2020-10-29 Emotet IOCs

CYBERCHEF RECIPE TO GET URLS FROM THE BASE64-ENCODED POWERSHELL SCRIPT
----------------------------------------------------------------------
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'`'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'=Y3nkOs'},' ',true,false,true,false)
Split('@','\\n')
Find_/_Replace({'option':'Simple string','string':'][ 1 jjkgS [] []w'},'/',true,false,true,false)
Extract_URLs(false)


THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

MALDOC DISTRIBUTION URLS
http://1008691.com/wp-content/parts_service/vfaSTHuKy/
http://2market.com.au/wp-includes/blocks/more/swift/UuJz/
http://4myhealth.in/wp-includes/O/
http://7sweets.site/wp-admin/INC/FQ1E6Pb2mX6lRNXT/
http://955dy.tk/wordpress/m2Q3VgjLfgG4mN2RW/
http://adamselectrics.com/wp-admin/vzqHrP384B6uJhWMK5g/
http://aguemiimoveis.com/bond-market/SXC9B8R/
http://alice-techs.com/free-crochet/nlIJtQI/
http://almalim.com/wp-admin/6wEvaYEQf85B7sPp0I2/
http://almirnapoleao.com/dlsxg/LrDv/
http://amikene.com/wp-includes/FILE/mp/
http://amorepooh.com/wp-content/attachments/attachments/402224444/CWIjbAG/
http://animalvetnerd.com/wp-content/AfJ9Gt0Bf5HHi2GKru2jJ24O3RY9J/
http://app.vishou.net/framework/Wignx94LIsZzdPSAeRgJYWmm715tCFQlylrMmy72dudYMhcC7NNbXLZ1bVIOV6B/
http://apps.vishou.net/framework/W4BSW479ER7whY7JTNMkIBNPHTfh5GZkJV3NNNTMN8xoo/
http://aramcotools.ae/wp-includes/DkxkyWcKujbtKT21avqkNpJGQdg3NtrUkFmCNJGNXi6navmFUJozD7OfCmVLohKDy6OoIn/
http://artemed.cl/wp-content/attachments/tRVYk8RAAV5OLun/
http://articwood.com/wp-content/form/459479/il5ne0n-0120870/
http://baedekker.com/forum/Yqm8lkxUhqmhWISSsK3vmMledx0PnIqwkD6gq5Hi/
http://bambam.me/wp-content/languages/form/7581/FPQoV/
http://bbclube.com/cine/gcrtqafxev0d18jdmurgkdczrn6zfgq84fn2qsrxgfw/
http://behtarinbime.com/cgi-bin/e8tmBlPrv9/
http://bestcableninternet.com/wp-content/GvVkogECK6CZFau2IJOzOSGM2wRHfxu8SqZVulojwxCgK0LkSQqMbtXNzdZGoDHAW9E0nU/
http://bestcloud.bestcom.com.tw/bestcloud/lqyvcmwnegbakc4ui0hcglp6qts6p/
http://betacenter.ir/wp-admin/MYEFYnAOvgMdmh1GH1wGvrhfcMtYmobFWgRzro6Sibtqv8ennxAxcYiBEdBfjYuq33Lq/
http://betterzhao.xyz/wp-admin/rqNTTh/
http://beyondbackpackspro.com/wp-includes/Documentation/ltsNFNmTeNu0/
http://bharatpoudel.com.np/developerl/form/rvEKUAGj/
http://bieldruk.pl/wp-admin/paclm/iCwuJIoIoMuW/
http://bilwee.com.ar/xcloner-ed11b/QU2ACDKR/ZIHmkJ/
http://bingopetshop.ir/wp-includes/ICOH71OYS3/PLVPwd61sfZLomC/
http://blackstonetutors-onlineportal.com/wp-includes/L8FTB545MgKU1cg/
http://blog.artemisaritim.com/accuracy-of/8Ds/
http://blog.banglaponjika.com/wp-admin/Documentation/WW7G0JMgg8Qg/
http://blog.skrap.xyz/wp-includes/vGCHw8QotASt/
http://blog.vishou.net/admin/attachments/imuVy2gXSGvn/
http://blog.vishou.net/admin/public/87nPNxzggpyT3Xj/
http://bnnjhbhhuj.com/wp-admin/gll9fjgyltmk/
http://braincloud.com.co/cgi-bin/FILE/8m5wkNnnqh/
http://brasilcacambas.com.br/F0xAutoConfig/5AABtkbhEWmop07t7ilFbWdIqyQVRzCima5qB/
http://budsystem.w187-e1.ezwebtest.com/9efesfwep/j9SEQ7QjbgVUEh12Zip9hmQru7NecIKUS3dkcZTWgc6Cjweuh84/
http://buyfreshperu.com/wp-content/cFiBzMLXI7djvlY8OE0C1vtSqtWMaOMzRz5jaKis3cAmXzOpReTqZXUUtYaTBe/
http://cab-vietnam.org/damand/oPqimL96/
http://cal-br.develoop.net/wp-admin/E5uyd3benqwWVnZgrCR/
http://cassandrelp.com/wp-admin/Pp996ivDJFq18gOZvk/
http://clone.affordable.cm/wp-admin/t2sH7Zw2E88mVQ/
http://cmnivaria.com/wp-content/QY4hIpT7uw4RHC8QOGW89bfZv7UNWEP0DLUF3LJGfspX7/
http://comercialadvance.com/indexing/TQzaM6jiBlT/
http://communityofexecutors.com/wp-content/8jZxjnEQeZYDncDzglUcMXuNkHofoWQgjlGhvix6aVZ1vHpoS4MP4JeFsci6bW1J/
http://consignspacesolutions.com/wp-content/uuyyxHmA5E34PXDJHbwB5yVSkkLWOiv4YR5Nba/
http://cozmicjet.info/wp-includes/esp/vzEVKhllJFgJiKT/
http://creauture.com/Update/UWsIqaqeD4edlqt1k9lVyP3ND/
http://davaorealproperty.com/blogs/i0jOsqdfOKxC2/
http://decohavin.com/Plugins/oWM4D/
http://diezon.ir/wp-content/CNy2tEEA15QrlFxOZQJwZ2BHiNHcRjZtpBd9uks4GR4SsBcvFpy55XIGS9BlN/
http://digitalwebcreations.com/wp-admin/E2mZTeupgm7SNLhEFHhUYIQpMPgQc/
http://digitleyhosting.com/wp-admin/FILE/Zkoh7TdwolFM7bCmYjt/
http://dmccainlaw.com/wp-content/KCMU/
http://ebrulilife.com/wp-includes/attachments/AqDp4Xf0Cgi6/
http://ed-pepper.eu/wp-includes/oqvAlSYZDElIp7KxYranikersbqFyIg1OwlllhALeSl2UiMn2Dr/
http://eflowersncakes.com/wp-includes/statement/336702300490882/33thiivlt-0847855/
http://englishmatters.hk/wp-admin/browse/Rz/
http://eobraia.com.br/wp-includes/rWTf5GRitOvxGT9vJOjEOp5zQKQAbLwq2MNJHzLtLG47JPAdQjj02BjIp7DL/
http://esfagrup.com/wp-content/xj/
http://essic.online/bymlii/J/
http://etcert.com/wp-content/72K9JpF4OhxzhJwS1xE2LUulFYNO8ISFUjYYCbz1/
http://excitersports.com/wp-admin/d7HZOMpbJmdzP7oMZWsObgkoIzNgBB74fcwotHmEmctS3KOyv8/
http://expeditionquest.com/register/phpcaptcha/images/35egPHPl5UzpvdMZ9BncmVOn3p/
http://ezi-pos.com/categoryl/LphwqB1xxxJ96UhY2ZugDbZoiIfYSBjL6ZH/
http://fai.umb.ac.id/how-to/lRmcID7q7kk2rdIICUPpymb1nGZVhaOzPQTP8fIHndSMSniJkVaxV2XHxR/
http://farsanshop.com/wp-admin/jru1-0006795/
http://fenfa.vishou.net/codepay/Reporting/EEcDPgVBz0vfIwg4lciI/
http://ff.vishou.net/static/OVa2KZ55/
http://fi.letscompareonline.com/wp-admin/5KD7sX/
http://finkarma.in/wp-admin/parts_service/VAdFw9JJj4DcC85StkyL/
http://grenflor.com/wp-admin/attachments/0010230312818998/RbwK0gr17a66iqWyff2h/
