/vc hxxp://185[.]142[.]53[.]43/g hxxp://185[.]142[.]53[.]43/av[.]sh hxxp://185[.]142[.]53[.]43/toto hxxp://185[.]142[.]53[.]43/aaa hxxp://185[.]142[.]53[.]43/fb hxxp://185[.]142[.]53[.]43/sdt hxxp://185[.]142[.]53[.]43/f5 hxxp://185[.]142[.]53[.]43/w[.]sh hxxp://185[.]142[.]53[.]43/z[.]sh hxxp://185[.]142[.]53[.]43/irz hxxp://185[.]142[.]53[.]43/adb hxxp://185[.]142[.]53[.]43/zz hxxp://185[.]142[.]53[.]43/b hxxp://185[.]142[.]53[.]43/bx hxxp://185[.]142[.]53[.]43/fdgsfg hxxp://185[.]142[.]53[.]43/ruck hxxp://185[.]142[.]53[.]43/tplink hxxp://185[.]142[.]53[.]43/linksys hxxp://185[.]142[.]53[.]43/xaxa hxxp://185[.]142[.]53[.]43/test[.]sh hxxp://185[.]142[.]53[.]43/asd hxxp://185[.]142[.]53[.]43/li hxxp://185[.]142[.]53[.]43/k[.]sh hxxp://185[.]142[.]53[.]43/ipc hxxp://185[.]142[.]53[.]43/mass[.]sh hxxp://185[.]142[.]53[.]43/lll hxxp://185[.]142[.]53[.]43/mag hxxp://185[.]142[.]53[.]43/jaws hxxp://185[.]142[.]53[.]43/multi hxxp://185[.]142[.]53[.]43/c[.]sh hxxp://176[.]119[.]150[.]11/a hxxp://176[.]119[.]150[.]11/x hxxp://176[.]119[.]150[.]11/b hxxp://176[.]119[.]150[.]11/u hxxp://176[.]119[.]150[.]11/s hxxp://176[.]119[.]150[.]11/d hxxp://176[.]119[.]150[.]11/h hxxp://176[.]119[.]150[.]11/t hxxp://176[.]119[.]150[.]11/l hxxp://176[.]119[.]150[.]11/y hxxp://176[.]119[.]150[.]11/c hxxp://176[.]119[.]150[.]11/e hxxp://185[.]142[.]53[.]43/bt |
Bashlite |
| URL | hxxp://5[.]252[.]155[.]64/script[.]ps1 hxxp://5[.]252[.]155[.]64/lem[.]exe hxxp://5[.]252[.]155[.]64/yoda[.]exe hxxp://5[.]252[.]155[.]64/skript[.]bat hxxp://5[.]252[.]155[.]64/installer[.]bat hxxp://5[.]252[.]155[.]64/din[.]exe hxxp://101[.]99[.]94[.]162/setup[.]exe |
Vidar |
| URL | hxxps://www[.]mediafire[.]com/file/90s0alo04ey7v2n/Loader[.]zip/file hxxps://www[.]mediafire[.]com/file/tizfbqesb9b58pl/2[.]3_Archive_v2[.]3[.][.]zip/file hxxps://www[.]mediafire[.]com/file/o1mtagit79o30v0/Reborn_Loader[.]zip/file hxxps://www[.]mediafire[.]com/file/pp0q0x3tr6rc92d/Genshin_Server[.]rar/file hxxps://www[.]mediafire[.]com/file/mxkbuaus3c50cba/HypnosiXJJv2[.]0[.]zip/file hxxps://www[.]mediafire[.]com/file/62jswh92er8mae3/HSR_Server[.]rar/file hxxps://www[.]mediafire[.]com/file/hpasvyjzo9ys05o/HypnosiXJJ[.]zip/file hxxps://www[.]mediafire[.]com/file/iuhzxz3wumwbxle/Pack-2024[.]zip/file hxxps://www[.]mediafire[.]com/file/7cj530oyggfvmwz/nokeyfunction[.]zip/file hxxps://www[.]mediafire[.]com/file/mke31vvy9y7xq11/ReleseBloxStrap%255B3[.]0[.]1%255D[.]zip/file hxxps://begguinnerz[.]biz/api hxxps://tougheryer[.]click/api hxxps://pickduccker[.]click/api hxxps://ladybughge[.]click/api hxxps://hollowrefuz[.]click/api hxxps://chillysalvagk[.]click/api hxxps://sustainskelet[.]lat/api hxxps://rapeflowwj[.]lat/api hxxps://necklacebudi[.]lat/api hxxps://grannyejh[.]lat/api hxxps://energyaffai[.]lat/api hxxps://discokeyus[.]lat/api hxxps://crosshuaht[.]lat/api hxxps://breezysmiterz[.]click/api hxxps://aspecteirs[.]lat/api hxxps://wellofflyric[.]click/api hxxps://klipsyzogey[.]shop/api hxxps://volcanohushe[.]click/api hxxps://peelyitemsn[.]click/api hxxps://www[.]mediafire[.]com/file/48b8xvt4bar1gr4/%255B1[.]1[.]0%255D-A%25D1%2580%25D1%2580-UNC-x64[.]zip/file hxxps://www[.]mediafire[.]com/file/zlnhsk8001cd2l9/Launcher[.]zip/file hxxp://45[.]143[.]200[.]72/Downloads/Fahrplan2025[.]pdf[.]lnk hxxps://wetlivelky[.]click/api hxxps://itsrevolutionmagnus[.]xyz/api hxxps://tiffany-careers[.]com/ghep2412_2 hxxps://www[.]mediafire[.]com/file/wgqssvillv6oroa/ReleseBloxStrap%255B3[.]0[.]1%255D[.]zip/file hxxps://klipvumisui[.]shop/api hxxps://cegu[.]shop/api hxxps://laborersquei[.]click/api hxxps://druster-master[.]com/gogolend1[.]zip hxxps://tiffany-careers[.]com/Ghep2712 hxxp://147[.]45[.]49[.]66/Downloads/Job_Digital_MKT[.]lnk hxxps://lackadausaz[.]click/api hxxps://parallellywko[.]shop/api hxxps://tightuteop[.]shop/api hxxps://jammywritej[.]click/api hxxps://alleybikeru[.]click/api hxxps://rurallyrishz[.]click/api hxxps://simplerapplau[.]click/api hxxps://fivenaii[.]click/api hxxps://fallyjustif[.]click/api hxxps://chrome-browser-download[.]com/ChromeSetup[.]exe hxxps://wholersorie[.]shop/api hxxps://tirepublicerj[.]shop/api hxxps://rabidcowse[.]shop/api hxxps://noisycuttej[.]shop/api hxxps://nearycrepso[.]shop/api hxxps://framekgirus[.]shop/api hxxps://cloudewahsj[.]shop/api hxxps://abruptyopsn[.]shop/api hxxps://fancywaxxers[.]shop/api hxxp://lumcopiqua6[.]shop/api hxxp://lumcozynest[.]shop/api hxxp://lumdukekiy[.]shop/api hxxp://lumcyjukui[.]shop/api hxxp://lumfokim[.]shop/api hxxp://lumgentlewave[.]shop/api hxxp://lumkecuq[.]shop/api hxxp://lumlasolyo[.]shop/api hxxp://lumlacumii[.]shop/api hxxp://lumlideweo[.]shop/api hxxp://lummozudey[.]shop/api hxxp://lummomusuo[.]shop/api hxxp://lumpeguwey[.]shop/api hxxp://lumqalij[.]shop/api hxxp://lumquvonee[.]shop/api hxxp://lumsawedua[.]shop/api hxxp://lumsuxinya[.]shop/api hxxp://lumtechtribune[.]shop/api hxxp://lumtovusao[.]shop/api hxxp://lumzacynuy[.]shop/api hxxp://lumzenspace[.]shop/api hxxp://lumzulyj[.]shop/api hxxp://mexocey[.]shop/api hxxp://nagurui[.]shop/api hxxp://nykidio[.]shop/api hxxp://rixokye[.]shop/api hxxp://sibyree[.]shop/api hxxp://toqyxuy[.]shop/api hxxp://wusaryy5[.]shop/api hxxp://xohivao[.]shop/api hxxp://lumramavyy[.]shop/api hxxp://keqirai[.]shop/api hxxp://lumbluesky[.]shop/api hxxp://kemuvao[.]shop/api hxxp://jigateu[.]shop/api hxxp://jimeqey[.]shop/api hxxp://happyjourney[.]shop/api hxxp://doqevue[.]shop/api hxxp://cycahao[.]shop/api hxxp://futipoy[.]shop/api hxxp://alleybikeru[.]click/api hxxps://solve[.]vwglq[.]com/awjxs[.]captcha?u=db1df324-8145-4238-a11a-7fca5c1a84be hxxps://deduhko2[.]klipzyroloo[.]shop/Poket[.]mp4 hxxp://31[.]41[.]244[.]11/files/CryShy/random[.]exe hxxps://acceptbaleeri[.]shop/api hxxps://solve[.]gevaq[.]com/awjxs[.]captcha?u=71723741-81f2-4e2f-915a-b3bed54203a6 hxxps://q[.]klipzyroloo[.]shop/Grpc[.]eml hxxps://deduhko[.]klipzyroloo[.]shop/dmg[.]xml hxxps://learningypr[.]click/api hxxps://deduhko[.]klipzyroloo[.]shop/mazkk[.]eml hxxp://31[.]41[.]244[.]11/files/6151862750/eXbhgU9[.]exe hxxp://31[.]41[.]244[.]11/files/6858984867/6QLvb9i[.]exe hxxp://31[.]41[.]244[.]11/files/7468467904/hdV0eOW[.]exe hxxp://31[.]41[.]244[.]11/files/11pip/random[.]exe hxxps://savecoupons[.]store/web44[.]mp4 hxxps://spotlessaja[.]click/api hxxps://topofsuper[.]shop/re5[.]mp4 hxxps://t2[.]awagama2[.]org/re5[.]mp4 hxxps://wishbusher[.]click/api hxxps://stampyflook[.]click/api hxxps://squencehb[.]cyou/api hxxps://regard-survey[.]cyou/api hxxps://noisercluch[.]click/api hxxps://fronyzealosud[.]click/api hxxps://cryofficesj[.]click/api hxxps://aboriginalkyv[.]click/api hxxps://imbibelubmbe[.]click/api hxxp://84[.]200[.]24[.]34/Downloads/Securing%20Your%20Cryptocurrency%20Wallet[.]pdf[.]lnk hxxp://84[.]200[.]24[.]34/Downloads/API%20_Guide[.]pdf[.]lnk hxxps://goatstuff[.]store/re5[.]mp4 hxxps://macphotoeditor[.]shop/singl5[.]mp4 hxxp://147[.]45[.]44[.]131/infopage/iubft[.]exe hxxp://147[.]45[.]44[.]157/iounh[.]ps1 hxxp://212[.]18[.]104[.]34/Downloads/21841/studymangaart[.]pdf[.]lnk hxxp://212[.]18[.]104[.]34/Documents/Instruction_695-18014-012_Rev[.]pdf[.]lnk hxxp://212[.]18[.]104[.]34/Downloads/18118[.]2041/Agreement%20for%20Cooperation[.]PDF[.]lnk hxxp://185[.]66[.]91[.]17/Downloads/[.]lnk hxxps://solve[.]vwglq[.]com/awjxs[.]captcha?u=6c079280-654d-44b7-add6-a7ba0821d64d hxxps://deduhko2[.]kliphuwatey[.]shop/Poket[.]mp4 hxxps://wisdom-echoes[.]shop/api hxxps://thumbystriw[.]store/api hxxps://scriptyprefej[.]store/api hxxps://presticitpo[.]store/api hxxps://outlookyn[.]cyou/api hxxps://fadehairucw[.]store/api hxxp://31[.]41[.]244[.]11/files/karl/random[.]exe hxxp://176[.]113[.]115[.]170/1/1[.]png hxxp://176[.]113[.]115[.]170/1/2[.]png hxxp://176[.]113[.]115[.]170/1/3[.]png hxxps://book-captcha[.]com/FLy1cL?hotel/hoteladmin/extranet_ng/manage/booking[.]html? hxxps://sectionobligationpow[.]site/api hxxps://solve[.]jrqr[.]org/awjxs[.]captcha hxxps://t3[.]awagama[.]org/mima[.]mp4 hxxps://t1[.]awagama[.]org/tornado[.]xlm hxxps://stomachabonda[.]click/api hxxps://pancakedipyps[.]click/api hxxps://impoliterenei[.]click/api hxxps://dyewounderzn[.]click/api hxxps://fishbitteruz[.]click/api hxxps://wonderfulbelif[.]click/api hxxps://modernantsrer[.]click/api hxxps://managerecetio[.]click/api hxxps://connectionlongi[.]click/api hxxps://bootstringjl[.]click/api hxxps://implanthide[.]click/api hxxps://obtainablecloud[.]click/api hxxps://scirroscus[.]click/api hxxps://symptomaticdryu[.]click/api hxxps://throwupset[.]click/api hxxps://chidesunnyso[.]click/api hxxps://doubtermoderuz[.]click/api hxxps://territoryleaduo[.]click/api hxxps://cureprouderio[.]click/api hxxps://survivesuz[.]click/api hxxps://locketsashayz[.]click/api hxxps://schooltreeus[.]click/api hxxps://arisealert[.]click/api hxxps://abberanteusz[.]click/api hxxps://storyspaddr[.]click/api hxxps://crackerdolk[.]click/api hxxps://givepickyl[.]click/api hxxps://renewballoi[.]click/api hxxps://imbibernes[.]click/api hxxps://conserordersz[.]click/api hxxps://tongueforcie[.]click/api hxxps://berserkyfir[.]click/api hxxps://aliveindu[.]click/api hxxps://windowthing[.]click/api hxxps://pleadragger[.]click/api hxxps://scrawnyinte[.]click/api hxxps://omitocenaj[.]buzz/api hxxps://markydinnt[.]lat/api hxxps://insurancebyh[.]cyou/api hxxps://currenycon[.]cyou/api hxxps://movementby[.]cyou/api hxxps://veilyveinj[.]cyou/api hxxps://revordirecut[.]cyou/api hxxps://advanced-ipscanner[.]com/fud32[.]exe hxxps://check[.]qlkwr[.]com/awjsx[.]captcha hxxps://klipdalygeo[.]shop/ginni[.]mp4 hxxps://altadefinizioneapp[.]com/api hxxps://onefreex[.]com/api hxxp://147[.]45[.]198[.]117/tvfqs[.]ps1 hxxp://api[.]accueil-coinbase[.]com/update/TPB-1[.]exe hxxp://rappel-coinbase[.]com/update/TPB-1[.]exe hxxp://api[.]rappel-coinbase[.]com/update/TPB-1[.]exe hxxp://api[.]aide-coinbase[.]com/update/TPB-1[.]exe hxxp://connexion-monwallet[.]com/update/TPB-1[.]exe hxxp://api[.]information-coinbase[.]com/update/TPB-1[.]exe hxxp://coinbase[.]connexion-monwallet[.]com/update/TPB-1[.]exe hxxp://api[.]information-binance[.]com/update/TPB-1[.]exe hxxp://compte-coinbase[.]com/update/TPB-1[.]exe hxxp://information-coinbase[.]com/update/TPB-1[.]exe hxxp://wildsolace[.]net/update/TPB-1[.]exe hxxp://information-binance[.]com/update/TPB-1[.]exe hxxp://91[.]202[.]233[.]151/update/TPB-1[.]exe hxxps://reflectsurmise[.]cfd/api hxxp://185[.]66[.]91[.]23/Downloads/HateSpeech2024_Summary[.]pdf[.]lnk hxxp://147[.]45[.]198[.]117/rewaxr[.]ps1 hxxps://swingybeattyz[.]sbs/api hxxps://displayclubby[.]sbs/api hxxps://cellardesiresso[.]sbs/api |
