title: Detect Activity to Known Malicious Other - OTX ips - Chunk 1 id: 2369d50b-04b4-55c0-af96-c5bf98bef9c4 status: experimental description: Detects traffic or activity related to known malicious ips associated with Other from OTX (Chunk 1). logsource: category: firewall detection: selection: dst_ip: - '192.168.1.100' condition: selection level: high tags: - attack.t1595 - source.OTX --- title: Detect Activity to Known Malicious Other - FeodoTracker ips - Chunk 1 id: c02e47c7-a21c-588c-bb21-24e6375bb3bb status: experimental description: Detects traffic or activity related to known malicious ips associated with Other from FeodoTracker (Chunk 1). logsource: category: firewall detection: selection: dst_ip: - '162.243.103.246' - '50.16.16.211' - '34.204.119.63' - '178.62.3.223' - '27.133.154.218' condition: selection level: high tags: - attack.t1071 - source.FeodoTracker --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: bbd98a62-ba3f-595c-89b5-1e975cca3cbf status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://59.180.149.25:47833/i*' - '*http://123.5.152.179:53001/bin.sh*' - '*http://61.52.157.25:38771/i*' - '*http://115.57.213.55:44802/i*' - '*http://182.127.126.249:34878/bin.sh*' - '*http://193.163.187.213:56836/i*' - '*http://39.73.178.223:57046/i*' - '*http://42.227.236.188:56408/i*' - '*http://42.227.236.188:56408/bin.sh*' - '*http://220.202.91.19:47976/i*' - '*http://42.7.137.238:54163/i*' - '*http://42.7.137.238:54163/bin.sh*' - '*http://221.15.189.83:48288/i*' - '*http://60.18.10.89:54830/bin.sh*' - '*http://42.235.89.186:57052/i*' - '*http://42.235.89.186:57052/bin.sh*' - '*http://163.142.92.217:51284/i*' - '*http://42.231.94.251:49336/bin.sh*' - '*http://42.237.57.144:50557/i*' - '*http://120.28.199.24:57663/i*' - '*http://220.202.90.163:55723/i*' - '*http://42.53.132.85:56771/i*' - '*http://42.238.171.237:58312/bin.sh*' - '*http://104.252.175.109/bbc*' - '*http://103.172.186.151:57239/i*' - '*http://120.28.199.24:57663/bin.sh*' - '*http://123.5.155.151:36913/i*' - '*http://182.113.252.127:47336/bin.sh*' - '*http://182.121.143.99:36544/i*' - '*http://105.184.45.109:34559/i*' - '*http://123.5.155.151:36913/bin.sh*' - '*http://221.1.224.23:34149/i*' - '*http://123.5.8.154:53588/bin.sh*' - '*http://123.9.199.52:50973/bin.sh*' - '*http://115.57.63.161:33463/i*' - '*http://45.172.218.181:45870/i*' - '*http://221.1.224.23:34149/bin.sh*' - '*http://105.186.70.97:38095/i*' - '*http://110.37.61.44:56384/bin.sh*' - '*http://115.57.63.161:33463/bin.sh*' - '*http://42.230.16.64:45927/bin.sh*' - '*http://105.186.70.97:38095/bin.sh*' - '*http://45.172.218.181:45870/bin.sh*' - '*http://182.116.39.137:40101/i*' - '*http://200.115.102.246:33509/i*' - '*http://182.116.39.137:40101/bin.sh*' - '*http://221.15.185.32:52527/i*' - '*http://200.115.102.246:33509/bin.sh*' - '*http://196.189.3.1:43690/bin.sh*' - '*http://123.11.2.81:35325/i*' - '*http://27.223.131.4:50274/i*' - '*http://123.11.2.81:35325/bin.sh*' - '*http://115.48.144.20:44986/i*' - '*http://27.223.131.4:50274/bin.sh*' - '*http://182.126.202.2:42262/i*' - '*http://115.55.11.148:49241/bin.sh*' - '*http://115.56.151.118:58019/i*' - '*http://105.225.45.181:49165/bin.sh*' - '*http://105.225.20.91:54171/i*' - '*http://110.37.42.21:55960/i*' - '*http://105.184.45.109:34559/bin.sh*' - '*http://206.62.120.157:43560/i*' - '*http://206.62.120.157:43560/bin.sh*' - '*http://110.37.42.21:55960/bin.sh*' - '*http://125.45.57.193:59157/Mozi.m*' - '*http://42.224.100.104:57589/bin.sh*' - '*http://42.230.216.27:33883/i*' - '*http://182.113.36.141:44588/bin.sh*' - '*http://182.127.33.151:45769/i*' - '*http://42.230.216.27:33883/bin.sh*' - '*http://61.54.253.89:37352/bin.sh*' - '*http://182.127.33.151:45769/bin.sh*' - '*http://39.87.15.172:39137/bin.sh*' - '*http://219.157.11.85:45654/i*' - '*http://42.224.22.251:43271/bin.sh*' - '*http://46.236.65.41:56440/bin.sh*' - '*http://105.186.64.236:52293/i*' - '*http://182.119.181.65:41920/i*' - '*http://61.52.184.241:56032/i*' - '*http://27.37.103.182:39139/i*' - '*http://105.186.64.236:52293/bin.sh*' - '*http://219.157.11.85:45654/bin.sh*' - '*http://123.9.220.15:51815/i*' - '*http://115.48.48.140:59805/i*' - '*http://115.48.48.140:59805/bin.sh*' - '*http://125.40.131.1:52924/i*' - '*http://113.230.197.154:40757/bin.sh*' - '*http://123.9.220.15:51815/bin.sh*' - '*http://222.142.250.233:37018/i*' - '*http://115.49.202.106:57597/i*' - '*http://125.40.131.1:52924/bin.sh*' - '*http://39.81.22.56:45205/i*' - '*http://182.119.60.180:48123/i*' - '*http://221.15.6.71:56873/i*' - '*http://182.119.60.180:48123/bin.sh*' - '*http://221.15.6.71:56873/bin.sh*' - '*http://176.65.132.8/mipsel*' - '*http://182.123.178.196:50097/i*' - '*http://123.4.238.131:57813/i*' - '*http://221.15.4.12:49038/i*' - '*http://182.123.178.196:50097/bin.sh*' - '*http://196.190.69.149:54241/i*' - '*http://103.157.210.26:36636/i*' - '*http://123.9.199.52:50973/i*' - '*http://221.15.4.12:49038/bin.sh*' - '*http://164.163.25.149:53018/i*' - '*http://196.190.69.149:54241/bin.sh*' - '*http://110.137.153.25:58965/i*' - '*http://164.163.25.149:53018/bin.sh*' - '*http://115.55.234.204:33731/i*' - '*http://115.55.234.204:33731/bin.sh*' - '*http://219.156.60.143:47272/i*' - '*http://219.156.60.143:47272/bin.sh*' - '*http://42.224.100.104:57589/i*' - '*http://110.136.44.90:51644/Mozi.m*' - '*http://91.92.40.8/real.bot*' - '*http://119.180.108.226:57617/i*' - '*http://78.70.179.92:42070/i*' - '*http://105.224.11.26:59697/i*' - '*http://105.224.11.26:59697/bin.sh*' - '*http://193.163.187.213:56836/bin.sh*' - '*http://112.248.155.54:45383/i*' - '*http://39.71.201.170:33249/i*' - '*http://112.248.102.74:50390/i*' - '*http://222.241.209.93:40812/i*' - '*http://105.184.7.22:52755/bin.sh*' - '*http://112.248.102.74:50390/bin.sh*' - '*http://125.41.8.198:53946/i*' - '*http://222.241.209.93:40812/bin.sh*' - '*http://115.55.11.148:49241/i*' - '*http://95.155.151.113/d/xd.spc*' - '*http://95.155.151.113/d/xd.mpsl*' - '*http://95.155.151.113/d/xd.ppc*' - '*http://95.155.151.113/d/xd.mips*' - '*http://95.155.151.113/d/xd.arm6*' - '*http://95.155.151.113/d/xd.arm*' - '*http://95.155.151.113/d/xd.m68k*' - '*http://95.155.151.113/d/xd.sh4*' - '*http://95.155.151.113/d/xd.arm7*' - '*http://95.155.151.113/d/xd.arm5*' - '*http://112.240.149.165:44630/i*' - '*http://115.57.207.9:60274/i*' - '*http://115.57.207.9:60274/bin.sh*' - '*http://94.154.43.148/MMaaRRiiOisecTanee/MMaaRRiiOisecTanee.mips*' - '*http://182.121.154.139:48630/i*' - '*http://110.37.14.156:44009/i*' - '*http://110.37.14.156:44009/bin.sh*' - '*http://115.59.239.53:39489/bin.sh*' - '*http://182.121.154.139:48630/bin.sh*' - '*http://222.137.143.236:33500/i*' - '*http://42.230.16.64:45927/i*' - '*http://123.12.229.234:36096/bin.sh*' - '*http://101.23.127.47:39961/i*' - '*http://182.121.72.50:38226/bin.sh*' - '*http://24.95.54.96:52325/i*' - '*http://101.23.127.47:39961/bin.sh*' - '*http://24.95.54.96:52325/bin.sh*' - '*http://77.247.88.99:55148/i*' - '*http://42.232.227.101:60282/i*' - '*http://219.155.229.130:56067/i*' - '*http://42.232.227.101:60282/bin.sh*' - '*http://222.141.214.75:35349/i*' - '*http://219.155.229.130:56067/bin.sh*' - '*http://77.247.88.99:55148/bin.sh*' - '*http://105.225.20.91:54171/bin.sh*' - '*http://115.49.0.112:37398/i*' - '*http://110.36.65.9:44808/bin.sh*' - '*http://123.172.77.129:59541/Mozi.m*' - '*http://129.121.110.105/ya4*' - '*http://105.224.29.237:48127/bin.sh*' - '*http://129.121.110.105/y1V*' - '*http://110.136.44.90:51644/i*' - '*http://91.199.133.133:8080/real_sh4*' - '*http://91.199.133.133:8080/bot.arm6*' - '*http://91.199.133.133:8080/real_ppc*' - '*http://91.199.133.133:8080/bot.x86*' - '*http://91.199.133.133:8080/real_i686*' - '*http://91.199.133.133:8080/real_arm5*' - '*http://91.199.133.133:8080/backup_0729_0324/real_arm*' - '*http://91.199.133.133:8080/backup_0729_0324/real_mips*' - '*http://117.253.48.187:52715/bin.sh*' - '*http://91.199.133.133:8080/bot.i686*' - '*http://91.199.133.133:8080/real_arm6*' - '*http://91.199.133.133:8080/real_arm7*' - '*http://91.199.133.133:8080/backup_0729_0324/real_mipsel*' - '*http://91.199.133.133:8080/bot.sh4*' - '*http://91.199.133.133:8080/ssh_brute*' - '*http://91.199.133.133:8080/real_x86*' - '*http://91.199.133.133:8080/bot.m68k*' - '*http://91.199.133.133:8080/real_m68k*' - '*http://91.199.133.133:8080/backup_0729_0324/real_x86_64*' - '*http://91.199.133.133:8080/bot.arm7*' - '*http://91.199.133.133:8080/bot.ppc*' - '*http://91.199.133.133:8080/backup_0729_0324/real_arm64*' - '*http://91.199.133.133:8080/bot.arm5*' - '*http://91.199.133.133:8080/real_spc*' - '*http://91.199.133.133:8080/bot.spc*' - '*http://138.204.196.254:43475/i*' - '*http://129.121.110.105/hix*' - '*http://129.121.110.105/RYb*' - '*http://129.121.110.105/HjEG*' - '*http://110.136.44.90:51644/bin.sh*' - '*http://61.53.121.177:56479/i*' - '*http://115.49.0.112:37398/bin.sh*' - '*http://138.204.196.254:43475/bin.sh*' - '*http://123.11.9.222:36220/i*' - '*http://61.52.93.219:46118/i*' - '*http://123.11.9.222:36220/bin.sh*' - '*http://61.52.93.219:46118/bin.sh*' - '*http://222.141.76.155:42372/i*' - '*http://222.141.76.155:42372/bin.sh*' - '*http://115.48.160.16:39786/bin.sh*' - '*http://60.176.252.170:42159/i*' - '*http://105.184.163.226:59621/i*' - '*http://125.40.64.214:46221/i*' - '*http://45.90.163.37//i486*' - '*http://45.90.163.37//powerpc*' - '*http://45.90.163.37//x86_64*' - '*http://45.90.163.37//i586*' - '*http://45.90.163.37//arm6*' - '*http://105.184.163.226:59621/bin.sh*' - '*http://125.40.64.214:46221/bin.sh*' - '*http://123.11.201.131:38238/bin.sh*' - '*http://123.13.48.160:33892/i*' - '*http://175.9.165.126:50484/bin.sh*' - '*http://61.53.121.177:56479/bin.sh*' - '*http://123.13.48.160:33892/bin.sh*' - '*http://112.242.183.234:58250/i*' - '*http://105.225.45.181:49165/i*' - '*http://112.242.183.234:58250/bin.sh*' - '*http://105.224.29.237:48127/i*' - '*http://115.63.84.79:53096/i*' - '*http://115.50.227.121:51281/i*' - '*http://110.37.100.201:58257/i*' - '*http://110.37.20.126:52033/i*' - '*http://115.48.148.255:58056/bin.sh*' - '*http://110.37.20.126:52033/bin.sh*' - '*http://109.236.46.199:50732/i*' - '*http://115.58.140.184:54228/i*' - '*http://115.57.253.89:52552/i*' - '*http://222.137.107.54:52378/i*' - '*http://45.90.163.37/i586*' - '*http://125.45.64.153:35082/i*' - '*http://125.45.64.153:35082/bin.sh*' - '*http://125.44.62.231:47335/i*' - '*http://115.58.140.184:54228/bin.sh*' - '*http://222.137.107.54:52378/bin.sh*' - '*http://27.194.103.229:35055/i*' - '*http://115.49.4.159:41971/i*' - '*http://115.58.83.206:45304/i*' - '*http://182.127.39.171:35008/i*' - '*http://112.233.255.77:33563/bin.sh*' - '*http://115.58.83.206:45304/bin.sh*' - '*http://182.127.39.171:35008/bin.sh*' - '*http://119.189.180.123:43056/i*' - '*http://115.51.43.20:46643/Mozi.m*' - '*http://42.55.49.152:38131/i*' - '*http://182.127.152.44:43288/i*' - '*http://182.127.152.44:43288/bin.sh*' - '*http://182.127.220.172:56464/i*' - '*http://110.85.99.9:38787/i*' - '*http://42.234.143.117:46657/i*' - '*http://122.159.34.131:39014/i*' - '*http://123.11.15.96:57440/i*' - '*http://123.5.128.250:35434/i*' - '*http://42.234.143.117:46657/bin.sh*' - '*http://182.116.38.225:55685/i*' - '*http://182.112.187.182:59130/bin.sh*' - '*http://123.5.128.250:35434/bin.sh*' - '*http://123.4.237.59:38288/i*' - '*http://123.14.101.207:44266/i*' - '*http://124.131.38.18:35909/i*' - '*http://42.224.193.224:50332/i*' - '*http://115.63.148.102:52572/bin.sh*' - '*http://124.131.38.18:35909/bin.sh*' - '*http://115.42.71.239:36758/bin.sh*' - '*http://182.121.215.97:37750/i*' - '*http://182.121.215.97:37750/bin.sh*' - '*http://115.55.63.89:54711/i*' - '*http://110.39.233.38:44583/bin.sh*' - '*http://115.55.63.89:54711/bin.sh*' - '*http://182.112.187.182:59130/i*' - '*http://115.49.72.114:35444/i*' - '*http://61.176.211.198:50302/i*' - '*http://216.126.86.75:39675/i*' - '*http://115.63.149.201:59931/i*' - '*http://216.126.86.75:39675/bin.sh*' - '*http://115.51.18.64:37808/i*' - '*http://113.237.63.22:56535/bin.sh*' - '*http://115.63.149.201:59931/bin.sh*' - '*http://115.63.48.100:44388/bin.sh*' - '*http://182.117.76.246:41138/i*' - '*http://123.4.237.59:38288/bin.sh*' - '*http://182.117.76.246:41138/bin.sh*' - '*http://105.224.110.80:47391/bin.sh*' - '*http://112.109.219.55:35136/i*' - '*http://182.127.114.76:45513/bin.sh*' - '*http://182.119.56.112:38183/i*' - '*http://123.12.236.117:57801/i*' - '*http://182.119.56.112:38183/bin.sh*' - '*http://119.179.237.104:60418/i*' - '*http://182.121.76.61:34989/i*' - '*http://115.48.25.201:59802/i*' - '*http://157.66.146.183:33846/i*' - '*http://222.138.132.154:55677/bin.sh*' - '*http://157.66.146.183:33846/bin.sh*' - '*http://115.61.11.221:34368/i*' - '*http://220.202.64.91:60576/bin.sh*' - '*http://113.231.228.129:59970/i*' - '*http://182.117.157.252:35315/bin.sh*' - '*http://182.122.196.88:52990/i*' - '*http://110.36.86.83:37291/i*' - '*http://113.231.228.129:59970/bin.sh*' - '*http://105.184.74.158:60163/i*' - '*http://182.117.157.252:35315/i*' - '*http://110.36.86.83:37291/bin.sh*' - '*http://115.59.89.146:48634/i*' - '*http://42.237.34.50:37654/i*' - '*http://94.154.43.203/bins/x86*' - '*http://94.154.43.203/bins/setting.xml*' - '*http://110.36.80.170:45483/i*' - '*http://42.237.34.50:37654/bin.sh*' - '*http://36.70.229.45:50390/i*' - '*http://110.36.80.170:45483/bin.sh*' - '*http://61.53.133.47:33333/i*' - '*http://59.103.121.32:38872/i*' - '*http://36.70.229.45:50390/bin.sh*' - '*http://115.56.168.117:44708/i*' - '*http://175.166.48.251:60468/i*' - '*http://115.216.101.165:41093/i*' - '*http://115.56.168.117:44708/bin.sh*' - '*http://46.236.65.235:51725/i*' - '*http://123.14.40.245:36647/i*' - '*http://110.85.108.218:41787/bin.sh*' - '*http://46.236.65.235:51725/bin.sh*' - '*http://123.7.227.87:60846/i*' - '*http://125.41.138.40:50809/i*' - '*http://175.166.48.251:60468/bin.sh*' - '*http://115.216.101.165:41093/bin.sh*' - '*http://115.57.120.233:32949/i*' - '*http://27.152.9.9:45145/bin.sh*' - '*http://125.43.37.182:53403/i*' - '*http://123.7.227.87:60846/bin.sh*' - '*http://61.53.75.251:59632/bin.sh*' - '*http://222.136.124.161:46959/bin.sh*' - '*http://125.41.138.40:50809/bin.sh*' - '*http://129.121.110.105/qme1*' - '*http://129.121.110.105/5FF*' - '*http://61.176.211.198:50302/bin.sh*' - '*http://125.43.37.182:53403/bin.sh*' - '*http://115.57.120.233:32949/bin.sh*' - '*http://129.121.110.105/LFt3*' - '*http://129.121.110.105/Lrtt*' - '*http://129.121.110.105/LrHq*' - '*http://220.158.234.220/m68k*' - '*http://45.207.196.86/bins/x86_64*' - '*http://45.207.196.86/bins/m68k*' - '*http://175.166.39.238:54134/i*' - '*http://123.4.197.18:59332/i*' - '*http://222.136.124.161:46959/i*' - '*http://175.173.214.165:59176/i*' - '*http://182.119.95.67:58013/i*' - '*http://182.119.95.67:58013/bin.sh*' - '*http://119.118.88.64:60669/i*' - '*http://115.55.147.8:34455/i*' - '*http://175.173.214.165:59176/bin.sh*' - '*http://61.53.133.47:33333/bin.sh*' - '*http://42.56.135.237:46645/i*' - '*http://37.34.242.99:35650/i*' - '*http://119.118.88.64:60669/bin.sh*' - '*http://94.45.34.166:43430/i*' - '*http://182.113.196.20:42129/i*' - '*http://27.218.62.176:52915/i*' - '*http://115.51.123.243:41991/i*' - '*http://182.113.196.20:42129/bin.sh*' - '*http://37.34.242.99:35650/bin.sh*' - '*http://115.51.123.243:41991/bin.sh*' - '*http://27.218.62.176:52915/bin.sh*' - '*http://115.55.46.154:38247/i*' - '*http://113.236.101.64:54189/bin.sh*' - '*http://112.247.255.36:59436/bin.sh*' - '*http://42.227.186.84:59865/bin.sh*' - '*http://219.156.188.57:46035/i*' - '*http://103.44.137.12:60790/i*' - '*http://219.156.188.57:46035/bin.sh*' - '*http://182.114.34.162:50206/i*' - '*http://103.44.137.12:60790/bin.sh*' - '*http://123.14.208.6:40785/i*' - '*http://91.199.133.133:8080/backup_old/real_mips*' - '*http://91.199.133.133:8080/backup_old/real_arm64*' - '*http://91.199.133.133:8080/backup_old/real_x86_64*' - '*http://91.199.133.133:8080/backup_old/real_mipsel*' - '*http://91.199.133.133:8080/backup_old/real_arm*' - '*http://182.117.43.4:35927/bin.sh*' - '*http://112.248.187.137:46314/i*' - '*http://59.91.116.175:52715/i*' - '*http://115.55.54.124:46531/i*' - '*http://59.91.116.175:52715/bin.sh*' - '*http://121.205.208.226:40109/i*' - '*http://115.55.54.124:46531/bin.sh*' - '*http://94.154.43.88/iran.mipsel*' - '*http://94.154.43.88/iran.sparc*' - '*http://94.154.43.88/iran.armv5l*' - '*http://94.154.43.88/iran.sh4*' - '*http://94.154.43.88/iran.armv6l*' - '*http://94.154.43.88/iran.armv7l*' - '*http://94.154.43.88/iran.i486*' - '*http://94.154.43.88/iran.arc*' - '*http://94.154.43.88/iran.x86_64*' - '*http://94.154.43.88/iran.mips*' - '*http://94.154.43.88/iran.aarch64*' - '*http://94.154.43.88/iran.armv4l*' - '*http://94.154.43.88/iran.m68k*' - '*http://94.154.43.88/iran.powerpc*' - '*http://31.56.209.153/nz/mz.x86_64*' - '*http://217.60.195.127/zero.armv6l*' - '*http://217.60.195.127/zero.armv7l*' - '*http://217.60.195.127/zero.armv4l*' - '*http://217.60.195.127/zero.sh4*' - '*http://217.60.195.127/zero.mipsrouter*' - '*http://217.60.195.127/zero.aarch64*' - '*http://217.60.195.127/zero.x86*' - '*http://217.60.195.127/zero.sparc*' - '*http://217.60.195.127/zero.armv5l*' - '*http://217.60.195.127/zero.m68k*' - '*http://217.60.195.127/zero.arc*' - '*http://217.60.195.127/zero.i486*' - '*http://217.60.195.127/zero.powerpc*' - '*http://217.60.195.127/zero.mips*' - '*http://217.60.195.127/zero.mipsel*' - '*http://111.178.125.136:60629/bin.sh*' - '*http://222.141.76.13:35648/i*' - '*http://121.205.208.226:40109/bin.sh*' - '*http://182.117.43.4:35