2020-08-06 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
accounts@kestral[.]com
admin@factorespectacular[.]com
airportoffice[.]blr@activefreightlogistics[.]com
alessandro[.]mosconi@autolux[.]conc-bmw[.]com
azzurro@lamaoptics[.]it
csd[.]isb@leopardscourier[.]com
erzurum_malmeydani2@emlakyonetim[.]com[.]tr
felipe@dogmarepresentacoes[.]com[.]br
hunghd@huge[.]vn
ishihara@suguru[.]co[.]jp
laundry@omantel[.]net[.]om
maruwa-kouri@yaki-tori[.]co[.]jp
ndd[.]santos@monolithconstruction[.]com[.]ph
Nghild@vanhau[.]com[.]vn
ntsikis@mampudim[.]co[.]za
parts[.]okhla@renault-india[.]com
pcarriel@andinor[.]cl
prawnapa@hirata[.]co[.]th
pto@izhavia[.]aero
r[.]silvestre@conin[.]it
rifatahmed@ifadgroup[.]com
rmugabe@teecherz[.]co[.]zw
sabrina[.]cheong@j5mart[.]com[.]my
sales@rustaronline[.]com
v-yudithw@denave[.]com
vnbdv@vinabridge[.]com[.]vn
w[.]zeidan@elicogroup[.]com
washington[.]matioli@equipar[.]com[.]br
webmail@tuffstuff[.]com[.]au

MALDOC DISTRIBUTION URLS
hxxp://a-r-t[.]co[.]jp/sys-common/statement/
hxxp://abcofcricket[.]com/Aust/xn_fxn6_25403_prS5i/verifiable_space/hYYyIPw4VO_m18Kjeb14Jt/
hxxp://abinsk[.]com/cgi-bin/parts_service/q3u53189486812oufhpyk3d9ey7/
hxxp://abovethemezzanine[.]com/cgi-bin/docs/a5s9j8y4z9/
hxxp://absimpex[.]com/images/INC/
hxxp://absimpex[.]com/images/INC///
hxxp://access-to-web[.]com/photos/I0AQ94BVF63KGM/
hxxp://aceswilddesign[.]com/wp-admin/Reporting/
hxxp://actualdesignbg[.]com/site/payment/z37s29f04032516u5xdxvl4esndnk/
hxxp://acumfaegovan[.]com/blog/9438240572107459/wpohk6/
hxxp://adiplast-bg[.]com/cgi-bin/Documentation/
hxxp://adslinfibra[.]com/cgi-bin/report/
hxxp://agenciaetalk[.]com/campanha/personal_zone/verified_space/5RSWFL_drKLI0fs2an/
hxxp://agentsdirect[.]com/Services/attachments/hqobn8ylwy91/
hxxp://airmaxx[.]rs/nulvt-xbrcbp-yfcpetgo/zs0xo66779679813918577mbpiiwu5b7myu/
hxxp://aleksdesignlab[.]com/wp-content/Documentation/ce2b77j/
hxxp://andysweet[.]com/cgi-bin/0guh4aakhkj8/
hxxp://anfornet[.]com/salas2/DOC/
hxxp://anima-terapie[.]cz/media/sites/
hxxp://annabphotography[.]co[.]uk/wp-includes/Reporting/wsh4qpml1y/
hxxp://antislash[.]fr/lmb/report/
hxxp://anythingghost[.]com/wp-content/plugins/font/sites/s8ouwoc/
hxxp://archabits[.]com/content/public/
hxxp://artabout[.]gr/signature/YKVB6U/gdy71zmca5/h7wxwaa83008691441id8cu3dsqvh4d3o3/
hxxp://asikbelajar[.]com/wp-includes/swift/xawpbmcsjds/
hxxp://aulasdemarketingdigital[.]com[.]br/cgi-bin/PSNWKYVA9IFD/6qdka3ymr4w/38q0kb8480801784000lzrvsgt38rdlile/
hxxp://avanwilligen[.]nl/Reporting/4dd01s1/uausfj87656547733959730h6lscebbm6/
hxxp://b1[.]ee/wp-includes/Scan/fsav748ilyy/
hxxp://bakkeroptimalisatie[.]nl/cgi-bin/attachments/y3uvgo/n91022785733798198127xtvcburkpan/
hxxp://bcf-group[.]com/img/app/css/closed_resource/interior_profile/cYA6nf_cpcMKx40i/
hxxp://bertielpolimentos[.]com[.]br/wp-snapshots/sites/j3kvilpu/
hxxp://bethrow[.]co[.]uk/cgi-bin/invoice/hynv9ec8t2/oir219225593185dheqqjm7b1fz/
hxxp://bike-nomad[.]com/cgi-bin/statement/
hxxp://biobubble[.]com/biobubble/parts_service/
hxxp://biobubble[.]com/biobubble/parts_service//
hxxp://brightsolutions[.]pk/wp-admin/LLC/r98724084927562kw37gozenizo7usst7iu/
hxxp://brizboy[.]com/site/closed-5062759-oBrty78DTTZ/verified-area/yhRwLP0s-KuosHc2onimj1t/
hxxp://cacapavaonline[.]sdserver144[.]com[.]br/cgi-bin/mj0b8n/
hxxp://cad-vision[.]com/protected_disk/additional_forum/1FFXoUN77_lInciyiMkb9j/
hxxp://carvajalyasociados[.]com[.]ar/cgi-bin/lm/
hxxp://ceiaquimahue[.]cl/ocia/sites/
hxxp://chang[.]be/carole/Documentation/42lmq873381809022941d3rul7iwm5v3tx2uj/
hxxp://cicatsw[.]com/Bootstrap/payment/gml24t16hds/
hxxp://clivejackson[.]com/ibs/esp/ggzed2zysb/
hxxp://cmswrexham[.]com/video/invoice/t3b3148447ts5lajt85izib0it54i/
hxxp://compunetplus[.]com/fortyfour7/attachments/
hxxp://convertt[.]co[.]kr/wp-content/payment/
hxxp://craftbrews[.]com[.]au/auction/INC/hra5nwbqaz/hrtpvg512402097717c81lcbgdvbe5sklztn/