http://h5game.vishou.net/cxnd/1AazUGRE3g88rF2tj8M1viEBcqNFQHAgjgb32EXSPfFwHOjqFgg6SWZdyYlNr/
http://habiganjjournal.com/wp-content/browse/PMVnhdMVxVcyuw/
http://hankook-hi.com/discord-emoji/exJJcMmatuUlb8SoTQfNPxGiYcGtb6qLUoMAmVKhwxHpfjGPtx/
http://herzkadeh.ir/old/hKhl/
http://hkq.cfc.myftpupload.com/macos-catalina/YdZZOLzbAuB5lYEyqnDcbxgUqAI/
http://honey-holiday.ru/content/E4z6xdLpCimHgvN47tvlQBtvUY2ARl/
http://hotelnewanand.com/cgi-bin/XeBmMEg0JWHU2wc0ZWqLWRPPWJB2473K10oSL53Tuxxpnn0MXscmEP2szNjQz/
http://howzatmedia.co.za/piwigo/afCmdJcM6L7yBIZ7oKEK3g4Dw/
http://htcformosa.gob.ar/wp-admin/XwG7ohaoPD8t/
http://ictmisericordia.org/cgi-bin/1eIPkCNHV7Oky2tEWGXaF1SYdZZOLzbAuB5lYEyqnDcbxgUqAIiWHBgLy/
http://ideasoft.com.co/ridgid-generator/eTrac/OpHAISHFwkTK/
http://imenisazan.com/wp-includes/nVBDVLA5cY0pnwG9TOWIprMga2SgQ0iUkwFMlOAOkKUSsRmzd31bCRnc4LnZaHaen5aO1/
http://imprima.pl/wp-includes/form/lAgM/
http://infotech.kr/wordpress/ac7lYUv4cAArjnSEBqdbAFEN9PEKqGlOOCHbWqF4nN3klJgAbgiGG/
http://inmobiliariaconfiaviv.com/wp-content/eTrac/BadR1jgkpBK/
http://innhanmachn.com/wp-admin/sA/
http://intranet.onep.go.th/content/FILE/ddrzC3uSBqM2TObuBeH/
http://inventorelectronica.com/wp-admin/VRZqWWZZw1PRLAXgfMFtm07Q3hi2D23U0PyVS4Yca5Ft3uxnEwqU/
http://iqauthority.com/wp-admin/URlFhEV22q3vHmMo20dWRILMF6Lo/
http://jobkings.net/wp-admin/XtoDbdvAVJnUFcSLGScFpQPNbYSKOaej3325nxxK90sKSp33rFDJE/
http://jwskincare.vn/shoprite-from/lau9ceDxBnczg9g6uwQxlVn5AwZunPgRYBgicxEWt3B2/
http://kadmar.com/wp-admin/46ocrcgmpcyZ7m3cyWk3svv34Ziwpld77rgrOpWNR5tkEXZTp/
http://kanpouyaku.jp/wp-admin/jopz5ewc54s-000881/
http://kasshmira.com/wp-content/BJ7mqlM0KGgfi4XoxXkQhhshXAoqlM7wi50d64lkubcSWqnvhHNUJZMhxElGSZx1/
http://kenh18.vn/wp-admin/wjS1gjv055Fx91pxOOE3A44ozbP9NZSQiFGyhBnaK2DCjGl/
http://keyhole.agency/wp-admin/34rq91KMbGC1ASOUpmnOmKx6dZtNl4vgLfWevXQyoaNghiTb3r0a5A88oVDISqaA/
http://keyvalue.in/demosite2/unhF26bONGhtoQkhAWyyOijzxT9SYUSJitCBnubbo44owNFEAH9D5/
http://khojinfo.com/wp-admin/FILE/tpdxUy34wVq/
http://kichai.xyz/wp-admin/3eJkZcUr/
http://kms.dywarning.com/wp-admin/LLC/rdDye7TEUF7Ktcb/
http://kofamonline.com/wp-content/ZPLNMAAfAbbu40BVNZmHDTvi0TJjG4L/
http://koswip.org.my/swift/4763088396948382/5ymltf-00730603/
http://logicarts.in/wp-includes/assets/JIsPJZYluhpCWLImmXB1PEFNSIMwxssln5fcHqXDrC9IKr/
http://luoilucsi.com/manufacturerl/ZzkgVq6d9VUrMqz/
http://macnort.com.br/wp-content/lm/WkGW2yirHq6axyE/
http://magazine.yasmakhotels.com/cgi-bin/ZLWLWLoUK2CCqVWgWbYhasMmjA0mXtoDbdvAVJnUFcSLGScFpQPNbYSKOaej3325nxxK9/
http://mahanext.ir/wp-includes/QR6C6XyjdA9fs4lcnGhcKekjTgPwPon9aF5rAQXwAXCrZDj9uCGGvf94Goikhkx/
http://marinasboutique.in/cgi-bin/Scan/xOz5x4OrMIHw/
http://measuresquare.com/sitepage/Scan/8rfacIDzvJ5yu/
http://meges-service.de/wp-content/Document/8453807018/YdwQ/
http://midnight-angel.net/haisetu-pheromone.net/Bah8SZ4OcMzGeYq7/
http://mizoramstateslottery.com/multiadd/LgC6GVJwSw2QNZMiqS164oxnDw0mEaVfp1BztNnPpPXhALk11WFssh14A5PkKKjoa2j/
http://mobi-game.vn/wp-content/themes/Newspaper/QGNlYcrsToprAGxUcHh4Wdvn/
http://mshopp.ir/install-package/GY1cMiS5La2JuHuds1hWyR33kTsIZMF3y5zAW2/
http://murugantemple-zh.ch/wp-content/R/
http://myentrepot.com/wp-content/uploads/paclm/WuDmncTHixQR0qgf/
http://mzurimamas.com/wp-admin/OCT/oPmNn7PNIiDqcE/
http://nanogeek.co/wp-content/3ezrNk5Yss0WD8JwtK3Bq92xT8o3fTHOr3olUVzvyUkh6ma804woIpc2cLdo7xinWuQF/
http://naturalwaterresources.com/wp-content/BaHtb/
http://nb-sangbad.com/yas8cuu7atrphsxck3tyoogtsybv2rrdbbbwitxr6xwfyuwwbw4scsbw77wgp9q/
http://ncxps.com/wp-includes/lm/7CFVaAA9jo/
http://nepalelectrical.com/nepalelectrical.com/0TsFy6xDONeugi5hU/
http://nhatcuong.xyz/cummins-onan/Overview/uGGlbH6kfK3CI7YsR/
http://nobyann.com.au/anns/balance/41116749/cdUiKrn/
http://nrduniversity.com/wp-content/Overview/cU4yZ9IVOu/
http://nutricaorenal.com.br/wp-admin/Reporting/CCNHKvQAzcL99b8TN/
http://oa.vishou.net/config/parts_service/g8Dm3hfrHHoPzYYxSP/
http://ostranderandassociates.com/var/RSm5eGlzaChT8YC/
http://panda-style.co.il/cgi-bin/lm/hClBSftXPEG8XdZcm/
http://pbinclv.com/wp-content/oMuOusHMCSCR246RrzHtkJFCQiO8LxEcbvvEhCAxpavkOF6RCzE/
http://pineislandok.com/cgi-bin/RU0laGseQgcLel2iKOkEBbGXvqalg7JM0k/
http://pneu-belgique.be/wp-admin/dWkvP88Pcxo68LlB0NI7nbEjnuZrCNvfA0X/
http://pontodopodologobh.com.br/wp-includes/sites/00N6NdIPBgiCwuJI/
http://protea2.com/wp-admin/umeNdDxiV4sKExrNQWvedXEr4YByXNHzz3OsrG/
http://qisatkifah.online/blog.cluphost.com/DeyDEN1NoDfqeX4lAuLJpAEYqtddd4lEuB447OX902xxQGbhL/
http://qualitymathtutors.com/wp-content/xu/
http://rabaco.vn/phpMyAdmin/ZPGiiHgIWNoawPFMMJLeur8/
http://racer3d.com/wp-admin/sites/LvT1JkSzhAC0ZZ/
http://recpecasalemao.com/wp-includes/S2OznKrOzJieftnfuxqLGCNDaUajLpAUV4faBtqsCFFcwCHek2DejkYp8y5HTzpLlIE9/
http://register-fca-orguk-shpo-firm-details-page-001f00n1lsuee.org/cgi-bin/wo0b70hPBrjyYGnQOd66cHGUxYZng2mkUQZB7rh/
http://riun.org/indexing/INC/wnH6ZYHEseh/
http://rmcomputerforensics.com/tltalks.com/paclm/aqxOBEpOAWYDUR/
http://rotarybp.com/wp-content/plugins/DOC/6ycLbHOst9/
http://santucciarq.com.br/hotelinfo/eTrac/ACweeEclRn/
http://selerakampung.com/wp-admin/Overview/0XQWarZrDxk69M/
http://sheeper.in/handbook/TSeIvy62rRoJILZtsFuVnXyw92EhjPLh8kaf8mkYQSwJ/
http://shijian36999.xyz/wp-admin/eIZqzSfoXdlpEDZuLypvqetUgA5FyzJ4LLA2J68yU/
http://shivanienterprise.in/wp-admin/BpKUmAepgxdWNxM5VK15Y42ECFHf1Rf0WiPIqocWmaAg4BY6dxAm78DOYlFb/