Lumma Stealer |
| URL | hxxp://45[.]9[.]148[.]181/elm[.]exe hxxp://45[.]9[.]148[.]181/markiz[.]exe hxxp://45[.]9[.]148[.]181/kanew[.]exe hxxp://45[.]9[.]148[.]181/duschno[.]exe hxxp://45[.]9[.]148[.]181/utkin[.]exe hxxp://66[.]63[.]187[.]250/mk/drop1[.]exe hxxp://cpcontacts[.]kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe hxxp://webmail[.]kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe hxxp://webdisk[.]kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe hxxp://cpcalendars[.]kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe hxxp://www[.]kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe hxxp://wg77[.]muntialo[.]desa[.]id/mk/drop1[.]exe hxxp://cpanel[.]kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe hxxp://mail[.]kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe hxxp://kasihcommunityschool[.]sch[.]id/mk/drop1[.]exe |
Meduza Stealer |
| URL | hxxps://unitedkingdomdiplomat[.]org/TechGuardSecureSuiteUpdates/updates/applications/kernel hxxps://unitedkingdomdiplomat[.]org/TechGuardSecureSuiteUpdates/updates/applications/libraries_v2 |
Matanbuchus |
| URL | hxxps://varburalar436[.]top/OWRmM2UzMTBiNjg4/ hxxps://kirmizibeyazfiltre[.]com/MWQxMmUxNmEyYmU4/ hxxps://kaderserininsamimiyansimalari[.]xyz/NzkzYmVjMjc2OGUz/ hxxps://dostlukveduygusalbaglarinkaderi[.]xyz/NzkzYmVjMjc2OGUz/ hxxps://s4zartuk4[.]top/OWRmM2UzMTBiNjg4/ hxxps://213[.]109[.]202[.]106/MzUyMGI3MTIxOWFk/ hxxps://aliatabakastabasdumerasdangs[.]com/MzUyMGI3MTIxOWFk/ hxxps://aliatabakastakiasasddarkharamilers[.]com/MzUyMGI3MTIxOWF/ hxxps://alibabacankasdirkhaasdramiler[.]net/MzUyMGI3MTIxOWFk/ hxxps://kirkharamilsaderveaasdgflibabacans[.]net/MzUyMGI3MTIxOWFk/ hxxps://alibabacankiasdrkfsdfgharamiler[.]com/MzUyMGI3MTIxOWFk/ hxxps://kirkharamasdilersavsadgshgastayinebea[.]com/MzUyMGI3MTIxOWFk/ hxxps://azisswravaas5[.]xyz/MDQ4Yzc4NTJkYTg4/ hxxps://azisswravaas34[.]xyz/MDQ4Yzc4NTJkYTg4/ hxxps://azisswrav44as2[.]xyz/MDQ4Yzc4NTJkYTg4/ hxxps://azisswrava333as2[.]xyz/MDQ4Yzc4NTJkYTg4/ hxxps://kanderasd2[.]top/OWRmM2UzMTBiNjg4/ hxxps://wildspiritzm[.]top/YTZhZjliODdlYTI4/ hxxps://hamkarada24[.]top/OWRmM2UzMTBiNjg4/ hxxps://gacahyat75[.]top/OWRmM2UzMTBiNjg4/ hxxps://moeurolandbabisde[.]net/MmI1M2ZiMGRmODEy/ hxxps://canseverlerinmutlulukhikayeleri[.]xyz/NWNlNzMzN2Y4NmI2/ hxxps://gazozsarap1d[.]com/MWQxMmUxNmEyYmU4/ |
Coper |
| URL | hxxps://enethost[.]com/js[.]php hxxps://amcikressimleri[.]xyz/work/original[.]js hxxps://enethost[.]com/2w3e[.]js hxxps://amcikressimleri[.]xyz/work/download[.]php hxxps://amcikressimleri[.]xyz/work/index[.]php hxxps://discoves[.]com/6yje[.]js hxxps://discoves[.]com/js[.]php hxxps://eldercity[.]xyz/work/original[.]js hxxps://potentie24nl[.]xyz/work/mmmm[.]zip hxxps://eldercity[.]xyz/work/index[.]php hxxps://eldercity[.]xyz/work/download[.]php hxxps://sublime[.]goldmasterallstars[.]com/work/original[.]js hxxps://sublime[.]goldmasterallstars[.]com/work/download[.]php hxxps://sublime[.]goldmasterallstars[.]com/work/index[.]php hxxp://mbuz73hb7z3[.]top/1[.]php hxxps://kl-219[.]040-241[.]qualityplusbuilders[.]com/work/original[.]js hxxps://kl-219[.]040-241[.]qualityplusbuilders[.]com/work/index[.]php hxxps://kl-219[.]040-241[.]qualityplusbuilders[.]com/work/download[.]php hxxps://yawk[.]stock[.]letsgoautomotive[.]com/merchantServices hxxps://chpqp[.]events[.]socalpocis[.]org/merchantServices hxxps://ganhogosi[.]xyz/work/index[.]php hxxps://ganhogosi[.]xyz/work/download[.]php hxxps://ganhogosi[.]xyz/work/original[.]js hxxps://123-hame[.]xyz/work/original[.]js hxxps://123-hame[.]xyz/work/download[.]php hxxps://123-hame[.]xyz/work/index[.]php hxxps://aogdj[.]stock[.]letsgoautomotive[.]com/merchantServices hxxps://xof[.]stock[.]letsgoautomotive[.]com/merchantServices hxxps://ambiwa[.]com/5o0e[.]js hxxps://ambiwa[.]com/js[.]php hxxps://uefy[.]stock[.]letsgoautomotive[.]com/merchantServices hxxps://xssvv[.]stock[.]letsgoautomotive[.]com/merchantServices hxxps://fwg[.]stock[.]letsgoautomotive[.]com/merchantServices hxxps://sublime[.]goldmasterallstars[.]com/work/yyy[.]zip hxxps://upih[.]stock[.]letsgoautomotive[.]com/merchantServices hxxps://gcafin[.]com/5u5r[.]js hxxps://gcafin[.]com/js[.]php hxxp://nuvye89bjz4[.]top/1[.]php hxxps://ugbhe[.]chain[.]buyclosersonline[.]com/merchantServices hxxps://cqda[.]chain[.]buyclosersonline[.]com/merchantServices hxxps://zaoqm[.]chain[.]buyclosersonline[.]com/merchantServices hxxps://fuvcw[.]chain[.]buyclosersonline[.]com/merchantServices hxxps://vig[.]chain[.]buyclosersonline[.]com/merchantServices hxxps://mirugby[.]com/5op9[.]js hxxps://mirugby[.]com/js[.]php hxxps://mwa[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxp://mnudybh4unh[.]top/1[.]php hxxps://lmlm[.]demo[.]ezra-ai[.]com/merchantServices hxxps://xxcnx[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxps://ggxfk[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxps://obm[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://apx[.]house[.]zionanakwenze[.]com/orderReview hxxps://qpc[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxps://usbkits[.]com/0o9o[.]js hxxps://usbkits[.]com/js[.]php hxxp://nfuvueibzi4[.]top/1[.]php hxxps://emd[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxps://imrz[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxps://ltitd[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxps://pje[.]slot[.]buyaiphoneonline[.]com/merchantServices hxxp://mubuzb3vvv[.]top/1[.]php hxxps://xaides[.]com/5yu7[.]js hxxps://xaides[.]com/js[.]php hxxps://sqfmp[.]slot[.]buyaiphoneonline[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxp://185[.]148[.]3[.]216/fdiuIoijofgrg hxxp://185[.]148[.]3[.]216/5fr5gthkjdg71 hxxp://38[.]242[.]241[.]140/c[.]exe hxxp://upload[.]vina-host[.]com/get/5TJt6zVCUn/ahmet[.]exe hxxps://github[.]com/AzureRex/napewnonievoiderhook/raw/main/seksiak[.]exe hxxps://github[.]com/Kami32X/Osiris/raw/refs/heads/main/2klz[.]exe hxxps://github[.]com/tiraUnderCode/rev/raw/main/Client-built[.]exe hxxps://github[.]com/rsvgsng/funpark/raw/refs/heads/main/diskutil[.]exe hxxps://github[.]com/just-cmd-1909/am/raw/refs/heads/main/Loader[.]exe hxxps://github[.]com/NullSpectre/WhyAreYouHere-/raw/4bed170d797d5d2077bfc312d8badcd3c1dbaa74/Test2[.]exe hxxps://github[.]com/samllea1/Gorebox-ModMenu/raw/refs/heads/main/Gorebox%20ModMenu%201[.]2[.]0[.]exe hxxps://github[.]com/Waynesson/Rocitizens/raw/refs/heads/main/Client-built[.]exe hxxps://github[.]com/robloxopensrc/robIox-cdn/raw/refs/heads/main/OneDrive[.]exe hxxps://github[.]com/arizaseeen/ariiiza/raw/refs/heads/main/ytjgjdrthjdw[.]exe hxxps://github[.]com/arizaseeen/ariiiza/raw/refs/heads/main/kthiokadjg[.]exe hxxps://github[.]com/yuriksq/papilla/raw/refs/heads/main/jrockekcurje[.]exe hxxps://github[.]com/07nn/am/raw/refs/heads/main/RuntimeBroker[.]exe hxxps://github[.]com/TOP-executors/JJsploit/raw/refs/heads/main/JJSPLOIT[.]V2[.]exe hxxps://jujuju[.]lat/files/1[.]exe hxxps://154[.]216[.]17[.]47/files/1[.]exe |
Quasar RAT |
| URL | hxxp://84[.]247[.]147[.]214:8080/LaZagne[.]exe | LaZagne |
| URL | hxxp://84[.]247[.]147[.]214:8080/mimikatz[.]exe | MimiKatz |
| URL | hxxp://84[.]247[.]147[.]214:8080/final[.]exe hxxp://45[.]43[.]36[.]223/aarch643308[.]elf hxxp://45[.]43[.]36[.]223/m4455 hxxp://45[.]43[.]36[.]223/45678[.]elf hxxp://45[.]43[.]36[.]223/arm3307 |
Meterpreter |
| URL | hxxps://117[.]50[.]190[.]56/02[.]08[.]2022[.]exe hxxps://82[.]156[.]19[.]76:2083/02[.]08[.]2022[.]exe hxxp://39[.]100[.]90[.]182/02[.]08[.]2022[.]exe hxxp://120[.]53[.]236[.]231:8080/02[.]08[.]2022[.]exe hxxps://111[.]229[.]208[.]249/02[.]08[.]2022[.]exe hxxps://209[.]38[.]116[.]17/02[.]08[.]2022[.]exe hxxps://81[.]71[.]64[.]66/02[.]08[.]2022[.]exe hxxps://209[.]38[.]116[.]17:8080/02[.]08[.]2022[.]exe hxxps://83[.]229[.]122[.]83/02[.]08[.]2022[.]exe hxxps://156[.]251[.]25[.]152:2096/02[.]08[.]2022[.]exe hxxps://3[.]107[.]99[.]202/02[.]08[.]2022[.]exe hxxps://175[.]24[.]234[.]176/02[.]08[.]2022[.]exe hxxps://39[.]106[.]2[.]51/02[.]08[.]2022[.]exe hxxps://124[.]71[.]137[.]28/02[.]08[.]2022[.]exe hxxp://156[.]244[.]19[.]46:5555/02[.]08[.]2022[.]exe hxxps://170[.]130[.]55[.]94:444/02[.]08[.]2022[.]exe hxxps://47[.]96[.]13[.]97:60000/02[.]08[.]2022[.]exe hxxps://124[.]156[.]166[.]78:7654/02[.]08[.]2022[.]exe hxxp://117[.]50[.]190[.]56/02[.]08[.]2022[.]exe hxxps://124[.]222[.]22[.]192/02[.]08[.]2022[.]exe hxxp://114[.]96[.]89[.]69:7777/02[.]08[.]2022[.]exe hxxps://58[.]48[.]10[.]77:2096/02[.]08[.]2022[.]exe hxxps://47[.]98[.]194[.]85:433/02[.]08[.]2022[.]exe hxxps://47[.]236[.]53[.]118:60013/02[.]08[.]2022[.]exe hxxps://39[.]98[.]48[.]153:6443/02[.]08[.]2022[.]exe hxxps://43[.]226[.]125[.]41:8889/02[.]08[.]2022[.]exe hxxps://112[.]124[.]71[.]123/02[.]08[.]2022[.]exe hxxp://137[.]175[.]124[.]48/02[.]08[.]2022[.]exe hxxps://147[.]182[.]192[.]11/02[.]08[.]2022[.]exe hxxps://94[.]232[.]43[.]211:7443/02[.]08[.]2022[.]exe hxxps://143[.]198[.]235[.]51:8080/02[.]08[.]2022[.]exe