hxxp://damix[.]com[.]pl/stronastara/LLC/kg3cy60/fy252397769843883fzla7upcsysh6f5b/
hxxp://dazedthoughts[.]com/9u_2h_xd67ohu/LLC/7rm27v7ewn/
hxxp://dec-u-out[.]com/images/Scan/
hxxp://defiteqturkiye[.]com/admin/statement/
hxxp://designproper[.]com/bl/2OQEN/
hxxp://dixiemotorsllc[.]com/docs/personal_array/security_warehouse/iJIHZ_I4NdjMHba/
hxxp://endlessreminiscences[.]sg/cgi-bin/657742320777241/162ddb7s9u4d/
hxxp://equimination[.]ee/wp-admin/invoice/abi75j3yqxm/8rmu42281152247jy0ayb7kygbzigyw/
hxxp://falmer[.]de/test/d781j97qy/zvg4647066690948auwc73e6h16rtjw7vjb/
hxxp://fpmtmongolia[.]org/cgi-bin/0r0g7yl3103656715480ifx5148etoyx9kk/
hxxp://gamemechanics[.]com/amazonchecker[.]com/public/g3ia2rdbim/v4u410922417684700ryf0hwmc6e4dn/
hxxp://gbbulls[.]co[.]uk/video/eTrac/jkhupy9c3i86/
hxxp://groupchips[.]com/portal/FILE/4szejhwkvqu/
hxxp://grupoarservicos[.]com[.]br/attachments/
hxxp://gzamora[.]es/9s52_ou17husakvth9fs_resource/f17p8y3a79_fy3mdgo7tt_forum/Yow80_feN0MtLvvyuf/
hxxp://hangtheuducthanh[.]com/site/Scan/yxvv9lu2/
hxxp://hangtheuducthanh[.]com/site/Scan/yxvv9lu2//
hxxp://hangtheuducthanh[.]com/site/Scan/yxvv9lu2///
hxxp://huxtable[.]com[.]au/cgi-bin/closed_sector/external_area/0225702_WusTOVKZoG0/
hxxp://hwtholiday[.]com/test/report/fqeajjd56272094831359k4gp72zwtpzxr2lc/
hxxp://incaprosac[.]com/cgi-bin/statement/80k0s2u345m/
hxxp://jenmacqueen[.]com/balance/
hxxp://jpwoodfordco[.]com/admin/browse/bx26825943sntgqf4q3nlr5a/
hxxp://kendo[.]web[.]id/wp-admin/4473555_KwctS_box/guarded_319223_EaH29cD278A8/767789072168_PSk7iJ9VQx/
hxxp://kingsidedesign[.]com/blog/closed_sector/special_space/QPSAg5K0_1due64N7oH8bl/
hxxp://kjnk[.]ee/icon/swift/
hxxp://korrekaminos[.]es/wp-admin/browse/8svaccu6rq/cwc54387574603464ryhh9zs2j/
hxxp://kozmeticnisalon[.]si/wp-includes/46fn5p0b/y5hbbju992166qqfn61vqbpaalg4j7d/
hxxp://kpi[.]ro/rca4all[.]ro/a58s4ui-66s5troaats8k-8777752088947-kJblF7ZLw/special-exj-8x04fq/el06hjvldvdh91-xw62z2s5/
hxxp://kpuru[.]com/wp-admin/8CqAX2a-KuOxKyOYHk-zone/individual-cloud/8220504-4TFSnJ/
hxxp://laarberg[.]com/wp-includes/Overview/dkwp4273rh2/ss4l4j088880332493968a5q80zuyhlu9e/
hxxp://laschuk[.]com[.]br/wordpress/Document/0tpl48a7ifdy/
hxxp://leafplanttech[.]com/wp-admin/lm/
hxxp://leftofcentre[.]net[.]au/TUGQINL87404/GRRMYP/
hxxp://leicht[.]tv/db/eTrac/q0h1u1i84/
hxxp://limelightatlanta[.]com/40tix/wyaj4wul/
hxxp://liveheart[.]co[.]jp/img/invoice/
hxxp://madolineltd[.]com/cgi-bin/Scan/
hxxp://magoenmadrid[.]com/Arturo1/OCT/
hxxp://managersoft[.]com[.]br/new/multifunctional-48786803-L5qcxLyUmK64K/individual-space/51394296016593-KqAaVaxCa/
hxxp://marcotesch[.]de/tmp/browse/mpnp08c5/
hxxp://markantes[.]com/jason/Scan/
hxxp://mccallum-enterprises[.]co[.]uk/Archive/RAFJCJ/n0our2a/6119f73267613342199tstti2gdp2rfa48difd/
hxxp://medyamaxafrica[.]info/wp-admin/sites/
hxxp://megabytte[.]com[.]br/bloqueio/7w3vyaf4l/jrvlpx9086899693089v30lk5k8r3cz64y2n72iswe/
hxxp://metheney[.]com/writehandservices[.]com/INC/
hxxp://mineisnodisgrace[.]com/yy/Wt5Se86g8-CwcvxA3Nhc-box/69nx8jyh-shseqr9z1spbe-87490215-t39fHCoWYt/184179-pFPDSHkATH9qR/
hxxp://missp[.]net/test/dJw2Pe_453q2xFDKEiFA_mrzlt122o_gi2j2olzk/MuLdiM9u9z_tJttXEwjF4Sx1S_forum/613201260091_rb0VkbGv/
hxxp://mtmoss[.]com[.]br/yoga/OCT/
hxxp://muliarental[.]com/wp-includes/FILE/bp01l0xm1gyo/
hxxp://mundodosabor[.]com/erros/Overview/8dtqtmf7rhn/
hxxp://mysyrowicz[.]com/wp-includes/protected-section/9yFYkCLjl-D40HAuDSb1j4-area/po7-wvv714x6/
hxxp://mywebnerd[.]com/bluesforsale/37j40hrp/i2888733455339owd2tk1u9axjgsxlcsmf/
hxxp://nanclares[.]com/assets/open-sector/individual-profile/4228551-VQt8mgpLvo6BnS/
hxxp://natidea[.]com/ayewahcom/personal_zone/close_forum/6uunxWi_mupgM2bMpbm/
hxxp://neptunservice[.]ro/wp-admin/closed_sector/close_forum/z78sbzh_sts20s69z9/
hxxp://neverland-g[.]com/img/open-JdN6-T8rbee9i/additional-space/c51e9pc9ts-216v68xy4s33/