http://signetenglish.com/wp-admin/0BG/
http://sistaqui.com/wp-content/public/iwGFT/
http://soundline.com.cn/wp-includes/ju286oz-0497/
http://southsudanconsulate.org/wp-includes/images/public/SkZKkjMRzy6ndwp/
http://squire.host/termo/attachments/WRyMb4GHbZjKP0Bm4W/
http://stepstoshops.com/cgi-bin/OCT/9079695/ntjzlqqzv-00020595/
http://suksiriestate.com/cgi-bin/g6JYsD0TSTiWj6FKVOc26mddzCoBfriFlqFXtJucvvPqEjUacobmCDW/
http://support.affordableblinds.com/wp-admin/VKzdk/
http://swbmw.net/uploads/WRwYOsI9ns24T6SA6iy/
http://thalang.phuket.doae.go.th/wp-content/uploads/Dp0bMlBN3XkRPR4Oc79qFaOI2UIIRtRs2CLd0y1cXuloqYPY1FzshInhYMiVTQA/
http://theiagemsandjewelry.com/content/5Np7tMLHPoTZZmPGFO6rnNOXpwe4y8kvOctXoIRQV7tAE6mmKDUE4GuWqbu2rp6/
http://thoitrangtrungnienkim.vn/wp-content/avIF9xlwXXrf4N2C9YP08hRrOuhMrh4yelwRsK1O3Ez04v5sCyEA7chYDFoF9od/
http://tigerstormtraffic.com/wp-includes/7qbIJJ8/
http://tinhxangocxuan.com/acanthite/rTu4RM/
http://tonekashop.com/test/wp-content/plugins/kliken-marketing-for-google/htdK3E9JoFEgV3sf0p6hdsX1h/
http://tradewithjazz.com/cgi-bin/FILE/FHRKUuCjqI/
http://tutorataplus.com/wp-content/OE1IQ9PBDR86D36/CDQ743VyUU/
http://uniteddatabase.net/wp-admin/css/INC/r2gjhhV0uFjusL9uVY/
http://vaphelp.com/wp-content/j9UdwI13DMuvfcJWp/
http://veenanews24.com/cgi-bin/DOC/vRzXnhd81qM8jFA/
http://vod.vishou.net/data/attachments/xYmlDDwjxJ/
http://weixin.vishou.net/framework/RDmA0e/
http://wellnursesmartnurse.co.za/wp-admin/ppWm6X9zFFx4PTATZPz43fL3QQz11vlISv/
http://widewebit.com/wp-admin/parts_service/BwOh7PJIsSbf4Jjr/
http://wp-test.greenergizer.a2hosted.com/cgi-bin/AdGHCGUS1O73LeAL0FmMIuN8riqj4VkTx2B6OChShH8x1Z40JGzSq0nMGnYSgv/
http://www.acezsensing.com/esp/40jDj9DeB7BzximgZBrQ/
http://www.bankofneopia.com/wp-admin/network/eO3k0j1cvX/5qbz5vO3T6teRgP7pGUHUzp0YAEvJzUZ2f7QD61cnbT5Yqf4bgskRwawxj/
http://www.bankofneopia.com/wp-admin/network/eO3k0j1cvX/noGuMG6JpMz3R9JKYl0BAscgdUqb0XYrSqYahii05u10mmLnJf3cmfyIe5wpAhaVOi36y/
http://www.beyondbackpackspro.com/wp-includes/Documentation/ltsNFNmTeNu0/
http://www.bmpi.fr/cgi-bin/yCUW7fupFIpXwYjgP/
http://www.bnnjhbhhuj.com/wp-admin/glL9fJgyLtmk/
http://www.criee-des-saveurs.com/wp-admin/public/STMm3p0jJDUqkWV/
http://www.delsano.in/wp-content/INC/2xpMCnpMtNb9NZXL/
http://www.ebrulilife.com/wp-includes/attachments/AqDp4Xf0Cgi6/
http://www.eflowersncakes.com/wp-includes/Pages/AtkpIu7fLPl/
http://www.etcert.com/wp-content/72K9JpF4OhxzhJwS1xE2LUulFYNO8ISFUjYYCbz1/
http://www.falconcastings.com/wp-content/N0VFh4sXUdY5E9VP7/
http://www.grenflor.com/wp-admin/attachments/0010230312818998/RbwK0gr17a66iqWyff2h/
http://www.lexune.com/wp-content/T3yQz7oNDgYr5BcJJLfpp27/
http://www.lyricspanti.com/bzbhf/OCT/TNmjjWUcS1F3nfCNsaC/
http://www.mondkalender.shop/wordpress/JhnpnmOYMaCI2vs9fozx3tXPR9kr8mxWxa9IHnEmHgK6/
http://www.movie-2free.com/cgi-bin/lWtF26jMBvTy0IXBRqLM3kHi/
http://www.nb-sangbad.com/YAS8cuu7ATrPHSxck3tyooGTsyBv2RRDBBBwITxR6xWFyUwWBw4SCSBW77WGp9q/
http://www.nelsonsbutchers.co.uk/cgi-bin/4vlAF1VqRwYfgWGXP33pcD1UydaUIb40DlLQUEFUrt5547d0XSMo/
http://www.novaes.com.br/admin/DOC/HMfJNsvxKgsFsq6bUWV/
http://www.office187.com/wp-content/9suBiWyQMcr5EVOhbTV9qL4RsZKoqoeaDBoW015aRvheLaMFOIpRnMZ8qnib/
http://www.panda-style.co.il/cgi-bin/lm/hClBSftXPEG8XdZcm/
http://www.portalecosolar.com.br/backup/224467282086/FCxsr9H3wkcohMo/
http://www.qualitymathtutors.com/wp-content/xu/
http://www.saracyp.com/wp-admin/fn7a4YgPRtzTmKNf0akwhmKcOnus6vPTdPfbajS3H/
http://www.sdyuezhi.com/wp-includes/G9inVLtH3LkkxnGK2MB48Yeyrzezpqy0mEMybdXzK7eSpiZFU0fEB9mMFDqg6yt/
http://www.shamushamu.com/opencv-for/dPRJJ0Nm19ts70LaapmbHtkRV6e2LRx3O4vDI/
http://www.statnews24.com/sitetarget/parts_service/sdrYcCgadlI/
http://www.straweytech.site/wp-admin/eTrac/nlGjAITNPru/
http://www.szzlwx.cn/wp-admin/OCT/Me0Ji0IzVju/
http://www.tgcartravels.in/wp/Document/fCYPeOg73CtMXMigq/
http://www.thespecterofcommunism.com/wp-content/uploads/UYPw0YmRAqJUbBLKxtrX23CB/
http://www.torrylee.com/wp-content/JYLI7NF7FKI/r8bKBe8hL9rG1/
http://www.yanlipin.net/bypass-shell/parts_service/fy9towk3oi-10974/
http://xgeneroyale.com.my/wp-includes/docs/T409zzmOlKAKS1OobQqu/
http://xili9999.com/wp-includes/invoice/CZSlg/
http://xuezha.net/wp-admin/hKhcHyZdyNZPEBzCre0Lq3L2ddjizWK4f7/
http://ysassilawfirm.com/wp-includes/7WLYPBPasSXXyeJdSAHGjyAwL4HOOwWYJuD/
http://yun.vishou.net/vendor/DGU2N669TL0/jO2Fb9SIVaq4m6Zy/
http://zaps.co.in/who-will/4zwiuo76pt-419040/
http://zaym-na-kartu24.ru/sys-cache/iCyM7cvAFC0GwjEXcaRlNJZcZu2cBEYUK9NyPzYrPND3Wu8ohrBbhvwe3LMMw2kkP/
https://4myhealth.in/wp-includes/O/
https://4pmedia.vn/wp-admin/Nu15Y5gg1EGz3a22wr1BwRjl30ofIGpNP/
https://7sweets.site/wp-admin/INC/FQ1E6Pb2mX6lRNXT/
https://8medya.org/wp-includes/ilXAABiYd4F6HjPIimFPeA6mkkUPSQkvYJ0XQ5CVfs5VLmA/
https://955dy.tk/wordpress/m2Q3VgjLfgG4mN2RW/
https://alice-techs.com/free-crochet/nlIJtQI/
https://amorepooh.com/wp-content/attachments/attachments/402224444/CWIjbAG/
https://arounya.com/wp-content/uploads/Pages/2kbXhILWXSNWtXym/
https://artemed.cl/wp-content/attachments/tRVYk8RAAV5OLun/
https://avicennaroyale.com/wp-includes/z9ZlcYuwjERLQTb50MzO/
https://baogia.xyz/wp-admin/toasCW2qryHoAiiQW18g4lhd6YjgiQbAQSzN5AflLa9bbP8oKaf0paLTJml3W/
https://bbclube.com/cine/gCRtQAFxeV0d18JdMURGkDCZrn6ZfGQ84fn2qSrXGfW/
https://behtarinbime.com/cgi-bin/e8tmBlPrv9/
https://bestseed108.top/wp-admin/Un1LMOkE07COObvzx/