hxxps://101[.]35[.]228[.]105/02[.]08[.]2022[.]exe hxxps://1[.]94[.]221[.]238:4433/02[.]08[.]2022[.]exe hxxps://47[.]92[.]83[.]128/02[.]08[.]2022[.]exe hxxps://1[.]94[.]149[.]77/02[.]08[.]2022[.]exe hxxps://143[.]198[.]235[.]51/02[.]08[.]2022[.]exe hxxp://107[.]149[.]220[.]104/02[.]08[.]2022[.]exe hxxp://23[.]94[.]169[.]124:9090/02[.]08[.]2022[.]exe hxxps://87[.]120[.]115[.]8/02[.]08[.]2022[.]exe hxxp://8[.]153[.]97[.]202/02[.]08[.]2022[.]exe hxxp://152[.]32[.]201[.]202/02[.]08[.]2022[.]exe hxxp://82[.]202[.]173[.]170:8001/02[.]08[.]2022[.]exe hxxp://82[.]202[.]173[.]167:8001/02[.]08[.]2022[.]exe hxxps://103[.]38[.]82[.]106/02[.]08[.]2022[.]exe hxxp://47[.]90[.]135[.]102:443/2Vcr hxxp://78[.]38[.]60[.]246:33664/02[.]08[.]2022[.]exe hxxp://91[.]139[.]153[.]236:59812/02[.]08[.]2022[.]exe hxxp://37[.]52[.]16[.]21:28447/02[.]08[.]2022[.]exe hxxp://82[.]114[.]200[.]50:48416/02[.]08[.]2022[.]exe hxxp://190[.]57[.]135[.]90:26843/02[.]08[.]2022[.]exe hxxp://218[.]38[.]241[.]103:1050/02[.]08[.]2022[.]exe hxxp://159[.]148[.]48[.]50:55174/02[.]08[.]2022[.]exe hxxp://186[.]233[.]59[.]20:55258/02[.]08[.]2022[.]exe hxxp://91[.]92[.]94[.]138:15350/02[.]08[.]2022[.]exe hxxp://202[.]53[.]164[.]210:17571/02[.]08[.]2022[.]exe hxxp://185[.]162[.]140[.]242:18411/02[.]08[.]2022[.]exe hxxp://2[.]187[.]7[.]29:51400/02[.]08[.]2022[.]exe hxxp://110[.]172[.]187[.]21:30471/02[.]08[.]2022[.]exe hxxp://179[.]51[.]168[.]26:10428/02[.]08[.]2022[.]exe hxxp://36[.]66[.]231[.]15:59555/02[.]08[.]2022[.]exe hxxp://182[.]59[.]133[.]14:37378/02[.]08[.]2022[.]exe hxxp://201[.]184[.]231[.]250:64676/02[.]08[.]2022[.]exe hxxp://181[.]211[.]250[.]118:14124/02[.]08[.]2022[.]exe hxxp://176[.]65[.]35[.]214:61252/02[.]08[.]2022[.]exe hxxp://178[.]131[.]95[.]168:29463/02[.]08[.]2022[.]exe hxxp://181[.]129[.]2[.]18:15557/02[.]08[.]2022[.]exe hxxp://188[.]72[.]6[.]218:43597/02[.]08[.]2022[.]exe hxxp://103[.]245[.]78[.]68:10257/02[.]08[.]2022[.]exe hxxp://83[.]166[.]197[.]212:34117/02[.]08[.]2022[.]exe hxxp://36[.]64[.]219[.]140:53129/02[.]08[.]2022[.]exe hxxp://200[.]122[.]211[.]138:31644/02[.]08[.]2022[.]exe hxxp://175[.]111[.]183[.]94:33971/02[.]08[.]2022[.]exe hxxp://27[.]156[.]154[.]3:58633/02[.]08[.]2022[.]exe hxxp://114[.]7[.]209[.]193:47530/02[.]08[.]2022[.]exe hxxp://37[.]255[.]217[.]87:32902/02[.]08[.]2022[.]exe hxxp://181[.]112[.]153[.]78:7046/02[.]08[.]2022[.]exe hxxp://95[.]170[.]114[.]70:19301/02[.]08[.]2022[.]exe hxxp://178[.]214[.]196[.]26:6264/02[.]08[.]2022[.]exe hxxp://46[.]52[.]164[.]170:29443/02[.]08[.]2022[.]exe hxxp://119[.]15[.]92[.]78:4374/02[.]08[.]2022[.]exe hxxp://122[.]254[.]13[.]239:61616/02[.]08[.]2022[.]exe hxxp://88[.]248[.]23[.]133:43901/02[.]08[.]2022[.]exe hxxp://23[.]236[.]6[.]197:31121/02[.]08[.]2022[.]exe hxxp://91[.]244[.]169[.]56:48300/02[.]08[.]2022[.]exe hxxp://111[.]185[.]23[.]52:33424/02[.]08[.]2022[.]exe hxxp://178[.]131[.]180[.]250:5311/02[.]08[.]2022[.]exe hxxp://109[.]107[.]78[.]7:52900/02[.]08[.]2022[.]exe hxxp://182[.]253[.]60[.]194:46757/02[.]08[.]2022[.]exe hxxp://213[.]6[.]74[.]138:39286/02[.]08[.]2022[.]exe hxxp://195[.]22[.]237[.]98:35989/02[.]08[.]2022[.]exe hxxp://208[.]89[.]168[.]31:35246/02[.]08[.]2022[.]exe hxxp://119[.]236[.]239[.]14:22517/02[.]08[.]2022[.]exe hxxp://190[.]2[.]237[.]104:65088/02[.]08[.]2022[.]exe hxxp://37[.]157[.]212[.]138:58474/02[.]08[.]2022[.]exe hxxp://124[.]153[.]22[.]49:59977/02[.]08[.]2022[.]exe hxxp://194[.]31[.]220[.]210:45112/02[.]08[.]2022[.]exe hxxp://206[.]214[.]35[.]106:20647/02[.]08[.]2022[.]exe hxxp://209[.]124[.]105[.]5:60724/02[.]08[.]2022[.]exe hxxp://91[.]246[.]214[.]25:35347/02[.]08[.]2022[.]exe hxxp://103[.]7[.]27[.]90:17260/02[.]08[.]2022[.]exe hxxp://185[.]57[.]69[.]125:16138/02[.]08[.]2022[.]exe hxxp://46[.]214[.]31[.]179:25098/02[.]08[.]2022[.]exe hxxp://38[.]47[.]36[.]238:16254/02[.]08[.]2022[.]exe hxxp://5[.]200[.]72[.]26:30860/02[.]08[.]2022[.]exe hxxp://119[.]40[.]84[.]254:32920/02[.]08[.]2022[.]exe hxxp://202[.]4[.]124[.]58:12137/02[.]08[.]2022[.]exe hxxp://185[.]181[.]51[.]73:4529/02[.]08[.]2022[.]exe hxxp://179[.]236[.]0[.]232:53967/02[.]08[.]2022[.]exe hxxp://103[.]86[.]199[.]82:37559/02[.]08[.]2022[.]exe hxxp://119[.]15[.]239[.]133:38567/02[.]08[.]2022[.]exe hxxp://46[.]173[.]163[.]110:42887/02[.]08[.]2022[.]exe hxxp://80[.]23[.]51[.]236:60454/02[.]08[.]2022[.]exe hxxp://36[.]66[.]191[.]218:9622/02[.]08[.]2022[.]exe hxxp://46[.]39[.]247[.]173:21514/02[.]08[.]2022[.]exe hxxp://41[.]215[.]69[.]106:33466/02[.]08[.]2022[.]exe hxxp://186[.]97[.]185[.]93:31376/02[.]08[.]2022[.]exe hxxp://91[.]203[.]89[.]146:46544/02[.]08[.]2022[.]exe hxxp://212[.]85[.]176[.]23:45741/02[.]08[.]2022[.]exe hxxp://103[.]79[.]113[.]45:6787/02[.]08[.]2022[.]exe hxxp://31[.]0[.]136[.]2:50867/02[.]08[.]2022[.]exe hxxp://46[.]6[.]12[.]230:8164/02[.]08[.]2022[.]exe hxxp://37[.]57[.]33[.]51:49049/02[.]08[.]2022[.]exe hxxp://87[.]241[.]174[.]59:38234/02[.]08[.]2022[.]exe hxxp://186[.]159[.]0[.]129:52617/02[.]08[.]2022[.]exe hxxp://103[.]50[.]4[.]173:28917/02[.]08[.]2022[.]exe hxxp://181[.]59[.]103[.]86:56348/02[.]08[.]2022[.]exe hxxp://36[.]66[.]150[.]221:59661/02[.]08[.]2022[.]exe hxxp://95[.]170[.]116[.]28:21086/02[.]08[.]2022[.]exe hxxp://188[.]2[.]23[.]244:39537/02[.]08[.]2022[.]exe hxxp://77[.]42[.]243[.]110:46471/02[.]08[.]2022[.]exe hxxp://193[.]228[.]135[.]75:26033/02[.]08[.]2022[.]exe hxxp://91[.]215[.]61[.]181:26378/02[.]08[.]2022[.]exe hxxp://193[.]95[.]254[.]50:40630/02[.]08[.]2022[.]exe hxxp://41[.]76[.]195[.]60:52732/02[.]08[.]2022[.]exe hxxp://43[.]224[.]0[.]5:1316/02[.]08[.]2022[.]exe hxxp://223[.]19[.]45[.]161:58126/02[.]08[.]2022[.]exe hxxp://85[.]105[.]79[.]209:29379/02[.]08[.]2022[.]exe hxxp://93[.]118[.]104[.]33:41338/02[.]08[.]2022[.]exe hxxp://109[.]87[.]223[.]241:39478/02[.]08[.]2022[.]exe hxxp://116[.]58[.]51[.]90:1162/02[.]08[.]2022[.]exe hxxp://41[.]190[.]70[.]217:20050/02[.]08[.]2022[.]exe hxxp://103[.]235[.]33[.]186:1662/02[.]08[.]2022[.]exe hxxp://202[.]51[.]180[.]42:22397/02[.]08[.]2022[.]exe hxxp://80[.]23[.]51[.]237:60454/02[.]08[.]2022[.]exe hxxp://61[.]65[.]59[.]95:7016/02[.]08[.]2022[.]exe hxxp://124[.]153[.]20[.]102:59977/02[.]08[.]2022[.]exe hxxp://103[.]43[.]128[.]123:59758/02[.]08[.]2022[.]exe hxxp://196[.]2[.]14[.]197:36682/02[.]08[.]2022[.]exe hxxp://88[.]247[.]163[.]125:48432/02[.]08[.]2022[.]exe hxxp://46[.]100[.]50[.]137:56504/02[.]08[.]2022[.]exe hxxp://94[.]158[.]158[.]67:40783/02[.]08[.]2022[.]exe hxxp://202[.]154[.]187[.]26:9896/02[.]08[.]2022[.]exe hxxp://213[.]186[.]69[.]18:18272/02[.]08[.]2022[.]exe hxxp://31[.]141[.]245[.]82:46625/02[.]08[.]2022[.]exe hxxp://27[.]54[.]121[.]126:49471/02[.]08[.]2022[.]exe hxxp://37[.]252[.]69[.]92:15274/02[.]08[.]2022[.]exe hxxp://43[.]230[.]159[.]242:16175/02[.]08[.]2022[.]exe hxxp://118[.]70[.]244[.]17:28411/02[.]08[.]2022[.]exe hxxp://118[.]200[.]131[.]212:12186/02[.]08[.]2022[.]exe hxxp://89[.]149[.]127[.]214:20636/02[.]08[.]2022[.]exe hxxp://36[.]49[.]65[.]99:34735/02[.]08[.]2022[.]exe hxxp://89[.]28[.]58[.]97:37382/02[.]08[.]2022[.]exe hxxp://90[.]68[.]161[.]157:4018/02[.]08[.]2022[.]exe hxxp://59[.]27[.]224[.]90:26587/02[.]08[.]2022[.]exe hxxp://194[.]208[.]56[.]189:19006/02[.]08[.]2022[.]exe hxxp://180[.]94[.]69[.]230:45238/02[.]08[.]2022[.]exe hxxp://182[.]252[.]66[.]18:18153/02[.]08[.]2022[.]exe hxxp://124[.]29[.]249[.]182:31583/02[.]08[.]2022[.]exe hxxp://168[.]228[.]6[.]22:58228/02[.]08[.]2022[.]exe hxxp://95[.]70[.]238[.]134:55591/02[.]08[.]2022[.]exe hxxp://182[.]252[.]66[.]2:17841/02[.]08[.]2022[.]exe hxxp://188[.]254[.]223[.]175:23600/02[.]08[.]2022[.]exe hxxp://94[.]240[.]37[.]34:56960/02[.]08[.]2022[.]exe hxxp://45[.]116[.]68[.]12:15607/02[.]08[.]2022[.]exe hxxp://147[.]91[.]249[.]85:53423/02[.]08[.]2022[.]exe hxxp://182[.]160[.]113[.]219:60350/02[.]08[.]2022[.]exe hxxp://177[.]72[.]78[.]249:19939/02[.]08[.]2022[.]exe hxxp://178[.]158[.]238[.]2:42830/02[.]08[.]2022[.]exe hxxp://195[.]66[.]105[.]122:49517/02[.]08[.]2022[.]exe hxxp://92[.]241[.]77[.]214:20631/02[.]08[.]2022[.]exe hxxp://41[.]160[.]128[.]130:35878/02[.]08[.]2022[.]exe hxxp://80[.]210[.]27[.]206:65461/02[.]08[.]2022[.]exe hxxp://196[.]43[.]113[.]182:5026/02[.]08[.]2022[.]exe hxxp://36[.]89[.]11[.]81:29418/02[.]08[.]2022[.]exe hxxp://85[.]50[.]148[.]206:42378/02[.]08[.]2022[.]exe hxxp://119[.]15[.]85[.]142:62506/02[.]08[.]2022[.]exe hxxp://200[.]35[.]49[.]74:43586/02[.]08[.]2022[.]exe hxxp://116[.]58[.]83[.]76:39359/02[.]08[.]2022[.]exe hxxp://190[.]128[.]195[.]138:50368/02[.]08[.]2022[.]exe hxxp://103[.]69[.]88[.]70:21502/02[.]08[.]2022[.]exe hxxp://2[.]180[.]23[.]84:7356/02[.]08[.]2022[.]exe hxxp://103[.]164[.]200[.]170:7080/02[.]08[.]2022[.]exe hxxp://186[.]125[.]133[.]243:53948/02[.]08[.]2022[.]exe hxxp://154[.]0[.]129[.]114:10702/02[.]08[.]2022[.]exe hxxp://80[.]23[.]51[.]235:60454/02[.]08[.]2022[.]exe hxxp://31[.]210[.]217[.]24:64046/02[.]08[.]2022[.]exe hxxp://178[.]239[.]120[.]153:48308/02[.]08[.]2022[.]exe hxxp://186[.]232[.]94[.]98:14411/02[.]08[.]2022[.]exe hxxp://116[.]58[.]21[.]218:27147/02[.]08[.]2022[.]exe hxxp://201[.]74[.]222[.]52:41753/02[.]08[.]2022[.]exe hxxp://103[.]70[.]204[.]50:30005/02[.]08[.]2022[.]exe hxxp://80[.]191[.]143[.]82:62104/02[.]08[.]2022[.]exe hxxp://180[.]218[.]160[.]96:3208/02[.]08[.]2022[.]exe hxxp://31[.]171[.]223[.]183:10522/02[.]08[.]2022[.]exe hxxp://31[.]0[.]199[.]8:23930/02[.]08[.]2022[.]exe hxxp://94[.]174[.]32[.]51:61370/02[.]08[.]2022[.]exe hxxp://185[.]237[.]157[.]98:41619/02[.]08[.]2022[.]exe hxxp://178[.]210[.]129[.]3:12620/02[.]08[.]2022[.]exe hxxp://36[.]94[.]29[.]82:23591/02[.]08[.]2022[.]exe hxxp://182[.]160[.]109[.]98:29602/02[.]08[.]2022[.]exe hxxp://95[.]170[.]119[.]57:1271/02[.]08[.]2022[.]exe hxxp://193[.]106[.]58[.]174:32789/02[.]08[.]2022[.]exe hxxp://213[.]92[.]222[.]96:9326/02[.]08[.]2022[.]exe