hxxp://nosolodeejays[.]com/wp-admin/common_sector/close_area/49260055677997_X95bKgwTuZv/
hxxp://novellogic[.]de/ad_o_2ig/2mnnXLTp-kpH5QsjR-array/5crrar1nezbbe-t8r7v9-portal/8442kCcp-7fwyN6pjuItv/
hxxp://nurcom[.]kz/private_disk/guarded_2313869_G99DDn3QWN/RgDsLgHoBY_M4sflzN2xhz3v/
hxxp://nursecallalarms[.]co[.]uk/modules/esp/m6074297759tfptsn3d1honqshx/
hxxp://nuwagi[.]com/old/swift/
hxxp://oftasoler[.]es/sKy240171/personal-section/4ql6prjz0h-dua1ondxs3sdw4x-forum/g4e-5s2y0z5t/
hxxp://omegaconsultoriacontabil[.]com[.]br/site/swift/
hxxp://onemart[.]vn/wp-content/sites/eyagc81443753061rnbmv6gd1lbfqd/
hxxp://oolag[.]com/QwEl1k5z9/browse/zbl23586054902167trbbt4jbmf4t8nf7/
hxxp://opiscineiro[.]com[.]br/wp-snapshots/available_53126350773_TuKgOaM1/open_forum/pvNCSlx_3u3deHJN1jcL/
hxxp://ordelman[.]info/cgi-bin/payment/8uoxrm05n/8pqeqym17060950365g17gutd63t5pzjjg/
hxxp://paisefilhossm[.]com[.]br/promocao/a014bd8/fqxdmu870398725430ojswlrmc2/
hxxp://paleochemical[.]com/font/lm/r3x203vdtsy/
hxxp://parser[.]com[.]br/10/t1vt4b8m6ks-zvovqpw5-disk/guarded-cloud/89mtno-t8y3zs33s2484y/
hxxp://partyflix[.]net/cgi-bin/available_v93Cj_v1wDUUyCaut2/verifiable_6850622086_vfsIOFCEeRcH1Aq/9971767_UnQHcs/
hxxp://peterfaber[.]dk/loggers/FZIR0dI0_nDjsIVSdS_array/interior_96939568_cUQiFNX9/RGbFV_mxdJg1tHzpir/
hxxp://piotrowskimusic[.]pl/FB/open_module/test_area/gV1HIQET9Hv_u6oLa9hmG2g/
hxxp://pixnbeats[.]com/chanakua[.]org/docs/kil68g3vvl/
hxxp://popprint[.]com[.]br/erros/23094/
hxxp://popweb[.]com[.]br/remedios/common-box/security-33426598-YS51WMKP/5113197732-2I84orIWu/
hxxp://posmarkt[.]com/zebra/Document/hi6tcis0n04/ahok655456854842396ixpy0pwotbv7z62o4lny11/
hxxp://prolegis[.]pl/kopia_zapasowa/closed_96706016_hLUY6U5kW4JCqc/interior_cloud/yzwm_yvy1x0t2/
hxxp://prospect-pro[.]com[.]hk/cgi-bin/closed-sector/usx-83v6nr-forum/806261103-Janbhn66InV7NoMd/
hxxp://provoke[.]bg/journal/LLC/puast1ji/
hxxp://rafaelparceriasconx[.]com[.]br/www/attachments/
hxxp://ragenetic[.]com/Documentation/browse/
hxxp://ramun[.]ch/87999976419-EkSObj-sector/common_0176057636_Y8ks7Apoy/external_area/LFunJqN_hcGM4ri5NH2e/
hxxp://rassow[.]de/wp-includes/Documentation/
hxxp://ravaze[.]com/cgi-bin/esp/qawt6vbnx/
hxxp://ravaze[.]com/cgi-bin/esp/qawt6vbnx//
hxxp://realistickeportrety[.]sk/wp-content/attachments/a7egj2f4/
hxxp://relishburger[.]ca/wp-includes/INC/pr61uzb2r/
hxxp://renovatiolivros[.]com[.]br/cgi-bin/OCT/po018016781958016151c37qudpzdyhzhti16/
hxxp://riovibe[.]com[.]br/2009/Admin/esp/
hxxp://rmonline[.]com[.]br/jamaica/bqrN56qPhX-EskndK6qixuD-box/additional-area/fxbo-2156u0s75t3/
hxxp://rodrigozambon[.]com[.]br/kanbanemacao/6PUWTTS/47iuc5q/
hxxp://rotulosalarcon[.]com/webservice/88ws_7e2pho_14M16JD_EMhOOFxmfLYrKVg/corporate_forum/Fhrv1ZA_2Jb4sKsiy/
hxxp://rtmedical[.]org/wp-content/Reporting/
hxxp://rukanet[.]cl/sanluisberries[.]com/BJVUGS/0szuwx2046kg/
hxxp://rushingservices[.]net/cgi-bin/Document/qtz5sn2jek/
hxxp://sacravirginitas[.]org/Imagenes/personal-section/verifiable-portal/qlMmnCX-HnvKrx8ikG1/
hxxp://sanchezysandoval[.]es/wp-content/default/report/43r4uajj0q/
hxxp://sanydobrasil[.]com/newimages/browse/3y81932/eerp4246367xpz0fy4f2l0sw/
hxxp://sauloramos[.]com[.]br/6a50svrn9v_1yjbpu-293/3nn1r2p/
hxxp://scampoligolosi[.]it/wp-admin/personal_array/guarded_area/f4jTQV_f0rnzwe7/
hxxp://scanfone[.]com[.]br/dianetica/Scan/yt8946095680333222ia5ivz5lawkt4nhv/
hxxp://schenckel[.]com[.]br/covid19/statement/
hxxp://sciww[.]com[.]pe/Scan/3kwrm7/
hxxp://scottknight[.]com/calculators/docs/on724093501160edkacsdytic5y/
hxxp://scrafford[.]com/stats/open_sector/security_portal/99169058_xxlrp/
hxxp://sculetus[.]nl/wp-admin/personal-disk/interior-991682359-Or2oadkU/30470476809504-rCNm6r/
hxxp://seatrade[.]com[.]eg/index_files/closed-o2z-17xm2/verifiable-portal/bkhs1-x930491v/
hxxp://sedistribuidora[.]com[.]br/Lumine1[.]6/81573865324-EdOMSS08wyoIdtBf-module/corporate-portal/33ovlyh7ya0c57-437692u/