927/i*' - '*http://91.153.133.160:48556/i*' - '*http://109.171.67.100:11548/i*' - '*http://94.154.43.42:12113/exec_binary*' - '*http://109.171.67.100:11548/bin.sh*' - '*http://221.15.21.172:35153/i*' - '*http://113.237.98.82:45619/i*' - '*http://221.15.21.172:35153/bin.sh*' - '*http://112.242.84.50:42236/i*' - '*http://105.186.73.125:55379/bin.sh*' - '*http://112.242.84.50:42236/bin.sh*' - '*http://182.127.122.39:55560/bin.sh*' - '*http://36.70.192.137:46780/i*' - '*http://185.141.233.178:34836/i*' - '*http://115.55.134.46:35308/i*' - '*http://36.70.192.137:46780/bin.sh*' - '*http://185.141.233.178:34836/bin.sh*' - '*http://36.70.225.171:47786/bin.sh*' - '*http://123.5.127.59:55258/i*' - '*http://115.50.202.13:54565/i*' - '*http://182.119.63.53:45610/bin.sh*' - '*http://123.5.127.59:55258/bin.sh*' - '*http://115.55.134.46:35308/bin.sh*' - '*http://42.58.160.115:46446/i*' - '*http://221.15.190.195:57524/i*' - '*http://222.138.132.154:55677/i*' - '*http://182.121.15.2:55953/i*' - '*http://182.121.15.2:55953/bin.sh*' - '*http://221.15.190.195:57524/bin.sh*' - '*http://125.40.51.82:52574/i*' - '*http://222.219.74.211:52755/i*' - '*http://123.12.230.120:38720/i*' - '*http://110.36.19.51:42772/bin.sh*' - '*http://222.219.74.211:52755/bin.sh*' - '*http://182.127.122.39:55560/i*' - '*http://123.12.230.120:38720/bin.sh*' - '*http://37.52.154.254:47072/i*' - '*http://182.112.156.220:41236/bin.sh*' - '*http://110.37.118.111:36398/bin.sh*' - '*http://125.40.51.82:52574/bin.sh*' - '*http://110.37.127.45:57192/i*' - '*http://110.37.90.152:49622/i*' - '*http://196.189.35.226:52074/bin.sh*' - '*http://37.52.154.254:47072/bin.sh*' - '*http://110.39.237.185:54089/bin.sh*' - '*http://125.44.178.22:35366/i*' - '*http://125.44.178.22:35366/bin.sh*' - '*http://61.52.46.142:56039/i*' - '*http://221.14.106.122:40872/i*' - '*http://185.139.214.200/bins/kworker_u8*' - '*http://185.139.214.200/bins/scsi_tmf_0*' - '*http://185.139.214.200/bins/rcuop_0*' - '*http://185.139.214.200/bins/xfsaild_sda*' - '*http://123.4.139.99:60299/i*' - '*http://185.139.214.200/bins/zswap_shrinkd*' - '*http://185.139.214.200/bins/edac_polld*' - '*http://185.139.214.200/bins/cfg80211d*' - '*http://185.139.214.200/bins/ecryptfsd*' - '*http://185.139.214.200/bins/jbd2_sda1d*' - '*http://185.139.214.200/bins/devfreq_wq*' - '*http://185.139.214.200/bins/ksoftirqd0*' - '*http://185.139.214.200/bins/kblockd0*' - '*http://185.139.214.200/bins/bioset0*' - '*http://185.139.214.200/loader.sh*' - '*http://185.139.214.200/bins/kswapd0*' - '*http://222.141.131.55:37958/i*' - '*http://182.119.29.39:51227/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 2 id: 3280d032-ab24-5bda-a626-46ea367dec83 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 2). logsource: category: proxy detection: selection: c-uri: - '*http://221.14.106.122:40872/bin.sh*' - '*http://222.141.131.55:37958/bin.sh*' - '*http://103.80.57.126:40459/bin.sh*' - '*http://123.4.139.99:60299/bin.sh*' - '*http://115.61.11.221:34368/bin.sh*' - '*http://112.198.130.140:58398/i*' - '*http://182.119.29.39:51227/bin.sh*' - '*http://175.165.30.194:45609/i*' - '*http://175.165.30.194:45609/bin.sh*' - '*http://120.84.215.86:46712/i*' - '*http://120.84.215.86:46712/bin.sh*' - '*http://182.113.248.129:40563/i*' - '*http://115.55.193.45:44664/i*' - '*http://182.113.248.129:40563/bin.sh*' - '*http://115.55.193.45:44664/bin.sh*' - '*http://193.187.101.227:41875/i*' - '*http://182.112.30.222:60319/Mozi.m*' - '*http://193.187.101.227:41875/bin.sh*' - '*http://110.37.10.113:54024/i*' - '*http://110.37.10.113:54024/bin.sh*' - '*http://123.130.133.208:53097/i*' - '*http://42.232.87.69:53184/i*' - '*http://42.229.242.151:58197/i*' - '*http://175.146.153.129:51494/i*' - '*http://91.199.133.133:8080/real_arm64*' - '*http://91.199.133.133:8080/rawbot_mipsel*' - '*http://91.199.133.133:8080/dlr.arm*' - '*http://91.199.133.133:8080/dlr.x86_64*' - '*http://91.199.133.133:8080/bot_discord*' - '*http://91.199.133.133:8080/test_mipsel_26*' - '*http://91.199.133.133:8080/bot_attack*' - '*http://91.199.133.133:8080/test_mips_26*' - '*http://91.199.133.133:8080/condi_c2*' - '*http://91.199.133.133:8080/router_exploit_v2*' - '*http://91.199.133.133:8080/real_x86_64*' - '*http://91.199.133.133:8080/bot.x86_64*' - '*http://91.199.133.133:8080/dlr.arm64*' - '*http://91.199.133.133:8080/discord_mipsel*' - '*http://91.199.133.133:8080/dlr.mipsel*' - '*http://91.199.133.133:8080/real_mipsel*' - '*http://91.199.133.133:8080/rawbot_mips*' - '*http://91.199.133.133:8080/real_mips*' - '*http://91.199.133.133:8080/bot.arm64*' - '*http://91.199.133.133:8080/bot.arm*' - '*http://91.199.133.133:8080/real_arm*' - '*http://91.199.133.133:8080/router_exploit*' - '*http://91.199.133.133:8080/listen_v3*' - '*http://91.199.133.133:8080/bot.mips*' - '*http://91.199.133.133:8080/boa_attacker*' - '*http://91.199.133.133:8080/bot.mipsel*' - '*http://91.199.133.133:8080/dlr.mips*' - '*http://42.237.3.199:60716/bin.sh*' - '*http://42.228.40.137:45035/i*' - '*http://112.248.191.118:48377/i*' - '*http://42.229.242.151:58197/bin.sh*' - '*http://182.127.114.76:45513/i*' - '*http://222.137.93.50:33652/i*' - '*http://222.137.93.50:33652/bin.sh*' - '*http://105.224.118.28:59451/i*' - '*http://61.53.122.167:59808/bin.sh*' - '*http://110.36.19.51:42772/i*' - '*http://105.224.118.28:59451/bin.sh*' - '*http://115.57.80.21:56349/i*' - '*http://110.37.118.111:36398/i*' - '*http://42.234.244.177:43724/i*' - '*http://114.227.48.176:58022/i*' - '*http://123.13.27.244:52593/i*' - '*http://123.13.27.244:52593/bin.sh*' - '*http://125.160.138.209:38748/i*' - '*http://27.215.124.45:58615/i*' - '*http://125.160.138.209:38748/bin.sh*' - '*http://42.226.65.43:49727/i*' - '*http://42.226.217.102:48667/i*' - '*http://42.226.65.43:49727/bin.sh*' - '*http://196.190.228.108:60661/i*' - '*http://42.226.217.102:48667/bin.sh*' - '*http://117.26.83.49:58079/i*' - '*http://117.26.83.49:58079/bin.sh*' - '*http://115.42.71.239:36758/i*' - '*http://119.179.255.108:50390/bin.sh*' - '*http://77.247.88.98:59064/i*' - '*http://123.252.17.79:33677/i*' - '*http://115.55.230.75:57358/i*' - '*http://182.117.81.84:53513/bin.sh*' - '*http://77.247.88.98:59064/bin.sh*' - '*http://123.13.72.42:38211/i*' - '*http://1.58.225.143:41065/i*' - '*http://115.55.230.75:57358/bin.sh*' - '*http://182.127.104.102:52909/i*' - '*http://123.252.17.79:33677/bin.sh*' - '*http://125.44.50.221:45691/i*' - '*http://180.190.85.135:39719/bin.sh*' - '*http://123.14.99.150:41745/bin.sh*' - '*http://39.74.83.192:39533/i*' - '*http://182.114.193.246:52052/i*' - '*http://115.53.219.93:49340/i*' - '*http://115.53.219.93:49340/bin.sh*' - '*http://123.11.172.243:59690/bin.sh*' - '*http://123.11.8.183:36623/i*' - '*http://31.77.227.110/bins/parm5*' - '*http://31.77.227.110/bins/pmips*' - '*http://31.77.227.110/bins/pppc*' - '*http://31.77.227.110/bins/pmpsl*' - '*http://31.77.227.110/bins/psh4*' - '*http://31.77.227.110/bins/parm*' - '*http://31.77.227.110/bins/x86_64*' - '*http://31.77.227.110/bins/pm68k*' - '*http://31.77.227.110/bins/pspc*' - '*http://31.77.227.110/bins/parm7*' - '*http://31.77.227.110/bins/parm6*' - '*http://31.77.227.110/bins/px86*' - '*http://196.190.11.194:36423/i*' - '*http://167.250.158.32:51374/bin.sh*' - '*http://196.190.11.194:36423/bin.sh*' - '*http://42.234.144.27:35871/Mozi.m*' - '*http://110.36.19.101:44917/i*' - '*http://182.116.8.238:59497/i*' - '*http://182.121.16.139:39047/i*' - '*http://105.225.189.9:47465/i*' - '*http://120.28.218.170:54332/i*' - '*http://77.247.88.121:58180/i*' - '*http://27.215.176.102:59504/i*' - '*http://105.184.99.91:34645/i*' - '*http://180.107.162.176:3588/bin.sh*' - '*http://182.121.16.139:39047/bin.sh*' - '*http://105.225.189.9:47465/bin.sh*' - '*http://77.247.88.121:58180/bin.sh*' - '*http://27.215.176.102:59504/bin.sh*' - '*http://105.184.99.91:34645/bin.sh*' - '*http://219.155.231.79:38940/i*' - '*http://182.116.8.238:59497/bin.sh*' - '*http://115.57.245.208:51181/i*' - '*http://125.41.226.164:54727/i*' - '*http://123.14.99.150:41745/i*' - '*http://221.15.140.164:33153/i*' - '*http://125.41.226.164:54727/bin.sh*' - '*http://110.85.98.202:38787/i*' - '*http://123.11.222.99:60685/bin.sh*' - '*http://45.207.196.86/bins/arm7*' - '*http://61.52.84.47:46026/i*' - '*http://45.207.196.86/bins/ppc*' - '*http://45.207.196.86/bins/mips*' - '*http://45.207.196.86/bins/sh4*' - '*http://45.207.196.86/bins/arm6*' - '*http://103.249.199.3:54470/i*' - '*http://103.249.199.3:54470/bin.sh*' - '*http://110.85.98.202:38787/bin.sh*' - '*http://115.62.183.239:40077/bin.sh*' - '*http://125.47.75.31:38821/bin.sh*' - '*http://162.255.251.91:56761/bin.sh*' - '*http://220.202.88.92:53928/i*' - '*http://27.213.108.217:58646/i*' - '*http://121.236.121.212:56911/i*' - '*http://27.213.108.217:58646/bin.sh*' - '*http://61.52.84.47:46026/bin.sh*' - '*http://61.52.53.53:51951/i*' - '*http://113.206.236.100:53989/i*' - '*http://121.236.121.212:56911/bin.sh*' - '*http://61.52.53.53:51951/bin.sh*' - '*http://196.189.96.59:36980/i*' - '*http://125.47.68.253:38949/i*' - '*http://196.189.96.59:36980/bin.sh*' - '*http://113.206.236.100:53989/bin.sh*' - '*http://125.47.68.253:38949/bin.sh*' - '*http://119.167.3.49:55650/i*' - '*http://45.150.110.50/bins/arm5*' - '*http://45.150.110.50/bins/arm6*' - '*http://45.150.110.50/bins/mipsel*' - '*http://45.150.110.50/bins/x86*' - '*http://45.150.110.50/bins/mips*' - '*http://45.150.110.50/bins/arm7*' - '*http://125.45.58.188:34980/i*' - '*http://115.57.164.23:36060/i*' - '*http://115.57.164.23:36060/bin.sh*' - '*http://125.40.214.219:54823/i*' - '*http://5.166.39.19:27250/i*' - '*http://115.63.48.165:35036/bin.sh*' - '*http://115.48.36.226:48544/i*' - '*http://222.127.77.227:51520/i*' - '*http://27.215.45.91:55255/i*' - '*http://77.247.88.81:49544/i*' - '*http://27.215.45.91:55255/bin.sh*' - '*http://103.44.136.115:40363/i*' - '*http://103.44.136.115:40363/bin.sh*' - '*http://119.116.38.141:51501/bin.sh*' - '*http://222.138.149.25:37984/i*' - '*http://125.44.34.100:54105/i*' - '*http://2.183.135.123:46360/i*' - '*http://175.149.73.167:52513/i*' - '*http://182.112.176.29:36020/i*' - '*http://27.215.108.28:50461/i*' - '*http://175.149.73.167:52513/bin.sh*' - '*http://182.112.176.29:36020/bin.sh*' - '*http://27.215.108.28:50461/bin.sh*' - '*http://95.133.245.15/mips*' - '*http://95.133.245.15/arm7*' - '*http://95.133.245.15/arm*' - '*http://95.133.245.15/arm5*' - '*http://31.56.209.153/nz/nz.i468*' - '*http://95.133.245.15/mipsel*' - '*http://110.178.50.118:55930/i*' - '*http://182.117.107.220:49098/Mozi.m*' - '*http://217.60.195.143/zero.mipsel*' - '*http://217.60.195.143/zero.armv7l*' - '*http://217.60.195.143/zero.x86_64*' - '*http://217.60.195.143/zero.armv6l*' - '*http://217.60.195.143/zero.armv4l*' - '*http://217.60.195.143/zero.i486*' - '*http://217.60.195.143/zero.armv5l*' - '*http://217.60.195.143/zero.sh4*' - '*http://217.60.195.143/zero.sparc*' - '*http://217.60.195.143/zero.powerpc*' - '*http://217.60.195.143/zero.mips*' - '*http://217.60.195.143/zero.m68k*' - '*http://217.60.195.143/zero.arc*' - '*http://110.178.50.118:55930/bin.sh*' - '*http://115.63.132.215:49858/bin.sh*' - '*http://175.150.26.8:44311/i*' - '*http://27.196.214.193:45611/i*' - '*http://222.142.195.230:37884/i*' - '*http://175.150.26.8:44311/bin.sh*' - '*http://27.196.214.193:45611/bin.sh*' - '*http://196.189.35.226:52074/i*' - '*http://125.45.58.85:43244/bin.sh*' - '*http://125.45.58.85:43244/i*' - '*http://196.190.133.180:37291/i*' - '*http://222.137.5.224:39395/i*' - '*http://109.171.67.100:36752/i*' - '*http://182.121.237.15:57581/i*' - '*http://115.63.48.165:35036/i*' - '*http://119.179.252.0:46609/i*' - '*http://110.37.66.64:58776/i*' - '*http://119.116.172.202:60468/i*' - '*http://109.171.67.100:36752/bin.sh*' - '*http://125.45.48.113:43164/bin.sh*' - '*http://119.116.172.202:60468/bin.sh*' - '*http://123.11.9.221:44191/i*' - '*http://221.200.220.208:52188/bin.sh*' - '*http://125.45.48.113:43164/i*' - '*http://123.11.9.221:44191/bin.sh*' - '*http://36.48.59.106:36887/i*' - '*http://105.184.105.78:54415/i*' - '*http://219.157.142.18:37229/i*' - '*http://175.43.178.52:46651/i*' - '*http://175.43.178.52:46651/bin.sh*' - '*http://110.93.243.19:44295/i*' - '*http://36.48.59.106:36887/bin.sh*' - '*http://189.127.169.20:49051/i*' - '*http://219.157.142.18:37229/bin.sh*' - '*http://105.184.105.78:54415/bin.sh*' - '*http://115.50.206.131:47410/bin.sh*' - '*http://115.48.146.133:51348/i*' - '*http://110.93.243.19:44295/bin.sh*' - '*http://27.206.131.190:40981/i*' - '*http://123.12.46.154:50072/i*' - '*http://118.248.37.90:52887/i*' - '*http://113.221.74.28:33643/bin.sh*' - '*http://121.202.142.137:26355/i*' - '*http://182.117.153.96:58569/i*' - '*http://118.248.37.90:52887/bin.sh*' - '*http://115.55.194.171:48855/i*' - '*http://115.53.223.6:57787/i*' - '*http://121.202.142.137:26355/bin.sh*' - '*http://115.52.23.187:53327/bin.sh*' - '*http://115.63.145.31:53393/i*' - '*http://61.52.186.184:44221/bin.sh*' - '*http://182.127.100.92:56238/i*' - '*http://110.39.233.38:44583/i*' - '*http://222.139.226.149:45819/bin.sh*' - '*http://123.5.133.123:52241/i*' - '*http://114.234.181.161:59025/i*' - '*http://123.5.133.123:52241/bin.sh*' - '*http://114.234.181.161:59025/bin.sh*' - '*http://42.234.200.29:42542/i*' - '*http://79.106.74.167:36061/bin.sh*' - '*http://77.239.124.139/nz/nz.m68k*' - '*http://77.239.124.139/nz/nz.spc*' - '*http://77.239.124.139/nz/debug*' - '*http://77.239.124.139/nz/nz.arc*' - '*http://77.239.124.139/nz/nz.sh4*' - '*http://77.239.124.139/nz/nz.ppc*' - '*http://77.239.124.139/nz/nz.mpsl*' - '*http://77.239.124.139/nz/nz.mips*' - '*http://77.239.124.139/nz/nz.arm5*' - '*http://77.239.124.139/nz/nz.arm*' - '*http://77.239.124.139/nz/nz.i686*' - '*http://77.239.124.139/nz/nz.x86_64*' - '*http://77.239.124.139/nz/nz.x86*' - '*http://77.239.124.139/nz/nz.arm6*' - '*http://104.252.175.109/data_mips*' - '*http://104.252.175.109/data_mipsel*' - '*http://219.157.249.115:35796/i*' - '*http://123.11.13.173:44354/i*' - '*http://221.15.185.193:50489/i*' - '*http://123.11.13.173:44354/bin.sh*' - '*http://27.152.9.9:45145/i*' - '*http://123.14.222.11:36503/bin.sh*' - '*http://221.15.185.193:50489/bin.sh*' - '*http://42.233.106.151:52431/i*' - '*http://123.12.24.225:48493/i*' - '*http://42.233.106.151:52431/bin.sh*' - '*http://123.12.46.32:47501/i*' - '*http://27.44.146.5:48371/i*' - '*http://115.50.206.131:47410/i*' - '*http://182.127.55.197:36002/i*' - '*http://196.191.104.78:33085/i*' - '*http://59.96.137.70:47200/Mozi.a*' - '*http://182.127.55.197:36002/bin.sh*' - '*http://105.184.15.142:37051/bin.sh*' - '*http://196.191.104.78:33085/bin.sh*' - '*http://42.237.17.56:51129/i*' - '*http://115.53.192.166:47722/bin.sh*' - '*http://182.126.119.15:49602/i*' - '*http://31.56.209.153/nz/nz.arm7*' - '*http://115.55.59.60:46353/i*' - '*http://31.56.209.153/nz/nz.arm5*' - '*http://31.56.209.153/nz/nz.arc*' - '*http://31.56.209.153/nz/nz.arm6*' - '*http://31.56.209.153/nz/nz.spc*' - '*http://31.56.209.153/nz/nz.i686*' - '*http://31.56.209.153/nz/nz.m68k*' - '*http://31.56.209.153/nz/nz.arm*' - '*http://31.56.209.153/nz/nz.sh4*' - '*http://31.56.209.153/nz/debug*' - '*http://31.56.209.153/nz/nz.mips*' - '*http://31.56.209.153/nz/nz.mpsl*' - '*http://31.56.209.153/nz/nz.x86*' - '*http://31.56.209.153/nz/nz.ppc*' - '*http://31.56.209.153/nz/nz.x86_64*' - '*http://59.96.137.193:40730/i*' - '*http://59.96.137.193:40730/bin.sh*' - '*http://217.60.195.187/LjEZs/arc*' - '*http://217.60.195.187/LjEZs/sh4*' - '*http://217.60.195.187/LjEZs/x86_64*' - '*http://217.60.195.187/LjEZs/mpsl*' - '*http://217.60.195.187/LjEZs/arm5*' - '*http://217.60.195.187/LjEZs/arm*' - '*http://217.60.195.187/LjEZs/m68k*' - '*http://217.60.195.187/LjEZs/arm7*' - '*http://217.60.195.187/LjEZs/x86*' - '*http://217.60.195.187/LjEZs/arm6*' - '*http://217.60.195.187/LjEZs/spc*' - '*http://217.60.195.187/LjEZs/mips*' - '*http://217.60.195.187/LjEZs/ppc*' - '*http://101.109.207.145:47440/bin.sh*' - '*http://110.39.255.227:54639/i*' - '*http://182.121.193.126:57398/i*' - '*http://125.40.83.207:35917/i*' - '*http://182.121.193.126:57398/bin.sh*' - '*http://217.60.195.199/flutter.arm*' - '*http://217.60.195.199/flutter.arm8*' - '*http://217.60.195.199/flutter.arm6*' - '*http://217.60.195.199/flutter.ppc64*' - '*http://217.60.195.199/flutter.x86*' - '*http://217.60.195.199/flutter.arm5*' - '*http://217.60.195.199/flutter.mips*' - '*http://217.60.195.199/flutter.x86_64*' - '*http://217.60.195.199/flutter.arm7*' - '*http://217.60.195.199/flutter.mipsel*' - '*http://217.60.195.199/flutter.ppc*' - '*http://217.60.195.199/flutter.m68k*' - '*http://110.39.255.227:54639/bin.sh*' - '*http://42.230.219.88:42220/i*' - '*http://118.232.137.101:56315/i*' - '*http://42.235.87.85:56674/i*' - '*http://42.230.219.88:42220/bin.sh*' - '*http://45.94.47.226/Doxanu*' - '*http://125.44.62.169:53481/i*' - '*http://118.232.137.101:56315/bin.sh*' - '*http://219.157.39.0:34723/i*' - '*http://61.53.122.167:59808/i*' - '*http://42.235.87.85:56674/bin.sh*' - '*http://123.8.24.77:56637/i*' - '*http://205.237.110.232/gigatex/aarch64*' - '*http://125.44.62.169:53481/bin.sh*' - '*http://125.44.19.78:54105/i*' - '*http://123.4.235.143:54118/bin.sh*' - '*http://123.9.244.135:59466/i*' - '*http://42.229.185.138:36224/i*' - '*http://158.94.211.63:8080/agent.bin*' - '*http://182.127.122.126:51711/i*' - '*http://2.58.56.170:8080/sync.sh*' - '*http://42.227.197.44:52761/i*' - '*http://209.38.75.180/pty3*' - '*http://60.21.94.139:47752/i*' - '*http://27.159.173.4:51830/bin.sh*' - '*http://182.127.122.126:51711/bin.sh*' - '*http://125.44.38