hxxp://212[.]154[.]209[.]206:16122/02[.]08[.]2022[.]exe hxxp://37[.]220[.]123[.]125:45497/02[.]08[.]2022[.]exe hxxp://46[.]176[.]48[.]219:24953/02[.]08[.]2022[.]exe hxxp://121[.]200[.]63[.]165:27123/02[.]08[.]2022[.]exe hxxp://36[.]67[.]251[.]151:24382/02[.]08[.]2022[.]exe hxxp://94[.]52[.]86[.]60:27955/02[.]08[.]2022[.]exe hxxp://36[.]88[.]244[.]2:9487/02[.]08[.]2022[.]exe hxxp://194[.]208[.]52[.]223:39900/02[.]08[.]2022[.]exe hxxp://186[.]125[.]133[.]242:53948/02[.]08[.]2022[.]exe hxxp://103[.]50[.]4[.]171:28917/02[.]08[.]2022[.]exe hxxp://174[.]7[.]42[.]250:3336/02[.]08[.]2022[.]exe hxxp://190[.]7[.]153[.]18:39564/02[.]08[.]2022[.]exe hxxp://193[.]239[.]254[.]115:28577/02[.]08[.]2022[.]exe hxxp://201[.]184[.]179[.]195:30450/02[.]08[.]2022[.]exe hxxp://202[.]51[.]191[.]102:15594/02[.]08[.]2022[.]exe hxxp://45[.]114[.]152[.]19:42820/02[.]08[.]2022[.]exe hxxp://139[.]255[.]78[.]211:62967/02[.]08[.]2022[.]exe hxxp://36[.]91[.]151[.]106:29956/02[.]08[.]2022[.]exe hxxp://212[.]8[.]38[.]73:3265/02[.]08[.]2022[.]exe hxxp://103[.]164[.]191[.]74:12576/02[.]08[.]2022[.]exe hxxp://178[.]211[.]135[.]170:12768/02[.]08[.]2022[.]exe hxxp://93[.]175[.]223[.]140:5544/02[.]08[.]2022[.]exe hxxp://87[.]5[.]1[.]88:39007/02[.]08[.]2022[.]exe hxxp://146[.]196[.]120[.]21:36191/02[.]08[.]2022[.]exe hxxp://186[.]189[.]199[.]6:3545/02[.]08[.]2022[.]exe hxxp://188[.]137[.]36[.]53:44689/02[.]08[.]2022[.]exe hxxp://78[.]153[.]52[.]58:19219/02[.]08[.]2022[.]exe hxxp://121[.]55[.]247[.]161:5427/02[.]08[.]2022[.]exe hxxp://27[.]147[.]132[.]114:38521/02[.]08[.]2022[.]exe hxxp://81[.]16[.]247[.]69:43158/02[.]08[.]2022[.]exe hxxp://37[.]252[.]86[.]167:36327/02[.]08[.]2022[.]exe hxxp://36[.]67[.]251[.]227:10466/02[.]08[.]2022[.]exe hxxp://212[.]225[.]179[.]160:21419/02[.]08[.]2022[.]exe hxxp://78[.]188[.]215[.]66:57861/02[.]08[.]2022[.]exe hxxp://130[.]185[.]229[.]3:64408/02[.]08[.]2022[.]exe hxxp://47[.]181[.]114[.]185:35261/02[.]08[.]2022[.]exe hxxp://217[.]218[.]139[.]205:38458/02[.]08[.]2022[.]exe hxxp://60[.]246[.]106[.]122:33463/02[.]08[.]2022[.]exe hxxp://190[.]113[.]124[.]155:64726/02[.]08[.]2022[.]exe hxxp://47[.]50[.]169[.]82:55508/02[.]08[.]2022[.]exe hxxp://81[.]16[.]242[.]236:28115/02[.]08[.]2022[.]exe hxxp://190[.]185[.]119[.]13:53572/02[.]08[.]2022[.]exe hxxp://186[.]211[.]154[.]33:42419/02[.]08[.]2022[.]exe hxxp://213[.]175[.]189[.]102:35260/02[.]08[.]2022[.]exe hxxp://31[.]186[.]54[.]203:19238/02[.]08[.]2022[.]exe hxxp://36[.]92[.]207[.]29:60948/02[.]08[.]2022[.]exe hxxp://144[.]48[.]170[.]111:19280/02[.]08[.]2022[.]exe hxxp://36[.]91[.]180[.]50:37658/02[.]08[.]2022[.]exe hxxp://208[.]68[.]68[.]178:6003/02[.]08[.]2022[.]exe hxxp://58[.]145[.]168[.]170:25222/02[.]08[.]2022[.]exe hxxp://186[.]125[.]133[.]244:53948/02[.]08[.]2022[.]exe hxxp://103[.]230[.]153[.]181:2570/02[.]08[.]2022[.]exe hxxp://185[.]136[.]193[.]25:12499/02[.]08[.]2022[.]exe hxxp://190[.]104[.]195[.]210:65110/02[.]08[.]2022[.]exe hxxp://177[.]247[.]15[.]185:5451/02[.]08[.]2022[.]exe hxxp://103[.]101[.]81[.]142:1281/02[.]08[.]2022[.]exe hxxp://81[.]16[.]254[.]181:31516/02[.]08[.]2022[.]exe hxxp://85[.]187[.]82[.]120:41465/02[.]08[.]2022[.]exe hxxp://41[.]219[.]187[.]180:65146/02[.]08[.]2022[.]exe hxxp://185[.]43[.]228[.]126:2473/02[.]08[.]2022[.]exe hxxp://103[.]43[.]6[.]118:7055/02[.]08[.]2022[.]exe hxxp://202[.]4[.]110[.]130:35612/02[.]08[.]2022[.]exe hxxp://150[.]129[.]202[.]197:1316/02[.]08[.]2022[.]exe hxxp://178[.]19[.]174[.]250:9954/02[.]08[.]2022[.]exe hxxp://36[.]92[.]77[.]11:45596/02[.]08[.]2022[.]exe hxxp://103[.]159[.]198[.]172:14233/02[.]08[.]2022[.]exe hxxp://163[.]182[.]13[.]103:10896/02[.]08[.]2022[.]exe hxxp://41[.]203[.]218[.]38:45842/02[.]08[.]2022[.]exe hxxp://146[.]196[.]120[.]194:45995/02[.]08[.]2022[.]exe hxxp://190[.]145[.]205[.]178:6360/02[.]08[.]2022[.]exe hxxp://179[.]190[.]109[.]156:21882/02[.]08[.]2022[.]exe hxxp://182[.]233[.]119[.]113:16957/02[.]08[.]2022[.]exe hxxp://71[.]83[.]248[.]9:43754/02[.]08[.]2022[.]exe hxxp://94[.]43[.]59[.]154:30924/02[.]08[.]2022[.]exe hxxp://190[.]95[.]23[.]47:34088/02[.]08[.]2022[.]exe hxxp://41[.]211[.]112[.]86:9955/02[.]08[.]2022[.]exe hxxp://90[.]140[.]13[.]202:28056/02[.]08[.]2022[.]exe hxxp://95[.]158[.]69[.]35:16506/02[.]08[.]2022[.]exe hxxp://91[.]92[.]187[.]23:17555/02[.]08[.]2022[.]exe hxxp://5[.]89[.]112[.]21:23105/02[.]08[.]2022[.]exe hxxp://178[.]222[.]2[.]50:49236/02[.]08[.]2022[.]exe hxxp://62[.]169[.]235[.]215:17145/02[.]08[.]2022[.]exe hxxp://27[.]147[.]225[.]2:29392/02[.]08[.]2022[.]exe hxxp://62[.]151[.]149[.]35:29357/02[.]08[.]2022[.]exe hxxp://181[.]204[.]218[.]148:4548/02[.]08[.]2022[.]exe hxxp://181[.]193[.]59[.]78:39941/02[.]08[.]2022[.]exe hxxp://109[.]92[.]143[.]90:65469/02[.]08[.]2022[.]exe hxxp://103[.]90[.]207[.]13:25925/02[.]08[.]2022[.]exe hxxp://36[.]66[.]168[.]49:4656/02[.]08[.]2022[.]exe hxxp://154[.]73[.]64[.]24:41934/02[.]08[.]2022[.]exe hxxp://200[.]69[.]219[.]25:6584/02[.]08[.]2022[.]exe hxxp://139[.]5[.]152[.]14:44491/02[.]08[.]2022[.]exe hxxp://190[.]109[.]223[.]242:4486/02[.]08[.]2022[.]exe hxxp://190[.]110[.]210[.]50:34972/02[.]08[.]2022[.]exe hxxp://203[.]115[.]101[.]243:32242/02[.]08[.]2022[.]exe hxxp://207[.]113[.]208[.]58:2544/02[.]08[.]2022[.]exe hxxp://200[.]90[.]15[.]65:54522/02[.]08[.]2022[.]exe hxxp://177[.]52[.]48[.]235:39654/02[.]08[.]2022[.]exe hxxp://36[.]92[.]68[.]241:27066/02[.]08[.]2022[.]exe hxxp://89[.]231[.]14[.]137:2282/02[.]08[.]2022[.]exe hxxp://178[.]160[.]216[.]103:49752/02[.]08[.]2022[.]exe hxxp://193[.]228[.]134[.]234:20043/02[.]08[.]2022[.]exe hxxp://186[.]211[.]153[.]18:42419/02[.]08[.]2022[.]exe hxxp://202[.]63[.]242[.]37:43762/02[.]08[.]2022[.]exe hxxp://85[.]113[.]141[.]237:30890/02[.]08[.]2022[.]exe hxxp://188[.]0[.]251[.]124:4444/02[.]08[.]2022[.]exe hxxp://212[.]98[.]186[.]8:6819/02[.]08[.]2022[.]exe hxxp://212[.]107[.]232[.]167:21838/02[.]08[.]2022[.]exe hxxp://185[.]236[.]46[.]120:45209/02[.]08[.]2022[.]exe hxxp://177[.]103[.]184[.]142:27328/02[.]08[.]2022[.]exe hxxp://103[.]125[.]163[.]10:7080/02[.]08[.]2022[.]exe hxxp://188[.]190[.]57[.]41:41465/02[.]08[.]2022[.]exe hxxp://150[.]129[.]202[.]193:1316/02[.]08[.]2022[.]exe hxxp://118[.]71[.]250[.]6:28411/02[.]08[.]2022[.]exe hxxp://88[.]119[.]95[.]176:40517/02[.]08[.]2022[.]exe hxxp://212[.]154[.]135[.]81:16122/02[.]08[.]2022[.]exe hxxp://192[.]162[.]49[.]16:19327/02[.]08[.]2022[.]exe hxxp://37[.]209[.]164[.]110:26488/02[.]08[.]2022[.]exe hxxp://181[.]205[.]125[.]58:54012/02[.]08[.]2022[.]exe hxxp://70[.]45[.]241[.]192:57703/02[.]08[.]2022[.]exe hxxp://2[.]187[.]118[.]22:25609/02[.]08[.]2022[.]exe hxxp://116[.]72[.]19[.]113:4229/02[.]08[.]2022[.]exe hxxp://213[.]91[.]236[.]237:10713/02[.]08[.]2022[.]exe hxxp://41[.]174[.]152[.]29:44372/02[.]08[.]2022[.]exe hxxp://36[.]95[.]96[.]237:42560/02[.]08[.]2022[.]exe hxxp://79[.]17[.]133[.]64:22235/02[.]08[.]2022[.]exe hxxp://154[.]126[.]178[.]16:30629/02[.]08[.]2022[.]exe hxxp://36[.]89[.]21[.]251:33122/02[.]08[.]2022[.]exe hxxp://84[.]22[.]48[.]234:63218/02[.]08[.]2022[.]exe hxxp://1[.]70[.]131[.]161:28048/02[.]08[.]2022[.]exe hxxp://113[.]214[.]56[.]234:44138/02[.]08[.]2022[.]exe hxxp://36[.]64[.]210[.]218:25588/02[.]08[.]2022[.]exe hxxp://176[.]115[.]245[.]19:45330/02[.]08[.]2022[.]exe hxxp://94[.]142[.]63[.]8:24860/02[.]08[.]2022[.]exe hxxp://103[.]30[.]85[.]58:9332/02[.]08[.]2022[.]exe hxxp://37[.]233[.]63[.]185:33423/02[.]08[.]2022[.]exe hxxp://109[.]195[.]82[.]21:32288/02[.]08[.]2022[.]exe hxxp://112[.]81[.]124[.]2:38744/02[.]08[.]2022[.]exe hxxp://195[.]34[.]91[.]22:61437/02[.]08[.]2022[.]exe hxxp://174[.]78[.]254[.]83:38585/02[.]08[.]2022[.]exe hxxp://46[.]209[.]255[.]18:1871/02[.]08[.]2022[.]exe hxxp://202[.]78[.]201[.]3:62330/02[.]08[.]2022[.]exe hxxp://115[.]245[.]112[.]26:20671/02[.]08[.]2022[.]exe hxxp://201[.]183[.]247[.]58:52513/02[.]08[.]2022[.]exe hxxp://84[.]242[.]139[.]154:15341/02[.]08[.]2022[.]exe hxxp://177[.]155[.]135[.]244:4443/02[.]08[.]2022[.]exe hxxp://185[.]29[.]162[.]101:3788/02[.]08[.]2022[.]exe hxxp://185[.]134[.]98[.]209:1744/02[.]08[.]2022[.]exe hxxp://212[.]43[.]34[.]226:57556/02[.]08[.]2022[.]exe hxxp://181[.]37[.]126[.]89:39568/02[.]08[.]2022[.]exe hxxp://91[.]185[.]49[.]15:16202/02[.]08[.]2022[.]exe hxxp://173[.]235[.]65[.]44:16764/02[.]08[.]2022[.]exe hxxp://154[.]126[.]186[.]44:34102/02[.]08[.]2022[.]exe hxxp://78[.]30[.]18[.]60:11602/02[.]08[.]2022[.]exe hxxp://45[.]121[.]33[.]18:12922/02[.]08[.]2022[.]exe hxxp://178[.]134[.]42[.]162:18520/02[.]08[.]2022[.]exe hxxp://176[.]62[.]237[.]79:62202/02[.]08[.]2022[.]exe hxxp://70[.]166[.]89[.]181:26293/02[.]08[.]2022[.]exe hxxp://200[.]81[.]127[.]208:42014/02[.]08[.]2022[.]exe hxxp://46[.]28[.]160[.]151:30426/02[.]08[.]2022[.]exe hxxp://91[.]92[.]98[.]94:32971/02[.]08[.]2022[.]exe hxxp://87[.]197[.]160[.]196:6324/02[.]08[.]2022[.]exe hxxp://118[.]232[.]241[.]143:20511/02[.]08[.]2022[.]exe hxxp://82[.]193[.]118[.]99:63838/02[.]08[.]2022[.]exe hxxp://186[.]154[.]93[.]81:8125/02[.]08[.]2022[.]exe hxxp://88[.]248[.]204[.]94:16957/02[.]08[.]2022[.]exe hxxp://190[.]4[.]44[.]202:14124/02[.]08[.]2022[.]exe hxxp://103[.]237[.]174[.]30:22399/02[.]08[.]2022[.]exe hxxp://90[.]182[.]214[.]197:50162/02[.]08[.]2022[.]exe hxxp://181[.]233[.]95[.]28:40000/02[.]08[.]2022[.]exe hxxp://138[.]19[.]251[.]214:59749/02[.]08[.]2022[.]exe hxxp://89[.]233[.]158[.]18:55398/02[.]08[.]2022[.]exe hxxp://193[.]189[.]188[.]129:40630/02[.]08[.]2022[.]exe hxxp://189[.]204[.]177[.]98:29762/02[.]08[.]2022[.]exe hxxp://82[.]193[.]120[.]99:4958/02[.]08[.]2022[.]exe hxxp://156[.]155[.]176[.]210:40080/02[.]08[.]2022[.]exe hxxp://181[.]143[.]114[.]106:61394/02[.]08[.]2022[.]exe hxxp://212[.]107[.]239[.]43:8026/02[.]08[.]2022[.]exe hxxp://36[.]91[.]171[.]37:4488/02[.]08[.]2022[.]exe