hxxp://seismophonic[.]com/images/t55prjrdcx/0y8615606244201084438n0kq7whr/
hxxp://seoblox[.]com/blog/15694409863-3nw0bzHmArhwvs-zone/test-0503443-Lv9udluCMNCyzrM/W5R0OSbgmO-cMLnqzft9Iig/
hxxp://serkell[.]com[.]br/JUNIOR/eTrac/o5kak87381271633514cjh39d03erkg9242gfqp0/
hxxp://sgbusiness[.]co[.]uk/open_sector/open_cloud/44612615522_11dELbF/
hxxp://shashagong[.]com/balance/
hxxp://shaunodonnell[.]com/concrete/Overview/c82a6ued4q/ix7436565376zw7p3yjd95vyts7e/
hxxp://sherrylynnsimoes[.]com/cgi-bin/Documentation/ygeb0ebrsr/
hxxp://shootie[.]de/djchristaffa[.]de/common_sector/verifiable_396250047_L5AtTwqpNVqd/q49wspdl9ney2j2f_362wy791t/
hxxp://shopmobilepcs[.]com/extranet/Scan/ehlfrr58sq/f7u85h27796667906s4tk5qh15yace/
hxxp://sicsa-co[.]com/cgi-bin/common_yorx_4dropl4bwc6v54j/close_0494409_jzdROHf/839095935_KJwax6B/
hxxp://siel[.]cl/albamar/personal_section/interior_69cyonx_y2oihcii/165946205317_rLYmUfp/
hxxp://signsofstillness[.]nl/wp-admin/DOC/
hxxp://silkweaver[.]com/stylesa/089403109690_sv8p3N2Yi2ff_disk/additional_area/lnlW1UdykpKK_bmNIt3obcLiJ/
hxxp://simaley[.]org/IRS[.]GOV/payment/fe73j5d/kv2vp5w31926231426844035k7ukybyevv/
hxxp://simonlegrand[.]com/wp-includes/common_disk/corporate_space/51q_t2t9ut1sw9/
hxxp://sinaiinformatica[.]com[.]br/webfonts/Scan/q8v22eqcv2d/j227443314do9t1zeo2bim5byex/
hxxp://sjhoops[.]com/ajl6vwf4j3wg-6qbdx-section/security-forum/125423639526-lPbl5aLueVQ0/
hxxp://skkonline[.]co[.]uk/assets/xuz97aw/
hxxp://skuduu[.]com/hima/docs/l0hd578223777476407qthhtvxp9xi5k/
hxxp://skullmedia[.]de/befroe[.]de/7dq04q/dq7438847794enu9zro5186j51gisk/
hxxp://skydiarynepal[.]org/wp-admin/paclm/xr1fpj/uzab0239055189vtjyny9i5s169mxanilot0/
hxxp://skytechresources[.]com[.]br/erros/FILE/ar7h5oo/
hxxp://sliceoflimedesigns[.]com/forum/multifunctional_IlBXME4_k9z70MFL011l5Ee/s43u_2nfjvkfrhsfem_warehouse/oII80rFk_y9vlK0a8/
hxxp://slotnes[.]com/wvvw1/Reporting/6otdo0ajyeu9/
hxxp://smetechnologies[.]co[.]za/wp-admin/4692255591482965/
hxxp://snhc[.]in/images/closed_array/external_warehouse/FAMYceD_lseb6b5v9Hbi/
hxxp://soaresjf[.]com/remoto/Scan/28g1zf/
hxxp://sociallysavvyseo[.]com/PinnacleDynamicServices/FILE/
hxxp://soho[.]at/wi/images/phnffv_26yrgebxcs4y0j8_box/special_2445924_hauzpyurdv1y/179408622340_slWJn3lKUuTX/
hxxp://southcoastwebsolutions[.]co[.]uk/suspended[.]page/available_zone/special_area/y233icqs52_2vy0u2w262/
hxxp://sporttherapie-muenchen[.]de/STM_WP_Backup/d7fj1625129601367gmix8vl23jdthz/
hxxp://spread[.]ooo/mudcafe/report/
hxxp://srconsultingsrv[.]com/wp-admin/open-9c-pqmgpgy9fo4mnwz/verifiable-area/10bpikjgd-32105y0ut8/
hxxp://stardealerportal[.]com/wp-content/browse/vq7wbvy7nmqp/6j835021262a64icfir068ofiyru/
hxxp://stawiarz[.]pl/pac/closed-841979172-7OqWx2YY9lCjix/corporate-area/lbgqbpmhz0e-3st285z1uvw/
hxxp://stingertek[.]com/vallejogardenclub/ciezkhkrfe/
hxxp://studiojvo[.]com/assets/OTNYFY5GY1/axgsnowtf2m/
hxxp://sudentas[.]com/travel/available-section/verified-profile/qJf8FUoCYd-LIpvrLzifhj2/
hxxp://sundragon[.]eu/FOTO/closed-sector/security-ek5mce5yn2x0l0-wth3qhgtns/34051606646301-jB0ZJ4J/
hxxp://superimagemdigital[.]com/admin/img/multifunctional_box/test_forum/6k8g5ejwq3a3y2_98sy66t8t40st/
hxxp://swiftlogisticseg[.]com/wp-admin/available-rEvbQDJne-2vpsDkD7vW/gw8-wdwzcwgjc-warehouse/MjQYHI8i-9idjejg79jfvq/
hxxp://t-infinity[.]com/wp-content/common-module/test-portal/138133-OhxwQ91/
hxxp://tagrijn-emma[.]nl/wp-content/private-j3-irovpd/additional-89369780129-Q7QWl4/hV9nGRjj-b5hzKJ6tnp/
hxxp://talau[.]com[.]br/css/public/
hxxp://tanveerkhaira[.]org/css/parts_service/
hxxp://tarantulatechnology[.]com/pipes/invoice/smzdvbg103194747175329vidkliisj7s/
hxxp://tavo[.]cl/resumen-uso-inodos/available_sector/additional_lxsMZsDO_vLJGQ2P89MWe/th93_7w97s92/
hxxp://tbcwimmera[.]com[.]au/protected_sector/external_warehouse/51710617371140_vkdJirkNTnmA/
hxxp://telecomafrica[.]org/cgi-bin/public/xyqdc1xm4u/
hxxp://temptmag[.]com/wp-admin/public/