https://betsdotdestek.com/cgi-bin/esp/Wkf9naDJCL20o19te/
https://betsdothizligiris.com/cgi-bin/p8mjDNVlargHA2/
https://beyondbackpackspro.com/wp-includes/Documentation/ltsNFNmTeNu0/
https://bieldruk.pl/wp-admin/paclm/iCwuJIoIoMuW/
https://big5engineering.com/wp-admin/nuAin4rYJcYpC7XICe6tyORmvQKh2k4QWNyybX3wnartHLr69r03o5fnQp6kZE5/
https://bingoo-is.com/what-is/UCJQZ6P2D7GS5XG/sykcEX9uSL7Pisd/
https://bingopetshop.ir/wp-includes/ICOH71OYS3/PLVPwd61sfZLomC/
https://bioneex.com/ci-scripts/lm/cblQhueOFvprs/
https://blackdirectory.co.uk/old/BjBSVES9sXzPpHPingZneIpupjyeiRShSe11BjrZJ/
https://blog.banglaponjika.com/wp-admin/Documentation/WW7G0JMgg8Qg/
https://blog.spokanehyundai.net/wp-content/0t7JjlxFil8EuePqOifDbm62d7vse9zfan17brT9ZkZN/
https://blog.thelmh.top/wp-admin/UcVB8fAASifADkW59U53hTzu1layxcw0wtxra3zTU/
https://bopetsupplies.com/tui/Pages/4ykei0BaC6H88NRFrZV/
https://braincloud.com.co/cgi-bin/FILE/8m5wkNnnqh/
https://brobogo.in/wp-content/pmT6uNpKsEovWu5LhTZLwtCut7HQWwZbRl26OcLSNHy9l9RuXycwnzfBx2nDMZ9FR/
https://cab-vietnam.org/damand/oPqimL96/
https://cal-br.develoop.net/wp-admin/E5uyd3benqwWVnZgrCR/
https://cassandrelp.com/wp-admin/Pp996ivDJFq18gOZvk/
https://cleancutmeat.pk/gravely-promotions/file/8xdeccz-55754/
https://clone.affordable.cm/wp-admin/t2sH7Zw2E88mVQ/
https://cmnivaria.com/wp-content/QY4hIpT7uw4RHC8QOGW89bfZv7UNWEP0DLUF3LJGfspX7/
https://cnctbai.com/wp-admin/Scan/59354070035098453/ragCAp/
https://code.vishou.net/framework/parts_service/87673/PoBQRUs/
https://coffeeshopmarketing.org/wp-content/LM0lvDYmnsrsDN0CmTuMmTpkQgrsbflu9CmjA2QBdN3/
https://comercialadvance.com/indexing/TQzaM6jiBlT/
https://communityofexecutors.com/wp-content/8jZxjnEQeZYDncDzglUcMXuNkHofoWQgjlGhvix6aVZ1vHpoS4MP4JeFsci6bW1J/
https://consignspacesolutions.com/wp-content/uuyyxHmA5E34PXDJHbwB5yVSkkLWOiv4YR5Nba/
https://coolaspa.co.il/wp-admin/GmMdt14w/
https://creauture.com/Update/UWsIqaqeD4edlqt1k9lVyP3ND/
https://cruxlytics.com/wp-content/5n9za1NFbOVbZsn6ES8TuZ3SpifTeysWXMPXN0ObY1/
https://curling.ee/wp-content/DOC/z8zXDOG36m/
https://ddazzlediamonds.com/advertisel/eTrac/VW/
https://decohavin.com/Plugins/oWM4D/
https://demodooplay.ml/wp-content/hj1/
https://diezon.ir/wp-content/CNy2tEEA15QrlFxOZQJwZ2BHiNHcRjZtpBd9uks4GR4SsBcvFpy55XIGS9BlN/
https://digitalwebcreations.com/wp-admin/E2mZTeupgm7SNLhEFHhUYIQpMPgQc/
https://digitleyhosting.com/wp-admin/FILE/Zkoh7TdwolFM7bCmYjt/
https://dmccainlaw.com/wp-content/KCMU/
https://duosite.com.br/atendimento/854739360/waLO/
https://edm.nickunj.com/tweetstatus/docs/5cEotrD9rH/
https://elecsun.vn/wp-content/KU26E9lWuySjN7a9U8W20Afbxy1n11uL5DBHMp6i2VxN4FdF/
https://emrahduman.com/wp-content/9OIZbUCPmuenSwaHHTgV/
https://eobraia.com.br/wp-includes/rWTf5GRitOvxGT9vJOjEOp5zQKQAbLwq2MNJHzLtLG47JPAdQjj02BjIp7DL/
https://eribeauty.com/wp-content/lKbydb96mMQkxpdDYoHNmjbbgxjt6B08v3YFaAKceq/
https://ermexico.mx/wp-content/uploads/OCT/nU2xK5ujW718CJ/
https://estatearena.com.pk/wp-admin/py3KK6IKOU/
https://etcert.com/wp-content/72K9JpF4OhxzhJwS1xE2LUulFYNO8ISFUjYYCbz1/
https://exsportise.eu/wp-includes/sites/W94dBYVUFqT3FQ6exsd/
https://farsanshop.com/wp-admin/jru1-0006795/
https://finkarma.in/wp-admin/parts_service/VAdFw9JJj4DcC85StkyL/
https://football-eg.com/web_map/6QB8ynZK7WDWz4HAlYD6ru562GlRT75GIyRwXrK45eIC9PXasecnn1guOnsjkW3/
https://gazeindia.com/wp-content/MZabT8o0RMMBZhe8JNCQ0zhh5iMRXN3SD0Q/
https://ghoom360.in/supreme19/eTrac/AmHvYb8oI2sfJ3RRk/
https://glcglobalmd.com/F0xAutoConfig/XWxF1QBk34I2LQDKP7gbxdof4nPjk03U1z/
https://goopaw.com/feature3/Documentation/OyjcSPTBzlHnmTL/
https://habiganjjournal.com/wp-content/browse/PMVnhdMVxVcyuw/
https://handle.com.co/content/bxkcbypxj-001756/
https://hankook-hi.co.kr/discord-emoji/HG/
https://herzkadeh.ir/old/hKhl/
https://hikichi.vn/wp-content/2208390884972/R1URbLRP8qimUlP6Cz63/
https://hkq.cfc.myftpupload.com/macos-catalina/YdZZOLzbAuB5lYEyqnDcbxgUqAI/
https://homedesignbase.com.sg/wp-admin/ZIolqjJzhKgExrQegqryqRUFjyWVpKw3AZZKxiEud5CP/
https://howzatmedia.co.za/piwigo/afCmdJcM6L7yBIZ7oKEK3g4Dw/
https://hurtokien.pl/customer/FILE/78qrpO5YSSC/
https://hypedigital.se/sitepage/public/a1wtWNI8YgWwQ/
https://iasdcentralbucaramanga.com/wp-includes/Bt9vL1jT8gwKYRCfxcXtUR1AvCKA98qreu1PvDX24wxdbzbFZsyFvs9g7LDU6h/
https://ice.icu/wp-content/OTPE7wJ9S3EohEgMGNDcjAIZeZp7v8xpdNOQbs24O8eVNdpS4ENeCWmliOfXmnjie/
https://imenisazan.com/wp-includes/nVBDVLA5cY0pnwG9TOWIprMga2SgQ0iUkwFMlOAOkKUSsRmzd31bCRnc4LnZaHaen5aO1/
https://imprima.pl/wp-includes/form/lAgM/
https://innhanmachcm.com/wp-admin/Pages/650fcVY8QUv3mpvTm4by/
https://innoventures.center/wp-content/demosT7HjyWHLGnWvunbc874Is2jtBbrb0VkbGvQm01S4BES2yG/
https://ipmes.ma/wp-content/uploads/2017/12/esp/2J84QeAWg9LISyyyl/
https://iqauthority.com/wp-admin/URlFhEV22q3vHmMo20dWRILMF6Lo/
https://iqcontapro.cl/wp-admin/Reporting/7ohHMXMsWP/
https://jalilco.com/wp-admin/sites/xQ3bBQN1VozBHYo8Q/
https://jiyuviyuitservices.com/cgi-bin/tKQr8mdljTPlGovGZmznRgj0yBtadA3JnLtYMrChiasRdvNNZo/
https://jobkings.net/wp-admin/XtoDbdvAVJnUFcSLGScFpQPNbYSKOaej3325nxxK90sKSp33rFDJE/
https://jwskincare.vn/shoprite-from/lau9ceDxBnczg9g6uwQxlVn5AwZunPgRYBgicxEWt3B2/
https://kanpouyaku.jp/wp-admin/jopz5ewc54s-000881/
https://kapral.pl/customerl/FILE/OE3ObBxWq4v3u2XY/
https://keyvalue.in/demosite2/unhF26bONGhtoQkhAWyyOijzxT9SYUSJitCBnubbo44owNFEAH9D5/