hxxp://118[.]70[.]242[.]100:50870/02[.]08[.]2022[.]exe hxxp://182[.]253[.]60[.]198:46757/02[.]08[.]2022[.]exe hxxp://202[.]178[.]115[.]73:19252/02[.]08[.]2022[.]exe hxxp://80[.]23[.]51[.]234:60454/02[.]08[.]2022[.]exe hxxp://190[.]248[.]145[.]19:49406/02[.]08[.]2022[.]exe hxxp://181[.]166[.]191[.]183:7136/02[.]08[.]2022[.]exe hxxp://78[.]83[.]245[.]86:12689/02[.]08[.]2022[.]exe hxxp://188[.]43[.]201[.]109:63202/02[.]08[.]2022[.]exe hxxp://46[.]249[.]148[.]216:4296/02[.]08[.]2022[.]exe hxxp://88[.]119[.]193[.]17:10462/02[.]08[.]2022[.]exe hxxp://188[.]175[.]134[.]62:4496/02[.]08[.]2022[.]exe hxxp://41[.]57[.]125[.]226:1037/02[.]08[.]2022[.]exe hxxp://47[.]49[.]114[.]179:27254/02[.]08[.]2022[.]exe hxxp://217[.]64[.]96[.]209:13156/02[.]08[.]2022[.]exe hxxp://203[.]109[.]201[.]77:8358/02[.]08[.]2022[.]exe hxxp://218[.]86[.]123[.]43:52183/02[.]08[.]2022[.]exe hxxp://216[.]244[.]201[.]251:8104/02[.]08[.]2022[.]exe hxxp://2[.]180[.]9[.]57:12220/02[.]08[.]2022[.]exe hxxp://88[.]204[.]58[.]118:54105/02[.]08[.]2022[.]exe hxxp://203[.]223[.]44[.]74:38359/02[.]08[.]2022[.]exe hxxp://186[.]42[.]121[.]70:57412/02[.]08[.]2022[.]exe hxxp://186[.]97[.]185[.]92:31376/02[.]08[.]2022[.]exe hxxp://181[.]224[.]243[.]165:50531/02[.]08[.]2022[.]exe hxxp://212[.]231[.]226[.]35:27102/02[.]08[.]2022[.]exe hxxp://178[.]131[.]59[.]215:19051/02[.]08[.]2022[.]exe hxxp://212[.]237[.]112[.]109:54692/02[.]08[.]2022[.]exe hxxp://121[.]180[.]197[.]138:52288/02[.]08[.]2022[.]exe hxxp://109[.]160[.]87[.]2:31378/02[.]08[.]2022[.]exe hxxp://49[.]142[.]114[.]242:6220/02[.]08[.]2022[.]exe hxxp://80[.]210[.]35[.]140:7607/02[.]08[.]2022[.]exe hxxp://177[.]130[.]45[.]132:18495/02[.]08[.]2022[.]exe hxxp://93[.]87[.]31[.]84:40955/02[.]08[.]2022[.]exe hxxp://181[.]49[.]100[.]190:56953/02[.]08[.]2022[.]exe hxxp://181[.]129[.]177[.]162:26290/02[.]08[.]2022[.]exe hxxp://46[.]97[.]137[.]50:64550/02[.]08[.]2022[.]exe hxxp://36[.]88[.]180[.]115:20043/02[.]08[.]2022[.]exe hxxp://92[.]114[.]191[.]82:3230/02[.]08[.]2022[.]exe hxxp://62[.]175[.]253[.]83:4369/02[.]08[.]2022[.]exe hxxp://47[.]35[.]24[.]97:20485/02[.]08[.]2022[.]exe hxxp://75[.]136[.]50[.]41:20362/02[.]08[.]2022[.]exe hxxp://63[.]78[.]214[.]18:33536/02[.]08[.]2022[.]exe hxxp://80[.]19[.]172[.]50:57652/02[.]08[.]2022[.]exe hxxp://89[.]216[.]107[.]99:65414/02[.]08[.]2022[.]exe hxxp://36[.]89[.]248[.]13:51408/02[.]08[.]2022[.]exe hxxp://37[.]202[.]49[.]118:56648/02[.]08[.]2022[.]exe hxxp://89[.]254[.]173[.]147:44386/02[.]08[.]2022[.]exe hxxp://186[.]177[.]98[.]100:50515/02[.]08[.]2022[.]exe hxxp://110[.]34[.]7[.]5:48764/02[.]08[.]2022[.]exe hxxp://75[.]183[.]98[.]139:1912/02[.]08[.]2022[.]exe hxxp://154[.]0[.]129[.]134:10702/02[.]08[.]2022[.]exe hxxp://46[.]209[.]88[.]218:59792/02[.]08[.]2022[.]exe hxxp://146[.]120[.]241[.]207:33962/02[.]08[.]2022[.]exe hxxp://86[.]63[.]79[.]174:15558/02[.]08[.]2022[.]exe hxxp://114[.]7[.]160[.]114:47530/02[.]08[.]2022[.]exe hxxp://45[.]116[.]68[.]70:23115/02[.]08[.]2022[.]exe hxxp://95[.]170[.]113[.]242:62214/02[.]08[.]2022[.]exe hxxp://213[.]109[.]234[.]217:56442/02[.]08[.]2022[.]exe hxxp://203[.]80[.]244[.]154:46151/02[.]08[.]2022[.]exe hxxp://119[.]252[.]167[.]172:45777/02[.]08[.]2022[.]exe hxxp://202[.]5[.]50[.]108:15808/02[.]08[.]2022[.]exe hxxp://210[.]4[.]69[.]226:44803/02[.]08[.]2022[.]exe hxxp://5[.]236[.]19[.]17:29536/02[.]08[.]2022[.]exe hxxp://183[.]112[.]2[.]247:45768/02[.]08[.]2022[.]exe hxxp://95[.]170[.]113[.]236:16525/02[.]08[.]2022[.]exe hxxp://36[.]66[.]108[.]167:57344/02[.]08[.]2022[.]exe hxxp://94[.]74[.]128[.]50:65074/02[.]08[.]2022[.]exe hxxp://36[.]66[.]16[.]133:12298/02[.]08[.]2022[.]exe hxxp://178[.]169[.]136[.]50:16723/02[.]08[.]2022[.]exe hxxp://178[.]151[.]163[.]54:7061/02[.]08[.]2022[.]exe hxxp://46[.]10[.]63[.]155:45108/02[.]08[.]2022[.]exe hxxp://36[.]39[.]146[.]69:48874/02[.]08[.]2022[.]exe hxxp://113[.]214[.]56[.]228:41018/02[.]08[.]2022[.]exe hxxp://24[.]79[.]48[.]21:55134/02[.]08[.]2022[.]exe hxxp://81[.]57[.]79[.]124:18461/02[.]08[.]2022[.]exe hxxp://60[.]188[.]59[.]126:8099/02[.]08[.]2022[.]exe hxxp://47[.]90[.]142[.]15/02[.]08[.]2022[.]exe hxxp://42[.]194[.]195[.]71:4433/02[.]08[.]2022[.]exe hxxp://42[.]240[.]133[.]45:8800/02[.]08[.]2022[.]exe hxxp://47[.]116[.]40[.]141/02[.]08[.]2022[.]exe hxxp://115[.]120[.]210[.]236:8090/02[.]08[.]2022[.]exe hxxp://124[.]222[.]59[.]8:8009/02[.]08[.]2022[.]exe hxxp://101[.]34[.]240[.]103/02[.]08[.]2022[.]exe hxxp://83[.]229[.]120[.]159:9999/02[.]08[.]2022[.]exe hxxp://47[.]97[.]96[.]147:82/02[.]08[.]2022[.]exe hxxp://165[.]154[.]98[.]216:8082/02[.]08[.]2022[.]exe hxxp://94[.]103[.]125[.]11/02[.]08[.]2022[.]exe hxxp://121[.]40[.]112[.]176:8087/02[.]08[.]2022[.]exe hxxp://47[.]121[.]137[.]189:8443/02[.]08[.]2022[.]exe hxxp://209[.]38[.]116[.]17:30241/02[.]08[.]2022[.]exe hxxp://46[.]175[.]150[.]13/02[.]08[.]2022[.]exe hxxp://64[.]71[.]152[.]199/02[.]08[.]2022[.]exe hxxp://event[.]windowserrorapis[.]com:8443/jquery-3[.]3[.]1[.]min[.]js hxxp://45[.]116[.]78[.]127:443/jquery-3[.]3[.]1[.]min[.]js hxxp://217[.]194[.]133[.]225:9999/1[.]exe hxxp://217[.]194[.]133[.]225:9999/1[.]ps1 hxxp://107[.]173[.]129[.]144:8000/bash hxxp://107[.]173[.]129[.]144:8000/cats hxxp://45[.]43[.]36[.]223/m/mode11_UVo6[.]exe hxxp://45[.]43[.]36[.]223/m/mode11_0HVJ[.]exe hxxp://45[.]43[.]36[.]223/m/mode11_AKUh[.]exe hxxp://45[.]43[.]36[.]223/m/mode11_N1Fz[.]exe hxxp://45[.]43[.]36[.]223/m/mode11_qLf2[.]exe hxxp://45[.]43[.]36[.]223/m/mode11_buqd[.]exe hxxp://101[.]201[.]227[.]94/intput[.]bin hxxp://101[.]201[.]247[.]232:803/02[.]08[.]2022[.]exe hxxp://39[.]108[.]145[.]133:33891/02[.]08[.]2022[.]exe hxxp://43[.]134[.]58[.]195:8080/02[.]08[.]2022[.]exe hxxp://58[.]87[.]94[.]238:81/02[.]08[.]2022[.]exe hxxp://47[.]95[.]197[.]166/02[.]08[.]2022[.]exe hxxp://3[.]22[.]61[.]147/02[.]08[.]2022[.]exe hxxp://43[.]154[.]153[.]84/02[.]08[.]2022[.]exe hxxp://1[.]94[.]195[.]62:8888/02[.]08[.]2022[.]exe hxxp://47[.]102[.]218[.]169:50051/02[.]08[.]2022[.]exe hxxp://124[.]71[.]84[.]202:1900/02[.]08[.]2022[.]exe hxxp://160[.]22[.]121[.]92/02[.]08[.]2022[.]exe hxxp://111[.]231[.]22[.]61/02[.]08[.]2022[.]exe hxxp://110[.]41[.]43[.]248/02[.]08[.]2022[.]exe hxxp://8[.]217[.]37[.]213:8088/02[.]08[.]2022[.]exe hxxp://8[.]140[.]239[.]162/02[.]08[.]2022[.]exe hxxp://36[.]137[.]91[.]198:18444/02[.]08[.]2022[.]exe hxxp://34[.]237[.]237[.]84/02[.]08[.]2022[.]exe hxxp://43[.]128[.]78[.]2/02[.]08[.]2022[.]exe hxxp://121[.]37[.]41[.]191:6666/02[.]08[.]2022[.]exe hxxp://47[.]76[.]49[.]150:8991/02[.]08[.]2022[.]exe hxxp://83[.]229[.]127[.]74/02[.]08[.]2022[.]exe hxxp://156[.]238[.]233[.]168:81/02[.]08[.]2022[.]exe hxxp://43[.]133[.]36[.]25:8088/02[.]08[.]2022[.]exe hxxp://43[.]143[.]48[.]234:8082/02[.]08[.]2022[.]exe hxxp://106[.]75[.]76[.]252/02[.]08[.]2022[.]exe hxxp://8[.]147[.]234[.]137:8999/02[.]08[.]2022[.]exe hxxp://18[.]138[.]186[.]108:4444/02[.]08[.]2022[.]exe hxxp://121[.]36[.]222[.]101:1111/02[.]08[.]2022[.]exe hxxp://150[.]158[.]121[.]15:62000/02[.]08[.]2022[.]exe hxxp://87[.]120[.]115[.]26/02[.]08[.]2022[.]exe hxxp://82[.]156[.]108[.]180:8080/02[.]08[.]2022[.]exe hxxp://8[.]130[.]92[.]171/02[.]08[.]2022[.]exe hxxp://5[.]44[.]252[.]28/02[.]08[.]2022[.]exe hxxp://43[.]139[.]216[.]112:4321/02[.]08[.]2022[.]exe hxxp://124[.]221[.]199[.]60/02[.]08[.]2022[.]exe hxxp://45[.]77[.]45[.]45/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxps://pravo-bashkortostan[.]ru/mama[.]exe hxxps://pravo-bashkortostan[.]ru/aaa[.]mp4 hxxp://5[.]253[.]59[.]41/Documents/bbb[.]lnk hxxp://5[.]253[.]59[.]41/Documents/gabbasov[.]lnk |
DanaBot |
| URL | hxxp://185[.]215[.]113[.]209/inc/main[.]exe | Sliver |
| URL | hxxp://5[.]175[.]237[.]74/GuruITDDoS3[.]sh hxxp://5[.]175[.]237[.]74/GuruITDDoS/RpcSecurity[.]arm6 hxxp://163[.]53[.]205[.]56:32999/i hxxp://202[.]148[.]18[.]218:30944/i hxxp://193[.]189[.]188[.]129:40630/i hxxp://181[.]10[.]211[.]18:2617/i hxxp://177[.]131[.]121[.]199:12006/i hxxp://186[.]4[.]222[.]76:19066/i hxxp://187[.]95[.]124[.]125:58300/i hxxp://92[.]38[.]45[.]132:51519/i hxxp://177[.]220[.]157[.]134:20907/i hxxp://213[.]184[.]249[.]83:56304/i hxxp://146[.]196[.]97[.]231:19590/i hxxp://185[.]19[.]119[.]228:50266/i hxxp://202[.]5[.]52[.]110:37085/i hxxp://195[.]218[.]152[.]38:7093/bin[.]sh hxxp://116[.]58[.]39[.]59:13057/i hxxp://202[.]5[.]52[.]110:37085/bin[.]sh hxxp://195[.]211[.]197[.]30:10994/i hxxp://93[.]175[.]223[.]140:5544/i hxxp://213[.]221[.]36[.]18:7124/i hxxp://83[.]239[.]105[.]190:63796/i hxxp://36[.]95[.]35[.]49:40708/i hxxp://185[.]131[.]240[.]71:52561/i hxxp://200[.]255[.]164[.]35:64406/i hxxp://190[.]52[.]34[.]253:40486/i hxxp://185[.]29[.]162[.]101:3788/i hxxp://188[.]0[.]251[.]2:52872/i hxxp://201[.]245[.]165[.]67:16287/i hxxp://77[.]49[.]193[.]166:20000/i hxxp://185[.]43[.]228[.]126:2473/i hxxp://195[.]162[.]70[.]5:2060/i hxxp://185[.]114[.]137[.]114:23308/i hxxp://77[.]91[.]137[.]168:13945/i hxxp://178[.]34[.]182[.]186:34662/i hxxp://186[.]211[.]153[.]18:42419/i hxxp://202[.]59[.]90[.]106:62207/i hxxp://200[.]69[.]219[.]25:6584/i hxxp://202[.]166[.]220[.]109:59928/i hxxp://190[.]246[.]165[.]66:1145/i hxxp://195[.]162[.]70[.]105:34207/i hxxp://188[.]191[.]16[.]250:14894/i hxxp://200[.]116[.]1[.]90:25508/i hxxp://203[.]150[.]128[.]89:17524/i hxxp://194[.]183[.]186[.]164:50835/i hxxp://178[.]222[.]134[.]59:15713/i hxxp://197[.]155[.]64[.]126:47085/i hxxp://193[.]95[.]254[.]50:40630/i hxxp://202[.]148[.]20[.]138:24291/i hxxp://178[.]212[.]51[.]54:9195/i hxxp://178[.]19[.]183[.]14:6116/i hxxp://87[.]14[.]24[.]141:17949/i hxxp://146[.]196[.]120[.]194:45995/i hxxp://103[.]69[.]89[.]229:21502/[.]i hxxp://195[.]98[.]68[.]52:41604/[.]i hxxp://188[.]175[.]134[.]62:4496/[.]i hxxp://103[.]203[.]92[.]41:7120/[.]i hxxp://94[.]43[.]59[.]154:30924/[.]i hxxp://84[.]43[.]49[.]111:1194/[.]i