hxxp://terifischer[.]com/yvhuy7250u0cxgo7_fgnit20osovcp_box/special_1152780_rNmTUUIgdNzHVm/wTqKYWl2_1rgqchqfnH88/
hxxp://thealdertons[.]us/media/multifunctional_resource/additional_8744394_UkBeOrPa5/3052758_Shsd7DjODxCP84P/
hxxp://thecbbgroup[.]com/wp-content/balance/gnvx588286wtqtw5obz8rarh8/
hxxp://thecolortheory[.]com/GeneratedItems/protected_06595511012_aBxkUkWzRfIopt/interior_cloud/GM3eWc_1dzNlmjn/
hxxp://thedopplershift[.]co[.]uk/esp/4kvsi5c/
hxxp://thesimpleproject[.]org/N0PCPC0SDT/
hxxp://thetubes[.]com[.]au/classes/parts_service/wrljm96soyg/
hxxp://thoughtwax[.]com/adaptive-spaces/protected_module/5859179215_ZZ9SIj7xDGLE_cloud/779001963_KKshekb/
hxxp://thys[.]info/cgi-bin/dto9bw762134183771szye4g6tyw/
hxxp://timegonebuy[.]com/drop_shadows/balance/3ns3ru/
hxxp://timpex[.]pl/sql_cwiczenia/p2vlkcv26/eh6eh0207648413677pae9yvru3gg3d491a1ls/
hxxp://tjorhom[.]no/cgi-bin/payment/0e487ufi6xf5/
hxxp://tjr[.]dk/aspnet_client/open_disk/guarded_space/4RSWJ_6y23eeJhv2rev/
hxxp://tksb[.]net/serenna/personal-sector/dtcmb-7d2m-cloud/nllezkuwdnn1n92-236u472xxw03x/
hxxp://tlbohr[.]com/webset/FILE/r8987978534354qj8wo8ey6xd6x7vx/
hxxp://tmansports[.]com/2007_12_28/796948446127-fM3eIQu0kGbY3Irw-disk/test-336060583-vdHmXUeT08ggR/8735230092-wGj0alsy2AEdng5f/
hxxp://toosmartguys[.]com/wp-admin/closed_array/1fksmyo5k02zqb_g4fnwd1_forum/VmbY43w_1nosGuHje69a/
hxxp://toursedestinos[.]pt/pdf/public/91fhrz4/
hxxp://travaglini[.]net/numismatique/public/ihymjuenz/
hxxp://treballsdobra[.]es/wp-content/Documentation/
hxxp://tregir[.]ch/sites/
hxxp://triniweddingplanner[.]com/images/wjzs3q1via/lc2cw747560550g44toxqkv7a1cimaqa/
hxxp://tunamim[.]com[.]tr/wp-includes/OCT/9dgu59bupl/
hxxp://tusbro[.]com/00tusbro_login_api/open-section/interior-space/3504481-kdTI1C4Tlf3Th4/
hxxp://tuszmajster[.]pl/cgi-bin/closed-section/additional-cloud/uxay883om-24vu/
hxxp://twist[.]ro/wwvv2/lvgutb0upn_qzrlughm37h8_sector/D1zOEk_EBbDGlvNTNug_gopozmilk4_crtjzebig4n3i/15215355_EShrPhOLx/
hxxp://tyy[.]co[.]jp/pdf/multifunctional_resource/close_cloud/35829403747_KVoi3x4UJ3/
hxxp://ultimate-24[.]de/logon/personal_section/verifiable_portal/79327268_kImG0pU12BbGPx/
hxxp://umwelt-kirchhof[.]de/mediapool/payment/u4ekdyw9utl/
hxxp://uniemail[.]net/cgi-bin/invoice/a5avz8d3/
hxxp://uss[.]ac[.]th/cgi-bin/q2th2018035104og9brmzz9ajk4ichud84/
hxxp://vacation-home[.]biz/modules/parts_service/
hxxp://vagrantcafe[.]com/ben/lm/
hxxp://vanbrusselservices[.]nl/cgi-bin/Reporting/
hxxp://vanisle[.]com/components/paclm/
hxxp://vb-teck[.]de/blogs/invoice/1guf01968693525036b6aykhkkgrls/
hxxp://veraz[.]co[.]uk/techfiles/invoice/
hxxp://veronicajames[.]com/cgi-bin/Document/x5vd2xi8734020j14j11usbl1/
hxxp://viewinside[.]com[.]au/css/Documentation/er7m6k/xo43ex8016124eawkcu8w7e/
hxxp://vindustries[.]com[.]my/biometricart[.]com[.]my/invoice/f6yy5v1/
hxxp://vivationdesign[.]com/files/browse/
hxxp://vtol[.]org/farcry/lm/
hxxp://vtscomputers[.]com/var/lm/5694238060652ik7y5xtktnjyuimedp/
hxxp://webspinnermedia[.]com/wp-includes/personal_disk/open_iaubzy_ji4r376rs6l/q2jfs1mG_eawIL1l8/
hxxp://wolfgang-brodte[.]de/3_jsb_1/InAUSx3_YvqcLPC50WmjwpA_6F42D_IlppKeWVoP/additional_Pl1BhCsQs_YZU1zDb4UNEM/jzl_90sst29933z/
hxxp://wowter[.]com/wp-admin/Document/tig185262892674095pv8lgqnby9n/
hxxp://www[.]cartoworld[.]co[.]ke/cgi-bin/Overview/tib054610007710574861h2hail6bauffse/
hxxp://www[.]carvajalyasociados[.]com[.]ar/cgi-bin/lm/
hxxp://www[.]ceiaquimahue[.]cl/ocia/report/jm0535879520019b2fck2pjfsdco0bz/
hxxp://www[.]codigobienes[.]com/wp-includes/statement/
hxxp://www[.]covektel[.]com/COPYRIGHT/esp/5lbi5mr/arb74559705781098e543b92t/
hxxp://www[.]fpmtmongolia[.]org/cgi-bin/0r0g7yl3103656715480ifx5148etoyx9kk/
hxxp://www[.]gozowindmill[.]com/meteo/sites/snrncn6w8see/v10315736f6ebexvu350a1wl/
hxxp://www[.]jenmacqueen[.]com/balance/
hxxp://www[.]konopna[.]sk/wwvvv/949676380_DIN6y_g1pkh6l38_42wa3/verifiable_area/3Wdyr_roIeltu85rsn/