.211:54876/bin.sh*' - '*http://42.227.197.44:52761/bin.sh*' - '*http://59.180.170.37:53154/i*' - '*http://60.21.94.139:47752/bin.sh*' - '*http://68.183.43.110/pty4*' - '*http://68.183.43.110/pty3*' - '*http://68.183.43.110/pty10*' - '*http://94.154.43.80/hiddenbin/boatnet.x86_64*' - '*http://94.154.43.80/hiddenbin/boatnet.arm5*' - '*http://94.154.43.80/hiddenbin/boatnet.i486*' - '*http://94.154.43.80/hiddenbin/boatnet.mpsl*' - '*http://94.154.43.80/hiddenbin/boatnet.arm6*' - '*http://94.154.43.80/hiddenbin/boatnet.arm*' - '*http://94.154.43.80/hiddenbin/boatnet.sh4*' - '*http://94.154.43.80/mips*' - '*http://94.154.43.80/hiddenbin/boatnet.mips*' - '*http://94.154.43.80/hiddenbin/boatnet.x86*' - '*http://94.154.43.80/hiddenbin/boatnet.m68k*' - '*http://94.154.43.80/hiddenbin/boatnet.arm7*' - '*http://94.154.43.80/bin.sh*' - '*http://94.154.43.80/hiddenbin/boatnet.ppc*' - '*http://94.154.43.80/hiddenbin/boatnet.i686*' - '*http://94.154.43.80/hiddenbin/boatnet.spc*' - '*http://192.159.99.173/load.sh*' - '*http://2.26.136.128/ftp.sh*' - '*http://2.26.136.128/mload.sh*' - '*http://2.26.136.128/dlr.mips*' - '*http://125.44.38.211:54876/i*' - '*http://2.26.136.128/dlr.mpsl*' - '*http://2.26.136.128/w*' - '*http://2.26.136.128/x86*' - '*http://117.9.0.160:38039/i*' - '*http://27.215.110.45:35968/bin.sh*' - '*http://2.26.136.128/dlr.arm6*' - '*http://2.26.136.128/dlr.arm5*' - '*http://2.26.136.128/d.sh*' - '*http://2.26.136.128/nvmsUpdate*' - '*http://2.26.136.128/dlr.arm7*' - '*http://2.26.136.128/lul.arm7*' - '*http://2.26.136.128/a*' - '*http://2.26.136.128/lul.arm*' - '*http://2.26.136.128/dlr.arm*' - '*http://2.26.136.128/karm6*' - '*http://2.26.136.128/lul.arm5*' - '*http://2.26.136.128/tftp.sh*' - '*http://31.56.209.70/nz/nz.i468*' - '*http://2.26.136.128/tarm7*' - '*http://103.161.17.92/hiddenbin/boatnet.arm*' - '*http://2.26.136.128/tarm5*' - '*http://103.161.17.92/hiddenbin/boatnet.ppc*' - '*http://103.161.17.92/hiddenbin/boatnet.sh4*' - '*http://2.26.136.128/tarm6*' - '*http://205.237.110.232/gigatex/mipsel*' - '*http://2.26.136.128/tarm*' - '*http://103.161.17.92/hiddenbin/boatnet.mpsl*' - '*http://103.161.17.92/hiddenbin/boatnet.arm6*' - '*http://103.161.17.92/hiddenbin/boatnet.x86*' - '*http://103.161.17.92/hiddenbin/boatnet.spc*' - '*http://103.161.17.92/hiddenbin/boatnet.mips*' - '*http://103.161.17.92/hiddenbin/boatnet.arm5*' - '*http://103.161.17.92/hiddenbin/boatnet.arc*' - '*http://2.26.136.128/tmips*' - '*http://103.161.17.92/hiddenbin/boatnet.arm7*' - '*http://103.161.17.92/hiddenbin/boatnet.m68k*' - '*http://205.237.110.232/gigatex/x86*' - '*http://103.161.17.92/hiddenbin/boatnet.i686*' - '*http://103.161.17.92/hiddenbin/boatnet.i468*' - '*http://103.161.17.92/hiddenbin/boatnet.x86_64*' - '*http://2.26.136.128/tmpsl*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i486*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i686*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64*' - '*http://94.154.43.61/c.sh*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arc*' - '*http://94.154.43.61/wget.sh*' - '*http://94.154.43.61/MMaaRRiiOisecTanee/MMaaRRiiOisecTanee.mips*' - '*http://94.154.43.61/w.sh*' - '*http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4*' - '*http://221.15.189.92:53997/i*' - '*http://125.166.31.187:48533/i*' - '*http://61.52.44.62:58722/i*' - '*http://38.56.21.66:51466/i*' - '*http://94.154.43.68/bins/kla.sh*' - '*http://103.161.17.92/ohshit.sh*' - '*http://130.12.209.147:55604/Mozi.m*' - '*http://110.37.97.32:49108/Mozi.a*' - '*http://117.26.226.163:59859/bin.sh*' - '*http://61.52.44.62:58722/bin.sh*' - '*http://125.166.31.187:48533/bin.sh*' - '*http://115.54.189.23:55481/i*' - '*http://39.90.187.50:58528/bin.sh*' - '*http://115.54.189.23:55481/bin.sh*' - '*http://60.161.2.82:56389/i*' - '*http://112.248.155.45:45383/i*' - '*http://60.161.2.82:56389/bin.sh*' - '*http://216.126.86.127:58945/i*' - '*http://221.15.189.92:53997/bin.sh*' - '*http://27.215.138.98:41527/i*' - '*http://115.57.74.75:35953/i*' - '*http://115.57.74.75:35953/bin.sh*' - '*http://222.134.175.71:46678/i*' - '*http://222.134.175.71:46678/bin.sh*' - '*http://123.14.102.112:54726/bin.sh*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 3 id: b4c3a7d0-bec2-5921-8931-e0b92dde7ae9 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 3). logsource: category: proxy detection: selection: c-uri: - '*http://115.50.66.149:51699/i*' - '*http://219.156.105.152:51559/i*' - '*http://42.178.61.155:32836/i*' - '*http://115.50.66.149:51699/bin.sh*' - '*http://42.231.47.59:38421/i*' - '*http://196.189.198.193:41438/i*' - '*http://196.189.198.193:41438/bin.sh*' - '*http://196.191.137.44:58420/bin.sh*' - '*http://196.191.104.40:53304/i*' - '*http://27.37.102.120:54475/i*' - '*http://27.37.102.120:54475/bin.sh*' - '*http://196.191.104.40:53304/bin.sh*' - '*http://105.184.26.87:54517/i*' - '*http://42.7.240.14:46174/i*' - '*http://105.184.26.87:54517/bin.sh*' - '*http://60.23.204.28:55899/bin.sh*' - '*http://220.158.234.220/arm*' - '*http://220.158.234.220/arm6*' - '*http://220.158.234.220/mpsl*' - '*http://222.219.74.179:52755/bin.sh*' - '*http://105.186.248.15:48079/bin.sh*' - '*http://115.49.200.94:35681/i*' - '*http://115.63.11.85:44190/bin.sh*' - '*http://42.227.203.153:43612/i*' - '*http://125.41.1.174:35830/i*' - '*http://123.5.186.150:49680/i*' - '*http://42.227.203.153:43612/bin.sh*' - '*http://117.146.92.46:38207/i*' - '*http://182.117.12.120:60697/i*' - '*http://182.117.12.120:60697/bin.sh*' - '*http://117.26.82.68:34302/i*' - '*http://42.231.47.59:38421/bin.sh*' - '*http://115.63.11.85:44190/i*' - '*http://59.58.188.145:33841/i*' - '*http://163.142.95.231:51284/i*' - '*http://112.240.253.166:57337/bin.sh*' - '*http://59.58.188.145:33841/bin.sh*' - '*http://123.4.168.73:36224/bin.sh*' - '*http://125.41.6.91:34555/i*' - '*http://125.42.236.220:40189/i*' - '*http://196.188.75.58:54416/i*' - '*http://27.215.208.135:40785/i*' - '*http://196.188.75.58:54416/bin.sh*' - '*http://42.231.70.61:51928/i*' - '*http://125.41.6.91:34555/bin.sh*' - '*http://175.146.225.46:48972/i*' - '*http://111.127.235.14:58633/bin.sh*' - '*http://125.42.236.220:40189/bin.sh*' - '*http://42.231.70.61:51928/bin.sh*' - '*http://27.37.100.220:38525/i*' - '*http://175.146.225.46:48972/bin.sh*' - '*http://27.215.208.135:40785/bin.sh*' - '*http://178.150.97.200:32971/i*' - '*http://61.52.186.184:44221/i*' - '*http://27.37.100.220:38525/bin.sh*' - '*http://14.177.88.148:46180/i*' - '*http://124.131.145.114:44654/i*' - '*http://178.150.97.200:32971/bin.sh*' - '*http://105.187.42.210:52419/i*' - '*http://110.85.99.205:38787/i*' - '*http://115.57.254.177:40779/i*' - '*http://115.57.254.177:40779/bin.sh*' - '*http://106.41.137.15:48343/i*' - '*http://46.236.65.43:41753/i*' - '*http://119.183.25.240:40130/bin.sh*' - '*http://115.55.239.136:53259/i*' - '*http://221.14.39.115:54130/i*' - '*http://115.56.171.219:49349/bin.sh*' - '*http://221.14.39.115:54130/bin.sh*' - '*http://125.47.239.251:37472/bin.sh*' - '*http://125.40.1.120:40654/bin.sh*' - '*http://115.49.203.4:34910/i*' - '*http://123.4.235.143:54118/i*' - '*http://182.127.167.83:54570/i*' - '*http://31.56.209.70/nz/nz.arm7*' - '*http://31.56.209.70/nz/nz.arm*' - '*http://31.56.209.70/nz/debug*' - '*http://31.56.209.70/nz/nz.m68k*' - '*http://31.56.209.70/nz/nz.ppc*' - '*http://31.56.209.70/nz/nz.arm5*' - '*http://31.56.209.70/nz/nz.arc*' - '*http://31.56.209.70/nz/nz.mpsl*' - '*http://31.56.209.70/nz/nz.mips*' - '*http://31.56.209.70/nz/nz.sh4*' - '*http://31.56.209.70/nz/nz.x86_64*' - '*http://31.56.209.70/nz/nz.spc*' - '*http://31.56.209.70/nz/nz.i686*' - '*http://31.56.209.70/nz/nz.x86*' - '*http://31.56.209.70/nz/nz.arm6*' - '*http://125.41.77.70:42863/bin.sh*' - '*http://115.50.26.7:56593/i*' - '*http://196.190.105.170:55224/bin.sh*' - '*http://115.49.90.44:58247/i*' - '*http://27.204.193.52:38367/i*' - '*http://27.204.193.52:38367/bin.sh*' - '*http://115.49.90.44:58247/bin.sh*' - '*http://123.14.86.236:46520/i*' - '*http://123.14.86.236:46520/bin.sh*' - '*http://61.53.147.144:57960/i*' - '*http://185.228.82.213/bins/morte.sh4*' - '*http://185.228.82.213/bins/morte.arm5*' - '*http://185.228.82.213/bins/morte.arm6*' - '*http://185.228.82.213/bins/morte.mips*' - '*http://185.228.82.213/bins/morte.arm7*' - '*http://185.228.82.213/bins/morte.mpsl*' - '*http://185.228.82.213/bins/morte.ppc*' - '*http://185.228.82.213/bins/morte.x86*' - '*http://185.228.82.213/bins/morte.m68k*' - '*http://185.228.82.213/bins/morte.arm4*' - '*http://117.253.61.124:54512/bin.sh*' - '*http://61.53.147.144:57960/bin.sh*' - '*http://110.37.39.146:47539/bin.sh*' - '*http://175.147.154.140:40485/i*' - '*http://120.43.15.30:58079/i*' - '*http://196.189.9.233:52901/i*' - '*http://110.36.1.200:34803/i*' - '*http://42.229.118.241:36901/i*' - '*http://27.204.224.152:60969/bin.sh*' - '*http://42.229.118.241:36901/bin.sh*' - '*http://115.56.144.2:47881/bin.sh*' - '*http://105.184.215.155:41731/i*' - '*http://42.239.188.92:38164/i*' - '*http://117.251.194.217:34712/Mozi.a*' - '*http://61.52.82.234:58492/i*' - '*http://185.228.82.213/awoo.sh*' - '*http://115.55.239.136:53259/bin.sh*' - '*http://105.184.215.155:41731/bin.sh*' - '*http://61.52.82.234:58492/bin.sh*' - '*http://110.37.39.146:47539/i*' - '*http://112.240.253.166:57337/i*' - '*http://205.237.110.232/gigatex/mips*' - '*http://205.237.110.232/gigatex/arm5*' - '*http://5.182.210.61/6479b5*' - '*http://5.182.210.61/e0e3db*' - '*http://5.182.210.61/ed194d*' - '*http://5.182.210.61/658944*' - '*http://5.182.210.61/b01242*' - '*http://5.182.210.61/5a18e2*' - '*http://5.182.210.61/2f46f0*' - '*http://5.182.210.61/b183ce*' - '*http://5.182.210.61/06bf36*' - '*http://5.182.210.61/2e484e*' - '*http://5.182.210.61/1ea271*' - '*http://5.182.210.61/ed7d7d*' - '*http://5.182.210.61/2f5b16*' - '*http://5.182.210.61/4dd8c4*' - '*http://5.182.210.61/af5caa*' - '*http://5.182.210.61/56fcee*' - '*http://5.182.210.61/7c1c1e*' - '*http://5.182.210.61/107d4c*' - '*http://5.182.210.61/6e8bae*' - '*http://5.182.210.61/4687f4*' - '*http://5.182.210.61/6951ce*' - '*http://5.182.210.61/bad060*' - '*http://5.182.210.61/23d115*' - '*http://5.182.210.61/01aa6b*' - '*http://205.237.110.232/gigatex/arm*' - '*http://205.237.110.232/gigatex/arm7*' - '*http://129.121.114.124/qMHl*' - '*http://129.121.114.124/CbgG*' - '*http://129.121.114.124/siZ*' - '*http://205.237.110.232/gigatex/mpsl*' - '*http://129.121.114.124/hRgU*' - '*http://129.121.114.124/ivo*' - '*http://190.115.80.35:49166/Mozi.m*' - '*http://45.177.32.104:48133/bin.sh*' - '*http://182.117.32.243:40434/i*' - '*http://42.232.30.250:60656/i*' - '*http://110.37.74.205:55589/i*' - '*http://112.247.255.36:59436/i*' - '*http://219.154.190.15:39243/i*' - '*http://182.117.32.243:40434/bin.sh*' - '*http://115.62.176.34:34668/bin.sh*' - '*http://105.184.79.27:43661/i*' - '*http://182.114.193.12:34103/i*' - '*http://182.114.193.12:34103/bin.sh*' - '*http://39.79.8.145:34405/i*' - '*http://42.235.170.224:34138/i*' - '*http://42.231.173.192:60685/i*' - '*http://81.231.82.79:42070/i*' - '*http://222.141.83.185:55957/bin.sh*' - '*http://105.224.7.192:36987/i*' - '*http://42.179.15.251:48866/i*' - '*http://110.36.15.1:37195/i*' - '*http://105.224.7.192:36987/bin.sh*' - '*http://41.216.189.236/bins/oiwefhfoloongarch64wopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfom68kwopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfosh4wopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfoi386wopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfoaarch64wopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfomipswopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhforiscv64wopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfopowerpcwopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfomicroblazewopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfoor1kwopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfox86_64wopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhforiscv32wopqfjwiuas*' - '*http://41.216.189.236/bins/oiwefhfosh2wopqfjwiuas*' - '*http://98.252.87.232:55884/i*' - '*http://77.79.160.210:45662/i*' - '*http://61.53.0.204:40742/i*' - '*http://98.252.87.232:55884/bin.sh*' - '*http://110.36.2.23:45384/i*' - '*http://42.239.11.141:53311/i*' - '*http://182.116.22.120:47264/i*' - '*http://112.237.236.9:43718/bin.sh*' - '*http://110.36.2.23:45384/bin.sh*' - '*http://39.74.35.191:45301/i*' - '*http://112.248.187.225:57944/i*' - '*http://110.36.65.9:53456/i*' - '*http://42.231.47.185:46513/i*' - '*http://105.224.82.249:42805/bin.sh*' - '*http://42.231.47.185:46513/bin.sh*' - '*http://182.114.193.246:52583/i*' - '*http://182.119.0.224:34128/i*' - '*http://42.224.97.81:43645/i*' - '*http://42.232.180.224:37072/i*' - '*http://105.186.187.17:52313/i*' - '*http://182.119.0.224:34128/bin.sh*' - '*http://110.36.28.230:48902/i*' - '*http://129.121.110.105/flB*' - '*http://129.121.110.105/SbKs*' - '*http://42.232.180.224:37072/bin.sh*' - '*http://171.83.59.154:46798/i*' - '*http://105.186.187.17:52313/bin.sh*' - '*http://171.83.59.154:46798/bin.sh*' - '*http://42.239.226.213:55619/i*' - '*http://129.121.110.105/yIB*' - '*http://129.121.110.105/WGGU*' - '*http://129.121.110.105/8oZ*' - '*http://110.36.28.230:48902/bin.sh*' - '*http://42.239.226.213:55619/bin.sh*' - '*http://94.154.43.42:808/perc.x86*' - '*http://42.55.37.12:50302/bin.sh*' - '*http://123.11.73.177:37884/i*' - '*http://112.255.63.96:43173/i*' - '*http://112.255.63.96:43173/bin.sh*' - '*http://110.36.75.245:37546/i*' - '*http://110.36.90.129:55690/i*' - '*http://182.127.152.209:46104/bin.sh*' - '*http://120.28.201.35:39329/i*' - '*http://101.66.20.151:34135/bin.sh*' - '*http://182.116.20.221:53095/i*' - '*http://120.28.201.35:39329/bin.sh*' - '*http://182.116.20.221:53095/bin.sh*' - '*http://27.8.3.55:37740/i*' - '*http://45.177.32.104:48133/i*' - '*http://114.227.48.176:58022/bin.sh*' - '*http://110.37.73.3:37630/i*' - '*http://27.8.3.55:37740/bin.sh*' - '*http://182.127.102.174:34892/i*' - '*http://182.127.102.174:34892/bin.sh*' - '*http://188.233.80.29:46107/bin.sh*' - '*http://110.36.75.201:39997/i*' - '*http://123.14.208.211:40785/bin.sh*' - '*http://110.37.21.60:40410/i*' - '*http://110.36.75.201:39997/bin.sh*' - '*http://72.255.30.244:44339/i*' - '*http://45.207.196.86/payload.sh*' - '*http://110.37.21.60:40410/bin.sh*' - '*http://72.255.30.244:44339/bin.sh*' - '*http://125.47.34.218:35283/i*' - '*http://46.216.199.241:53041/bin.sh*' - '*http://123.14.219.164:58511/i*' - '*http://123.130.59.140:55267/i*' - '*http://182.127.69.227:41922/i*' - '*http://27.207.227.95:37522/bin.sh*' - '*http://123.130.59.140:55267/bin.sh*' - '*http://123.7.220.34:50236/i*' - '*http://175.150.1.74:49881/i*' - '*http://175.150.1.74:49881/bin.sh*' - '*http://27.44.146.244:50458/i*' - '*http://113.225.34.170:33833/i*' - '*http://110.39.255.247:59624/i*' - '*http://61.53.148.84:50258/i*' - '*http://182.119.250.213:52704/i*' - '*http://78.73.69.23:42070/i*' - '*http://113.225.34.170:33833/bin.sh*' - '*http://120.43.15.30:58079/bin.sh*' - '*http://61.53.148.84:50258/bin.sh*' - '*http://182.119.250.213:52704/bin.sh*' - '*http://39.88.4.102:46092/i*' - '*http://110.37.12.8:57186/i*' - '*http://125.40.44.193:33777/i*' - '*http://42.235.49.63:40981/i*' - '*http://125.40.44.193:33777/bin.sh*' - '*http://42.235.49.63:40981/bin.sh*' - '*http://220.133.154.70:40154/bin.sh*' - '*http://193.31.201.20:53638/i*' - '*http://67.197.195.125:58613/i*' - '*http://93.157.253.209:45451/i*' - '*http://182.123.247.79:42733/i*' - '*http://125.43.225.123:44975/i*' - '*http://125.43.225.123:44975/bin.sh*' - '*http://27.193.63.212:38756/i*' - '*http://123.9.90.10:49133/i*' - '*http://59.103.116.68:36364/i*' - '*http://123.13.141.30:32930/i*' - '*http://219.155.211.129:54088/i*' - '*http://59.103.116.68:36364/bin.sh*' - '*http://222.208.111.39:43160/i*' - '*http://123.13.141.30:32930/bin.sh*' - '*http://160.30.142.2:42184/i*' - '*http://160.30.142.2:42184/bin.sh*' - '*http://182.113.219.53:55448/i*' - '*http://182.113.219.53:55448/bin.sh*' - '*http://222.208.111.39:43160/bin.sh*' - '*http://119.179.250.16:44326/i*' - '*http://119.179.250.16:44326/bin.sh*' - '*http://221.15.242.183:51802/i*' - '*http://223.10.4.192:35468/i*' - '*http://123.5.185.65:47976/i*' - '*http://221.15.242.183:51802/bin.sh*' - '*http://223.10.4.192:35468/bin.sh*' - '*http://196.190.69.149:38766/i*' - '*http://61.163.149.140:45095/i*' - '*http://85.11.167.224/bins/arm5*' - '*http://85.11.167.224/huhu/titanjr.arm5*' - '*http://85.11.167.224/huhu/titanjr.arm*' - '*http://85.11.167.224/huhu/titanjr.ppc*' - '*http://85.11.167.224/huhu/titanjr.arm7*' - '*http://85.11.167.224/mipsel*' - '*http://85.11.167.224/ppc*' - '*http://85.11.167.224/huhu/titanjr.mips*' - '*http://61.163.149.140:45095/bin.sh*' - '*http://115.55.167.46:38646/i*' - '*http://59.180.136.198:52846/i*' - '*http://219.155.211.181:56314/i*' - '*http://115.61.119.0:59394/i*' - '*http://115.55.167.46:38646/bin.sh*' - '*http://219.155.211.181:56314/bin.sh*' - '*http://110.37.64.31:60162/i*' - '*http://111.88.7.48:57794/i*' - '*http://182.120.11.86:50293/bin.sh*' - '*http://218.73.97.231:34731/i*' - '*http://183.92.205.61:44151/i*' - '*http://125.40.112.92:52218/i*' - '*http://124.92.78.253:60827/i*' - '*http://218.73.97.231:34731/bin.sh*' - '*http://110.185.65.207:57774/bin.sh*' - '*http://125.40.112.92:52218/bin.sh*' - '*http://183.92.205.61:44151/bin.sh*' - '*http://175.9.134.169:50484/i*' - '*http://119.166.141.245:58165/bin.sh*' - '*http://42.232.108.146:48828/i*' - '*http://175.9.134.169:50484/bin.sh*' - '*http://42.232.108