hxxp://62[.]152[.]23[.]177:14418/[.]i hxxp://103[.]43[.]7[.]93:7601/i hxxp://109[.]69[.]79[.]44:55952/i hxxp://130[.]0[.]219[.]207:27096/i hxxp://190[.]186[.]115[.]41:54059/i hxxp://115[.]188[.]121[.]248:4062/i hxxp://212[.]237[.]112[.]109:54692/i hxxp://91[.]92[.]82[.]180:17789/i hxxp://103[.]93[.]176[.]116:51065/i hxxp://89[.]40[.]54[.]142:44298/i hxxp://182[.]93[.]84[.]57:63686/i hxxp://217[.]171[.]55[.]168:10055/i hxxp://83[.]1[.]241[.]6:62288/i hxxp://195[.]218[.]152[.]38:7093/i hxxp://121[.]101[.]130[.]14:49784/i hxxp://213[.]6[.]74[.]138:39286/i hxxp://201[.]234[.]151[.]229:47684/i hxxp://210[.]4[.]69[.]226:44803/i hxxp://77[.]40[.]49[.]162:16097/i hxxp://146[.]66[.]164[.]51:59592/i hxxp://79[.]127[.]76[.]34:51525/i hxxp://203[.]176[.]137[.]54:39516/i hxxp://180[.]92[.]233[.]78:25155/i hxxp://182[.]253[.]60[.]197:46757/i hxxp://89[.]28[.]58[.]97:37382/i hxxp://88[.]135[.]140[.]194:58387/i hxxp://5[.]188[.]145[.]60:58103/i hxxp://91[.]192[.]153[.]73:53020/i hxxp://36[.]64[.]23[.]219:16021/i hxxp://46[.]20[.]63[.]220:54770/i hxxp://190[.]205[.]35[.]203:44238/i hxxp://202[.]131[.]244[.]202:30068/i hxxp://202[.]191[.]123[.]196:27033/i hxxp://85[.]72[.]39[.]196:39497/[.]i hxxp://43[.]230[.]158[.]100:42063/i hxxp://130[.]204[.]214[.]199:5560/[.]i hxxp://160[.]155[.]16[.]204:5446/[.]i hxxp://87[.]4[.]241[.]105:5005/[.]i hxxp://186[.]33[.]110[.]83:60001/[.]i hxxp://186[.]33[.]113[.]195:8801/[.]i hxxp://77[.]76[.]80[.]223:3000/[.]i hxxp://185[.]226[.]17[.]104:4782/[.]i hxxp://177[.]23[.]93[.]50:9306/[.]i hxxp://95[.]105[.]41[.]79:50100/[.]i hxxp://46[.]246[.]164[.]241:9765/[.]i hxxp://95[.]154[.]70[.]215:1314/[.]i hxxp://105[.]213[.]84[.]53:4444/[.]i hxxp://89[.]215[.]188[.]163:41800/[.]i hxxp://186[.]33[.]110[.]239:2121/[.]i hxxp://186[.]33[.]117[.]22:8545/[.]i hxxp://196[.]202[.]194[.]133:63946/[.]i hxxp://103[.]50[.]7[.]126:3689/[.]i hxxp://91[.]200[.]115[.]75:2086/[.]i hxxp://188[.]114[.]68[.]131:3000/[.]i hxxp://186[.]33[.]113[.]75:3689/[.]i hxxp://94[.]137[.]31[.]250:8993/[.]i hxxp://79[.]119[.]55[.]204:1911/[.]i hxxp://190[.]109[.]178[.]139:24931/4 hxxp://190[.]128[.]153[.]54:64700/[.]i hxxp://200[.]61[.]163[.]235:27538/[.]i hxxp://85[.]133[.]154[.]94:50435/[.]i hxxp://181[.]112[.]153[.]78:7046/[.]i hxxp://85[.]130[.]70[.]76:58241/[.]i hxxp://46[.]167[.]196[.]225:6989/[.]i hxxp://103[.]90[.]207[.]58:41059/[.]i hxxp://71[.]83[.]248[.]9:43754/[.]i hxxp://88[.]199[.]42[.]31:61023/[.]i hxxp://103[.]93[.]177[.]61:26431/[.]i hxxp://178[.]169[.]136[.]50:16723/i hxxp://139[.]255[.]78[.]211:62967/i hxxp://200[.]122[.]211[.]138:31644/[.]i hxxp://27[.]147[.]132[.]114:38521/[.]i hxxp://203[.]128[.]76[.]99:58053/[.]i hxxp://103[.]61[.]103[.]83:2620/Mozi[.]m hxxp://202[.]63[.]242[.]37:43762/Mozi[.]m hxxp://103[.]1[.]157[.]126:20748/Mozi[.]m hxxp://77[.]87[.]236[.]131:32971/Mozi[.]m hxxp://103[.]165[.]58[.]235:59082/Mozi[.]m hxxp://217[.]144[.]173[.]240:2559/[.]i hxxp://77[.]70[.]95[.]84:27048/Mozi[.]m |
Mirai |
| URL | hxxps://api[.]telegram[.]org/bot6540906397:AAG08fPgT-V7I17vtz49STaZEuwqXqKshuM/sendMessage?chat_id=5445185021 | BlackGuard |
| URL | hxxp://dopooomogaa247247dopomoga[.]world/files/install[.]exe | Rhadamanthys |
| URL | hxxp://65[.]20[.]104[.]212:8080/docs/IMG_01829[.]lnk hxxp://finatick[.]com:8080/docs/IMG_01829[.]lnk |
VenomLNK |
| URL | hxxp://185[.]215[.]113[.]66/tcoin[.]exe | Phorpiex |
| URL | hxxp://85[.]209[.]133[.]28:20722/b/mipsel hxxp://45[.]88[.]91[.]244:20722/b/mipsel hxxp://80[.]76[.]49[.]14:20722/b/mips hxxp://85[.]209[.]133[.]6:20722/t/mips |
Kaiji |
| URL | hxxps://ksarcftp[.]com/updater[.]php hxxps://kikoschmidt[.]com/updater[.]php hxxp://kevinflansburg[.]com/updater[.]php hxxps://caliandentistry[.]com/updater[.]php |
Satacom |
| URL | hxxp://mondiale-relaissupport[.]com/no_dropper[.]apk hxxp://mondiale-relaissupport[.]com/dropper[.]apk hxxp://avastcxp[.]com/Avastavv[.]apk hxxp://avastng[.]com/Avastavv[.]apk hxxps://avastng[.]com/Avastavv[.]apk hxxps://avastpdr[.]com/Avastavv[.]apk hxxps://avastcxp[.]com/Avastavv[.]apk |
SpyNote |
| URL | hxxp://117[.]199[.]19[.]169:40252/Mozi[.]m hxxp://219[.]156[.]96[.]47:41486/Mozi[.]m hxxp://221[.]14[.]60[.]132:53880/Mozi[.]m hxxp://42[.]231[.]223[.]147:60259/Mozi[.]m hxxp://188[.]113[.]74[.]78:58542/Mozi[.]m hxxp://117[.]209[.]89[.]239:39944/Mozi[.]m |
Mozi |
| URL | hxxp://87[.]121[.]86[.]86/plugin1[.]dll hxxp://87[.]121[.]86[.]86/plugin2[.]dll |
PureCrypter |
| URL | hxxp://87[.]121[.]86[.]86/plugin3[.]dll hxxp://87[.]120[.]117[.]203/plugin3[.]dll hxxp://95[.]234[.]63[.]6/xmrig[.]exe hxxp://45[.]125[.]67[.]168/stelin/Bootxr[.]exe hxxp://test[.]molex[.]cloud/Video[.]scr hxxp://221[.]193[.]234[.]162:20000/Video[.]scr hxxp://121[.]206[.]54[.]50:8899/AV[.]scr hxxp://221[.]193[.]234[.]162:20000/AV[.]scr hxxp://222[.]133[.]104[.]88:8888/Photo[.]scr hxxp://121[.]206[.]54[.]50:8899/Photo[.]scr hxxp://test[.]molex[.]cloud/Photo[.]scr hxxp://222[.]133[.]104[.]88:8888/Video[.]scr hxxp://221[.]193[.]234[.]162:20000/info[.]zip hxxp://221[.]193[.]234[.]162:20000/Photo[.]scr hxxp://test[.]molex[.]cloud/AV[.]scr hxxp://121[.]206[.]54[.]50:8899/Video[.]scr hxxp://test[.]molex[.]cloud/Photo[.]lnk hxxp://218[.]92[.]65[.]139:20001/TEST/AV[.]lnk hxxp://test[.]molex[.]cloud/Video[.]lnk hxxp://222[.]133[.]104[.]88:8888/AV[.]scr hxxp://222[.]133[.]104[.]88:8888/Video[.]lnk hxxp://221[.]220[.]171[.]13:8085/AV[.]lnk hxxp://221[.]220[.]171[.]13:8085/Video[.]lnk hxxp://test[.]molex[.]cloud/AV[.]lnk hxxp://123[.]119[.]163[.]71:8085/Video[.]lnk hxxp://218[.]92[.]65[.]139:20001/TEST/Photo[.]lnk hxxp://123[.]119[.]163[.]71:8085/Photo[.]lnk hxxp://218[.]92[.]65[.]139:20001/TEST/Video[.]lnk hxxp://121[.]206[.]54[.]50:8899/Photo[.]lnk hxxp://121[.]206[.]54[.]50:8899/Video[.]lnk hxxp://221[.]193[.]234[.]162:20000/Video[.]lnk hxxp://221[.]193[.]234[.]162:20000/AV[.]lnk hxxp://121[.]206[.]54[.]50:8899/AV[.]lnk hxxp://221[.]193[.]234[.]162:20000/Photo[.]lnk hxxp://123[.]119[.]163[.]71:8085/AV[.]lnk hxxp://221[.]220[.]171[.]13:8085/Photo[.]lnk hxxp://222[.]133[.]104[.]88:8888/Photo[.]lnk hxxp://222[.]133[.]104[.]88:8888/AV[.]lnk hxxp://114[.]245[.]192[.]58:8085/Video[.]scr hxxp://114[.]245[.]192[.]58:8085/Photo[.]scr hxxp://114[.]245[.]192[.]58:8085/AV[.]scr hxxp://114[.]241[.]230[.]249:8085/Photo[.]scr hxxp://114[.]241[.]230[.]249:8085/AV[.]scr hxxp://114[.]241[.]230[.]249:8085/Video[.]scr hxxp://59[.]39[.]134[.]254:81/AV[.]scr hxxp://59[.]39[.]134[.]254:81/Photo[.]scr hxxps://114[.]254[.]35[.]251:999/Video[.]lnk hxxps://114[.]254[.]35[.]251:999/AV[.]lnk hxxps://114[.]254[.]35[.]251:999/Photo[.]lnk hxxp://43[.]240[.]65[.]55:81/IMG001[.]exe hxxp://59[.]39[.]134[.]254:81/info[.]zip hxxps://114[.]254[.]35[.]251:999/AV[.]scr hxxp://1[.]181[.]70[.]42:17003/info[.]zip hxxps://114[.]254[.]35[.]251:999/Video[.]scr hxxps://114[.]254[.]35[.]251:999/Photo[.]scr hxxp://114[.]241[.]230[.]249:8085/Video[.]lnk hxxp://60[.]26[.]216[.]79:88/info[.]zip hxxp://59[.]39[.]134[.]254:81/Video[.]scr hxxp://61[.]157[.]18[.]84:9088/info[.]zip hxxp://114[.]245[.]192[.]58:8085/Video[.]lnk hxxp://114[.]245[.]192[.]58:8085/Photo[.]lnk hxxp://114[.]241[.]230[.]249:8085/Photo[.]lnk hxxp://114[.]241[.]230[.]249:8085/AV[.]lnk hxxp://81[.]42[.]249[.]132:1080/info[.]zip hxxp://114[.]245[.]192[.]58:8085/AV[.]lnk hxxp://www[.]kasihcommunityschool[.]sch[.]id/mk/drop2[.]exe hxxp://wg77[.]muntialo[.]desa[.]id/mk/drop2[.]exe hxxp://cpcalendars[.]kasihcommunityschool[.]sch[.]id/mk/drop2[.]exe hxxp://cpanel[.]kasihcommunityschool[.]sch[.]id/mk/drop2[.]exe hxxp://cpcontacts[.]kasihcommunityschool[.]sch[.]id/mk/drop2[.]exe hxxp://webmail[.]kasihcommunityschool[.]sch[.]id/mk/drop2[.]exe hxxp://kasihcommunityschool[.]sch[.]id/mk/drop2[.]exe hxxp://mail[.]kasihcommunityschool[.]sch[.]id/mk/drop2[.]exe hxxp://66[.]63[.]187[.]250/mk/drop2[.]exe |
Coinminer |
| URL | hxxp://193[.]124[.]185[.]54/81bD01OkzH1z hxxp://193[.]124[.]185[.]53/81bD01OkzH1z hxxp://193[.]124[.]185[.]50/81bD01OkzH1z hxxp://141[.]98[.]9[.]202/81bD01OkzH1z hxxp://141[.]98[.]9[.]203/81bD01OkzH1z hxxp://141[.]98[.]9[.]201/81bD01OkzH1z hxxp://141[.]98[.]9[.]20/81bD01OkzH1z hxxps://fantafab[.]com/81bD01OkzH1z hxxp://141[.]98[.]9[.]202/joinsystem |
AMOS |
| URL | hxxp://eygds[.]info/api[.]php hxxps://5[.]89[.]185[.]156/uncrypted[.]exe |
Agent Tesla |
| URL | hxxp://104[.]167[.]221[.]146/m68k hxxp://104[.]167[.]221[.]146/ppc hxxp://193[.]233[.]202[.]23/arm7 hxxp://193[.]233[.]202[.]23/arm6 hxxp://193[.]233[.]202[.]23/x86_64 hxxp://193[.]233[.]202[.]23/ppc hxxp://193[.]233[.]202[.]23/mpsl hxxp://193[.]233[.]202[.]23/mips |
MooBot |
| URL | hxxps://github[.]com/litches-jpg/dwqdwqqw/releases/download/dwdqdwq/microsoft-onedrive[.]exe hxxps://github[.]com/TheKingZirush/AccGena1/raw/refs/heads/main/mcgen[.]exe |
BlankGrabber |
| URL | hxxp://31[.]41[.]244[.]11/files/none/random[.]exe hxxp://31[.]41[.]244[.]11/files/6797680669/iSHmPkn[.]exe |
Lumar |
| URL | hxxp://104[.]255[.]172[.]60/eDOdJWCxLqbsjLPul50[.]bin hxxp://107[.]173[.]177[.]152/WOOFr219[.]bin |
CloudEyE |
| URL | hxxp://185[.]81[.]68[.]147/ioc[.]exe hxxp://185[.]81[.]68[.]147/cici[.]exe hxxps://github[.]com/rviance/ubiquitous-fortnight/releases/download/toolwin/toolwin[.]exe hxxps://github[.]com/spooffewfe/yff/raw/refs/heads/main/build[.]exe hxxp://81[.]177[.]6[.]78/IRemotePanel |
RedLine Stealer |
| URL | hxxp://185[.]81[.]68[.]147/dropper64[.]exe hxxp://185[.]196[.]8[.]37/Gd85kkjf/Login[.]php hxxp://185[.]81[.]68[.]147/7vhfjke3/Plugins/vnc[.]exe hxxp://185[.]81[.]68[.]147/7vhfjke3/Plugins/clip[.]dll hxxp://185[.]81[.]68[.]147/7vhfjke3/Plugins/cred[.]dll hxxp://185[.]81[.]68[.]147/data[.]php hxxps://185[.]215[.]113[.]20/gb9fskvs/index[.]php hxxps://185[.]215[.]113[.]202/Zu7JuNko/Login[.]php |
Amadey |