hxxp://www[.]krausen[.]ee/cli/gevfff3b-na4wr-resource/individual-forum/bjir54i-533xw3/
hxxp://www[.]ksgresearch[.]org/wp-content/paclm/9iw23ewv5y2/
hxxp://www[.]madolineltd[.]com/cgi-bin/Scan/
hxxp://www[.]madolineltd[.]com/cgi-bin/Scan//
hxxp://www[.]magoenmadrid[.]com/Arturo1/OCT/
hxxp://www[.]massiv[.]net/mail/balance/
hxxp://www[.]nancywhite-realtor[.]com/wp-content/paclm/s41n3t/txx651074600286776ogq21hkg9/
hxxp://www[.]neptunservice[.]ro/wp-admin/closed_sector/close_forum/z78sbzh_sts20s69z9/
hxxp://www[.]noor[.]me[.]ke/wp-content/eTrac/d31611375636604memplnorbv8bo6y/
hxxp://www[.]paellassupremas[.]com/css/Reporting/
hxxp://www[.]purpleline[.]co[.]uk/logs/DOC/w9rthezofkd/
hxxp://www[.]reifenquick[.]de/Scripts/open-0627720493640-azQ24PfFjRm/guarded-space/gxkx9t42ra6yf-6x7uyx330389w/
hxxp://www[.]sauna-saunas[.]com[.]br/wp-includes/lm/
hxxp://www[.]sauna-saunas[.]com[.]br/wp-includes/lm//
hxxp://www[.]schumaecker[.]net/scripts_index/payment/yr8eb0tlz89/
hxxp://www[.]sitepazar[.]com/cgi-bin/eTrac/m0icpze6c7k7/
hxxp://www[.]sprachwerk[.]at/ATutor/qn0-n6awkcoeni-392284-Se58dwSoONwu/security-forum/333534-xxrv5aMZS/
hxxp://www[.]studio63productions[.]com/fonts/fiu2HA_inzrpqBeY8_zone/external_cloud/uytzo5fvxgf_yu8w973/
hxxp://www[.]swdimages[.]com[.]au/latest-show-proofs-101/Overview/hb7g6ionfee/
hxxp://www[.]thepartycompany[.]co[.]uk/image/multifunctional-box/verified-area/duG4uUNM-ju209rlGr52/
hxxp://www[.]tuncambalaj[.]com[.]tr/wp-admin/hj48shax0r6/
hxxp://www[.]twilightshadows[.]net/ACT/closed_37395971_l1jQqsWLH6/70hdk_j8b_cloud/0339228_pSe58dwSoO/
hxxp://www[.]uscomponent[.]com/admin/postimage/INC/zuy6meqe7/0ye4107030747782410919xqpvrs85n341pat/
hxxp://www[.]yamak[.]net/ymkblsm/balance/
hxxp://www[.]yasa[.]eu/mambots/invoice/0fnjco5i7o7/
hxxp://www[.]zabezpecovacky[.]eu/ke-stazeni/browse/tqu61nhhfq2/r8nmwd5240399877135dp4kz76mn9d/
hxxp://www[.]zuhapps[.]com/2048puzzle/lm/oa2mc74dt/q3a08252019n6o6xghpnile806y/
hxxp://wyredsecurity[.]com/cgi-bin/balance/
hxxp://xanadudigital[.]com/condosdominicano[.]biz/Document/vkr0851060705713l3niorviz68sucoutf33/
hxxp://xsesa[.]com/i54j1209425596238283587ch5yax3kredj0cfmrf3lnx/
hxxp://yargan[.]com/anon_ftp/esp/
hxxp://yargan[.]com/anon_ftp/paclm/65u93mp30iz/10p02aa80080211864fpzg6h979nlb/
hxxp://yearbooktech[.]com/www[.]yearbooktech[.]com/5hyt5h/
hxxp://ygraphx[.]com/NBM/Scan/biroddfk/
hxxp://yoklama[.]org/_vti_bin/parts_service/2dl2q2/o307084106601575286d4d0hj7nfndv08/
hxxp://yourman[.]co[.]uk/picture_library/statement/2e1fuqp/w62473776666888813gnl33034d08/
hxxp://yourwebproject[.]net/ae_project/3wjun6iwk9wl/
hxxp://zabezpecovacky[.]eu/ke-stazeni/browse/tqu61nhhfq2/r8nmwd5240399877135dp4kz76mn9d/
hxxp://zagnet[.]pl/nexity/Overview/loew56q32o/
hxxp://zipatoco[.]ir/aria/Reporting/
hxxp://zipatoco[.]ir/aria/Reporting///
hxxps://3spower[.]sk/bck/DOC/evangsemr/
hxxps://adamant[.]kz/admin/8n2ltnukscl/
hxxps://ajstudiollc[.]com/cgi-bin/esp/t8jzbl38e/u12i1590730846dss9to16go7qrjmkjno/
hxxps://andythomas[.]co[.]uk/esp/qs5q115eqs/
hxxps://andythomas[.]co[.]uk/esp/qs5q115eqs//
hxxps://andythomas[.]co[.]uk/esp/qs5q115eqs///
hxxps://artisan[.]com[.]sa/interior/91059899461/0lq71465007929br3j9001zjc/
hxxps://autogoods[.]us/LLC/exgcu3/
hxxps://azjones[.]info/css/5D1FNRQ3T6C/gwdu6n4/
hxxps://bangkokcityjewel[.]com/cgi-bin/ag6884ym/
hxxps://bazarot[.]com/biznietosconcha/paclm/oe7s615002105532o1490466p1wzkhps/
hxxps://blackdogtracks[.]com/css/rmukuvlf1il7/
hxxps://blueberrypharma[.]com/asserts/OCT/invoookpoq/rm88553307vq5w21hw7a9ebzsg4dasb/
hxxps://brockington[.]org/techmail/available_module/guarded_space/SP2eQgvnW_r5qI7cslNlIy9f/
hxxps://burnix[.]org/cgi-bin/invoice/
hxxps://caboned[.]com/cgi-bin/available-resource/additional-portal/91101292777-ePBh7pMGjkSL8/
hxxps://cr-technik[.]de/css/eTrac/1pg6br3ul/lsi452384921141400803jllllefvcnl8rt6/
hxxps://gatewaycentrechurch[.]org/backup-1441643750-wp-admin/19i3zj98/2m48172795825417e3ammwb6s2tqe/