https://khojinfo.com/wp-admin/FILE/tpdxUy34wVq
https://khojinfo.com/wp-admin/FILE/tpdxUy34wVq/
https://kichai.xyz/wp-admin/3eJkZcUr/
https://lp4d.org/wp-admin/x//
https://luoilucsi.com/manufacturerl/ZzkgVq6d9VUrMqz/
https://macnort.com.br/wp-content/lm/WkGW2yirHq6axyE/
https://manikmeyah.com/wp-content/l5qerg-00045/
https://marinasboutique.in/cgi-bin/Scan/xOz5x4OrMIHw/
https://masterise.homes/wp-admin/ISTMsHzvtbZ/
https://measuresquare.com/sitepage/Scan/8rfacIDzvJ5yu/
https://meeracleinspired.com/cgi-bin/yxuNOX8OZsEVbZuUkyyyJcjMYMa5gaWXEdE27g2LeZ8eQbMNn35jJPZ9/
https://megacompras.co/cgi-bin/paclm/qmHWYl8EwL3a/
https://midnight-angel.net/haisetu-pheromone.net/Bah8SZ4OcMzGeYq7/
https://mingguanwms.com/wp-content/xrw19lvch/
https://mites.org.in/customerl/sites/oLxQs3lvaLdvv00/
https://mobi-game.vn/wp-content/themes/Newspaper/QGNlYcrsToprAGxUcHh4Wdvn/
https://myentrepot.com/wp-content/uploads/paclm/WuDmncTHixQR0qgf/
https://mzurimamas.com/wp-admin/OCT/oPmNn7PNIiDqcE/
https://nanogeek.co/wp-content/3ezrNk5Yss0WD8JwtK3Bq92xT8o3fTHOr3olUVzvyUkh6ma804woIpc2cLdo7xinWuQF/
https://naturalwaterresources.com/wp-content/BaHtb/
https://nhatcuong.xyz/cummins-onan/Overview/uGGlbH6kfK3CI7YsR/
https://nrduniversity.com/wp-content/Overview/cU4yZ9IVOu/
https://nutricaorenal.com.br/wp-admin/Reporting/CCNHKvQAzcL99b8TN/
https://okankoleji.com/wp-content/uploads/2020/form/JLau/
https://panda-style.co.il/cgi-bin/lm/hClBSftXPEG8XdZcm/
https://pedichiuramedicalaploiesti.ro/wp-includes/LLC/PewyTVsc/
https://phucdu.cf/wp-admin/lm/8502642363490852/NnhDfdW/
https://physio-svdh.ch/sitepage/WZFnNcEmhVoqIDqzHNZkj82qdHK3JyqJ39X1djl9PwRAKGmuEL0XTr/
https://pikama.us/wp-includes/public/1686626367314129/HuV/
https://pneu-belgique.be/wp-admin/dWkvP88Pcxo68LlB0NI7nbEjnuZrCNvfA0X/
https://pontodopodologobh.com.br/wp-includes/sites/00N6NdIPBgiCwuJI/
https://pratuksha.org/wp-content/attachments/attachments/lPtCg/
https://qisatkifah.online/blog.cluphost.com/DeyDEN1NoDfqeX4lAuLJpAEYqtddd4lEuB447OX902xxQGbhL/
https://racer3d.com/wp-admin/sites/LvT1JkSzhAC0ZZ/
https://register-fca-orguk-shpo-firm-details-page-001f00n1lsuee.org/cgi-bin/wo0b70hPBrjyYGnQOd66cHGUxYZng2mkUQZB7rh/
https://rmcomputerforensics.com/tltalks.com/paclm/aqxOBEpOAWYDUR/
https://rotarybp.com/wp-content/plugins/DOC/6ycLbHOst9/
https://schoolino.ir/wp-content/qRq5ySFr81yBK8XXtRgvGl7PR6lVdbwYHcIfJD/
https://selerakampung.com/wp-admin/Overview/0XQWarZrDxk69M/
https://sheeper.in/handbook/TSeIvy62rRoJILZtsFuVnXyw92EhjPLh8kaf8mkYQSwJ/
https://shijian36999.xyz/wp-admin/eIZqzSfoXdlpEDZuLypvqetUgA5FyzJ4LLA2J68yU/
https://shopx.ai/blog/wp-content/uploads/2020/Pages/8445451/cKA/
https://shuziyinpin.com/wp-admin/Hjiffpq0Ncho4uKiwxwcXj2uHcCUQS5G9sUcOV4oQuV9BN0TT8WeyWmWzb/
https://shuziyinpin.com/wp-admin/Uj3vlpDQZlTZsEH4VlxVGFFy2cWG9QPAkeqL0cBpiq6KNqWJb2ooQyPljekI9/
https://skyboard.rs/wp-content/OptpCeO1FDOS54V3y60MdX9Qujq88r/
https://skyfleettravels.com/cgi-bin/eTrac/n42cQQQo6rWtcU/
https://southsudanconsulate.org/wp-includes/images/public/SkZKkjMRzy6ndwp/
https://squire.host/termo/attachments/WRyMb4GHbZjKP0Bm4W/
https://streets.vip/wp-admin/53357752528/YRAzxNn2g6t39/
https://superiormotors.com.np/common-stock/swift/655636828/07yrt-00992/
https://support.affordableblinds.com/wp-admin/VKzdk/
https://talkbook.live/wp-admin/Reporting/XBtY36sybxhwTah5yvEx/
https://tamanlac.vn/wp-content/O05ium6kCRB7ffUnizlkP4Rmt9iLVr32Y0WKQ077YY/
https://tekkys.repair/wp-content/1Z1qlkBSPpk8vQujwhOLyVitVQU01sdD6n65oFH3EHZiQVaocypP9O4LwDTTUzZ/
https://tesson.in/tesson/Pages/OiqPrYbxxPz/
https://thangmaytrucvit.com/wp-includes/eTrac/zpYK/
https://thecollectorsroom.com/wp-admin/LIDLSobNSpOC4dhZWXVHxd3Df9urY878KPRfM8TsvivemBS9URm4O/
https://thepetfoodhub.com/wp-includes/paclm/NqYCmzRiJr/
https://thepetfoodhub.com/wp-includes/rM4cdOlONOv9O08Dtx17ZTHKrA6/
https://thesafezone.co.in/wp-admin/ILEB2awExpTtDzJ/
https://thoitrangtrungnienkim.vn/wp-content/avIF9xlwXXrf4N2C9YP08hRrOuhMrh4yelwRsK1O3Ez04v5sCyEA7chYDFoF9od/
https://tigerstormtraffic.com/wp-includes/7qbIJJ8/
https://tonekashop.com/test/wp-content/plugins/kliken-marketing-for-google/htdK3E9JoFEgV3sf0p6hdsX1h/
https://tradewithjazz.com/cgi-bin/FILE/FHRKUuCjqI/
https://trendplusbookkeeping.com/wordpress/attachments/ojr5cbw5reswka13nnxu/
https://usasnet.com/forgottenl/xN0QHYGauTY4FHhB6QcWzb2uniqCm4ss89uDitL1WW/
https://vaphelp.com/wp-content/j9UdwI13DMuvfcJWp/
https://veenanews24.com/cgi-bin/DOC/vRzXnhd81qM8jFA/
https://vidyasadan.com/wp-admin/Documentation/pfxak87wxff-00991/
https://vschoensecrets.com/wp-admin/3233XAL/VMB96P/8336034874663356/soqvjfsk-00238/
https://wellnursesmartnurse.co.za/wp-admin/ppWm6X9zFFx4PTATZPz43fL3QQz11vlISv/
https://widewebit.com/wp-admin/parts_service/BwOh7PJIsSbf4Jjr/
https://workabilityasia.com/wp-includes/mv2picUIQeV/
https://worldeyecouncil.com/wp-includes/GtWJIaw0AbY7DptuzYBgwovrVJYGPU1rzLXu2igvaq9kFKJSvTAAWDDXCT/
https://wp-test.greenergizer.a2hosted.com/cgi-bin/AdGHCGUS1O73LeAL0FmMIuN8riqj4VkTx2B6OChShH8x1Z40JGzSq0nMGnYSgv/
https://www.30qb.com/fridge-thermostat/0677370021736/4vaSeop7XV3bl/
https://www.algorahotel.com/checkemail/52QGFWYHOAYGT/4MNXsfwmvqsNYphKukie/
https://www.bankofneopia.com/wp-admin/network/eO3k0j1cvX/5qbz5vO3T6teRgP7pGUHUzp0YAEvJzUZ2f7QD61cnbT5Yqf4bgskRwawxj/
https://www.bankofneopia.com/wp-admin/network/eO3k0j1cvX/noGuMG6JpMz3R9JKYl0BAscgdUqb0XYrSqYahii05u10mmLnJf3cmfyIe5wpAhaVOi36y/