.146:48828/bin.sh*' - '*http://182.116.35.228:39727/bin.sh*' - '*http://27.215.176.150:40899/i*' - '*http://27.207.231.96:35454/i*' - '*http://196.190.228.108:53676/i*' - '*http://196.190.228.108:53676/bin.sh*' - '*http://110.36.29.73:56138/i*' - '*http://42.237.20.8:42542/i*' - '*http://110.37.43.119:45382/i*' - '*http://42.226.70.39:48349/i*' - '*http://101.66.20.151:34135/i*' - '*http://42.226.70.39:48349/bin.sh*' - '*http://110.37.43.119:45382/bin.sh*' - '*http://113.230.198.209:40757/i*' - '*http://123.4.207.83:36878/i*' - '*http://112.198.140.250:36883/i*' - '*http://125.43.41.42:39783/i*' - '*http://123.4.207.83:36878/bin.sh*' - '*http://112.198.140.250:36883/bin.sh*' - '*http://222.141.83.185:55957/i*' - '*http://115.55.195.19:47264/i*' - '*http://27.193.63.212:38756/bin.sh*' - '*http://182.127.153.207:60157/bin.sh*' - '*http://115.55.195.19:47264/bin.sh*' - '*http://115.55.57.240:48898/bin.sh*' - '*http://119.116.124.229:37559/bin.sh*' - '*http://105.224.253.102:45835/bin.sh*' - '*http://171.81.97.131:34342/i*' - '*http://171.81.97.131:34342/bin.sh*' - '*http://182.113.33.238:39802/i*' - '*http://27.210.41.219:48552/i*' - '*http://45.207.196.86/bins/x86*' - '*http://42.235.80.131:51699/bin.sh*' - '*http://111.35.78.2:26702/i*' - '*http://182.113.29.60:41084/i*' - '*http://182.113.33.238:39802/bin.sh*' - '*http://111.35.78.2:26702/bin.sh*' - '*http://117.251.6.63:49901/bin.sh*' - '*http://105.225.107.53:52335/bin.sh*' - '*http://43.228.157.47/bot.mips*' - '*http://42.227.128.250:40404/i*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnpowerpcxnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnor1kxnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnsh4xnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnmipsxnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnriscv32xnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnsh2xnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnmicroblazexnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnriscv64xnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnx86_64xnxn*' - '*http://123.7.236.222:55776/i*' - '*http://125.44.221.211:37637/bin.sh*' - '*http://110.36.109.57:35387/i*' - '*http://182.113.36.146:42173/i*' - '*http://110.36.109.57:35387/bin.sh*' - '*http://110.36.25.58:41114/Mozi.a*' - '*http://110.37.12.8:50702/i*' - '*http://27.207.227.95:37522/i*' - '*http://110.36.70.189:37746/i*' - '*http://110.37.12.8:50702/bin.sh*' - '*http://182.119.221.36:37593/i*' - '*http://110.36.70.189:37746/bin.sh*' - '*http://105.184.236.200:57839/i*' - '*http://115.57.232.101:49435/i*' - '*http://105.184.236.200:57839/bin.sh*' - '*http://60.19.223.48:41000/i*' - '*http://94.154.43.191:8080/mips*' - '*http://45.233.94.135:47604/i*' - '*http://60.19.223.48:41000/bin.sh*' - '*http://115.57.232.101:49435/bin.sh*' - '*http://115.55.234.59:45952/i*' - '*http://115.57.195.152:35283/i*' - '*http://182.113.43.32:32781/i*' - '*http://45.8.118.17:54149/i*' - '*http://45.233.94.135:47604/bin.sh*' - '*http://27.215.44.41:60969/i*' - '*http://113.228.134.22:50099/bin.sh*' - '*http://182.113.43.32:32781/bin.sh*' - '*http://221.1.141.26:55302/i*' - '*http://221.1.141.26:55302/bin.sh*' - '*http://45.207.196.86/bins/arm5*' - '*http://45.207.196.86/bins/mpsl*' - '*http://45.207.196.86/bins/arm*' - '*http://182.127.152.209:46104/i*' - '*http://125.118.90.28:50649/i*' - '*http://74.83.48.109:2399/bin.sh*' - '*http://125.118.90.28:50649/bin.sh*' - '*http://182.116.35.228:39727/i*' - '*http://42.226.76.230:49460/bin.sh*' - '*http://45.172.218.181:40632/i*' - '*http://182.114.197.58:57757/bin.sh*' - '*http://219.154.184.42:46862/i*' - '*http://119.116.25.147:45381/i*' - '*http://182.123.210.111:53086/i*' - '*http://180.107.162.176:3588/i*' - '*http://123.9.193.189:33011/i*' - '*http://59.180.142.187:52846/i*' - '*http://219.154.184.42:46862/bin.sh*' - '*http://110.39.255.227:57592/i*' - '*http://222.137.38.14:58676/i*' - '*http://219.157.65.193:56360/i*' - '*http://222.137.38.14:58676/bin.sh*' - '*http://185.89.157.150:49271/i*' - '*http://110.38.221.182:49247/i*' - '*http://115.55.194.228:54338/i*' - '*http://219.157.65.193:56360/bin.sh*' - '*http://222.134.175.201:33021/i*' - '*http://185.89.157.150:49271/bin.sh*' - '*http://115.55.48.247:33991/bin.sh*' - '*http://36.88.136.194:45815/i*' - '*http://110.38.221.182:49247/bin.sh*' - '*http://110.39.255.227:57592/bin.sh*' - '*http://42.52.207.199:34276/i*' - '*http://219.154.36.120:43197/i*' - '*http://42.235.95.190:60510/bin.sh*' - '*http://113.230.198.209:40757/bin.sh*' - '*http://129.121.114.124/CcDE*' - '*http://129.121.114.124/RGno*' - '*http://129.121.114.124/GD8*' - '*http://129.121.114.124/QRV*' - '*http://129.121.114.124/iZ5O*' - '*http://58.242.23.224:33747/bin.sh*' - '*http://36.88.136.194:45815/bin.sh*' - '*http://112.248.60.201:41266/bin.sh*' - '*http://42.52.207.199:34276/bin.sh*' - '*http://110.36.72.243:42963/i*' - '*http://61.53.75.206:44584/bin.sh*' - '*http://222.142.250.254:57339/i*' - '*http://110.36.72.243:42963/bin.sh*' - '*http://222.142.250.254:57339/bin.sh*' - '*http://61.52.107.24:50209/i*' - '*http://61.52.107.24:50209/bin.sh*' - '*http://182.119.71.32:60620/i*' - '*http://175.147.31.159:46645/i*' - '*http://123.148.142.235:43457/Mozi.a*' - '*http://123.148.142.235:43457/i*' - '*http://123.148.142.235:43457/bin.sh*' - '*http://123.148.142.235:43457/Mozi.m*' - '*http://42.235.95.190:60510/i*' - '*http://195.201.123.9/iran.sh4*' - '*http://195.201.123.9/iran.armv7l*' - '*http://195.201.123.9/iran.sparc*' - '*http://195.201.123.9/iran.armv6l*' - '*http://195.201.123.9/iran.arc*' - '*http://195.201.123.9/iran.armv5l*' - '*http://195.201.123.9/iran.powerpc*' - '*http://195.201.123.9/iran.armv4l*' - '*http://195.201.123.9/iran.i486*' - '*http://175.147.31.159:46645/bin.sh*' - '*http://182.126.121.209:60111/i*' - '*http://222.138.181.164:52853/i*' - '*http://110.36.15.18:39149/bin.sh*' - '*http://42.224.102.236:47807/i*' - '*http://114.198.242.174:33658/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 4 id: 31d10a72-77a2-5904-a676-31ec13776188 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 4). logsource: category: proxy detection: selection: c-uri: - '*http://182.126.121.209:60111/bin.sh*' - '*http://42.55.37.12:50302/i*' - '*http://182.117.14.43:59751/i*' - '*http://222.138.181.164:52853/bin.sh*' - '*http://42.224.102.236:47807/bin.sh*' - '*http://115.58.132.251:54865/i*' - '*http://37.34.237.45:39142/bin.sh*' - '*http://106.41.137.15:48343/bin.sh*' - '*http://182.117.14.43:59751/bin.sh*' - '*http://36.70.237.129:50450/i*' - '*http://196.191.231.12:36097/i*' - '*http://196.189.198.193:37192/i*' - '*http://196.190.195.130:54419/i*' - '*http://110.36.25.58:42271/i*' - '*http://120.28.215.129:50122/bin.sh*' - '*http://36.70.237.129:50450/bin.sh*' - '*http://110.36.93.217:49376/i*' - '*http://196.189.198.193:37192/bin.sh*' - '*http://110.36.93.217:49376/bin.sh*' - '*http://180.114.248.166:45399/bin.sh*' - '*http://196.190.195.130:54419/bin.sh*' - '*http://123.148.227.127:43983/i*' - '*http://115.51.108.250:34740/i*' - '*http://45.74.3.37:5001/armv7l*' - '*http://45.74.3.37:5001/arm*' - '*http://45.74.3.37:5001/android_arm64*' - '*http://45.74.3.37:5001/arm64*' - '*http://45.74.3.37:5001/mips*' - '*http://45.74.3.37:5001/arm6*' - '*http://45.74.3.37:5001/arm5*' - '*http://45.74.3.37:5001/mipsle*' - '*http://45.74.3.37:5001/i386*' - '*http://45.74.3.37:5001/x86*' - '*http://45.74.3.37:5001/amd64*' - '*http://219.155.202.252:43444/i*' - '*http://222.137.24.130:48867/bin.sh*' - '*http://42.228.47.62:38943/i*' - '*http://115.63.55.58:56860/bin.sh*' - '*http://115.51.108.250:34740/bin.sh*' - '*http://123.148.227.127:43983/bin.sh*' - '*http://42.227.165.242:54918/i*' - '*http://42.227.204.240:50152/i*' - '*http://110.37.104.0:39260/i*' - '*http://182.114.197.58:57757/i*' - '*http://42.227.165.242:54918/bin.sh*' - '*http://94.154.43.180/mpsl*' - '*http://94.154.43.115/bins/px86*' - '*http://94.154.43.115/bins/pspc*' - '*http://94.154.43.115/bins/parm7*' - '*http://94.154.43.115/bins/parm6*' - '*http://94.154.43.115/bins/x86_64*' - '*http://94.154.43.115/bins/parm5*' - '*http://94.154.43.115/bins/parm*' - '*http://94.154.43.115/bins/pmips*' - '*http://94.154.43.115/bins/pm68k*' - '*http://94.154.43.115/bins/psh4*' - '*http://94.154.43.115/bins/pppc*' - '*http://94.154.43.115/bins/pmpsl*' - '*http://39.85.99.152:53887/i*' - '*http://138.204.196.254:58384/i*' - '*http://222.134.174.95:46609/i*' - '*http://219.156.87.24:34598/i*' - '*http://39.85.99.152:53887/bin.sh*' - '*http://177.86.229.12:58871/i*' - '*http://222.134.174.95:46609/bin.sh*' - '*http://138.204.196.254:58384/bin.sh*' - '*http://219.156.87.24:34598/bin.sh*' - '*http://58.47.19.12:40509/i*' - '*http://130.12.209.147:55604/i*' - '*http://81.229.60.159:51889/bin.sh*' - '*http://58.47.19.12:40509/bin.sh*' - '*http://42.226.66.96:32872/i*' - '*http://31.173.199.131:45019/bin.sh*' - '*http://110.37.39.88:54707/i*' - '*http://130.12.209.147:55604/bin.sh*' - '*http://59.97.251.104:39714/i*' - '*http://110.36.31.132:35333/bin.sh*' - '*http://42.232.182.254:38076/bin.sh*' - '*http://103.176.139.56:38161/bin.sh*' - '*http://59.97.251.104:39714/bin.sh*' - '*http://110.36.31.132:35333/i*' - '*http://219.155.84.10:38873/bin.sh*' - '*http://94.154.43.37/bins/sora.sh4*' - '*http://94.154.43.37/bins/sora.arm5*' - '*http://94.154.43.37/bins/sora.x86*' - '*http://94.154.43.37/bins/sora.spc*' - '*http://94.154.43.37/bins/sora.arm*' - '*http://94.154.43.37/bins/sora.mips*' - '*http://94.154.43.37/bins/sora.arm6*' - '*http://94.154.43.37/bins/sora.m68k*' - '*http://94.154.43.37/bins/sora.mpsl*' - '*http://94.154.43.37/bins/sora.ppc*' - '*http://110.36.31.205:38677/i*' - '*http://185.82.110.106:51070/i*' - '*http://61.52.90.68:47197/i*' - '*http://119.117.54.119:47695/i*' - '*http://175.173.138.212:56771/i*' - '*http://110.36.31.205:38677/bin.sh*' - '*http://119.117.54.119:47695/bin.sh*' - '*http://94.154.43.164/armv7l*' - '*http://61.53.216.33:38955/bin.sh*' - '*http://42.229.240.151:58197/bin.sh*' - '*http://185.82.110.106:51070/bin.sh*' - '*http://110.36.25.58:42271/bin.sh*' - '*http://162.249.125.141/release/mips*' - '*http://162.249.125.141/release/arm7*' - '*http://162.249.125.141/release/arm5*' - '*http://162.249.125.141/release/mipsel*' - '*http://162.249.125.141/release/arm*' - '*http://110.37.104.0:39260/bin.sh*' - '*http://123.132.167.175:45301/bin.sh*' - '*http://179.49.213.85:54579/bin.sh*' - '*http://110.37.31.174:58913/i*' - '*http://182.117.42.238:54871/bin.sh*' - '*http://125.47.243.166:53293/i*' - '*http://190.7.240.24:43473/bin.sh*' - '*http://113.237.108.171:45619/bin.sh*' - '*http://182.124.39.218:41705/i*' - '*http://27.96.228.235:2069/i*' - '*http://27.96.228.235:2069/bin.sh*' - '*http://110.36.18.60:46723/i*' - '*http://61.53.216.33:38955/i*' - '*http://110.37.38.176:46241/i*' - '*http://110.37.73.3:54669/i*' - '*http://110.37.38.176:46241/bin.sh*' - '*http://110.37.73.3:54669/bin.sh*' - '*http://110.36.27.209:46596/bin.sh*' - '*http://219.155.84.10:38873/i*' - '*http://182.127.6.238:37368/i*' - '*http://1.62.231.16:48265/i*' - '*http://120.28.194.204:46863/bin.sh*' - '*http://129.121.110.105/5F5E*' - '*http://129.121.110.105/GTu*' - '*http://129.121.110.105/EKT*' - '*http://129.121.110.105/PrOo*' - '*http://129.121.110.105/9V5S*' - '*http://129.121.110.105/D1Qd*' - '*http://129.121.110.105/jc6*' - '*http://129.121.110.105/D32*' - '*http://129.121.110.105/idSL*' - '*http://129.121.110.105/3fN4*' - '*http://129.121.110.105/2eHC*' - '*http://129.121.110.105/XOB*' - '*http://129.121.110.105/FpmO*' - '*http://129.121.110.105/AAgC*' - '*http://129.121.114.124/tE6C*' - '*http://129.121.110.105/2i1I*' - '*http://129.121.110.105/C61*' - '*http://129.121.110.105/R6Pi*' - '*http://129.121.110.105/dH1*' - '*http://129.121.110.105/UMnf*' - '*http://129.121.110.105/34Pn*' - '*http://129.121.110.105/vsxv*' - '*http://129.121.110.105/FuF0*' - '*http://129.121.110.105/VDy*' - '*http://129.121.110.105/bgX*' - '*http://129.121.114.124/0FG*' - '*http://129.121.110.105/iM7*' - '*http://114.227.50.186:47510/i*' - '*http://123.14.89.113:46520/i*' - '*http://182.119.198.213:54545/bin.sh*' - '*http://112.248.60.201:41266/i*' - '*http://182.127.6.238:37368/bin.sh*' - '*http://223.167.60.201:59230/i*' - '*http://223.167.60.201:59230/bin.sh*' - '*http://110.37.5.60:60679/i*' - '*http://42.231.88.153:48898/i*' - '*http://125.41.3.103:41295/i*' - '*http://42.231.88.153:48898/bin.sh*' - '*http://42.180.15.15:60688/i*' - '*http://110.37.5.60:60679/bin.sh*' - '*http://125.41.3.103:41295/bin.sh*' - '*http://125.40.94.54:47197/i*' - '*http://115.52.20.14:37432/i*' - '*http://125.40.94.54:47197/bin.sh*' - '*http://115.52.20.14:37432/bin.sh*' - '*http://125.40.49.213:39648/bin.sh*' - '*http://36.25.99.85:60395/i*' - '*http://110.37.5.157:59057/i*' - '*http://125.44.25.79:50502/i*' - '*http://74.83.48.109:2399/i*' - '*http://36.25.99.85:60395/bin.sh*' - '*http://42.227.203.231:60823/i*' - '*http://182.119.70.155:46103/i*' - '*http://110.37.5.157:59057/bin.sh*' - '*http://219.157.233.184:51727/bin.sh*' - '*http://112.231.204.207:49619/i*' - '*http://91.92.42.213/bins/phantom.arm7*' - '*http://91.92.42.213/bins/phantom.ppc*' - '*http://91.92.42.213/bins/phantom.m68k*' - '*http://91.92.42.213/bins/phantom.arm6*' - '*http://91.92.42.213/bins/phantom.arm4*' - '*http://129.121.114.124/WsN*' - '*http://129.121.114.124/LBLg*' - '*http://129.121.114.124/ilEn*' - '*http://129.121.114.124/3eRa*' - '*http://182.119.70.155:46103/bin.sh*' - '*http://91.92.42.213/bins/phantom.sh4*' - '*http://91.92.42.213/bins/phantom.arm5*' - '*http://129.121.114.124/tm8x*' - '*http://42.227.203.231:60823/bin.sh*' - '*http://110.38.211.139:33957/bin.sh*' - '*http://27.193.169.9:35982/i*' - '*http://182.127.114.53:34892/i*' - '*http://125.44.25.79:50502/bin.sh*' - '*http://182.127.114.53:34892/bin.sh*' - '*http://27.44.146.217:51284/i*' - '*http://46.236.65.23:60207/bin.sh*' - '*http://123.11.10.161:47124/i*' - '*http://42.224.191.38:50966/bin.sh*' - '*http://182.121.156.49:45012/i*' - '*http://110.37.127.45:35628/i*' - '*http://196.190.11.194:47920/bin.sh*' - '*http://160.22.106.17/release/arm*' - '*http://115.58.251.134:37255/i*' - '*http://113.239.94.123:46916/i*' - '*http://105.225.189.37:52601/bin.sh*' - '*http://113.239.94.123:46916/bin.sh*' - '*http://45.90.163.37/arm4*' - '*http://182.121.156.49:45012/bin.sh*' - '*http://163.142.92.229:35959/i*' - '*http://27.215.176.150:40899/bin.sh*' - '*http://163.142.92.229:35959/bin.sh*' - '*http://5.59.107.34:58496/i*' - '*http://110.185.65.207:57774/i*' - '*http://5.59.107.34:58496/bin.sh*' - '*http://129.121.114.124/5YEF*' - '*http://129.121.114.124/bB3*' - '*http://129.121.114.124/8Mty*' - '*http://129.121.114.124/WgR*' - '*http://129.121.114.124/uteZ*' - '*http://129.121.110.105/Q3A*' - '*http://129.121.110.105/TFW*' - '*http://110.36.92.72:52327/i*' - '*http://129.121.114.124/RCvP*' - '*http://129.121.114.124/yPT*' - '*http://129.121.114.124/7r3*' - '*http://129.121.110.105/NER9*' - '*http://115.49.200.94:49949/i*' - '*http://14.117.44.146:42000/i*' - '*http://103.249.199.3:38765/i*' - '*http://94.154.43.96/bins/sora.x86*' - '*http://129.121.110.105/Zd2*' - '*http://129.121.110.105/MoO*' - '*http://129.121.110.105/oeC6*' - '*http://110.36.15.18:39149/i*' - '*http://129.121.110.105/VAt*' - '*http://103.249.199.3:38765/bin.sh*' - '*http://112.242.4.33:55890/i*' - '*http://115.48.160.74:35320/i*' - '*http://110.37.18.249:42406/i*' - '*http://110.37.18.249:42406/bin.sh*' - '*http://112.242.4.33:55890/bin.sh*' - '*http://42.235.92.16:46367/bin.sh*' - '*http://115.48.160.74:35320/bin.sh*' - '*http://125.47.243.166:53293/bin.sh*' - '*http://217.60.195.187/arm7*' - '*http://46.236.65.27:53179/i*' - '*http://110.36.28.45:59891/i*' - '*http://46.236.65.27:53179/bin.sh*' - '*http://125.161.253.250:41702/i*' - '*http://129.121.114.124/jpSv*' - '*http://182.117.122.215:54792/i*' - '*http://110.36.28.45:59891/bin.sh*' - '*http://129.121.110.105/ajFn*' - '*http://123.5.187.102:38286/i*' - '*http://129.121.114.124/ajOn*' - '*http://129.121.114.124/4Xk*' - '*http://129.121.114.124/xLDS*' - '*http://182.127.153.207:60157/i*' - '*http://129.121.114.124/Xqz*' - '*http://129.121.114.124/MlNT*' - '*http://129.121.110.105/7fe*' - '*http://129.121.110.105/uxoi*' - '*http://129.121.110.105/Wca*' - '*http://119.186.23.214:42866/i*' - '*http://42.5.227.253:54163/i*' - '*http://119.186.23.214:42866/bin.sh*' - '*http://182.117.122.215:54792/bin.sh*' - '*http://147.182.224.216/rev*' - '*http://129.121.110.105/o8DX*' - '*http://129.121.114.124/pDY*' - '*http://182.126.113.27:51140/i*' - '*http://129.121.114.124/9a0L*' - '*http://129.121.114.124/MjsG*' - '*http://129.121.114.124/Xqm*' - '*http://129.121.114.124/QZh*' - '*http://129.121.114.124/HX2Q*' - '*http://42.5.227.253:54163/bin.sh*' - '*http://129.121.110.105/Tv6t*' - '*http://129.121.110.105/pNhc*' - '*http://129.121.110.105/dYD*' - '*http://129.121.110.105/oHd5*' - '*http://129.121.110.105/hx1i*' - '*http://129.121.114.124/YND*' - '*http://129.121.110.105/1FSL*' - '*http://129.121.110.105/PrA*' - '*http://129.121.110.105/4Hep*' - '*http://129.121.114.124/VIt*' - '*http://129.121.114.124/Z4S*' - '*http://82.114.178.6:32866/i*' - '*http://129.121.114.124/UvE*' - '*http://182.117.42.238:54871/i*' - '*http://129.121.114.124/0HB*' - '*http://129.121.114.124/KOdr*' - '*http://129.121.114.124/RZt*' - '*http://129.121.114.124/Bnxv*' - '*http://129.121.114.124/kLOX*' - '*http://125.41.8.42:57402/i*' - '*http://167.172.253.162/arc*' - '*http://167.71.213.136/y*' - '*http://129.121.110