hxxps://jantehobe[.]com/wp-includes/lm/eyof0r5xt9d/
hxxps://kontaci[.]com/cgi-bin/Reporting/a7387cg2tyi/8yg365591989425t0pp8vslzkzns4/
hxxps://latson[.]de/wp-admin/report/cc4vfhx/
hxxps://locuslinguarum[.]co[.]uk/css/open_section/security_area/aAGPsW_8N4w6ntkHper/
hxxps://lundys[.]nl/blogs/docs/
hxxps://lvl[.]com[.]br/wp-includes/1961016819661btogcee1fpajs6/
hxxps://maclatex[.]com[.]br/site/hb8yw68wj5sv/
hxxps://natureduca[.]com/lonuestro/swift/
hxxps://rastarespect[.]com/wp-content/YJ5P25DNUE4W/b197124431704ul7h41ln91d/
hxxps://rowlan[.]com/mf/sites/
hxxps://sentir[.]nl/m/closed_box/4DlCoFg5_qdxDNNT3y_547914208_hdiEzE5d4n/u4qtits6nkxglkx1_20s78uv957sx/
hxxps://serdani[.]nl/cgi-bin/docs/
hxxps://simoneporzi[.]it/wp-snapshots/lm/10mcf1ow73i/
hxxps://slotnes[.]com/wvvw1/Reporting/6otdo0ajyeu9/
hxxps://soltecnic[.]com/wp-admin/personal_zone/special_area/c3pBuvUAp2U_iv4sgo7HtMd83/
hxxps://twofive[.]com/2015/protected_fWiqVKYz_71aTb5yf/individual_portal/b9aYSoA_t5Jg8ji9Jiu8/
hxxps://u12295161[.]ct[.]sendgrid[.]net/ls/click?upn=a5-2F-2FGlEPrrVsVMU6F0xqKFErtjbzb6ZmfQEhDBIC7a8SoCe6lB12UdGgfoR4IKo5fWjaND55D0-2Be4MfE1NOPbZbA-2BJPSiH-2B50YN7BU8YQCs-3DZmc2_aO2sFgicRFT1OdMVISRabDHT4P88ImTq9ynXaGDR9i7YmAtcjNeksJB4UepcdttON3erMTnr4ww2bzvgE-2Fm1SHrwKAWaZY-2BB-2FuIqHCJknPIkWFyBGRMdW-2B62QV489PAP6lbpomB9wc234ASfrws7DMjFaRgGkb0LY5uiZoqg6FZ4m-2BRa-2F6q9uuoKw-2F-2Fi5CPjYOsewbxjSn-2Be1Y8SOwp2tYrw5LK7CYCvhlZxDRqg4voTWXDZf5CXZ7-2FExggRaIFh/
hxxps://uaisoftware[.]com[.]br/site/FILE/
hxxps://udon[.]com[.]br/_0LD/private-3h-pvghfj6mys0ujp/verifiable-forum/iy2f98myvcaa-uw9125ys/
hxxps://vivahforever[.]com/temp/vzv1qvcdqb1/gxhh8q289162373577nk6ej5o9qxiskqan/
hxxps://vtol[.]org/farcry/lm/
hxxps://webso[.]ca/dev/LLC/
hxxps://welcomehouse[.]ca/cgi-bin/paclm/spdij5/
hxxps://www[.]actacomunicacao[.]com[.]br/provisorio/221386537620361/
hxxps://www[.]astrocorfu[.]gr/plugins/Reporting/
hxxps://www[.]kor-network[.]de/assets/payment/
hxxps://www[.]lvl[.]com[.]br/wp-includes/1961016819661btogcee1fpajs6/
hxxps://www[.]newplastic[.]es/cgi-bin/open-array/Ilr9s-6ItDe1XgRk-EljWaxEOr-rPVqkbJ5GOKW/472999247-ouz9yfBOW58kJ4n/
hxxps://www[.]novaes[.]com[.]br/processo/of33d2_r26rfmlrk7pphmwx_disk/jyzk5LmQ4e_EcLlrqQ9e_23gzy_xdgbb1nba/2fiib91_35xxxx7y/
hxxps://www[.]pr1mula[.]nl/bootcamp/u2d2rlg31516190469063lsyw6ct7/
hxxps://www[.]sebastianehinger[.]de/wp-includes/lfrEYdJUF_KmzCNtD_resource/additional_forum/217241633_32PkjLu6bW/
hxxps://www[.]servomotorsadjust[.]com/wp-admin/9RLU1OOHS1XPHW/b8z8880806576543308eneyhkvao7lbg4/
hxxps://www[.]sonoki-family[.]com/wp-content/wg5v1_v48fdbur8xhp9ar5_section/additional_017442_TMqqWwDr/Qm5e9_9MGnd9Jjynmq47/
hxxps://www[.]syowakogyo[.]co[.]jp/images/Document/
hxxps://www[.]teleargentina[.]com/ver/personal_zone/external_cloud/61294841175_6SGUUOwU/
hxxps://www[.]terramagica[.]es/FiestaPijama/Reporting/
hxxps://www[.]ultralounge[.]ch/frauenzirkel/eTrac/ijj3a8cu7dh/
hxxps://www[.]uscomponent[.]com/admin/postimage/INC/zuy6meqe7/0ye4107030747782410919xqpvrs85n341pat/
hxxps://www[.]visgroup[.]pl/payment/x268207360832161e8od3hlmpdwbawruan6v/
hxxps://www[.]webworks[.]fr/images/swift/7651134656xfgptmd9w3ew0qkf3/

DOCUMENT FILE HASHES
161412c21fe72ecfefdbe67b4d5c551b
3e8f49fbc37f42239c531719ed76a596
5dad5aac3be8ecd607f0187f931e3df5
68725c7876785ce656a883c5721e6458
70b506289c97c6906636f1f28ab67c51
8adb7fad822bb4155e6a293f0f81ed90
b3d9f1a028b36c4231282f98d19526c0
d7ca494f1cd77bcbf8c0d4d2c05959af
f68bbf3f39d6bae176326a7cd54f069c

PAYLOAD FILE HASHES
21e172d53b876ab6877afdb3969c362b
a7a7139bfc426efe0262b954f10b8897
aec44da4971efa0de37bda4d57854399
b058467d28a3f010c7cc46de1a712c38
ebc29af9263658c882fd842a560f540d
eef8ff91ec1d21dea4e6d463aadff172

EMOTET PAYLOAD URLs
hxxp://airmidhealthgroup[.]com/plugins/kb_r_5y5p44z9/
hxxp://debnath[.]org/stats/SB/
hxxp://dgreitkelis[.]lt/ww12/gmei_ksa_vb/
hxxp://dkeventmarketing[.]com/tasteofnj/aqr8_xsa_53/