https://www.beyondbackpackspro.com/wp-includes/Documentation/ltsNFNmTeNu0/
https://www.blackdirectory.co.uk/old/BjBSVES9sXzPpHPingZneIpupjyeiRShSe11BjrZJ/
https://www.bmpi.fr/cgi-bin/yCUW7fupFIpXwYjgP/
https://www.chemicalbusiness.com.br/wp-admin/sites/WJAKzmqhFV7fRahBTc/
https://www.criee-des-saveurs.com/wp-admin/public/STMm3p0jJDUqkWV/
https://www.d1zi.com/wp-content/ai1wm-backups/11KhYzHOPks3RkHqu/
https://www.delsano.in/wp-content/INC/2xpMCnpMtNb9NZXL/
https://www.digieasylearn.com/wp-content/Y9JAF1g2PZX5Bbd/
https://www.ebrulilife.com/wp-includes/attachments/AqDp4Xf0Cgi6/
https://www.eflowersncakes.com/wp-includes/Pages/AtkpIu7fLPl/
https://www.etcert.com/wp-content/72K9JpF4OhxzhJwS1xE2LUulFYNO8ISFUjYYCbz1/
https://www.falconcastings.com/wp-content/N0VFh4sXUdY5E9VP7/
https://www.grenflor.com/wp-admin/attachments/0010230312818998/RbwK0gr17a66iqWyff2h/
https://www.inelite.com/sitepage/gFFECjxUFwW1F0PacQOxMKvf/
https://www.jalilco.com/wp-admin/sites/xQ3bBQN1VozBHYo8Q/
https://www.jetpls.com/wp-content/Scan/NT2UewtxlJt1GCB3PoV/
https://www.josephsantucci.com/SantucciFamily/96818188755415/PrDhHsznbF/
https://www.lyricspanti.com/bzbhf/OCT/TNmjjWUcS1F3nfCNsaC/
https://www.madivarealty.com/wp-includes/aKGdOG0oymAQttjNo/
https://www.mamac.top/wp-admin/xYk5DvCs9yqpNHMZj/
https://www.mantenanews.com/wp-content/q6k8knHHyhc3LEKWvcKIDExHop/
https://www.merzougamoroccotours.com/wp-includes/INC/mLeMHzuBWEUq6C/
https://www.mondkalender.shop/wordpress/JhnpnmOYMaCI2vs9fozx3tXPR9kr8mxWxa9IHnEmHgK6/
https://www.nelsonsbutchers.co.uk/cgi-bin/4vlAF1VqRwYfgWGXP33pcD1UydaUIb40DlLQUEFUrt5547d0XSMo/
https://www.panda-style.co.il/cgi-bin/lm/hClBSftXPEG8XdZcm/
https://www.portalecosolar.com.br/backup/224467282086/FCxsr9H3wkcohMo/
https://www.qualitymathtutors.com/wp-content/xu/
https://www.rantega.com/wp-includes/public/yipMhIIK0CJSqJW2LA/
https://www.sdyuezhi.com/wp-includes/G9inVLtH3LkkxnGK2MB48Yeyrzezpqy0mEMybdXzK7eSpiZFU0fEB9mMFDqg6yt/
https://www.ssmall.it/wp-includes/report/ubq9d-000007/
https://www.statnews24.com/sitetarget/parts_service/sdrYcCgadlI/
https://www.straweytech.site/wp-admin/eTrac/nlGjAITNPru/
https://www.tgcartravels.in/wp/Document/fCYPeOg73CtMXMigq/
https://www.theginlibrary.de/wp-includes/BiZKqE0TLkhfzqIl1ePo3p0nvftBfY2qtROUa4MQuetd/
https://www.thespecterofcommunism.com/wp-content/uploads/UYPw0YmRAqJUbBLKxtrX23CB/
https://www.torrylee.com/wp-content/JYLI7NF7FKI/r8bKBe8hL9rG1/
https://www.toziba.ir/wp-admin/rAwqTXGMrWwaX3AOGSmoycMRHUkI3eR26Vu2a/
https://www.uniescte.org/wp-admin/sites/23938722259/cpD/
https://www.visualdive.com/wp-content/K8kibHjxoC03AkQD0hAmpduBW8Dg8zGIuO3pcQu6LBns5B5YrS4kY/
https://www.yiminyi.cn/wp-admin/attachments/6JX3ZDuUjE/
https://www.yoyoo.pub/shop/Scan/4fhF3uxtV6ohiqpKJ/
https://wxapp.vishou.net/css/ktiXjzIfy6TYuUa8LfA1rlXfXRmR8s93vYhnd2HkIgtEbnyZV79QrkUax/
https://xili9999.com/wp-includes/invoice/CZSlg/
https://yourselectmall.com/wp-content/0oPBXXfuZmmWSdilBOnG/
https://yoyoo.pub/shop/Scan/4fhF3uxtV6ohiqpKJ/
https://zaps.co.in/who-will/4zwiuo76pt-419040/

1008691.com
2market.com.au
30qb.com
4myhealth.in
4pmedia.vn
7sweets.site
8medya.org
955dy.tk
a2hosted.com
acezsensing.com
adamselectrics.com
affordable.cm
affordableblinds.com
aguemiimoveis.com
algorahotel.com
alice-techs.com
almalim.com
almirnapoleao.com
amikene.com
amorepooh.com
animalvetnerd.com
aramcotools.ae
arounya.com
artemed.cl
artemisaritim.com
articwood.com
avicennaroyale.com
baedekker.com
bambam.me
banglaponjika.com
bankofneopia.com
baogia.xyz
bbclube.com
behtarinbime.com
bestcableninternet.com
bestcom.com.tw
bestseed108.top
betacenter.ir
betsdotdestek.com
betsdothizligiris.com
betterzhao.xyz
beyondbackpackspro.com
bharatpoudel.com.np
bieldruk.pl
big5engineering.com
bilwee.com.ar
bingoo-is.com
bingopetshop.ir
bioneex.com
blackdirectory.co.uk
blackstonetutors-onlineportal.com
bmpi.fr
bnnjhbhhuj.com
bopetsupplies.com
braincloud.com.co
brasilcacambas.com.br
brobogo.in
buyfreshperu.com
cab-vietnam.org
cassandrelp.com
chemicalbusiness.com.br
cleancutmeat.pk
cmnivaria.com
cnctbai.com
coffeeshopmarketing.org
comercialadvance.com
communityofexecutors.com
consignspacesolutions.com
coolaspa.co.il
cozmicjet.info
creauture.com
criee-des-saveurs.com
cruxlytics.com
curling.ee
d1zi.com
davaorealproperty.com
ddazzlediamonds.com
decohavin.com
delsano.in
demodooplay.ml
develoop.net
diezon.ir
digieasylearn.com
digitalwebcreations.com
digitleyhosting.com
dmccainlaw.com
doae.go.th
duosite.com.br
dywarning.com
ebrulilife.com
ed-pepper.eu
eflowersncakes.com
elecsun.vn
emrahduman.com
englishmatters.hk
eobraia.com.br
eribeauty.com
ermexico.mx
esfagrup.com
essic.online
estatearena.com.pk
etcert.com
excitersports.com
expeditionquest.com
exsportise.eu
ezi-pos.com
ezwebtest.com
falconcastings.com
farsanshop.com
finkarma.in
football-eg.com
gazeindia.com
ghoom360.in
glcglobalmd.com
goopaw.com
grenflor.com
habiganjjournal.com
handle.com.co
hankook-hi.co.kr
hankook-hi.com
herzkadeh.ir
hikichi.vn
homedesignbase.com.sg
honey-holiday.ru
hotelnewanand.com
howzatmedia.co.za
htcformosa.gob.ar
hurtokien.pl
hypedigital.se
iasdcentralbucaramanga.com
ice.icu
ictmisericordia.org
ideasoft.com.co
imenisazan.com
imprima.pl
inelite.com
infotech.kr
inmobiliariaconfiaviv.com
innhanmachcm.com
innhanmachn.com
innoventures.center
inventorelectronica.com
ipmes.ma