| URL | hxxps://tmpfiles[.]org/dl/18727834/remcos_a[.]exe hxxps://tmpfiles[.]org/dl/18881248/remcos_a[.]exe hxxps://bitbucket[.]org/docspaceplace/test2/downloads/1[.]exe hxxps://github[.]com/fericarr/newky/raw/refs/heads/main/prueba[.]exe hxxps://github[.]com/yusuf216/sshport/raw/refs/heads/main/evetbeta[.]exe hxxps://github[.]com/yusuf216/sshport/raw/refs/heads/main/benpolatalemdar[.]exe hxxps://github[.]com/mariolalo/myrec/raw/refs/heads/main/NOTallowedtocrypt[.]exe hxxps://paste[.]ee/d/5VcuL/0 hxxps://paste[.]ee/d/snSm4 hxxps://myguyapp[.]com/c3[.]hta |
Remcos |
| URL | hxxp://124[.]156[.]117[.]13/1[.]exe | ValleyRAT |
| URL | hxxp://45[.]155[.]249[.]178/payload[.]exe hxxp://43[.]245[.]131[.]15/test[.]apk |
Metasploit |
| URL | hxxp://87[.]120[.]113[.]91/image[.]exe hxxp://31[.]41[.]244[.]11/files/5131681669/4ZAAIhb[.]exe hxxp://31[.]41[.]244[.]11/files/5131681669/hIPhQZD[.]exe |
DarkVision RAT |
| URL | hxxp://serverl[.]org/cords/install[.]msi hxxp://31[.]192[.]232[.]35:8080/Document_for_signing[.]lnk hxxp://serverl[.]org:8080/Document_for_signing[.]lnk hxxps://serverl[.]org/cords/install[.]msi hxxps://31[.]192[.]232[.]35/cords/install[.]msi hxxp://147[.]45[.]37[.]43/disk/installs1[.]msi hxxp://31[.]192[.]232[.]35/cords/install[.]msi hxxp://193[.]233[.]22[.]135/paper/install[.]msi hxxp://hostel99[.]com/paper/install[.]msi hxxp://datagov[.]info/paper/install[.]msi |
MetaStealer |
| URL | hxxps://vividpulse[.]pro/Seed/Havoc hxxps://zylocraft[.]pro/Falcon/Hope hxxp://101[.]99[.]75[.]60/Document hxxp://152[.]136[.]140[.]85:40389/zotero/9NKWK7NH[.]zip hxxp://152[.]136[.]140[.]85:40389/zotero/WL3GTVGQ[.]zip hxxp://152[.]136[.]140[.]85:40389/zotero/UJP4JDMY[.]zip hxxp://152[.]136[.]140[.]85:40389/zotero/8RH4S7PL[.]zip hxxp://152[.]136[.]140[.]85:40389/zotero/DWPPJ74T[.]zip hxxp://152[.]136[.]140[.]85:40389/zotero/JDYM53NL[.]zip hxxp://152[.]136[.]140[.]85:40389/zotero/E9FFA5DA[.]zip hxxp://152[.]136[.]140[.]85:40389/zotero/8ZG9FAZ4[.]zip hxxp://212[.]18[.]104[.]35/Documents/Instruction_695-18014-012_Rev[.]pdf[.]lnk hxxp://185[.]66[.]91[.]23/Downloads/[.]lnk |
Emmenhtal |
| URL | hxxp://home[.]fiveth5vs[.]top/KhxTILlSHLygUudVWlQk1735 hxxp://home[.]eleventj11vt[.]top/olNuzJxAApOsKhOXzdRo1 |
CryptBot |
| URL | hxxp://185[.]66[.]91[.]17/Downloads/[.]exe hxxp://185[.]149[.]146[.]164/trwsfg[.]ps1 hxxps://109[.]199[.]101[.]109/xx[.]jpg hxxp://45[.]141[.]26[.]234/Java32[.]exe hxxp://45[.]141[.]26[.]234/XClient[.]exe hxxps://paste[.]ee/d/4ulon/0 hxxps://81[.]214[.]76[.]68/Public[.]zip hxxp://185[.]149[.]146[.]164/wrcaf[.]ps1 hxxp://147[.]45[.]44[.]131/infopage/iviewers[.]dll hxxp://147[.]45[.]44[.]131/infopage/rwvg1[.]exe hxxp://147[.]45[.]44[.]131/infopage/ersyb[.]exe hxxp://147[.]45[.]44[.]131/infopage/iubn[.]ps1 hxxp://94[.]156[.]167[.]30/XClient[.]exe hxxp://54[.]39[.]248[.]66:5000/XW/n[.]exe hxxps://github[.]com/jackyz777/activebypass/raw/refs/heads/main/systempreter[.]exe hxxps://github[.]com/DARKNEONGLITCH/Prooes/raw/refs/heads/main/Sync[.]exe hxxps://github[.]com/kidxnox/image-logger/raw/refs/heads/main/image%20logger[.]exe hxxp://185[.]66[.]91[.]23/Downloads/[.]exe hxxps://upload[.]vina-host[.]com/get/HlXk13yHsR/sdggwsdgdrwgrwgrwgrwgrw[.]exe hxxps://tmpfiles[.]org/dl/18952778/asyncclientlocal[.]exe hxxp://147[.]45[.]44[.]131/infopage/trwesf[.]exe hxxp://147[.]45[.]44[.]131/infopage/egq53qs[.]bat hxxp://147[.]45[.]44[.]131/infopage/tvsqyp[.]exe hxxp://147[.]45[.]44[.]131/infopage/trwx[.]ps1 hxxps://chinawoddon[.]co/Audacity[.]exe |
AsyncRAT |
| URL | hxxp://147[.]45[.]44[.]131/infopage/vfrcxq[.]ps1 hxxp://147[.]45[.]44[.]131/infopage/gqub[.]bat hxxp://147[.]45[.]44[.]131/infopage/vfdjo[.]exe hxxp://147[.]45[.]44[.]131/infopage/yijth[.]exe |
StormKitty |
| URL | hxxp://51[.]15[.]241[.]168/AED77D05-A028-477C-B013-04F33F1385C3/index[.]php | Azorult |
| URL | hxxp://rlrz[.]org/fhsgtsspen6/get[.]php | STOP |
| URL | hxxp://45[.]207[.]215[.]58/2[.]exe hxxp://45[.]207[.]215[.]58/1[.]exe hxxp://45[.]141[.]26[.]134/CE5Mv2[.]exe hxxp://45[.]141[.]26[.]134/CE5M[.]exe |
XWorm |
| URL | hxxps://api[.]telegram[.]org/bot7822875840:AAE1dEB39_r2yuQHwPOz--iI8ECcmIivnQs/sendMessage?chat_id=7342994424 | Snake Keylogger |
| URL | hxxp://originalpizzaplus[.]ca/forum/viewtopic[.]php hxxp://onlyidea[.]com/forum/viewtopic[.]php hxxp://onecable[.]ca/forum/viewtopic[.]php hxxp://oliviagurun[.]com/forum/viewtopic[.]php hxxp://watertreecapital[.]com/ponyz/gate[.]php hxxp://attentivetodetails[.]com/ponyz/gate[.]php hxxp://furnishedfloorplans[.]com/ponyz/gate[.]php hxxp://helisovertidewater[.]com/ponyz/gate[.]php |
Pony |
| URL | hxxp://94[.]156[.]177[.]41/alpha/five/fre[.]php | LokiBot |
| URL | hxxp://zzz[.]hnyzh[.]co/win[.]exe hxxp://205[.]185[.]126[.]56/win[.]exe |
Ghost RAT |
| URL | hxxp://45[.]43[.]36[.]223/5544x64[.]elf | ConnectBack |
| URL | hxxps://cdn[.]ps5[.]zip/steam[.]exe | Formbook |
| URL | hxxps://xanaxspoofer[.]com/files/Loader[.]exe | Zeus |
| URL | hxxp://aa[.]hostasa[.]org/config[.]rar hxxp://154[.]201[.]65[.]10/Linux4[.]7 |
XOR DDoS |
| URL | hxxps://github[.]com/AlNyak/Test/raw/main/testingg[.]exe hxxps://github[.]com/ItsChanGat/Test/raw/refs/heads/main/Server[.]exe hxxps://bitbucket[.]org/blithad/manager/downloads/Updating[.]exe |
NjRAT |
| URL | hxxp://89[.]23[.]107[.]253/Downloads/ZoomWorkplace[.]lnk | QakBot |
| URL | hxxp://pqa[.]gov[.]pakmarines[.]com/4958/1/2657/2/0/0/0/files-f8032b2c/file[.]rtf hxxp://srilanka-navy[.]lforvk[.]com/135/1/334/2/0/0/0/m/files-4fdaf6c7/file[.]rtf hxxp://pnwc[.]bol-north[.]com/5808/1/3686/2/0/0/0/m/files-a2e589d2/file[.]rtf hxxp://www-opmcm-gov-np[.]direct888[.]net/552565_26thMangsir2080/file[.]rtf hxxp://www-moha-gov-lk[.]direct888[.]net/article237/34b922ab/file[.]rtf hxxp://www-moha-gov-lk[.]direct888[.]net/Article237/34b922ab/file[.]rtf hxxp://training[.]detru[.]info/CyberDiplomacyTraining_993638/file[.]rtf hxxp://ww25[.]mail-dmp-navy-pk[.]dytt88[.]org/14459/1/23/2/0/0/0/m/files-14333226/file[.]rtf hxxp://ww25[.]ministryofforeignaffairs-mofa-gov-pk[.]dytt88[.]org/14444/1/2454/2/0/0/0/m/files-9ba90b7f/file[.]rtf hxxp://pnwc[.]bahriafoundation[.]live/5610/1/2776/2/0/0/0/m/files-9747049b/file[.]rtf hxxp://pnwc[.]bahriafoundation[.]live/5610/1/4203/2/0/0/0/m/files-2fc0caf2/file[.]rtf hxxp://pmd[.]paknavy-gov[.]com/5751/1/8532/2/0/0/0/m/files-d18c58ac/file[.]rtf hxxp://pmd[.]paknavy-gov[.]com/5751/1/8533/2/0/0/0/m/files-c6e52942/file[.]rtf hxxp://pnwc[.]bahariafoundation[.]live/5239/1/4004/2/0/0/0/m/files-f36a387a/file[.]rtf hxxp://pmd[.]paknavy-gov[.]com/5751/1/8530/2/0/0/0/m/files-87e4d5b5/file[.]rtf hxxp://pmd[.]paknavy-gov[.]com/5751/1/8531/2/0/0/0/m/files-bc3cf7c3/file[.]rtf hxxp://paknavy[.]paknavy[.]live/5516/1/4367/2/0/0/0/m/files-db71f6b3/file[.]rtf hxxp://pmd[.]paknavy-gov[.]com:443/5751/1/8533/2/0/0/0/m/files-c6e52942/file[.]rtf hxxp://pmd[.]paknavy-gov[.]com/5751/1/8529/2/0/0/0/m/files-f8ba0c1e/file[.]rtf hxxp://sppc[.]moma-pk[.]org/5281/1/4265/2/0/0/0/m/files-d2608a99/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5799/2/0/0/0/m/files-03dd18bd/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5804/2/0/0/0/m/files-c43dece3/file[.]rtf hxxp://sppc[.]moma-pk[.]org/5281/1/2302/2/0/0/0/m/files-01fd94b4/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5797/2/0/0/0/m/files-875e140b/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5798/2/0/0/0/m/files-c3178f3d/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5794/2/0/0/0/m/files-60cb1621/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5795/2/0/0/0/m/files-c9dddc54/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5796/2/0/0/0/m/files-97e02960/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5791/2/0/0/0/m/files-bda6f896/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5792/2/0/0/0/m/files-da7756e4/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5793/2/0/0/0/m/files-f2d0617e/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5789/2/0/0/0/m/files-8822f8ff/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5790/2/0/0/0/m/files-a3d0041a/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5786/2/0/0/0/m/files-5def1d52/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5787/2/0/0/0/m/files-fb528413/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5788/2/0/0/0/m/files-3acec3be/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5783/2/0/0/0/m/files-a26663eb/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5784/2/0/0/0/m/files-94153639/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5785/2/0/0/0/m/files-76f11745/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5781/2/0/0/0/m/files-62caea91/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5782/2/0/0/0/m/files-78d7e141/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5778/2/0/0/0/m/files-27d5c7d3/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5779/2/0/0/0/m/files-2f2e186d/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5780/2/0/0/0/m/files-20bba5af/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5776/2/0/0/0/m/files-175c56e7/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5777/2/0/0/0/m/files-7f2e758b/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5773/2/0/0/0/m/files-5a31d681/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5774/2/0/0/0/m/files-12eca223/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5775/2/0/0/0/m/files-fca3cc50/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5770/2/0/0/0/m/files-2d21c32e/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5771/2/0/0/0/m/files-5995311a/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5772/2/0/0/0/m/files-84c4942a/file[.]rtf hxxp://sl-navy[.]officedrive[.]live/45/1/334/2/0/0/0/m/filesfe9dade2/file[.]rtf hxxp://slpa[.]mod-gov[.]org/5946/1/5769/2/0/0/0/m/files-2f6b9c9a/file[.]rtf