.105/Cvk*' - '*http://82.114.178.6:32866/bin.sh*' - '*http://39.81.219.246:58526/i*' - '*http://129.121.114.124/rDe*' - '*http://125.41.8.42:57402/bin.sh*' - '*http://45.233.94.135:59430/bin.sh*' - '*http://129.121.114.124/tvCr*' - '*http://129.121.114.124/6zq*' - '*http://129.121.114.124/xWr*' - '*http://125.44.58.234:47872/bin.sh*' - '*http://129.121.110.105/tTd*' - '*http://129.121.110.105/dNPT*' - '*http://129.121.110.105/Wznp*' - '*http://167.71.81.147/pty3*' - '*http://167.99.120.17/pty3*' - '*http://167.99.106.125/pty4*' - '*http://167.71.81.147/pty4*' - '*http://167.71.81.147/pty10*' - '*http://129.121.110.105/Tc2*' - '*http://129.121.110.105/C9M*' - '*http://39.81.219.246:58526/bin.sh*' - '*http://167.99.106.125/pty10*' - '*http://167.99.106.125/pty3*' - '*http://129.121.114.124/AkFS*' - '*http://129.121.114.124/vuSO*' - '*http://129.121.114.124/2z2*' - '*http://219.157.145.153:48280/i*' - '*http://129.121.110.105/LHMi*' - '*http://129.121.110.105/23N*' - '*http://129.121.110.105/Chfd*' - '*http://129.121.110.105/oDh*' - '*http://222.137.159.214:44514/bin.sh*' - '*http://129.121.110.105/2qr*' - '*http://129.121.110.105/2Fr7*' - '*http://129.121.110.105/EmVP*' - '*http://129.121.110.105/xu8*' - '*http://129.121.110.105/fIp*' - '*http://129.121.110.105/jSfh*' - '*http://129.121.114.124/EdYO*' - '*http://129.121.114.124/Avx5*' - '*http://116.207.220.63:57284/i*' - '*http://129.121.114.124/3wI*' - '*http://129.121.114.124/Z31w*' - '*http://110.37.83.214:43234/i*' - '*http://129.121.114.124/03W7*' - '*http://129.121.114.124/K6U*' - '*http://129.121.110.105/soH*' - '*http://129.121.114.124/Qlz*' - '*http://129.121.114.124/30HR*' - '*http://129.121.114.124/cHz*' - '*http://175.148.159.236:43123/i*' - '*http://129.121.110.105/MYP*' - '*http://129.121.110.105/msH*' - '*http://123.11.195.103:56665/i*' - '*http://129.121.110.105/b7g*' - '*http://129.121.110.105/PYdl*' - '*http://129.121.110.105/hXz8*' - '*http://27.220.92.173:37899/i*' - '*http://110.37.115.167:49664/i*' - '*http://129.121.110.105/ssJw*' - '*http://129.121.110.105/hytC*' - '*http://129.121.110.105/KXV*' - '*http://129.121.114.124/t3In*' - '*http://129.121.114.124/y93q*' - '*http://129.121.114.124/8Bn*' - '*http://116.207.220.63:57284/bin.sh*' - '*http://123.11.195.103:56665/bin.sh*' - '*http://110.37.115.167:49664/bin.sh*' - '*http://110.37.85.16:40485/i*' - '*http://119.14.97.112:60013/bin.sh*' - '*http://60.22.169.167:53741/i*' - '*http://175.148.159.236:43123/bin.sh*' - '*http://182.113.28.236:53434/bin.sh*' - '*http://110.37.85.16:40485/bin.sh*' - '*http://110.37.76.236:35351/i*' - '*http://117.9.1.156:38039/i*' - '*http://60.22.169.167:53741/bin.sh*' - '*http://123.10.71.51:59319/i*' - '*http://42.224.80.214:46327/i*' - '*http://110.37.76.236:35351/bin.sh*' - '*http://221.15.7.54:47113/i*' - '*http://61.53.117.230:58958/i*' - '*http://221.15.7.54:47113/bin.sh*' - '*http://113.231.238.227:60688/i*' - '*http://119.115.160.240:46645/i*' - '*http://42.85.135.109:46174/i*' - '*http://123.10.71.51:59319/bin.sh*' - '*http://125.43.23.193:59317/i*' - '*http://219.157.185.231:45095/bin.sh*' - '*http://125.43.23.193:59317/bin.sh*' - '*http://219.155.82.113:33700/i*' - '*http://123.8.95.95:58132/i*' - '*http://112.241.135.209:40885/i*' - '*http://112.241.135.209:40885/bin.sh*' - '*http://91.92.40.5/release/x86_64*' - '*http://42.224.191.38:50966/i*' - '*http://182.117.112.78:37518/i*' - '*http://110.37.44.158:52719/bin.sh*' - '*http://113.221.74.230:39813/i*' - '*http://115.61.58.110:43443/i*' - '*http://123.11.15.146:37492/bin.sh*' - '*http://105.184.57.149:41007/i*' - '*http://105.184.57.149:41007/bin.sh*' - '*http://182.117.112.78:37518/bin.sh*' - '*http://60.160.170.234:50103/bin.sh*' - '*http://115.61.58.110:43443/bin.sh*' - '*http://217.60.195.143/iran.armv6l*' - '*http://217.60.195.143/iran.armv7l*' - '*http://217.60.195.143/iran.i486*' - '*http://217.60.195.143/iran.armv5l*' - '*http://217.60.195.143/iran.armv4l*' - '*http://217.60.195.143/iran.x86_64*' - '*http://217.60.195.143/iran.m68k*' - '*http://217.60.195.143/iran.mips*' - '*http://217.60.195.143/iran.powerpc*' - '*http://217.60.195.143/iran.mipsel*' - '*http://217.60.195.143/iran.arc*' - '*http://217.60.195.143/iran.sparc*' - '*http://217.60.195.143/iran.sh4*' - '*http://113.236.101.64:54189/i*' - '*http://124.131.4.138:51153/i*' - '*http://113.221.74.230:39813/bin.sh*' - '*http://42.232.235.165:50144/i*' - '*http://115.58.135.179:58220/i*' - '*http://110.39.226.242:36140/i*' - '*http://140.237.7.125:41787/i*' - '*http://45.184.19.72:53232/i*' - '*http://39.81.179.181:41855/i*' - '*http://203.99.180.148:52838/i*' - '*http://39.81.179.181:41855/bin.sh*' - '*http://222.137.146.233:56679/i*' - '*http://175.146.225.35:48972/i*' - '*http://45.184.19.72:53232/bin.sh*' - '*http://221.15.195.147:54358/i*' - '*http://115.63.55.219:42956/i*' - '*http://115.63.55.219:42956/bin.sh*' - '*http://203.99.180.148:52838/bin.sh*' - '*http://123.11.10.161:47124/bin.sh*' - '*http://222.137.146.233:56679/bin.sh*' - '*http://175.146.225.35:48972/bin.sh*' - '*http://202.1.26.13:38519/bin.sh*' - '*http://31.77.227.10/nullnet.arc*' - '*http://61.53.119.78:53914/i*' - '*http://196.189.9.27:55826/bin.sh*' - '*http://61.53.119.78:53914/bin.sh*' - '*http://42.235.89.153:35475/i*' - '*http://219.155.201.22:44365/i*' - '*http://110.37.13.55:37070/bin.sh*' - '*http://42.235.89.153:35475/bin.sh*' - '*http://182.126.123.65:51140/i*' - '*http://165.232.101.151/pty4*' - '*http://165.232.101.151/pty3*' - '*http://165.232.55.140/pty3*' - '*http://165.232.55.140/pty4*' - '*http://165.232.101.151/pty10*' - '*http://165.232.55.140/pty10*' - '*http://59.90.191.103:50794/i*' - '*http://180.103.139.79:3588/i*' - '*http://115.55.223.175:41006/i*' - '*http://59.90.191.103:50794/bin.sh*' - '*http://110.37.31.108:48860/i*' - '*http://110.37.31.108:48860/bin.sh*' - '*http://115.56.165.63:50293/bin.sh*' - '*http://123.188.214.188:44236/bin.sh*' - '*http://115.55.223.175:41006/bin.sh*' - '*http://110.37.12.8:54030/i*' - '*http://38.137.250.247:34913/bin.sh*' - '*http://129.121.110.105/mxrK*' - '*http://129.121.110.105/CQP1*' - '*http://129.121.110.105/VL5*' - '*http://64.89.163.215/bins/putita.mipsrouter*' - '*http://45.90.163.37/x86_64*' - '*http://61.53.98.213:33122/i*' - '*http://110.37.97.32:58512/i*' - '*http://110.37.97.32:58512/bin.sh*' - '*http://36.250.201.242:34741/i*' - '*http://129.121.114.124/oXx*' - '*http://129.121.114.124/fjBe*' - '*http://61.53.98.213:33122/bin.sh*' - '*http://125.41.2.161:56323/i*' - '*http://36.250.201.242:34741/bin.sh*' - '*http://42.229.240.151:58197/i*' - '*http://129.121.110.105/QnCa*' - '*http://112.237.236.9:43718/i*' - '*http://125.41.2.161:56323/bin.sh*' - '*http://129.121.114.124/OUi7*' - '*http://129.121.114.124/U9Z*' - '*http://129.121.114.124/FN6*' - '*http://154.242.143.178:47668/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 5 id: f24002af-ac50-52ff-99ad-5db356ff3e34 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 5). logsource: category: proxy detection: selection: c-uri: - '*http://129.121.110.105/Ubhm*' - '*http://129.121.110.105/wRGQ*' - '*http://129.121.110.105/prj*' - '*http://45.90.163.37//arm5*' - '*http://45.90.163.37//x86*' - '*http://45.90.163.37//mpsl*' - '*http://45.90.163.37//mips*' - '*http://45.90.163.37//arm7*' - '*http://45.90.163.37//arm4*' - '*http://110.39.237.192:56284/i*' - '*http://61.52.82.210:52366/i*' - '*http://110.39.237.192:56284/bin.sh*' - '*http://222.138.103.103:54994/i*' - '*http://61.52.82.210:52366/bin.sh*' - '*http://222.139.227.215:54795/i*' - '*http://222.139.227.215:54795/bin.sh*' - '*http://94.154.43.37/bins/sora.arm7*' - '*http://27.215.214.103:45500/i*' - '*http://182.121.69.80:48513/i*' - '*http://196.191.137.44:53180/bin.sh*' - '*http://182.121.69.80:48513/bin.sh*' - '*http://88.112.33.200:57942/i*' - '*http://182.114.199.247:37976/i*' - '*http://42.57.53.121:36534/i*' - '*http://42.57.53.121:36534/bin.sh*' - '*http://219.157.185.231:45095/i*' - '*http://106.125.210.233:38507/i*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4*' - '*http://31.77.227.104/MMaaRRiiOisecTanee/MMaaRRiiOisecTanee.mips*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc*' - '*http://177.125.169.218:3556/i*' - '*http://115.55.128.46:46067/i*' - '*http://106.125.210.233:38507/bin.sh*' - '*http://105.186.209.154:39375/i*' - '*http://202.1.26.13:38519/i*' - '*http://217.60.195.187/bins/pmips*' - '*http://45.231.145.15:35128/bin.sh*' - '*http://221.14.114.113:51129/i*' - '*http://221.14.114.113:51129/bin.sh*' - '*http://115.50.227.63:36178/bin.sh*' - '*http://36.69.82.140:58226/bin.sh*' - '*http://117.95.212.118:35345/i*' - '*http://196.189.35.226:56218/i*' - '*http://182.118.240.77:44648/i*' - '*http://196.189.35.226:56218/bin.sh*' - '*http://123.10.203.39:53311/i*' - '*http://182.118.240.77:44648/bin.sh*' - '*http://125.43.124.57:57410/bin.sh*' - '*http://182.126.95.171:58952/bin.sh*' - '*http://182.126.242.103:37058/bin.sh*' - '*http://123.10.203.39:53311/bin.sh*' - '*http://42.228.91.45:46856/i*' - '*http://42.235.84.235:42719/i*' - '*http://110.38.211.139:33957/i*' - '*http://182.126.90.227:37215/bin.sh*' - '*http://111.127.235.14:58633/i*' - '*http://42.235.84.235:42719/bin.sh*' - '*http://42.238.250.245:45189/bin.sh*' - '*http://219.156.154.120:35534/i*' - '*http://110.36.19.51:33685/i*' - '*http://219.156.154.120:35534/bin.sh*' - '*http://110.36.19.51:33685/bin.sh*' - '*http://42.225.200.199:43958/i*' - '*http://31.77.227.10/nullnet.x86_64*' - '*http://31.77.227.10/nullnet.arm*' - '*http://31.77.227.10/nullnet.spc*' - '*http://31.77.227.10/nullnet.i686*' - '*http://31.77.227.10/nullnet.mips*' - '*http://31.77.227.10/nullnet.sh4*' - '*http://31.77.227.10/nullnet.arm6*' - '*http://31.77.227.10/nullnet.mpsl*' - '*http://31.77.227.10/nullnet.i586*' - '*http://31.77.227.10/nullnet.m68k*' - '*http://31.77.227.10/nullnet.ppc*' - '*http://110.36.29.196:42666/i*' - '*http://42.235.98.36:39028/i*' - '*http://31.77.227.10/nullnet.arm5*' - '*http://31.77.227.10/nullnet.arm7*' - '*http://110.36.29.196:42666/bin.sh*' - '*http://1.196.78.133:37800/i*' - '*http://45.66.228.114/nz/nz.i468*' - '*http://61.53.91.68:33445/bin.sh*' - '*http://110.37.58.92:56744/i*' - '*http://110.37.58.92:56744/bin.sh*' - '*http://115.49.31.43:41869/i*' - '*http://196.191.137.44:53180/i*' - '*http://42.231.93.248:46492/i*' - '*http://123.4.239.199:43678/i*' - '*http://159.223.62.102/bh-linux*' - '*http://45.154.98.126/Coxedem*' - '*http://222.140.185.230:40566/i*' - '*http://61.52.47.43:58749/i*' - '*http://42.231.93.248:46492/bin.sh*' - '*http://222.140.185.230:40566/bin.sh*' - '*http://61.52.159.76:46604/i*' - '*http://123.4.239.199:43678/bin.sh*' - '*http://182.112.28.37:40375/i*' - '*http://222.243.95.50:56045/bin.sh*' - '*http://222.243.95.50:56045/i*' - '*http://221.203.232.209:44311/i*' - '*http://182.112.28.37:40375/bin.sh*' - '*http://115.51.252.97:51648/i*' - '*http://115.51.252.97:51648/bin.sh*' - '*http://125.44.58.234:47872/i*' - '*http://175.44.157.80:58732/i*' - '*http://115.51.20.203:48835/i*' - '*http://175.44.157.80:58732/bin.sh*' - '*http://159.65.247.13/test.sh*' - '*http://221.3.78.163:40548/i*' - '*http://182.118.244.121:52033/i*' - '*http://115.55.10.148:52853/i*' - '*http://221.3.78.163:40548/bin.sh*' - '*http://182.118.244.121:52033/bin.sh*' - '*http://110.36.29.195:56713/bin.sh*' - '*http://106.57.6.155:56421/bin.sh*' - '*http://110.39.233.38:37849/bin.sh*' - '*http://115.52.20.126:37432/bin.sh*' - '*http://27.215.122.209:48873/i*' - '*http://182.127.220.202:58803/i*' - '*http://27.215.122.209:48873/bin.sh*' - '*http://110.37.64.27:43489/i*' - '*http://182.127.220.202:58803/bin.sh*' - '*http://221.1.157.142:36980/i*' - '*http://110.39.227.44:51602/i*' - '*http://164.92.204.248/pty3*' - '*http://164.92.204.248/pty10*' - '*http://164.92.204.248/pty4*' - '*http://119.117.190.194:46446/i*' - '*http://110.39.227.44:51602/bin.sh*' - '*http://123.130.188.111:48423/i*' - '*http://110.37.116.78:52013/i*' - '*http://183.23.140.107:35951/i*' - '*http://110.37.116.78:52013/bin.sh*' - '*http://115.50.248.116:38317/bin.sh*' - '*http://123.130.188.111:48423/bin.sh*' - '*http://123.11.79.11:35843/bin.sh*' - '*http://103.249.199.3:49581/i*' - '*http://183.23.137.161:53767/i*' - '*http://183.23.140.107:35951/bin.sh*' - '*http://183.23.137.161:53767/bin.sh*' - '*http://115.61.114.194:42977/bin.sh*' - '*https://159.89.119.69/mig*' - '*http://161.35.71.130/1.sh*' - '*http://161.35.71.130/sshd*' - '*http://161.35.71.130/cache*' - '*http://123.4.159.180:56374/i*' - '*http://42.237.82.176:39637/bin.sh*' - '*http://115.49.82.37:48169/i*' - '*http://81.236.234.16:59159/bin.sh*' - '*http://123.4.159.180:56374/bin.sh*' - '*http://115.50.168.193:44781/i*' - '*http://103.107.97.42:43299/i*' - '*http://182.116.35.167:60395/i*' - '*http://161.35.217.42/x*' - '*http://115.50.168.193:44781/bin.sh*' - '*http://123.129.131.24:50662/i*' - '*http://77.247.88.82:40510/i*' - '*http://110.37.119.65:55158/i*' - '*http://103.107.97.42:43299/bin.sh*' - '*http://41.249.56.178:53635/i*' - '*http://123.129.131.24:50662/bin.sh*' - '*http://41.249.56.178:53635/bin.sh*' - '*http://124.6.169.54:35580/i*' - '*http://46.236.65.160:59737/i*' - '*http://skript.club/eclipse.m68k*' - '*http://skript.club/eclipse.powerpc-440fp*' - '*http://skript.club/eclipse.mips*' - '*http://skript.club/eclipse.sh4*' - '*http://skript.club/eclipse.armv4l*' - '*http://skript.club/eclipse.powerpc*' - '*http://skript.club/eclipse.armv7l*' - '*http://skript.club/eclipse.armv5l*' - '*http://skript.club/eclipse.x86_64*' - '*http://skript.club/eclipse.mipsel*' - '*http://skript.club/eclipse.i686*' - '*http://skript.club/eclipse.armv6l*' - '*http://skript.club/eclipse.i586*' - '*http://61.53.117.119:56282/i*' - '*http://38.43.193.232:54182/i*' - '*http://182.121.154.76:38424/i*' - '*http://46.236.65.160:59737/bin.sh*' - '*http://61.53.117.119:56282/bin.sh*' - '*http://58.42.185.198:58203/i*' - '*http://38.43.193.232:54182/bin.sh*' - '*http://222.141.42.40:50759/i*' - '*http://222.141.42.40:50759/bin.sh*' - '*http://115.49.30.27:58059/i*' - '*http://105.184.130.212:44233/i*' - '*http://115.49.30.27:58059/bin.sh*' - '*http://105.186.149.42:36815/i*' - '*http://182.123.210.60:41415/i*' - '*http://105.184.130.212:44233/bin.sh*' - '*http://110.37.10.113:46906/i*' - '*http://105.186.149.42:36815/bin.sh*' - '*http://27.194.87.205:36676/i*' - '*http://27.204.199.30:59329/i*' - '*http://125.43.16.205:55986/i*' - '*http://110.37.67.34:41123/i*' - '*http://27.204.199.30:59329/bin.sh*' - '*http://221.203.121.25:35093/bin.sh*' - '*http://42.224.24.5:40092/bin.sh*' - '*http://123.8.19.195:47947/i*' - '*http://skript.club/nz/nz.ppc*' - '*http://45.66.228.114/nz/nz.arm5*' - '*http://45.66.228.114/nz/nz.arm7*' - '*http://45.66.228.114/nz/nz.spc*' - '*http://45.66.228.114/nz/nz.arc*' - '*http://45.66.228.114/nz/nz.m68k*' - '*http://45.66.228.114/nz/nz.i686*' - '*http://45.66.228.114/nz/nz.mpsl*' - '*http://45.66.228.114/nz/nz.arm6*' - '*http://45.66.228.114/nz/nz.mips*' - '*http://45.66.228.114/nz/nz.arm*' - '*http://45.66.228.114/nz/nz.sh4*' - '*http://45.66.228.114/nz/nz.x86_64*' - '*http://45.66.228.114/nz/nz.ppc*' - '*http://skript.club/nz/nz.arm6*' - '*http://skript.club/nz/nz.mpsl*' - '*http://skript.club/nz/nz.arc*' - '*http://skript.club/nz/nz.i686*' - '*http://skript.club/nz/nz.sh4*' - '*http://skript.club/nz/debug*' - '*http://skript.club/nz/nz.x86*' - '*http://skript.club/nz/nz.arm7*' - '*http://skript.club/nz/nz.arm5*' - '*http://skript.club/nz/nz.arm*' - '*http://skript.club/nz/nz.x86_64*' - '*http://skript.club/nz/nz.mips*' - '*http://skript.club/nz/nz.spc*' - '*http://skript.club/nz/nz.m68k*' - '*http://45.66.228.114/nz/nz.x86*' - '*http://36.70.71.191:47231/bin.sh*' - '*http://81.236.234.16:59159/i*' - '*http://175.165.212.187:59176/i*' - '*http://175.165.212.187:59176/bin.sh*' - '*http://39.81.19.153:33185/i*' - '*http://106.57.6.155:56421/i*' - '*http://113.237.61.7:49506/bin.sh*' - '*http://222.134.168.54:47179/i*' - '*http://123.11.35.54:60685/i*' - '*http://5.166.107.132:44061/i*' - '*http://222.134.168.54:47179/bin.sh*' - '*http://125.24.171.206:33891/bin.sh*' - '*http://123.13.107.224:41466/i*' - '*http://112.248.126.74:56533/i*' - '*http://123.13.107.224:41466/bin.sh*' - '*http://110.39.253.204:49606/bin.sh*' - '*http://129.121.110.105/Clq*' - '*http://112.248.126.74:56533/bin.sh*' - '*http://129.121.110.105/F8dj*' - '*http://129.121.110.105/MfzI*' - '*http://129.121.110.105/oVH*' - '*http://129.121.110.105/u2yu*' - '*http://129.121.110.105/mFp*' - '*http://129.121.110.105/JN2M*' - '*http://115.55.189.88:53293/bin.sh*' - '*http://129.121.110.105/DS2*' - '*http://129.121.110.105/HR2d*' - '*http://129.121.110.105/OTw*' - '*http://45.194.88.27:44418/i*' - '*http://42.225.84.215:48835/i*' - '*http://90.174.94.96:45230/bin.sh*' - '*http://90.174.94.96:45230/i*' - '*http://163.142.87.152:44702/bin.sh*' - '*http://110.37.44.158:52719/i*' - '*http://182.126.242.103:37058/i*' - '*http://123.11.203.60:51650/i*' - '*http://61.53.91.68:33445/i*' - '*http://222.137.145.251:58297/i*' - '*http://115.56.127.191:53522/bin.sh*' - '*http://119.177.187.21:40981/i*' - '*http://123.11.203.60:51650/bin.sh*' - '*http://115.55.189.88:53293/i*' - '*http://219.157.21.205:43284/i*' - '*http://119.177.187.21:40981/bin.sh*' - '*http://pvphood.cc/eclipse.powerpc*' - '*http://pvphood.cc/eclipse.powerpc-440fp*' - '*http://94.154.43.114/eclipse.i586*' - '*http://94.154.43.114/eclipse.armv4l*' - '*http://94.154.43.114/eclipse.sh4*' - '*http://94.154.43.114/eclipse.armv6l*' - '*http://94.154.43.114/eclipse.mips*