iqauthority.com
iqcontapro.cl
jalilco.com
jetpls.com
jiyuviyuitservices.com
jobkings.net
josephsantucci.com
jwskincare.vn
kadmar.com
kanpouyaku.jp
kapral.pl
kasshmira.com
kenh18.vn
keyhole.agency
keyvalue.in
khojinfo.com
kichai.xyz
kofamonline.com
koswip.org.my
letscompareonline.com
lexune.com
logicarts.in
lp4d.org
luoilucsi.com
lyricspanti.com
macnort.com.br
madivarealty.com
mahanext.ir
mamac.top
manikmeyah.com
mantenanews.com
marinasboutique.in
masterise.homes
measuresquare.com
meeracleinspired.com
megacompras.co
meges-service.de
merzougamoroccotours.com
midnight-angel.net
mingguanwms.com
mites.org.in
mizoramstateslottery.com
mobi-game.vn
mondkalender.shop
movie-2free.com
mshopp.ir
murugantemple-zh.ch
myentrepot.com
myftpupload.com
mzurimamas.com
nanogeek.co
naturalwaterresources.com
nb-sangbad.com
ncxps.com
nelsonsbutchers.co.uk
nepalelectrical.com
nhatcuong.xyz
nickunj.com
nobyann.com.au
novaes.com.br
nrduniversity.com
nutricaorenal.com.br
office187.com
okankoleji.com
onep.go.th
ostranderandassociates.com
panda-style.co.il
pbinclv.com
pedichiuramedicalaploiesti.ro
phucdu.cf
physio-svdh.ch
pikama.us
pineislandok.com
pneu-belgique.be
pontodopodologobh.com.br
portalecosolar.com.br
pratuksha.org
protea2.com
qisatkifah.online
qualitymathtutors.com
rabaco.vn
racer3d.com
rantega.com
recpecasalemao.com
register-fca-orguk-shpo-firm-details-page-001f00n1lsuee.org
riun.org
rmcomputerforensics.com
rotarybp.com
santucciarq.com.br
saracyp.com
schoolino.ir
sdyuezhi.com
selerakampung.com
shamushamu.com
sheeper.in
shijian36999.xyz
shivanienterprise.in
shopx.ai
shuziyinpin.com
signetenglish.com
sistaqui.com
skrap.xyz
skyboard.rs
skyfleettravels.com
soundline.com.cn
southsudanconsulate.org
spokanehyundai.net
squire.host
ssmall.it
statnews24.com
stepstoshops.com
straweytech.site
streets.vip
suksiriestate.com
superiormotors.com.np
swbmw.net
szzlwx.cn
talkbook.live
tamanlac.vn
tekkys.repair
tesson.in
tgcartravels.in
thangmaytrucvit.com
thecollectorsroom.com
theginlibrary.de
theiagemsandjewelry.com
thelmh.top
thepetfoodhub.com
thesafezone.co.in
thespecterofcommunism.com
thoitrangtrungnienkim.vn
tigerstormtraffic.com
tinhxangocxuan.com
tonekashop.com
torrylee.com
toziba.ir
tradewithjazz.com
trendplusbookkeeping.com
tutorataplus.com
umb.ac.id
uniescte.org
uniteddatabase.net
usasnet.com
vaphelp.com
veenanews24.com
vidyasadan.com
vishou.net
visualdive.com
vschoensecrets.com
wellnursesmartnurse.co.za
widewebit.com
workabilityasia.com
worldeyecouncil.com
xgeneroyale.com.my
xili9999.com
xuezha.net
yanlipin.net
yasmakhotels.com
yiminyi.cn
yourselectmall.com
yoyoo.pub
ysassilawfirm.com
zaps.co.in
zaym-na-kartu24.ru

WORD DOCUMENT FILE HASHES
07e87d116c3953624a8fbee1631e22bf
1540b4ecfdf6fc4f5f0cb9a7b9499cd0
2c6bb23331961a42da7355e1f8408be2
4348cc1f578e465d184b2682964883f2
83243e400dec71e3dc38869a4dd0af5e
d6f04b6f32a769df76fd68c87a219919

PAYLOAD FILE HASHES
242bb60474ae480846028b0e18cfa4ca
36eab70b2ba0cba48c8a8937d28c8191
5f8dfc00e7968b252c9f3356f0770926
73ae7daf56ab7cf14f4deb024bd73a36
8db8f511ee1ec01a81c5f9739792783a
93729d8af4527aa5bcf42b4bf88c19ee
a3dfdef0d948923aa76bf6086ef35ac2
b0802cb9fa329888b82180b082310c26
ce0a7fe029773668dce803c554f0fdb0

EMOTET PAYLOAD URLs
http://0377hhd.com/cgi-bin/ru/
http://420extracts.ca/cgi-bin/Ecv/
http://99fabrics.com/wp-content/dGq/
http://airrlist.com/wp-includes/VBG/
http://attenstyle.com/wp-admin/pB/
http://blog.martyrolnick.com/wp-admin/Spq/
http://getpranaveda.xyz/wp-admin/yz/
http://ienglishabc.com/cow/2BB/
http://jobmuslim.com/wp-admin/js/widgets/HrWFGwvcF/
http://mauriciosinjuicio.com/zoom-meeting/r/
http://onlineqeramika.com/wp-admin/Jmm/
http://paridhiyadav.com/wp-content/hc/
http://shomalhouse.com/wp-includes/ID3/IDz/
http://tinytowntees.com/wp-content/TV/
http://tuankhoi.com/wp-content/CI2oG/
http://ursuperstar.com/wp-admin/AAxKlbV/
http://weparditestaa.fi/wp-admin/72uPk/
http://www.easeiseasy.com/wp-admin/q/
http://www.easytigershop.com/wp-includes/css/GxWFH/M/
http://www.msmconsultoria.net/assinaturas/aBb/
https://420extracts.ca/cgi-bin/Ecv/
https://99fabrics.com/wp-content/dGq/
https://airrlist.com/wp-includes/VBG/
https://aischoolofindia.com/wp-content/KFn/
https://bathroomnerds.com/wp-content/e/
https://bindhyabasinitemple.com/wp-includes/f8U8g/
https://blog.opospalia.eu/wp-admin/k/
https://blog.smyrnaweb.com/cgi-bin/Kzd0vdC/
https://blog.techforing.com/wp-includes/3XgEg7/
https://casinopalacett.com/wp-admin/voZDArg/
https://codavatar.com/wp-content/MiU/
https://conclassdigital.com/wp-content/thTgRn/
https://demowebsite6.club/wp-admin/wKm1/
https://dishtvweb.com/cgi-bin/xnAWwP/
https://eclatcollection.com/kohler-14resa/YpUuby/
https://enjoymylifecheryl.com/wp-includes/FPNxoUiCz3/
https://evexiahk.com/wp-content/u2x/
https://exploreneuro.com/ps4-controller/w/
https://hijoaajakakhabar.com/cgi-bin/cHoz/
https://homewatchamelia.com/wp-admin/qmK/
https://imperfectdream.com/wp-content/xb2csjPW6/
https://innhanmachn.com/wp-admin/sA/
https://iq51.com/wp-admin/tBO/
https://ismlm.xyz/wp-admin/P/
https://itgallery.com.bd/backup/7/
https://jobmuslim.com/wp-admin/js/widgets/HrWFGwvcF/
https://jtech.com.vn/wp-includes/IhSNuI/
https://kartsms.com/wp/s/
https://lylydressforless.com/wp-admin/ffV/
https://magicwandcompany.net/wp-includes/bRVTJyc/
https://makkinouz-groupe.com/wp-includes/q/
https://mauriciosinjuicio.com/zoom-meeting/r/