hxxp://sarabanmithnavvtni-mil[.]com/importanmail/78571/file[.]rtf hxxp://sarabanmithnavy[.]tni-mil[.]com/importanmail/785871/file[.]rtf hxxp://sl-navy[.]office-drive[.]live/45/1/334/2/0/0/0/m/files-fe9dade2/file[.]rtf hxxp://president-gov-lk[.]donwloaded[.]net/A4884A53/FILE[.]rtf hxxp://promotionlist[.]comsats-net[.]com:443/5756/1/8887/2/0/0/0/m/files-3d1dff0f/file[.]rtf hxxp://promotionlist[.]comsats-net[.]com/5756/1/8887/2/0/0/0/m/files-3d1dff0f/file[.]rtf hxxp://president-gov-ik[.]donwloaded[.]net/a4884a53/file[.]rtf hxxp://president-gov-lk[.]donwloaded[.]net/a4884a53/file[.]rtf hxxp://paknavy[.]edu-cx[.]org/2862/1/35022/2/0/0/0/m/files-5c23f212/file[.]rtf hxxp://paknavy[.]jmicc[.]xyz/5627/1/4367/2/0/0/0/m/files-9e0912cc/file[.]rtf hxxp://paknavy[.]comsats[.]xyz/5552/1/5037/2/0/0/0/m/files-1b5c7556/file[.]rtf hxxp://paknavy[.]defpak[.]org/5973/1/8665/2/0/0/0/m/files-f8fd19ec/file[.]rtf hxxp://opmcm-gov-np[.]fia-gov[.]net/37841677null/file[.]rtf hxxp://paknavy-gov-pkp[.]downld[.]net/14578/1/6277/2/0/0/0/m/files-75dc2b1e/file[.]rtf hxxp://nima[.]ppra[.]live/5133/1/3272/2/0/0/0/m/files-41b31573/file[.]rtf hxxp://opmcm-gov-np[.]fia-gov[.]net/37841677/file[.]rtf hxxp://navy-lk[.]direct888[.]net/report/29476965/file[.]rtf hxxp://msacn[.]ntcpk[.]net/6825/report/7176/file[.]rtf hxxp://mtss[.]bol-south[.]org/5974/1/8682/2/0/0/0/m/files-b2dff0ca/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4375/2/0/0/0/m/files-8062311a/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4376/2/0/0/0/m/files-f85db74c/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4372/2/0/0/0/m/files-d2e0a1dc/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4373/2/0/0/0/m/files-6eee3f68/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4374/2/0/0/0/m/files-2fe05aad/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4370/2/0/0/0/m/files-e05c563f/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4371/2/0/0/0/m/files-b62d382f/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4368/2/0/0/0/m/files-e5f0d8da/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4369/2/0/0/0/m/files-4afe6b27/file[.]rtf hxxp://moma[.]comsats-net[.]com:443/5753/1/4371/2/0/0/0/m/files-b62d382f/file[.]rtf hxxp://moma[.]comsats-net[.]com:443/5753/1/4373/2/0/0/0/m/files-6eee3f68/file[.]rtf hxxp://moma[.]comsats-net[.]com/5753/1/4367/2/0/0/0/m/files-0b066736/file[.]rtf hxxp://moitt-gov-pk[.]fia-gov[.]net/659949null/file[.]rtf hxxp://mohgovsg[.]bahariafoundation[.]live/5320/1/13/2/0/0/0/m/files-1ddf5195/file[.]rtf hxxp://moitt-gov-pk[.]fia-gov[.]net/364896null/file[.]rtf hxxp://mofabn[.]ksewpk[.]com/5511/1/4993/2/0/0/0/m/files-18e5db65/file[.]rtf hxxp://mofadividion[.]ptcl-gov[.]com/5724/1/3268/2/0/0/0/m/files-11e30891/file[.]rtf hxxp://mofa[.]iugur[.]live/2623/1/45326/2/0/0/0/files-5d797627/file[.]rtf hxxp://mofa-gov-pk[.]donwloaded[.]com/NegativeRepoting/b8dfd8db/file[.]rtf hxxp://mofa-gov-pk[.]donwloaded[.]com/negativerepoting/b8dfd8db/file[.]rtf hxxp://mofa-gov-pk[.]donwloaded[.]com/cg/016424/file[.]rtf hxxp://mofa-gov-pk[.]donwloaded[.]com/CG/016424/file[.]rtf hxxp://mofa-gov-pk[.]directt888[.]com/82890988/protocolhandbook/file[.]rtf hxxp://mofa-gov-pk[.]donwloaded[.]com/40493692/updatedlist/file[.]rtf hxxp://mofa-gov-pk[.]donwloaded[.]com/40493692/UpdatedList/file[.]rtf hxxp://mofa-gov-np[.]fia-gob[.]net/notice/74b78aee/file[.]rtf hxxp://mofa-gov-np[.]fia-gov[.]net/notice/74b78aee/file[.]rtf hxxp://ministryofforeignaffairs-mofa-gov-pk[.]dytt88[.]org/14444/1/2454/2/0/0/0/m/files-9ba90b7f/file[.]rtf hxxp://moemaldives[.]pmd-office[.]com/aa2076dc/circular/file[.]rtf hxxp://mailrta[.]mfagov[.]org/3818/1/53382/2/0/0/0/m/files-c78a6966/file[.]rtf hxxp://maritimepakistan[.]kpt-pk[.]net/5434/1/&3694/2/0/0/0/m/files-ce32ed85/file[.]rtf hxxp://mailnavymilbd[.]govpk[.]net/5848/1/13/2/0/0/0/m/files-57d837e4/file[.]rtf hxxp://mailoutlookcom[.]cvix[.]live/2912/1/53734/2/0/0/0/m/files-74a3adce/file[.]rtf hxxp://mailmfa[.]mofa-gov[.]info/letterhead-55228949/file[.]rtf hxxp://mailarmylk[.]mods[.]email/ltr86-1aadeec4/file[.]rtf hxxp://mailarmylk[.]mods[.]email/Ltr86-laadeec4/file[.]rtf hxxp://mail-dmp-navy-pk[.]dytt88[.]org/14459/1/23/2/0/0/0/m/files-14333226/file[.]rtf hxxp://mailaplf[.]cvix[.]live/2968/1/50390/2/0/0/0/m/files-7630e91a/file[.]rtf hxxp://ksew[.]kpt-gov[.]org/5663/1/3275/2/0/0/0/m/files-937950ad/file[.]rtf hxxp://ksew[.]org/5471/1/1101/2/0/0/0/m/files-cd6e6dbd/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5041/2/0/0/0/m/files-dd96433f/file[.]rtf hxxp://invitation-letter[.]govpk[.]info/invitation_447093/file[.]rtf hxxp://karachishipyard[.]krlwin[.]org/14231/1/3025/2/0/0/0/m/files-5ad64a22/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5039/2/0/0/0/m/files-d7c7dda1/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5040/2/0/0/0/m/files-f3b20b30/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5037/2/0/0/0/m/files-3a06489f/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5038/2/0/0/0/m/files-4623b4d2/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5034/2/0/0/0/m/files-e9745687/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5035/2/0/0/0/m/files-4a0480ae/file[.]rtf hxxp://forecast[.]comsats-net[.]com/5760/1/5036/2/0/0/0/m/files-2ad09cbd/file[.]rtf hxxp://dgms[.]paknavy-gov[.]com/5733/1/5051/2/0/0/0/m/files-73bdca4d/file[.]rtf hxxp://dgpr[.]paknvay-pk[.]net/5330/1/1330/2/0/0/0/m/files-4d9d0395/file[.]rtf hxxp://defencelk[.]cvix[.]live/3023/1/54082/2/0/0/0/m/files-0c31ed2d/file[.]rtf hxxp://commerce-gov-pk[.]directt888[.]com/KPIs_fd3931ab/file[.]rtf hxxp://dbms[.]crclab-bahria[.]org/5397/1/1322/2/0/0/0/m/files-54cc58cd/file[.]rtf hxxp://commerce-gov-pk[.]directt888[.]com/KPIs_fd3531ab/file[.]rtf hxxp://commerce-gov-pk[.]directt888[.]com/kpis_fd3531ab/file[.]rtf hxxp://cmm[.]int-secure[.]org/2557/1/51442/2/0/0/0/files-0a14cf32/file[.]rtf hxxp://cnmm[.]int-secure[.]org/2557/1/51442/2/0/0/0/files-0a14cf32/file[.]rtf hxxp://commerce-gov-pk[.]directt888[.]com/KPIs_fd0531ab/file[.]rtf hxxp://cabinet-gov-pk[.]ministry-pk[.]net/14300/1/1273/2/0/0/0/m/files-68ebf815/file[.]rtf hxxp://careitservices[.]paknvay-pk[.]net/5359/1/4586/2/0/0/0/m/files-266ad911/file[.]rtf hxxp://behr[.]ppinewsagency[.]live/5098/1/1069/2/0/0/m/files-3607001e/file[.]rtf hxxp://behr[.]ppinewsagency[.]live/5098/1/1084/2/0/0/0/m/files-bd31fa80/file[.]rtf hxxp://behr[.]ppinewsagency[.]live/5098/1/1069/2/0/0/0/m/files-3607001e/file[.]rtf hxxps://www-mof-gov-np[.]mail-govt[.]com/ccc14f983948/Profile[.]rtf hxxp://bangladeshmarineacademylibrary[.]ppinewsagency[.]live/5083/1/3417/2/0/0/0/m/files-76793138/file[.]rtf hxxps://defence-lk[.]military-bd[.]org/medicalgrantform/11d601c6/profile[.]rtf hxxp://defence-lk[.]military-bd[.]org/medicalgrantform/11d601c6/profile[.]rtf hxxp://www-mof-gov-np[.]mail-govt[.]com/ccc14f983948/Profile[.]rtf hxxp://defence-lk[.]military-bd[.]org/MedicalGrantForm/11d601c6/Profile[.]rtf hxxps://sgad-punjab-gov-pk[.]dirctt888[.]info/95a7d2b5-instructions/doc[.]rtf hxxps://stae-org-mz[.]document-viewer[.]live/65739039-voter-verified/doc[.]rtf hxxps://salary-cuxxing[.]session-out[.]com/37656199_notice/doc[.]rtf hxxps://passagensv[.]sslblindado[.]com/DOC[.]rtf hxxps://notice[.]portdedjibouti[.]live/portmaster/64addde1/doc[.]rtf hxxps://myriamherman[.]com/whooma/01035710928/doc[.]rtf hxxps://mofa-gov-pk[.]download[.]info/869469_APT/doc[.]rtf hxxps://mofa-gov-pk[.]dowmload[.]info/869469_apt/doc[.]rtf hxxps://mofa-gov-np[.]dirctt88[.]co/41882813/doc[.]rtf hxxps://kenaikan[.]portdedjibouti[.]live/Notice_483075/doc[.]rtf hxxps://marthayfabrizio[.]com/fibra/03727640983/doc[.]rtf hxxps://floridaprotiles[.]com/fauna/CLMFNC73E06G273A/doc[.]rtf hxxps://efes-mindef-gov-pk[.]dowmload[.]org/personaldataform/85678990/doc[.]rtf hxxps://efes-mindef-qov-pk[.]dowmload[.]org/PersonalDataForm/85678990/doc[.]rtf hxxps://chinghsiang[.]com/proti/GMBSLL75A44D611L/doc[.]rtf hxxps://213[.]183[.]55[.]52/moitt/755092/doc[.]rtf hxxp://www-airport-lk[.]mail-gov[.]org/8e8f2a7a/doc[.]rtf hxxp://www-army-mil-bd[.]dirctt88[.]co/65048925/doc[.]rtf hxxp://stae-org-mz[.]document-viewer[.]live/75789039-voter-verified/doc[.]rtf hxxp://stae-org-mz[.]document-viewer[.]live/65739039-voter-verified/doc[.]rtf hxxp://stae-org-mz[.]document-viewer[.]live/73126439-voter-verified/doc[.]rtf hxxp://sgad-punjab-gov-pk[.]dirctt888[.]info/95a7d2b5-instructions/doc[.]rtf hxxp://salary-cutting[.]session-out[.]com/37656199_notice/doc[.]rtf hxxp://salary-cuxxing[.]session-out[.]com/37656199_notice/doc[.]rtf hxxp://passagensv[.]sslblindado[.]com/doc[.]rtf hxxp://reports[.]dgps-govtpk[.]com/63645534-case/doc[.]rtf hxxp://notice[.]portdedjibouti[.]live/portmaster/772f2e19/doc[.]rtf hxxp://office[.]document-viewer[.]info/97051770/customs/doc[.]rtf hxxp://paknavy-gov-pk[.]dirctt888[.]info/757293-advisory/doc[.]rtf hxxp://notice[.]portdedjibouti[.]live/portmaster/64addde1/doc[.]rtf hxxp://moittadvisory[.]pmd-offc[.]info/moitt/755092/doc[.]rtf hxxp://mora[.]pdfadobe[.]com/d8149d32/mora/doc[.]rtf hxxp://mofa-gov-pk[.]dowmload[.]info/869469_apt/doc[.]rtf hxxp://mofa-gov-pk[.]download[.]info/869469_APT/doc[.]rtf hxxp://kenaikan[.]portdedjibouti[.]live/Notice_483075/doc[.]rtf hxxp://mod-gov-bd[.]dowmload[.]co/127888/doc[.]rtf hxxp://mofa-gov-np[.]dirctt88[.]co/41882813/doc[.]rtf hxxp://heatwave[.]paknavy[.]store/pn/510426/doc[.]rtf hxxp://investigation04[.]session-out[.]com/fbd901_harassment/doc[.]rtf hxxp://efes-mindef-gov-pk[.]dowmload[.]org/personaldataform/85678990/doc[.]rtf hxxp://efes-mindef-gov-pk[.]dowmload[.]org/PersonalDataForm/85678990/doc[.]rtf hxxp://notifications-khmod[.]d0cumentview[.]info/circular-d9e305/Document[.]rtf hxxp://advisories-sgcustoms[.]d0cumentview[.]info/notifications_430507/Document[.]rtf |
SideWinder |