' - '*http://94.154.43.114/eclipse.powerpc*' - '*http://94.154.43.114/eclipse.armv7l*' - '*http://pvphood.cc/eclipse.i686*' - '*http://94.154.43.114/eclipse.mipsel*' - '*http://94.154.43.114/eclipse.m68k*' - '*http://94.154.43.114/eclipse.i686*' - '*http://94.154.43.114/eclipse.x86_64*' - '*http://94.154.43.114/eclipse.armv5l*' - '*http://pvphood.cc/eclipse.m68k*' - '*http://pvphood.cc/eclipse.sh4*' - '*http://pvphood.cc/eclipse.mipsel*' - '*http://pvphood.cc/eclipse.mips*' - '*http://pvphood.cc/eclipse.armv7l*' - '*http://pvphood.cc/eclipse.x86_64*' - '*http://pvphood.cc/eclipse.armv5l*' - '*http://pvphood.cc/eclipse.i586*' - '*http://pvphood.cc/eclipse.armv6l*' - '*http://pvphood.cc/eclipse.armv4l*' - '*http://112.234.115.187:51163/i*' - '*http://221.14.85.226:55775/i*' - '*http://112.234.115.187:51163/bin.sh*' - '*http://42.237.82.176:39637/i*' - '*http://58.208.16.233:3588/i*' - '*http://182.113.4.149:57963/bin.sh*' - '*http://221.14.85.226:55775/bin.sh*' - '*http://42.227.201.106:38999/bin.sh*' - '*http://42.227.201.106:38999/i*' - '*http://105.186.143.19:59213/i*' - '*http://147.182.224.216/so*' - '*http://147.182.224.216/clean*' - '*http://147.182.224.216/socket*' - '*http://147.182.224.216/bot*' - '*http://125.45.67.61:46866/i*' - '*http://223.151.250.135:51663/i*' - '*http://92.124.120.65:44976/i*' - '*http://125.45.67.61:46866/bin.sh*' - '*http://115.48.160.38:39646/i*' - '*http://92.124.120.65:44976/bin.sh*' - '*http://45.66.228.114/eclipse.armv5l*' - '*http://45.66.228.114/eclipse.x86_64*' - '*http://45.66.228.114/eclipse.i686*' - '*http://45.66.228.114/eclipse.sh4*' - '*http://45.66.228.114/eclipse.mipsel*' - '*http://45.66.228.114/eclipse.armv7l*' - '*http://45.66.228.114/eclipse.powerpc*' - '*http://45.66.228.114/eclipse.armv6l*' - '*http://45.66.228.114/eclipse.i586*' - '*http://45.66.228.114/eclipse.m68k*' - '*http://45.66.228.114/eclipse.armv4l*' - '*http://45.66.228.114/eclipse.mips*' - '*http://115.61.116.64:38969/i*' - '*http://223.151.250.135:51663/bin.sh*' - '*http://123.11.35.54:60685/bin.sh*' - '*http://lcd88.cfd/eclipse.i586*' - '*http://lcd88.cfd/eclipse.armv6l*' - '*http://140.237.37.43:35874/i*' - '*http://lcd88.cfd/eclipse.mipsel*' - '*http://lcd88.cfd/eclipse.m68k*' - '*http://lcd88.cfd/eclipse.armv4l*' - '*http://lcd88.cfd/eclipse.armv7l*' - '*http://lcd88.cfd/eclipse.i686*' - '*http://lcd88.cfd/eclipse.powerpc*' - '*http://lcd88.cfd/eclipse.mips*' - '*http://lcd88.cfd/eclipse.powerpc-440fp*' - '*http://lcd88.cfd/eclipse.sh4*' - '*http://lcd88.cfd/eclipse.x86_64*' - '*http://lcd88.cfd/eclipse.armv5l*' - '*http://103.179.240.227:41947/i*' - '*http://177.86.229.12:35799/bin.sh*' - '*http://219.157.189.210:49040/i*' - '*http://140.237.37.43:35874/bin.sh*' - '*http://110.36.31.247:38254/i*' - '*http://125.44.33.238:47576/i*' - '*http://125.44.33.238:47576/bin.sh*' - '*http://110.37.61.44:60357/bin.sh*' - '*http://42.178.236.22:41208/i*' - '*http://27.207.82.194:55890/i*' - '*http://219.155.81.73:33700/i*' - '*http://82.86.65.140:45484/i*' - '*http://42.178.236.22:41208/bin.sh*' - '*http://27.207.82.194:55890/bin.sh*' - '*http://42.225.84.215:48835/bin.sh*' - '*http://175.107.16.92:60176/i*' - '*http://219.155.81.73:33700/bin.sh*' - '*http://115.61.120.4:51515/i*' - '*http://115.61.120.4:51515/bin.sh*' - '*http://123.11.96.89:32941/i*' - '*http://105.186.111.126:48959/i*' - '*http://105.186.111.126:48959/bin.sh*' - '*http://123.9.240.187:44239/i*' - '*http://200.115.102.16:53554/i*' - '*http://60.19.221.46:59961/i*' - '*http://200.115.102.16:53554/bin.sh*' - '*http://123.11.96.89:32941/bin.sh*' - '*http://114.105.166.72:53438/bin.sh*' - '*http://60.19.221.46:59961/bin.sh*' - '*http://222.139.37.132:39031/i*' - '*http://123.12.41.74:46880/i*' - '*http://105.225.25.159:43833/i*' - '*http://182.117.121.107:42655/i*' - '*http://110.38.221.11:35070/bin.sh*' - '*http://182.117.121.107:42655/bin.sh*' - '*http://105.225.25.159:43833/bin.sh*' - '*http://85.15.119.53:44457/bin.sh*' - '*http://221.15.123.32:43477/i*' - '*http://123.4.239.117:36156/i*' - '*http://105.184.103.200:44543/i*' - '*http://221.15.123.32:43477/bin.sh*' - '*http://222.137.153.148:44514/i*' - '*http://37.55.161.57:49531/i*' - '*http://182.126.242.102:37058/i*' - '*http://222.137.153.148:44514/bin.sh*' - '*http://110.39.231.36:39522/i*' - '*http://37.55.161.57:49531/bin.sh*' - '*http://31.77.227.10/bins/manji.arm7*' - '*http://219.155.16.45:59388/i*' - '*http://115.55.241.158:55507/i*' - '*http://115.55.245.216:52059/i*' - '*http://113.237.61.7:49506/i*' - '*http://219.155.16.45:59388/bin.sh*' - '*http://61.52.47.43:58749/bin.sh*' - '*http://94.154.43.42/skiddy.x86*' - '*http://94.154.43.42/skiddy.x86_64*' - '*http://115.55.241.158:55507/bin.sh*' - '*http://27.201.110.150:33452/i*' - '*http://115.57.44.82:33218/bin.sh*' - '*http://123.129.130.29:38181/i*' - '*http://123.9.197.25:60228/i*' - '*http://123.9.197.25:60228/bin.sh*' - '*http://123.129.130.29:38181/bin.sh*' - '*http://120.28.119.54:58459/i*' - '*http://182.113.4.149:57963/i*' - '*http://110.85.110.124:41787/i*' - '*http://120.28.119.54:58459/bin.sh*' - '*http://42.230.189.253:39241/i*' - '*http://123.14.75.146:41541/i*' - '*http://195.24.237.240/.x/black3*' - '*http://digital.digitaldatainsights.org/.x/black3*' - '*http://110.85.110.124:41787/bin.sh*' - '*http://129.121.110.105/0GE*' - '*http://129.121.110.105/c3cS*' - '*http://129.121.110.105/rU0*' - '*http://129.121.110.105/43Ob*' - '*http://217.60.195.187:8080/bot.m68k*' - '*http://160.119.69.4/z/post/noroot.php*' - '*http://217.60.195.187:8080/bot.armv5l*' - '*http://217.60.195.187:8080/bot.armv7l*' - '*http://217.60.195.187:8080/bot.armv4l*' - '*http://217.60.195.187:8080/bot.i686*' - '*http://129.121.110.105/iHO*' - '*http://129.121.110.105/Fz0*' - '*http://217.60.195.187:8080/bot.mipsel*' - '*http://129.121.110.105/KIB*' - '*http://217.60.195.187:8080/bot.x86*' - '*http://217.60.195.187:8080/bot.powerpc*' - '*http://217.60.195.187:8080/bot.x86_64*' - '*http://129.121.110.105/W5y*' - '*http://129.121.110.105/irSl*' - '*http://217.60.195.187:8080/bot.armv6l*' - '*http://217.60.195.187:8080/bot.arm*' - '*http://217.60.195.187:8080/bot.i586*' - '*http://129.121.110.105/utE*' - '*http://217.60.195.187:8080/bot.mips*' - '*http://110.37.39.146:60547/i*' - '*http://60.211.30.133:55771/i*' - '*http://123.14.75.146:41541/bin.sh*' - '*http://42.224.24.5:40092/i*' - '*http://42.239.109.169:54600/i*' - '*http://60.211.30.133:55771/bin.sh*' - '*http://125.43.26.64:56438/i*' - '*http://110.37.39.146:60547/bin.sh*' - '*http://125.43.26.64:56438/bin.sh*' - '*http://42.239.109.169:54600/bin.sh*' - '*http://110.38.223.172:50026/i*' - '*http://14.117.250.138:42000/i*' - '*http://14.117.250.138:42000/bin.sh*' - '*http://180.120.3.54:44129/i*' - '*http://123.4.23.187:33896/i*' - '*http://180.120.3.54:44129/bin.sh*' - '*http://123.4.23.187:33896/bin.sh*' - '*http://123.9.198.8:58379/i*' - '*http://219.157.245.64:46059/i*' - '*http://123.9.198.8:58379/bin.sh*' - '*http://219.157.245.64:46059/bin.sh*' - '*http://123.14.250.177:55198/i*' - '*http://123.14.250.177:55198/bin.sh*' - '*http://61.53.99.119:36871/i*' - '*http://61.53.99.119:36871/bin.sh*' - '*http://123.5.173.102:40544/i*' - '*http://42.224.15.77:57410/bin.sh*' - '*http://202.107.5.69:52110/i*' - '*http://47.212.193.38:37938/i*' - '*http://221.209.83.186:37817/bin.sh*' - '*http://47.212.193.38:37938/bin.sh*' - '*http://202.107.5.69:52110/bin.sh*' - '*http://115.48.162.93:40693/i*' - '*http://115.48.162.93:40693/bin.sh*' - '*http://221.209.83.186:37817/i*' - '*http://182.113.25.122:50144/i*' - '*http://219.154.180.116:35534/i*' - '*http://115.55.53.162:41618/i*' - '*http://182.113.25.122:50144/bin.sh*' - '*http://219.154.180.116:35534/bin.sh*' - '*http://115.55.53.162:41618/bin.sh*' - '*http://110.37.13.55:39778/i*' - '*http://115.49.211.101:57441/i*' - '*http://110.37.13.55:39778/bin.sh*' - '*http://182.113.45.143:39127/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 6 id: 4c7aa780-cda7-52f9-8706-3be71e36c8fa status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 6). logsource: category: proxy detection: selection: c-uri: - '*http://182.113.45.143:39127/bin.sh*' - '*http://115.57.248.77:40854/i*' - '*http://115.49.211.101:57441/bin.sh*' - '*http://108.168.0.60:47365/i*' - '*http://108.168.0.60:47365/bin.sh*' - '*http://117.26.110.213:38787/i*' - '*http://182.119.3.190:35288/i*' - '*http://59.96.142.114:46035/i*' - '*http://118.213.38.120:48336/i*' - '*http://117.26.110.213:38787/bin.sh*' - '*http://115.54.174.118:42542/i*' - '*http://59.96.142.114:46035/bin.sh*' - '*http://27.217.211.17:55130/bin.sh*' - '*http://182.119.3.190:35288/bin.sh*' - '*http://118.213.38.120:48336/bin.sh*' - '*http://110.36.65.9:33905/i*' - '*http://120.28.192.219:47904/i*' - '*http://27.213.10.249:50903/bin.sh*' - '*http://182.126.106.230:39438/i*' - '*http://120.28.192.219:47904/bin.sh*' - '*http://110.36.65.9:33905/bin.sh*' - '*http://221.203.121.25:35093/i*' - '*http://46.216.199.241:56837/i*' - '*http://182.126.106.230:39438/bin.sh*' - '*http://46.216.199.241:56837/bin.sh*' - '*http://59.97.254.172:49126/i*' - '*http://42.227.236.65:39345/i*' - '*http://41.249.237.211:53635/i*' - '*http://41.249.237.211:53635/bin.sh*' - '*http://110.36.30.184:53865/i*' - '*http://182.117.87.146:55388/i*' - '*http://182.117.87.146:55388/bin.sh*' - '*http://175.174.44.196:60468/i*' - '*http://59.97.254.172:49126/bin.sh*' - '*http://ths.lat/volar.sh4*' - '*http://ths.lat/volar.mips*' - '*http://ths.lat/volar.i686*' - '*http://ths.lat/volar.m68k*' - '*http://ths.lat/volar.armv5l*' - '*http://ths.lat/volar.powerpc-440fp*' - '*http://ths.lat/volar.armv6l*' - '*http://ths.lat/volar.armv7l*' - '*http://ths.lat/volar.x86_64*' - '*http://ths.lat/volar.powerpc*' - '*http://ths.lat/volar.armv4l*' - '*http://ths.lat/volar.mipsel*' - '*http://ths.lat/volar.i586*' - '*http://182.118.245.210:52033/i*' - '*http://31.77.227.10/manji.arm7*' - '*http://182.118.245.210:52033/bin.sh*' - '*http://175.174.44.196:60468/bin.sh*' - '*http://110.36.89.246:55926/i*' - '*http://123.11.75.241:36837/i*' - '*http://85.11.167.178/manji.x86_64*' - '*http://85.11.167.178/manji.arm*' - '*http://85.11.167.178/manji.i586*' - '*http://85.11.167.178/manji.sparc*' - '*http://85.11.167.178/manji.arc*' - '*http://85.11.167.178/manji.mips64*' - '*http://91.92.42.50/byroom.armv6*' - '*http://91.92.42.50/byroom.armv7*' - '*http://91.92.42.50/byroom.armv5*' - '*http://105.184.95.53:33851/i*' - '*http://115.55.222.169:32872/bin.sh*' - '*http://110.36.89.246:55926/bin.sh*' - '*http://123.4.170.231:33744/i*' - '*http://105.184.95.53:33851/bin.sh*' - '*http://123.5.173.102:40544/bin.sh*' - '*http://222.182.122.189:50511/bin.sh*' - '*http://110.37.10.113:54633/i*' - '*http://113.230.195.5:40757/bin.sh*' - '*http://105.225.40.204:43449/i*' - '*http://115.48.151.204:45432/i*' - '*http://27.216.121.201:46287/i*' - '*http://27.216.121.201:46287/bin.sh*' - '*http://112.25.235.194:46904/i*' - '*http://38.137.17.205:49648/i*' - '*http://38.137.17.205:49648/bin.sh*' - '*http://105.225.40.204:43449/bin.sh*' - '*http://125.112.61.233:35817/i*' - '*http://113.237.108.171:45619/i*' - '*http://42.226.78.204:39920/i*' - '*http://123.9.220.91:35314/bin.sh*' - '*http://58.22.16.244:46561/i*' - '*http://58.22.16.244:46561/bin.sh*' - '*http://115.61.18.174:41677/i*' - '*http://115.56.66.218:38739/i*' - '*http://46.236.65.106:52182/i*' - '*http://27.215.137.222:45282/i*' - '*http://105.225.115.127:42331/i*' - '*http://115.56.66.218:38739/bin.sh*' - '*http://182.117.5.9:34214/i*' - '*http://182.117.5.9:34214/bin.sh*' - '*http://27.215.137.222:45282/bin.sh*' - '*http://46.236.65.106:52182/bin.sh*' - '*http://110.36.86.83:42924/i*' - '*http://115.55.230.29:38430/i*' - '*http://182.127.168.154:47418/bin.sh*' - '*http://105.184.79.248:35857/i*' - '*http://110.36.86.83:42924/bin.sh*' - '*http://115.50.26.53:43885/i*' - '*http://105.184.213.19:56501/bin.sh*' - '*http://115.55.230.29:38430/bin.sh*' - '*http://115.50.26.53:43885/bin.sh*' - '*http://125.43.8.8:34827/i*' - '*http://105.184.79.248:35857/bin.sh*' - '*http://110.36.93.182:53790/i*' - '*http://138.255.10.120:57405/i*' - '*http://110.37.70.50:43380/i*' - '*http://138.255.10.120:57405/bin.sh*' - '*http://182.122.232.148:54079/i*' - '*http://110.36.93.182:53790/bin.sh*' - '*http://110.37.70.50:43380/bin.sh*' - '*http://36.70.71.191:47231/i*' - '*http://110.37.76.64:39898/bin.sh*' - '*http://182.122.232.148:54079/bin.sh*' - '*http://182.116.116.107:37779/i*' - '*http://42.178.63.166:32836/i*' - '*http://27.213.10.249:50903/i*' - '*http://157.230.50.234/pty3*' - '*http://157.230.50.234/pty4*' - '*http://157.230.50.234/pty10*' - '*http://123.129.132.137:35336/bin.sh*' - '*http://110.181.234.147:34711/i*' - '*http://42.178.63.166:32836/bin.sh*' - '*http://115.54.124.147:57484/bin.sh*' - '*http://39.74.37.178:39605/i*' - '*http://219.157.234.137:51727/bin.sh*' - '*http://110.181.234.147:34711/bin.sh*' - '*http://39.74.37.178:39605/bin.sh*' - '*http://113.231.16.102:48284/bin.sh*' - '*http://120.28.200.112:52763/i*' - '*http://110.38.207.66:48927/i*' - '*http://110.38.207.66:48927/bin.sh*' - '*http://42.232.101.158:59286/i*' - '*http://115.203.230.54:33823/i*' - '*http://115.203.230.54:33823/bin.sh*' - '*http://115.57.44.82:33218/i*' - '*http://120.28.200.112:52763/bin.sh*' - '*http://222.140.183.120:53912/bin.sh*' - '*http://42.232.101.158:59286/bin.sh*' - '*http://222.137.140.47:50504/i*' - '*http://42.225.204.96:54324/i*' - '*http://103.61.243.11:53677/i*' - '*http://123.234.188.81:40186/i*' - '*http://177.223.57.224:55211/bin.sh*' - '*http://115.197.138.73:36085/bin.sh*' - '*http://ths.lat/eclipse.x86_64*' - '*http://123.234.188.81:40186/bin.sh*' - '*http://115.56.127.191:53522/i*' - '*http://125.41.8.156:44972/i*' - '*http://61.53.73.7:56092/i*' - '*http://117.26.225.128:40109/i*' - '*http://110.37.69.175:37577/i*' - '*http://182.117.71.250:44370/i*' - '*http://182.113.198.75:54306/i*' - '*http://113.221.99.137:37914/i*' - '*http://117.26.225.128:40109/bin.sh*' - '*http://61.53.73.7:56092/bin.sh*' - '*http://125.41.8.156:44972/bin.sh*' - '*http://85.140.44.96:58737/i*' - '*http://85.140.44.96:58737/bin.sh*' - '*http://115.57.228.194:54697/i*' - '*http://115.51.97.58:44075/i*' - '*http://123.9.122.84:54775/i*' - '*http://115.57.228.194:54697/bin.sh*' - '*http://123.9.122.84:54775/bin.sh*' - '*http://221.1.227.177:42067/i*' - '*http://220.202.89.211:49820/i*' - '*http://125.43.226.48:37804/i*' - '*http://113.221.99.137:37914/bin.sh*' - '*http://180.252.217.48:36167/i*' - '*http://220.202.89.211:49820/bin.sh*' - '*http://27.215.52.27:55049/i*' - '*http://125.43.226.48:37804/bin.sh*' - '*http://182.126.120.34:40375/i*' - '*http://125.160.138.71:38389/i*' - '*http://110.39.225.163:40518/i*' - '*http://125.160.138.71:38389/bin.sh*' - '*http://110.36.64.245:42645/bin.sh*' - '*http://61.53.4.1:58803/i*' - '*http://61.53.4.1:58803/bin.sh*' - '*http://96.245.232.215:59415/bin.sh*' - '*http://202.1.26.13:49155/i*' - '*http://119.185.240.251:42075/i*' - '*http://94.154.43.42/manji.x86*' - '*http://94.154.43.42/x_8_6.S-A-K-U-R-A*' - '*http://94.154.43.42/x_8_6_6_4.S-A-K-U-R-A*' - '*http://94.154.43.42/manji.x86_64*' - '*http://110.37.76.236:53011/i*' - '*http://110.37.76.236:53011/bin.sh*' - '*http://105.186.160.136:33521/bin.sh*' - '*http://115.49.149.126:57489/i*' - '*http://112.248.102.91:56221/i*' - '*http://217.60.195.187/bins/parm5*' - '*http://217.60.195.187/bins/pmpsl*' - '*http://217.60.195.187/bins/x86_64*' - '*http://217.60.195.187/bins/pspc*' - '*http://217.60.195.187/bins/pm68k*' - '*http://217.60.195.187/bins/pppc*' - '*http://217.60.195.187/bins/parm*' - '*http://217.60.195.187/bins/psh4*' - '*http://217.60.195.187/bins/parm7*' - '*http://217.60.195.187/bins/px86*' - '*http://217.60.195.187/bins/parm6*' - '*http://112.248.102.91:56221/bin.sh*' - '*http://123.13.1.8:38138/i*' - '*http://200.112.129.158:50268/i*' - '*http://200.112.129.158:50268/bin.sh*' - '*http://123.13.1.8:38138/bin.sh*' - '*http://45.207.196.86/huhu/titanjr.mips*' - '*http://42.225.204.96:54324/bin.sh*' - '*http://61.53.4.235:36791/i*' - '*http://27.44.144.81:36545/i*' - '*http://27.44.144.81:36545/bin.sh*' - '*http://110.36.65.9:47047/i*' - '*http://178.75.28.248:55046/i*' - '*http://125.47.240.62:41604/bin.sh*' - '*http://182.117.78.154:39801/i*' - '*http://221.13.251.96:39031/i*' - '*http://182.117.78.154:39801/bin.sh*' - '*http://178.75.28.248:55046/bin.sh*' - '*http://85.11.167.178/manji.x86*' - '*http://85.11.167.178/manji.sh4*' - '*http://85.11.167.178/manji.spc*' - '*http://85.11.167.178/manji.ppc*' - '*http://85.11.167.178/manji.ppc440*' - '*http://85.11.167.178/manji.arm4*' - '*http://85.11.167.178/manji.i486*' - '*http://85.11.167.178/manji.dbg*' - '*http://85.11.167.178/manji.m68k*' - '*http://85.11.167.178/manji.arm5*' - '*http://85.11.167.178/manji.arm7*' - '*http://85.11.167.178/manji.i686*' - '*http://85.11.167.178/manji.mpsl*' - '*http://85.11.167.178/manji.mips*' - '*http://85.11.167.178/manji.arm6*' - '*http://91.92.40.15/zero.sh4*' - '*http://91.92.40.15/zero.aarch64*' - '*http://91.92.40.15/zero.armv4l*' - '*http://91.92.40.15/zero.armv7l*' - '*http://91.92.42.50/byroom.mips*' - '*http://91.92.42.50/byroom.mpsl*' - '*http://91.92.42.50/byroom.x86*' - '*http://91.92.42.50/byroom.m68k*' - '*http://91.92.42.50/byroom.sh4*' - '*http://91.92.42.50/byroom.spc*' - '*http://91.92.42.50/byroom.arm5*' - '*http://91.92.42.50/byroom.arm7*' - '*http://91.92.42.50/byroom.arm6*' - '*http://91.92.42.50/byroom.arm*' - '*http://91.92.42.50/byroom.ppc*' - '*http://91.92.40.15/zero.armv6l*' - '*