hxxp://driftaway-holidays[.]co[.]uk/wp-content/wf_gmc_c1tk6o1/
hxxp://fon-gsm[.]pl/87/n4o2_fl5_kw0f36a/
hxxp://nfis[.]com/accounts/h_d7c10_dnl/
hxxp://oasisproject[.]us/news/4KTOf/
hxxp://obserai[.]co[.]jp/sys/7zi27420/
hxxp://pallabhazarika[.]com/bestsmarttvindia[.]com/Bn1u/
hxxp://randynowell[.]com/images/SE2150/
hxxp://sampling-group[.]com/J0Eubtq06/
hxxp://sasystemsuk[.]com/recruit/sl979/
hxxp://spektrondesigns[.]com/cgi-bin/3vzc_oj94_q3v42ns4nb/
hxxp://techlh[.]com/old_whmcs/jd_elc_1e/
hxxp://tedbrengel[.]com/wp-admin/gg_p_njyjdpr/
hxxp://teldesign[.]com/stats/szv5_kv_vaf4016v/
hxxp://tvsanmiguel[.]com/ww4w/y_mm_n8/
hxxp://umphrey[.]us/ww12/qo_s1mq_p4o/
hxxp://volkanakbalik[.]com/_inc/2W/
hxxp://vpixel[.]net/varekai/PVDLd2Yk/
hxxp://watersdesigns[.]com/cgi-bin/XXRfKgf/
hxxp://wealthytiffany[.]com/wp-content/KnUCE39870/
hxxp://web77marketing[.]com/_vti_cnf/CsZp488/
hxxp://webmotion-design[.]com/test/ul_tx_n6bfaag/
hxxp://wellparts[.]net/cgi-bin/qAj081/
hxxp://wiretube[.]com[.]br/assets/kudb3_i3gjx_y52/
hxxp://wolfbird[.]com/wp-content/2ddcr_bqmi2_d0vmdgu/
hxxp://www[.]hlsquared[.]ca/cache/e_q84_jobz/
hxxp://www[.]ncsu[.]org[.]ng/wp-content/3_tcn_pc/
hxxp://www[.]skydiarynepal[.]org/wp-admin/m_u8_iv41d84ow/
hxxp://www[.]vipi[.]co[.]ke/cgi-bin/h_2lnix_2y/
hxxp://www[.]weddingsday[.]co[.]uk/docs/1oYncTNHDu/
hxxps://caritatea[.]nl/img/c0t5t_j_n2zr/
hxxps://fsastudio[.]com/zp_m_j4/
hxxps://vmais[.]net/bebemaria/download/Hf2k1JxvZd/
hxxps://wksbsolutions[.]com/picture_library/f9_f03t4_4z/

EMOTET EPOCH 2 C2s
hxxp://47[.]146[.]32[.]175
hxxp://212[.]51[.]142[.]238:8080
hxxp://200[.]55[.]243[.]138:8080
hxxp://65[.]111[.]120[.]223
hxxp://47[.]144[.]21[.]12:443
hxxp://81[.]2[.]235[.]111:8080
hxxp://152[.]168[.]248[.]128:443
hxxp://24[.]43[.]99[.]75
hxxp://114[.]146[.]222[.]200
hxxp://50[.]116[.]86[.]205:8080
hxxp://121[.]124[.]124[.]40:7080
hxxp://153[.]126[.]210[.]205:7080
hxxp://183[.]101[.]175[.]193
hxxp://189[.]212[.]199[.]126:443
hxxp://62[.]75[.]141[.]82
hxxp://46[.]105[.]131[.]79:8080
hxxp://104[.]236[.]246[.]93:8080
hxxp://83[.]110[.]223[.]58:443
hxxp://162[.]241[.]92[.]219:8080
hxxp://180[.]92[.]239[.]110:8080
hxxp://72[.]12[.]127[.]184:443
hxxp://190[.]160[.]53[.]126
hxxp://139[.]59[.]60[.]244:8080
hxxp://181[.]230[.]116[.]163
hxxp://201[.]173[.]217[.]124:443
hxxp://95[.]213[.]236[.]64:8080
hxxp://200[.]41[.]121[.]90
hxxp://113[.]160[.]130[.]116:8443
hxxp://110[.]145[.]77[.]103
hxxp://91[.]231[.]166[.]124:8080
hxxp://104[.]131[.]11[.]150:443
hxxp://139[.]130[.]242[.]43
hxxp://87[.]106[.]136[.]232:8080
hxxp://190[.]55[.]181[.]54:443
hxxp://165[.]165[.]171[.]160:8080
hxxp://209[.]182[.]216[.]177:443
hxxp://5[.]39[.]91[.]110:7080
hxxp://137[.]59[.]187[.]107:8080
hxxp://5[.]196[.]74[.]210:8080
hxxp://204[.]197[.]146[.]48
hxxp://91[.]211[.]88[.]52:7080
hxxp://67[.]241[.]24[.]163:8080
hxxp://203[.]153[.]216[.]189:7080
hxxp://78[.]24[.]219[.]147:8080
hxxp://116[.]203[.]32[.]252:8080
hxxp://41[.]60[.]200[.]34
hxxp://157[.]147[.]76[.]151
hxxp://104[.]131[.]44[.]150:8080
hxxp://109[.]74[.]5[.]95:8080
hxxp://169[.]239[.]182[.]217:8080
hxxp://222[.]214[.]218[.]37:4143
hxxp://176[.]111[.]60[.]55:8080
hxxp://209[.]141[.]54[.]221:8080
hxxp://103[.]86[.]49[.]11:8080
hxxp://124[.]45[.]106[.]173:443
hxxp://142[.]105[.]151[.]124:443
hxxp://95[.]179[.]229[.]244:8080
hxxp://76[.]27[.]179[.]47
hxxp://61[.]19[.]246[.]238:443
hxxp://62[.]138[.]26[.]28:8080
hxxp://37[.]139[.]21[.]175:8080
hxxp://24[.]179[.]13[.]119
hxxp://168[.]235[.]67[.]138:7080
hxxp://47[.]153[.]182[.]47
hxxp://93[.]51[.]50[.]171:8080
hxxp://70[.]167[.]215[.]250:8080
hxxp://79[.]98[.]24[.]39:8080
hxxp://157[.]245[.]99[.]39:8080
hxxp://119[.]198[.]40[.]179
hxxp://24[.]234[.]133[.]205
hxxp://87[.]106[.]139[.]101:8080
hxxp://75[.]139[.]38[.]211
hxxp://74[.]208[.]45[.]104:8080
hxxp://185[.]94[.]252[.]104:443
hxxp://47[.]146[.]117[.]214
hxxp://37[.]187[.]72[.]193:8080