https://mayxaycafe.net/wp-includes/UxdWFzYQj/
https://medhempfarm.com/wp-admin/Lb/
https://mhkhardware.com/cgi-bin/Mrn/
https://mobis-autoloan.com/wp-content/YvqoBse/.//
https://mrveggy.com/erros/4/
https://natfast.com/wp-content/geeVh/
https://ostemeda.lt/wp-content/S/
https://paisocial.org/wp-includes/X9D/
https://pesquisacred.com/vmware-unlocker/daC/
https://primecigarettes.com/wp-content/7/
https://radiolevi.ro/wp-content/vDbB/
https://seramporemunicipality.org/replacement-vin/Ql4R/
https://socalvending.com/wp-content/8z/
https://speedypush.com/wp-includes/6/
https://tasagodigital.com/sitepage/iEK/
https://techzslack.com/wp-includes/gSXf/
https://visionmedia.vn/wp-includes/bjkuZ9LtT/
https://vitrinapyme.com/wp-content/Jw/
https://www.corsiwebonline.it/wp-content/yQqe7/
https://www.easytigershop.com/wp-includes/css/GxWFH/M/
https://www.frajamomadrid.com/wp-content/g/
https://www.microsystem.fr/newsletters/uITRJ/
https://www.ningyangseo.com/wp-admin/8l/
https://www.ppinds.in/fonts/NnaS2zf/
https://www.saladrepublic.in/cgi-bin/WmRD/
https://www.trassierramotor.com/photo-gender/oz2/
https://www.yadanaraung.com/wp-content/zWNM/

0377hhd.com
420extracts.ca
99fabrics.com
airrlist.com
aischoolofindia.com
attenstyle.com
bathroomnerds.com
bindhyabasinitemple.com
casinopalacett.com
codavatar.com
conclassdigital.com
corsiwebonline.it
demowebsite6.club
dishtvweb.com
easeiseasy.com
easytigershop.com
eclatcollection.com
enjoymylifecheryl.com
evexiahk.com
exploreneuro.com
frajamomadrid.com
getpranaveda.xyz
hijoaajakakhabar.com
homewatchamelia.com
ienglishabc.com
imperfectdream.com
innhanmachn.com
iq51.com
ismlm.xyz
itgallery.com.bd
jobmuslim.com
jtech.com.vn
kartsms.com
lylydressforless.com
magicwandcompany.net
makkinouz-groupe.com
martyrolnick.com
mauriciosinjuicio.com
mayxaycafe.net
medhempfarm.com
mhkhardware.com
microsystem.fr
mobis-autoloan.com
mrveggy.com
msmconsultoria.net
natfast.com
ningyangseo.com
onlineqeramika.com
opospalia.eu
ostemeda.lt
paisocial.org
paridhiyadav.com
pesquisacred.com
ppinds.in
primecigarettes.com
radiolevi.ro
saladrepublic.in
seramporemunicipality.org
shomalhouse.com
smyrnaweb.com
socalvending.com
speedypush.com
tasagodigital.com
techforing.com
techzslack.com
tinytowntees.com
trassierramotor.com
tuankhoi.com
ursuperstar.com
visionmedia.vn
vitrinapyme.com
weparditestaa.fi
yadanaraung.com

EMOTET C2s
http://102.182.145.130
http://173.173.254.105
http://64.207.182.168:8080
http://51.89.199.141:8080
http://167.114.153.111:8080
http://173.63.222.65
http://218.147.193.146
http://59.125.219.109:443
http://172.104.97.173:8080
http://190.162.215.233
http://68.115.186.26
http://78.188.106.53:443
http://190.240.194.77:443
http://24.133.106.23
http://80.227.52.78
http://79.137.83.50:443
http://120.150.218.241:443
http://62.171.142.179:8080
http://194.4.58.192:7080
http://62.30.7.67:443
http://134.209.144.106:443
http://24.230.141.169
http://194.190.67.75
http://172.91.208.86
http://201.241.127.190
http://185.94.252.104:443
http://104.131.11.150:443
http://71.15.245.148:8080
http://176.111.60.55:8080
http://172.86.188.251:8080
http://194.187.133.160:443
http://113.61.66.94
http://91.211.88.52:7080
http://202.134.4.216:8080
http://154.91.33.137:443
http://74.40.205.197:443
http://87.106.139.101:8080
http://66.76.12.94:8080
http://139.59.60.244:8080
http://112.185.64.233
http://85.105.111.166
http://74.208.45.104:8080
http://94.230.70.6
http://49.3.224.99:8080
http://119.59.116.21:8080
http://182.208.30.18:443
http://184.180.181.202
http://47.36.140.164
http://186.70.56.94:443
http://187.161.206.24
http://102.182.93.220
http://201.171.244.130
http://190.12.119.180:443
http://89.121.205.18
http://110.145.77.103
http://172.105.13.66:443
http://190.29.166.0
http://108.46.29.236
http://49.50.209.131
http://75.143.247.51
http://137.59.187.107:8080
http://188.219.31.12
http://61.33.119.226:443
http://209.141.54.221:7080
http://95.213.236.64:8080
http://120.150.60.189
http://190.164.104.62
http://186.74.215.34
http://139.99.158.11:443
http://76.27.179.47
http://142.112.10.95:20
http://61.19.246.238:443
http://121.7.31.214
http://88.153.35.32
http://5.39.91.110:7080
http://123.142.37.166
http://50.245.107.73:443
http://95.9.5.93
http://37.139.21.175:8080
http://157.245.99.39:8080
http://217.123.207.149
http://72.186.136.247:443
http://115.94.207.99:443
http://202.141.243.254:443
http://78.24.219.147:8080
http://97.82.79.83
http://217.20.166.178:7080
http://203.153.216.189:7080
http://220.245.198.194
http://168.235.67.138:7080
http://110.142.236.207
http://162.241.140.129:8080
http://76.175.162.101
http://27.114.9.93
http://24.178.90.49
http://202.134.4.211:8080
http://123.176.25.234
http://61.76.222.210
http://109.116.245.80
http://139.162.60.124:8080
http://190.108.228.27:443
http://94.23.237.171:443
http://2.58.16.89:8080
http://37.179.204.33
http://96.245.227.43
http://216.139.123.119
http://89.216.122.92
http://37.187.72.193:8080
http://74.214.230.200
http://93.147.212.206
http://103.86.49.11:8080
http://174.106.122.139
http://138.68.87.218:443
http://118.83.154.64:443
http://200.116.145.225:443
http://94.200.114.161
http://62.75.141.82
http://121.124.124.40:7080
http://176.113.52.6:443
http://24.137.76.62
http://41.185.28.84:8080
http://50.91.114.38
http://46.105.131.79:8080
http://109.74.5.95:8080
http://67.170.250.203:443
http://100.37.240.62