http://91.92.40.15/zero.i486*' - '*http://91.92.40.15/zero.mipsel*' - '*http://91.92.40.15/zero.powerpc*' - '*http://91.92.40.15/zero.mips*' - '*http://91.92.40.15/zero.x86*' - '*http://91.92.40.15/zero.sparc*' - '*http://91.92.40.15/zero.m68k*' - '*http://91.92.40.15/zero.mipsrouter*' - '*http://91.92.40.15/zero.arc*' - '*http://91.92.40.15/zero.armv5l*' - '*http://147.182.159.177/pty4*' - '*http://147.182.159.177/pty10*' - '*http://105.224.192.88:41617/i*' - '*http://147.182.159.177/pty3*' - '*http://115.63.245.86:55114/i*' - '*http://105.224.192.88:41617/bin.sh*' - '*http://123.5.147.47:43859/i*' - '*http://42.178.27.130:48866/i*' - '*http://42.178.27.130:48866/bin.sh*' - '*http://115.63.245.86:55114/bin.sh*' - '*http://123.10.12.204:54600/i*' - '*http://203.177.28.149:36806/i*' - '*http://203.177.28.149:36806/bin.sh*' - '*http://123.10.12.204:54600/bin.sh*' - '*http://175.169.188.92:59887/i*' - '*http://60.182.121.161:36943/i*' - '*http://220.161.100.142:59859/i*' - '*http://42.224.24.146:36731/i*' - '*http://220.161.100.142:59859/bin.sh*' - '*http://42.224.198.158:52664/bin.sh*' - '*http://42.239.252.44:48124/i*' - '*http://42.239.252.44:48124/bin.sh*' - '*http://115.56.0.157:36076/i*' - '*http://115.63.203.20:36312/i*' - '*http://45.183.184.74:39848/i*' - '*http://45.183.184.74:39848/bin.sh*' - '*http://110.37.38.176:53643/i*' - '*http://221.202.227.69:54765/i*' - '*http://115.57.194.157:41492/i*' - '*http://171.38.24.62:47753/bin.sh*' - '*http://221.202.227.69:54765/bin.sh*' - '*http://27.8.19.149:51581/i*' - '*http://81.229.60.159:51889/i*' - '*http://42.239.254.226:49365/i*' - '*http://110.37.38.176:53643/bin.sh*' - '*http://222.133.105.172:40848/bin.sh*' - '*http://115.57.194.157:41492/bin.sh*' - '*http://42.239.254.226:49365/bin.sh*' - '*http://27.8.19.149:51581/bin.sh*' - '*http://125.45.10.255:38689/i*' - '*http://46.236.65.43:54957/i*' - '*http://112.249.186.100:48649/i*' - '*http://105.186.125.68:56001/bin.sh*' - '*http://60.25.1.67:47355/i*' - '*http://222.140.183.120:53912/i*' - '*http://146.190.46.178/pty3*' - '*http://175.175.135.32:53741/i*' - '*http://60.25.1.67:47355/bin.sh*' - '*http://219.156.33.32:33066/i*' - '*http://175.175.135.32:53741/bin.sh*' - '*http://5.175.174.231/ppc.Sakura*' - '*http://5.175.174.231/arm4.Sakura*' - '*http://5.175.174.231/mips.Sakura*' - '*http://5.175.174.231/arm7.Sakura*' - '*http://5.175.174.231/arm5.Sakura*' - '*http://5.175.174.231/mipsel.Sakura*' - '*http://5.175.174.231/i686.Sakura*' - '*http://5.175.174.231/m68k.Sakura*' - '*http://5.175.174.231/yarn*' - '*http://5.175.174.231/arm6.Sakura*' - '*http://5.175.174.231/sh4.Sakura*' - '*http://5.175.174.231/x86_64.Sakura*' - '*http://219.156.33.32:33066/bin.sh*' - '*http://146.190.117.198/pty4*' - '*http://146.190.117.198/pty3*' - '*http://146.190.117.198/pty10*' - '*http://42.238.240.6:47417/i*' - '*http://146.190.244.239/pty4*' - '*http://146.190.244.239/pty3*' - '*http://146.190.244.239/pty10*' - '*http://27.159.173.106:51830/i*' - '*http://222.141.10.41:52985/bin.sh*' - '*http://42.238.240.6:47417/bin.sh*' - '*http://125.47.240.62:41604/i*' - '*http://221.14.17.203:39346/i*' - '*http://27.159.173.106:51830/bin.sh*' - '*http://221.14.17.203:39346/bin.sh*' - '*http://221.1.225.152:39037/i*' - '*http://221.1.225.152:39037/bin.sh*' - '*http://182.116.117.45:36277/i*' - '*http://182.113.45.71:41749/i*' - '*http://105.186.143.197:56177/i*' - '*http://182.116.117.45:36277/bin.sh*' - '*http://115.55.197.181:45657/i*' - '*http://219.157.234.137:51727/i*' - '*http://182.113.45.71:41749/bin.sh*' - '*http://115.55.197.181:45657/bin.sh*' - '*http://182.121.157.48:59212/i*' - '*http://205.237.110.232/tvt/arm7*' - '*http://205.237.110.232/tvt/aarch64*' - '*http://205.237.110.232/tvt/arm*' - '*http://205.237.110.232/tvt/mips*' - '*http://205.237.110.232/tvt/mpsl*' - '*http://205.237.110.232/tvt/arm5*' - '*http://205.237.110.232/tvt/x86*' - '*http://94.154.43.87/bins/parm*' - '*http://94.154.43.87/bins/parm7*' - '*http://94.154.43.87/bins/pppc*' - '*http://94.154.43.87/bins/parm6*' - '*http://94.154.43.87/bins/parm5*' - '*http://94.154.43.87/bins/psh4*' - '*http://94.154.43.87/bins/pmips*' - '*http://94.154.43.87/bins/pm68k*' - '*http://94.154.43.87/bins/pmpsl*' - '*http://94.154.43.87/bins/px86*' - '*http://182.124.23.15:33387/i*' - '*http://110.37.5.60:42804/i*' - '*http://39.87.0.220:57104/bin.sh*' - '*http://110.37.5.60:42804/bin.sh*' - '*http://182.124.23.15:33387/bin.sh*' - '*http://42.224.93.190:55917/bin.sh*' - '*http://177.223.57.224:55211/i*' - '*http://115.63.203.20:36312/bin.sh*' - '*http://119.184.23.172:50431/i*' - '*http://110.37.58.92:54292/i*' - '*http://95.85.239.61/huhu/titanjr.spc*' - '*http://95.85.239.61/huhu/titanjr.m68k*' - '*http://95.85.239.61/huhu/titanjr.x86_32*' - '*http://95.85.239.61/huhu/titanjr.arm7*' - '*http://95.85.239.61/huhu/titanjr.ppc*' - '*http://95.85.239.61/huhu/titanjr.arm*' - '*http://95.85.239.61/huhu/titanjr.x86_64*' - '*http://95.85.239.61/huhu/titanjr.i486*' - '*http://95.85.239.61/huhu/titanjr.ppc440*' - '*http://95.85.239.61/huhu/titanjr.arm6*' - '*http://95.85.239.61/huhu/titanjr.i686*' - '*http://95.85.239.61/huhu/titanjr.sh4*' - '*http://95.85.239.61/huhu/titanjr.arm5*' - '*http://222.133.105.172:40848/i*' - '*http://110.37.58.92:54292/bin.sh*' - '*http://ecl80.cfd:8080/volar.mips*' - '*http://ecl80.cfd:8080/volar.armv5l*' - '*http://ecl80.cfd:8080/volar.mipsel*' - '*http://85.15.80.74:41166/bin.sh*' - '*http://60.212.102.37:58532/i*' - '*http://115.63.128.47:38576/i*' - '*http://110.37.23.188:58259/i*' - '*http://182.116.37.8:56003/i*' - '*http://110.37.23.188:58259/bin.sh*' - '*http://222.219.74.84:50681/i*' - '*http://182.124.234.107:53035/i*' - '*http://123.129.152.176:42592/i*' - '*http://222.219.74.84:50681/bin.sh*' - '*http://182.124.234.107:53035/bin.sh*' - '*http://219.155.59.84:38750/i*' - '*http://115.57.243.136:33950/i*' - '*http://182.116.37.8:56003/bin.sh*' - '*http://219.155.59.84:38750/bin.sh*' - '*http://129.121.114.124/sto*' - '*http://129.121.114.124/oXY*' - '*http://129.121.114.124/d3t*' - '*http://115.49.229.175:53465/i*' - '*http://123.9.220.91:35314/i*' - '*http://110.38.199.247:56297/i*' - '*http://115.49.229.175:53465/bin.sh*' - '*http://110.39.227.81:60736/i*' - '*http://110.38.199.247:56297/bin.sh*' - '*http://8.213.214.55/nerv.mpsl*' - '*http://8.213.214.55/nerv.ppc*' - '*http://8.213.214.55/nerv.x86*' - '*http://8.213.214.55/nerv.arm5*' - '*http://8.213.214.55/nerv.arm6*' - '*http://8.213.214.55/nerv.ppc440*' - '*http://8.213.214.55/nerv.arm4*' - '*http://8.213.214.55/nerv.mips*' - '*http://8.213.214.55/nerv.x86_64*' - '*http://8.213.214.55/nerv.sh4*' - '*http://8.213.214.55/nerv.x86_32*' - '*http://8.213.214.55/nerv.arm7*' - '*http://8.213.214.55/nerv.sparc*' - '*http://8.213.214.55/nerv.m68k*' - '*http://125.110.2.162:43243/i*' - '*http://110.36.72.162:47566/i*' - '*http://124.129.180.130:55508/i*' - '*http://110.36.72.162:47566/bin.sh*' - '*http://42.239.177.59:46786/i*' - '*http://222.142.249.107:53982/bin.sh*' - '*http://42.239.177.59:46786/bin.sh*' - '*http://39.87.0.220:57104/i*' - '*http://45.135.194.50/x86*' - '*http://175.174.94.240:58713/i*' - '*http://45.135.194.50/m68k*' - '*http://45.135.194.50/sparc*' - '*http://45.135.194.50/arc*' - '*http://45.135.194.50/arm*' - '*http://45.135.194.50/arm7*' - '*http://45.135.194.50/mpsl*' - '*http://45.135.194.50/sh4*' - '*http://45.135.194.50/aarch64*' - '*http://45.135.194.50/x86_64*' - '*http://45.135.194.50/i586*' - '*http://45.135.194.50/arm5*' - '*http://45.135.194.50/ppc*' - '*http://45.135.194.50/arm6*' - '*http://45.135.194.50/mips*' - '*http://42.239.246.177:48714/i*' - '*http://129.121.110.105/LgI6*' - '*http://115.55.247.118:38430/i*' - '*http://129.121.110.105/Pj2b*' - '*http://115.55.247.118:38430/bin.sh*' - '*http://129.121.110.105/rmfG*' - '*http://129.121.110.105/4Ij*' - '*http://117.223.143.90:47806/bin.sh*' - '*http://219.156.128.55:60831/i*' - '*http://60.214.20.152:44629/i*' - '*http://219.156.128.55:60831/bin.sh*' - '*http://129.121.110.105/8ZD*' - '*http://182.127.153.63:52170/bin.sh*' - '*http://41.216.189.236/nz/nz.sh4*' - '*http://41.216.189.236/nz/nz.mips*' - '*http://41.216.189.236/nz/nz.m68k*' - '*http://41.216.189.236/nz/nz.mpsl*' - '*http://41.216.189.236/nz/nz.i686*' - '*http://41.216.189.236/nz/nz.x86*' - '*http://41.216.189.236/nz/nz.arm6*' - '*http://41.216.189.236/nz/nz.x86_64*' - '*http://41.216.189.236/nz/nz.ppc*' - '*http://41.216.189.236/nz/debug*' - '*http://41.216.189.236/nz/nz.spc*' - '*http://41.216.189.236/nz/nz.arm5*' - '*http://41.216.189.236/nz/nz.arm*' - '*http://41.216.189.236/nz/nz.arc*' - '*http://41.216.189.236/nz/nz.arm7*' - '*http://60.214.20.152:44629/bin.sh*' - '*http://129.121.110.105/aXxp*' - '*http://129.121.110.105/Rtcm*' - '*http://129.121.110.105/RhxC*' - '*http://110.36.91.33:55255/i*' - '*http://129.121.114.124/dbgw*' - '*http://129.121.114.124/2Kdi*' - '*http://27.204.197.55:40806/i*' - '*http://123.9.74.17:55194/i*' - '*http://110.36.91.33:55255/bin.sh*' - '*http://129.121.114.124/Kumc*' - '*http://129.121.114.124/E87z*' - '*http://129.121.114.124/5zF4*' - '*http://27.215.182.105:50867/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 7 id: 58f410fd-0021-5896-acb9-cadc9e436b75 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 7). logsource: category: proxy detection: selection: c-uri: - '*http://175.175.96.62:47695/bin.sh*' - '*http://27.215.182.105:50867/bin.sh*' - '*http://123.8.41.17:49564/i*' - '*http://110.36.70.28:49465/i*' - '*http://110.36.70.28:49465/bin.sh*' - '*http://123.8.41.17:49564/bin.sh*' - '*http://110.37.53.25:60651/i*' - '*http://110.37.57.144:50249/i*' - '*http://222.136.103.210:39637/i*' - '*http://42.231.205.15:59676/i*' - '*http://42.231.205.15:59676/bin.sh*' - '*http://110.37.57.144:50249/bin.sh*' - '*http://182.112.72.41:45265/i*' - '*http://110.39.237.185:43485/i*' - '*http://115.62.202.225:40628/i*' - '*http://112.248.255.71:48598/bin.sh*' - '*http://110.37.73.3:45692/i*' - '*http://182.112.72.41:45265/bin.sh*' - '*http://110.39.237.185:43485/bin.sh*' - '*http://222.140.180.125:42956/i*' - '*http://110.37.73.3:45692/bin.sh*' - '*http://119.185.240.182:41326/i*' - '*http://123.5.184.186:35415/i*' - '*http://92.118.39.63/bins/parm5*' - '*http://92.118.39.63/bins/parm*' - '*http://92.118.39.63/bins/pm68k*' - '*http://220.158.234.220/p-p.c-.Sakura*' - '*http://92.118.39.63/bins/parm6*' - '*http://220.158.234.220/m-p.s-l.Sakura*' - '*http://220.158.234.220/a-r.m-6.Sakura*' - '*http://220.158.234.220/x-8.6-.Sakura*' - '*http://220.158.234.220/a-r.m-5.Sakura*' - '*http://220.158.234.220/a-r.m-4.Sakura*' - '*http://92.118.39.63/bins/psh4*' - '*http://92.118.39.63/bins/pmips*' - '*http://92.118.39.63/bins/px86*' - '*http://92.118.39.63/bins/pspc*' - '*http://119.185.240.182:41326/bin.sh*' - '*http://105.224.33.137:52067/i*' - '*http://123.5.184.186:35415/bin.sh*' - '*http://196.191.137.44:40307/i*' - '*http://196.191.137.44:40307/bin.sh*' - '*http://110.37.64.31:59620/bin.sh*' - '*http://46.216.199.241:46855/i*' - '*http://60.19.192.55:45381/i*' - '*http://60.19.192.55:45381/bin.sh*' - '*http://46.216.199.241:46855/bin.sh*' - '*http://182.124.162.184:58970/i*' - '*http://182.117.68.134:45208/i*' - '*http://115.50.88.113:49183/bin.sh*' - '*http://115.48.162.25:39646/i*' - '*http://123.13.96.86:41253/bin.sh*' - '*http://110.36.72.243:54864/i*' - '*http://110.36.86.148:56863/i*' - '*http://42.232.181.65:53311/i*' - '*http://110.36.72.243:54864/bin.sh*' - '*http://123.14.253.136:42936/i*' - '*http://46.236.65.145:50730/i*' - '*http://59.96.140.26:58251/i*' - '*http://110.36.86.148:56863/bin.sh*' - '*http://59.103.116.172:39481/bin.sh*' - '*http://42.232.181.65:53311/bin.sh*' - '*http://123.14.253.136:42936/bin.sh*' - '*http://94.154.43.42/bot.mipsel*' - '*http://94.154.43.42/bot.arm5*' - '*http://94.154.43.42/bot.ppc*' - '*http://94.154.43.42/bot.arm7*' - '*http://202.163.107.242:59201/bin.sh*' - '*http://94.154.43.42/bot.arm4*' - '*http://94.154.43.42/bot.arm6*' - '*http://94.154.43.42/bot.x64*' - '*http://94.154.43.42/bot.mips*' - '*http://94.154.43.42/bot.mpsl*' - '*http://94.154.43.42/bot.x86*' - '*http://46.236.65.145:50730/bin.sh*' - '*http://120.28.198.192:56244/bin.sh*' - '*http://59.96.140.26:58251/bin.sh*' - '*http://77.247.88.103:43260/i*' - '*http://115.57.253.223:59731/i*' - '*http://77.247.88.103:43260/bin.sh*' - '*http://115.97.187.121:35354/i*' - '*http://61.53.121.46:34571/i*' - '*http://182.121.233.32:45190/i*' - '*http://125.45.66.92:56671/i*' - '*http://182.121.233.32:45190/bin.sh*' - '*http://110.37.88.141:56881/bin.sh*' - '*http://110.36.15.1:54205/i*' - '*http://185.89.157.150:32986/i*' - '*http://180.116.55.223:47238/bin.sh*' - '*http://185.89.157.150:32986/bin.sh*' - '*http://36.71.29.111:45855/i*' - '*http://222.142.240.17:50115/i*' - '*http://110.37.83.1:37394/i*' - '*http://36.71.29.111:45855/bin.sh*' - '*http://222.142.240.17:50115/bin.sh*' - '*http://222.140.180.125:42956/bin.sh*' - '*http://110.37.83.1:37394/bin.sh*' - '*http://61.136.85.126:45075/i*' - '*http://42.226.232.202:52628/i*' - '*http://123.11.243.153:49063/i*' - '*http://171.38.24.62:47753/i*' - '*http://203.101.181.9:54419/i*' - '*http://123.11.243.153:49063/bin.sh*' - '*http://203.101.181.9:54419/bin.sh*' - '*http://45.207.196.86/huhu/titanjr.x86_32*' - '*http://45.207.196.86/huhu/titanjr.arm*' - '*http://105.186.86.220:60969/bin.sh*' - '*http://61.53.121.46:34571/bin.sh*' - '*http://61.52.4.106:43912/i*' - '*http://105.186.86.220:60969/i*' - '*http://110.37.111.8:54696/i*' - '*http://222.141.79.99:58811/i*' - '*http://182.127.155.158:49782/i*' - '*http://110.37.111.8:54696/bin.sh*' - '*http://222.141.79.99:58811/bin.sh*' - '*http://160.178.200.115:42130/i*' - '*http://42.238.116.39:35257/i*' - '*http://193.93.228.160:38677/i*' - '*http://182.127.155.158:49782/bin.sh*' - '*http://196.190.133.180:53046/bin.sh*' - '*http://222.142.249.107:53982/i*' - '*http://123.8.52.6:37776/i*' - '*http://123.4.254.47:41717/bin.sh*' - '*http://113.254.36.153:35220/i*' - '*http://110.37.102.224:43959/i*' - '*http://1.62.112.108:48265/i*' - '*http://160.178.200.115:42130/bin.sh*' - '*http://113.254.36.153:35220/bin.sh*' - '*http://1.62.112.108:48265/bin.sh*' - '*http://110.37.88.141:56881/i*' - '*http://124.6.169.54:34531/bin.sh*' - '*http://27.206.83.207:41795/i*' - '*http://42.57.244.164:34312/i*' - '*http://221.15.23.121:39082/i*' - '*http://27.206.83.207:41795/bin.sh*' - '*http://110.39.237.16:59717/i*' - '*http://110.39.237.16:59717/bin.sh*' - '*http://115.55.244.24:43579/i*' - '*http://24.54.95.49:47320/i*' - '*http://27.215.80.8:33896/bin.sh*' - '*http://110.37.55.84:47861/i*' - '*http://24.54.95.49:47320/bin.sh*' - '*http://182.124.162.184:58970/bin.sh*' - '*http://182.121.113.179:50276/i*' - '*http://124.29.223.148:39385/bin.sh*' - '*http://123.14.19.35:57906/bin.sh*' - '*http://110.37.64.31:59620/i*' - '*http://110.36.65.23:48819/i*' - '*http://115.55.244.24:43579/bin.sh*' - '*http://182.113.26.232:32999/i*' - '*http://182.124.190.21:41906/i*' - '*http://182.121.113.179:50276/bin.sh*' - '*http://110.36.65.23:48819/bin.sh*' - '*http://72.255.30.244:40396/i*' - '*http://182.124.190.21:41906/bin.sh*' - '*http://182.113.26.232:32999/bin.sh*' - '*http://110.37.90.59:49913/i*' - '*http://110.37.123.170:54646/i*' - '*http://72.255.30.244:40396/bin.sh*' - '*http://110.37.121.252:56842/i*' - '*http://220.158.234.220/sh4*' - '*http://220.158.234.220/x86*' - '*http://220.158.234.220/x86_64*' - '*http://220.158.234.220/ppc*' - '*http://220.158.234.220/mips*' - '*http://220.158.234.220/debug.dbg*' - '*http://220.158.234.220/arm5*' - '*http://220.158.234.220/arm7*' - '*http://220.158.234.220/spc*' - '*http://110.37.90.59:49913/bin.sh*' - '*http://110.37.123.170:54646/bin.sh*' - '*http://110.37.43.119:51326/i*' - '*http://125.47.244.69:60499/i*' - '*http://182.126.143.124:60685/i*' - '*http://110.37.88.109:54375/i*' - '*http://182.113.47.114:33161/i*' - '*http://182.126.143.124:60685/bin.sh*' - '*http://115.56.126.189:49972/i*' - '*http://110.37.106.220:42512/i*' - '*http://115.50.88.113:49183/i*' - '*http://110.37.106.220:42512/bin.sh*' - '*http://125.44.49.187:39010/i*' - '*http://115.56.149.1:37779/bin.sh*' - '*http://125.44.49.187:39010/bin.sh*' - '*http://123.11.10.24:50477/i*' - '*http://115.55.230.235:55507/i*' - '*http://222.141.140.242:40971/i*' - '*http://183.95.8.124:42684/i*' - '*http://163.142.89.244:55634/i*' - '*http://222.141.140.242:40971/bin.sh*' - '*http://27.208.117.59:45640/i*' - '*http://123.14.19.35:57906/i*' - '*http://182.121.157.159:37305/i*' - '*http://163.142.89.244:55634/bin.sh*' - '*http://123.11.10.24:50477/bin.sh*' - '*http://115.59.27.130:42542/i*' - '*http://27.208.117.59:45640/bin.sh*' - '*http://182.121.157.159:37305/bin.sh*' - '*http://27.217.211.17:55130/i*' - '*http://42.237.102.123:44822/i*' - '*http://42.237.102.123:44822/bin.sh*' - '*http://113.236.97.10:46916/i*' - '*http://113.236.97.10:46916/bin.sh*' - '*http://103.167.175.108:36975/i*' - '*http://182.52.133.14:58644/i*' - '*http://182.52.133.14:58644/bin.sh*' - '*http://123.12.224.248:56618/i*' - '*http://113.239.220.99:34276/bin.sh*' - '*http://182.121.226.41:41062/i*' - '*http://103.167.175.108:36975/bin.sh*' - '*http://119.108.240.18:54945/i*' - '*http://123.11.74.78:34578/i*' - '*http://119.108.240.18:54945/bin.sh*' - '*http://182.116.35.244:48197/i*' - '*http://27.207.73.215:50431/i*' - '*http://182.121.226.41:41062/bin.sh*' - '*http://123.4.198.143:58462/i*' - '*http://123.4.198.143:58462/bin.sh*' - '*http://42.224.98.49:50506/i*' - '*http://123.4.207.13:38570/i*' - '*http://110.37.119.65:38995/bin.sh*' - '*http://110.37.119.65:38995/i*' - '*http://112.239.101.73:48551/i*' - '*http://39.80.61.25:36540/bin.sh*' - '*http://110.138.7.189:53796/bin.sh*' - '*http://112.239.101.73:48551/bin.sh*' - '*http://124.94.147.175:44236/i*' - '*http://138.124.67.218/x86_64*' - '*http://123.5.128.66:37180/i*' - '*http://61.53.86.45:46229/i*' - '*http://42.234.136.251:36837/i*' - '*http://203.101.187.22:45492/i*' - '*http://123.5.128.66:37180/bin.sh*' - '*http://42.234.136.251:36837/bin.sh*' - '*http://115.51.103.16:39826/i*' - '*http://203.101.187.22:45492/bin.sh*' - '*http://182.126.126.202:44467/i*' - '*http://182.126.126.202:44467/bin.sh*' - '*http://42.5.59.133:56535/i*' - '*http://115.56.190.252:59720/bin.sh*' - '*http://42.5.59.133:56535/bin.sh*' - '*http://42.226.208.136:59139/i*' - '*http://182.119.49.164:33329/i*' - '*http://171.114.231.43:48473/bin.sh*' - '*http://115.53.223.236:33211/i*' - '*http://115.53.223.236:33211/bin.sh*' - '*http://46.236.65.23:60207/i*' - '*http://182.46.196.157:40165/i*' - '*http://218.91.141.176:45041/bin.sh*' - '*http://110.138.7.189:53796/i*' - '*http://123.4.202.133:35648/bin.sh*' - '*http://216.126.86.69:43335/i*' - '*http://216.126.86.69:43335/bin.sh*' - '*http://182.127.114.41:54581/i*' - '*http://42.230.43.246:49767/bin.sh*' - '*http://39.71.17.161:54972/i*' - '*http://222.127.76.40:37063/i*' - '*http://39.71.17.161:54972/bin.sh*' - '*http://182.127.114.41:54581/bin.sh*' - '*http://27.219.192.236:57138/i*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnsh2xnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnmicroblazexnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnriscv32xnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnor1kxnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnsh4xnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnx86_64xnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnmipsxnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnriscv64xnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnpowerpcxnxn*' - '*http://116.167.106.46:48393/i*' - '*http://42.237.19.116:51129/i*' - '*http://149.71.39.60:49660/i*' - '*http://219.155.202.52:60988/i*' - '*http://149.71.39.60:49660/bin.sh*' - '*http://116.167.106.46:48393/bin.sh*' - '*http://60.184.133.62:46798/i*' - '*http://219.155.202.52:60988/bin.sh*' - '*http://125.27.11.110:53603/i*' - '*http://115.56.102.63:41987/i*' - '*http://115.56.102.63:41987/bin.sh*' - '*http://59.96.139.3:50204/i*' - '*http://112.248.255.71:48598/i*' - '*http://125.27.11.110:53603/bin.sh*' - '*http://105.184.153.120:40291/i*' - '*http://42.230.43.246:49767/i*' - '*http://124.29.223.148:39385/i*' - '*http://122.241.93.94:59147/i*' - '*http://27.215.215.32:59771/i*' - '*http://27.215.215.32:59771/bin.sh*' - '*http://115.48.160.227:39646/bin.sh*' - '*http://193.31.201.20:51851/i*' - '*http://123.5.189.227:60095/i*' - '*http://193.31.201.20:51851/bin.sh*' - '*http://112.246.117.14:50038/i*' - '*http://182.119.224.15:39205/i*' - '*http://182.119.224.15:39205/bin.sh*' - '*http://222.220.145.56:51630/i*' - '*http://45.207.196.86/huhu/titanjr.ppc*' - '*http://45.207.196.86/huhu/titanjr.ppc440*' - '*http://45.207.196.86/huhu/titanjr.x86_64*' - '*http://42.237.34.224:44084/i*' - '*http://112.246.117.14:50038/bin.sh*' - '*http://91.189.183.211:50758/i*' - '*http://123.11.11.39:51592/i*' - '*http://222.220.145.56:51630/bin.sh*' - '*http://91.189.183.211:50758/bin.sh*' - '*http://42.237.34.224:44084/bin.sh*' - '*http://119.52.129.31:54273/i*' - '*http://222.138.239.25:33501/i*' - '*http://115.55.246.240:53878/bin.sh*' - '*http://119.52.129.31:54273/bin.sh*' - '*http://115.50.108.29:35497/i*' - '*http://115.50.108.29:35497/bin.sh*' - '*http://27.215.53.188:49578/i*' - '*http://120.28.194.30:54505/i*' - '*http://120.28.194.30:54505/bin.sh*' - '*http://124.6.169.54:34531/i*' - '*http://196.189.198.193:47796/i*' - '*http://112.239.122.181:44587/i*' - '*http://39.70.183.42:40654/bin.sh*' - '*http://42.233.244.40:42789/i*' - '*http://115.61.18.125:43982/i*' - '*http://154.242.15.112:38150/i*' - '*http://222.208.112.42:32798/i*' - '*http://115.61.18.125:43982/bin.sh*' - '*http://154.242.15.112:38150/bin.sh*' - '*http://42.233.244.40:42789/bin.sh*' - '*http://222.208.112.42:32798/bin.sh*' - '*http://175.148.155.138:35825/i*' - '*http://125.44.254.182:40468/i*' - '*http://61.52.2.183:45781/i*' - '*http://175.173.138.201:56771/i*' - '*http://117.82.171.92:51310/i*' - '*http://125.44.254.182:40468/bin.sh*' - '*http://45.231.145.15:35128/i*' - '*http://112.248.101.55:60651/i*' - '*http://222.139.87.128:46244/i*' - '*http://123.148.225.193:43983/bin.sh*' - '*http://115.56.190.252:59720/i*' - '*http://222.139.87.128:46244/bin.sh*' - '*http://123.14.235.72:52104/i*' - '*http://115.56.156.177:33000/bin.sh*' - '*http://125.44.189.104:43745/i*' - '*http://182.121.171.92:43256/i*' - '*http://125.40.108.107:34830/i*' - '*http://190.103.72.66:50896/i*' - '*http://125.40.108.107:34830/bin.sh*' - '*http://42.234.219.55:42542/i*' - '*http://110.37.102.129:52323/i*' - '*http://42.227.185.166:38528/i*' - '*http://59.97.248.117:49918/bin.sh*' - '*http://110.37.102.129:52323/bin.sh*' - '*http://169.40.135.244/SBIDIOT/arm6*' - '*http://169.40.135.244/SBIDIOT/bot.x86*' - '*http://196.188.141.17:47066/i*' - '*http://113.230.195.5:40757/i*' - '*http://42.231.88.9:58695/i*' - '*http://123.10.230.242:50105/i*' - '*http://182.117.49.21:49069/i*' - '*http://120.28.217.84:36618/i*' - '*http://42.229.240.9:58197/i*' - '*http://123.10.230.242:50105/bin.sh*' - '*http://36.80.229.52:38724/bin.sh*' - '*http://42.229.240.9:58197/bin.sh*' - '*http://42.85.74.0:60468/i*' - '*http://138.204.196.254:37593/i*' - '*http://138.204.196.254:37593/bin.sh*' - '*http://42.55.238.98:49506/bin.sh*' - '*https://chant-78.com/curl/d09381d5801fc497b6062cd05c066f61e7eaf767292c669873313cbcd5627d5a*' - '*http://113.228.135.107:50099/i*' - '*http://182.127.153.63:52170/i*' - '*http://182.114.199.213:54438/i*' - '*http://182.114.199.213:54438/bin.sh*' - '*http://5.166.38.225:27250/i*' - '*http://182.116.86.192:38172/i*' - '*http://5.166.38.225:27250/bin.sh*' - '*http://61.52.86.216:46412/i*' - '*http://221.200.209.25:35133/i*' - '*http://160.176.254.143:47889/i*' - '*http://115.55.246.240:53878/i*' - '*http://61.52.86.216:46412/bin.sh*' - '*http://123.132.158.164:44814/i*' - '*http://160.176.254.143:47889/bin.sh*' - '*http://27.216.175.89:44418/i*' - '*http://140.237.39.87:50794/i*' - '*http://221.200.209.25:35133/bin.sh*' - '*http://42.229.169.70:36754/i*' - '*http://59.180.140.134:40785/i*' - '*http://27.216.175.89:44418/bin.sh*' - '*http://196.189.104.106:60246/i*' - '*http://112.114.32.50:33615/i*' - '*http://wreath.rapidbranchzi.com/rebirth.arm7*' - '*http://wreath.rapidbranchzi.com/rebirth.sh4*' - '*http://wreath.rapidbranchzi.com/rebirth.ppc*' - '*http://wreath.rapidbranchzi.com/rebirth.m68k*' - '*http://112.114.32.50:33615/bin.sh*' - '*http://wreath.rapidbranchzi.com/rebirth.arm6*' - '*http://wreath.rapidbranchzi.com/rebirth.arm5*' - '*http://wreath.rapidbranchzi.com/rebirth.arm*' - '*http://182.119.219.240:33066/i*' - '*http://wreath.rapidbranchzi.com/rebirth.x86*' - '*http://wreath.rapidbranchzi.com/rebirth.mips*' - '*http://wreath.rapidbranchzi.com/rebirth.mpsl*' - '*http://gravy.rapidbranchzi.com/bot.aarch64*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.x86*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.i686*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.sh4*' - '*http://zipper.rapidbranchzi.com/debug.dbg*' - '*http://gravy.rapidbranchzi.com/main_aarch64*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.spc*' - '*http://gravy.rapidbranchzi.com/bot.mipsel*' - '*http://gravy.rapidbranchzi.com/main_arm7*' - '*http://gravy.rapidbranchzi.com/bot.mips*' - '*http://gravy.rapidbranchzi.com/main_mpsl*' - '*http://gravy.rapidbranchzi.com/main_mips*' - '*http://gravy.rapidbranchzi.com/main_x64*' - '*http://42.229.169.70:36754/bin.sh*' - '*http://120.84.213.218:46712/i*' - '*http://gravy.rapidbranchzi.com/bot.x86_64*' - '*http://gravy.rapidbranchzi.com/bot.arm*' - '*http://gravy.rapidbranchzi.com/main_arm*' - '*http://zipper.rapidbranchzi.com/main_mpsl*' - '*http://zipper.rapidbranchzi.com/main_arm6*' - '*http://zipper.rapidbranchzi.com/main_m68k*' - '*http://zipper.rapidbranchzi.com/dlr.m68k*' - '*http://zipper.rapidbranchzi.com/main_arm7*' - '*http://zipper.rapidbranchzi.com/dlr.spc*' - '*http://zipper.rapidbranchzi.com/dlr.arm*' - '*http://zipper.rapidbranchzi.com/main_sh4*' - '*http://zipper.rapidbranchzi.com/dlr.mpsl*' - '*http://zipper.rapidbranchzi.com/dlr.ppc*' - '*http://zipper.rapidbranchzi.com/main_mips*' - '*http://zipper.rapidbranchzi.com/main_arm*' - '*http://zipper.rapidbranchzi.com/dlr.arm5*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.arm6*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.arm7*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.x86_64*' - '*http://zipper.rapidbranchzi.com/dlr.mips*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.m68k*' - '*http://zipper.rapidbranchzi.com/dlr.sh4*' - '*http://zipper.rapidbranchzi.com/main_arm5*' - '*http://zipper.rapidbranchzi.com/dlr.arm7*' - '*http://zipper.rapidbranchzi.com/main_x86_64*' - '*http://zipper.rapidbranchzi.com/main_ppc*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.arm*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.mips*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.mpsl*' - '*http://organza.rapidbranchzi.com/hiddenbin/zombie.arm5*' - '*http://zipper.rapidbranchzi.com/dlr.x86*' - '*http://zipper.rapidbranchzi.com/dlr.arm6*' - '*http://219.156.102.170:40193/i*' - '*http://182.119.219.240:33066/bin.sh*' - '*http://137.184.6.122/s*' - '*http://137.184.6.122/x*' - '*http://120.84.213.218:46712/bin.sh*' - '*http://222.191.203.156:35202/i*' - '*http://42.176.40.174:33008/i*' - '*http://219.156.102.170:40193/bin.sh*' - '*http://42.228.105.109:47442/i*' - '*http://110.36.1.200:35611/i*' - '*http://42.176.40.174:33008/bin.sh*' - '*http://42.228.105.109:47442/bin.sh*' - '*http://182.113.31.247:56618/i*' - '*http://110.36.1.200:35611/bin.sh*' - '*http://221.1.227.114:56696/bin.sh*' - '*http://182.113.31.247:56618/bin.sh*' - '*http://182.114.199.68:41869/i*' - '*http://200.112.129.195:35411/i*' - '*http://42.229.172.95:56226/i*' - '*http://42.229.172.95:56226/bin.sh*' - '*http://182.124.209.59:41906/bin.sh*' - '*http://183.92.205.84:44151/i*' - '*http://125.43.144.188:45792/i*' - '*http://117.245.84.209:48772/i*' - '*http://183.92.205.84:44151/bin.sh*' - '*http://221.1.227.114:56696/i*' - '*http://endpoint.project0.cc/f/m/libcommon.so_x86_64*' - '*http://119.117.156.106:43300/i*' - '*http://125.43.144.188:45792/bin.sh*' - '*http://222.191.203.156:35202/bin.sh*' - '*http://110.37.49.20:36149/i*' - '*http://119.117.156.106:43300/bin.sh*' - '*http://61.52.72.136:50524/i*' - '*http://123.5.172.173:34251/i*' - '*http://94.154.43.70/hiddenbin/Space.mpsl*' - '*http://94.154.43.70/hiddenbin/Space.x86*' - '*http://94.154.43.70/hiddenbin/Space.arm6*' - '*http://94.154.43.70/hiddenbin/Space.i686*' - '*http://94.154.43.70/hiddenbin/Space.arm*' - '*http://94.154.43.70/hiddenbin/Space.x86_64*' - '*http://94.154.43.70/hiddenbin/Space.arc*' - '*http://94.154.43.70/hiddenbin/Space.arm5*' - '*http://94.154.43.70/hiddenbin/Space.arm7*' - '*http://94.154.43.70/hiddenbin/Space.sh4*' - '*http://94.154.43.70/hiddenbin/Space.sparc*' - '*http://94.154.43.70/hiddenbin/Space.ppc*' - '*http://94.154.43.70/hiddenbin/Space.mips64*' - '*http://94.154.43.70/hiddenbin/Space.mips*' - '*http://94.154.43.70/hiddenbin/Space.m68k*' - '*http://182.113.222.145:54243/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 8 id: 4b73b07a-d06c-5ccd-a8f0-2e0eb1b99b49 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 8). logsource: category: proxy detection: selection: c-uri: - '*http://94.154.43.70/1.sh*' - '*http://94.154.43.70/hiddenbin/zombie.mpsl*' - '*http://94.154.43.70/hiddenbin/zombie.x86_64*' - '*http://94.154.43.70/hiddenbin/zombie.mips*' - '*http://94.154.43.70/hiddenbin/zombie.arm6*' - '*http://94.154.43.70/hiddenbin/zombie.ppc*' - '*http://94.154.43.70/hiddenbin/zombie.m68k*' - '*http://94.154.43.70/hiddenbin/zombie.x86*' - '*http://94.154.43.70/hiddenbin/zombie.arm7*' - '*http://94.154.43.70/hiddenbin/zombie.arm5*' - '*http://94.154.43.70/hiddenbin/zombie.i686*' - '*http://94.154.43.70/hiddenbin/zombie.arm*' - '*http://94.154.43.70/hiddenbin/zombie.spc*' - '*http://94.154.43.70/hiddenbin/zombie.sh4*' - '*http://94.154.43.51/main_x86_64*' - '*http://94.154.43.51/main_x86*' - '*http://94.154.43.51/dlr.arm*' - '*http://94.154.43.51/main_arm*' - '*http://94.154.43.51/main_m68k*' - '*http://94.154.43.51/main_ppc*' - '*http://94.154.43.51/dlr.m68k*' - '*http://94.154.43.51/dlr.arm5*' - '*http://94.154.43.51/main_arm7*' - '*http://94.154.43.51/dlr.x86*' - '*http://94.154.43.51/dlr.spc*' - '*http://94.154.43.51/dlr.arm7*' - '*http://94.154.43.51/dlr.arm6*' - '*http://94.154.43.51/dlr.sh4*' - '*http://94.154.43.51/main_mpsl*' - '*http://94.154.43.51/dlr.mpsl*' - '*http://94.154.43.51/dlr.mips*' - '*http://94.154.43.51/dlr.ppc*' - '*http://94.154.43.51/main_arm6*' - '*http://94.154.43.51/main_arm5*' - '*http://94.154.43.51/main_mips*' - '*http://94.154.43.51/debug.dbg*' - '*http://94.154.43.51/main_sh4*' - '*http://188.232.76.68:20238/i*' - '*http://219.155.211.71:55862/i*' - '*http://94.154.43.88/bins/txkjolgzu.arm5*' - '*http://94.154.43.88/bins/nvephtfwk*' - '*http://94.154.43.88/bins/nvwrudmsi*' - '*http://94.154.43.88/bins/txkjolgzu.arm6*' - '*http://94.154.43.88/bins/ikydgrvum*' - '*http://94.154.43.88/bins/abzutimdw*' - '*http://94.154.43.88/bins/lkchngqsu*' - '*http://94.154.43.88/bins/txkjolgzu.arm*' - '*http://61.52.72.136:50524/bin.sh*' - '*http://110.36.3.201:35761/bin.sh*' - '*http://112.239.120.131:39996/i*' - '*http://94.154.43.73/main_mpsl*' - '*http://94.154.43.73/bot.arm*' - '*http://94.154.43.73/main_arm*' - '*http://94.154.43.73/main_arm7*' - '*http://94.154.43.73/main_x64*' - '*http://94.154.43.73/main_aarch64*' - '*http://94.154.43.73/main_mips*' - '*http://94.154.43.73/bot.x86_64*' - '*http://94.154.43.73/bot.mipsel*' - '*http://94.154.43.73/bot.mips*' - '*http://94.154.43.73/bot.aarch64*' - '*http://182.113.222.145:54243/bin.sh*' - '*http://115.56.65.191:43676/bin.sh*' - '*http://125.40.153.82:45244/i*' - '*http://42.224.69.116:43247/i*' - '*http://182.118.246.69:45869/i*' - '*http://109.236.46.199:38124/i*' - '*http://109.236.46.199:38124/bin.sh*' - '*http://123.129.129.113:46532/bin.sh*' - '*http://42.224.69.116:43247/bin.sh*' - '*http://42.238.170.31:54253/i*' - '*http://125.40.153.82:45244/bin.sh*' - '*http://27.44.147.56:50458/i*' - '*http://42.238.170.31:54253/bin.sh*' - '*http://183.141.129.79:35801/bin.sh*' - '*http://27.44.147.56:50458/bin.sh*' - '*http://110.37.16.86:49868/i*' - '*http://110.37.16.86:49868/bin.sh*' - '*http://196.189.198.193:39186/i*' - '*http://27.216.199.130:36784/bin.sh*' - '*http://221.202.207.90:49137/bin.sh*' - '*http://42.228.221.117:53555/i*' - '*http://110.36.86.148:40690/i*' - '*http://110.37.13.213:55784/i*' - '*http://42.228.221.117:53555/bin.sh*' - '*http://118.232.137.101:48141/i*' - '*http://119.187.249.1:52457/bin.sh*' - '*http://110.37.25.189:59393/i*' - '*http://110.38.223.172:35521/i*' - '*http://105.184.147.15:44875/i*' - '*http://182.113.194.106:55664/bin.sh*' - '*http://105.184.147.15:44875/bin.sh*' - '*http://103.157.210.26:54448/i*' - '*http://103.157.210.26:54448/bin.sh*' - '*http://110.37.10.113:48215/i*' - '*http://5.134.252.106:56153/i*' - '*http://123.11.15.48:50483/i*' - '*http://110.37.10.113:48215/bin.sh*' - '*http://105.184.93.115:54259/i*' - '*http://182.126.58.113:33017/i*' - '*http://105.184.93.115:54259/bin.sh*' - '*http://125.41.4.100:36488/i*' - '*http://182.126.58.113:33017/bin.sh*' - '*http://218.91.14.10:35128/bin.sh*' - '*http://123.11.15.48:50483/bin.sh*' - '*http://125.41.4.100:36488/bin.sh*' - '*http://42.224.93.190:55917/i*' - '*http://36.35.73.89:40757/i*' - '*http://112.248.177.91:51675/i*' - '*http://112.248.177.91:51675/bin.sh*' - '*http://117.26.225.169:40468/i*' - '*http://110.38.207.151:46188/bin.sh*' - '*http://220.184.3.184:37223/i*' - '*http://42.239.255.84:36392/i*' - '*http://117.26.225.169:40468/bin.sh*' - '*http://105.184.124.53:37383/i*' - '*http://27.215.89.121:43736/i*' - '*http://27.215.89.121:43736/bin.sh*' - '*http://42.239.255.84:36392/bin.sh*' - '*http://105.184.124.53:37383/bin.sh*' - '*http://222.137.0.237:49157/bin.sh*' - '*http://42.227.236.130:42069/bin.sh*' - '*http://182.119.15.130:40264/i*' - '*http://59.96.143.187:58897/i*' - '*http://61.53.99.119:51675/i*' - '*http://115.48.160.227:39646/i*' - '*http://42.56.232.66:55589/bin.sh*' - '*http://59.96.143.187:58897/bin.sh*' - '*http://61.53.99.119:51675/bin.sh*' - '*http://222.138.79.158:39801/i*' - '*http://45.207.196.86/huhu/titanjr.arm7*' - '*http://45.207.196.86/huhu/titanjr.arm6*' - '*http://45.207.196.86/huhu/titanjr.spc*' - '*http://45.207.196.86/huhu/titanjr.arm5*' - '*http://45.207.196.86/huhu/titanjr.m68k*' - '*http://222.138.79.158:39801/bin.sh*' - '*http://120.28.197.118:47227/bin.sh*' - '*http://112.248.113.115:34830/i*' - '*http://219.155.195.215:53450/i*' - '*http://216.249.4.20:48369/i*' - '*http://216.249.4.20:48369/bin.sh*' - '*http://110.36.77.34:38726/i*' - '*http://219.155.195.215:53450/bin.sh*' - '*http://223.151.249.23:38648/bin.sh*' - '*http://59.96.141.232:43521/i*' - '*http://58.208.16.222:3588/i*' - '*http://182.113.194.106:55664/i*' - '*http://115.48.149.165:57807/i*' - '*http://119.189.200.96:40294/i*' - '*http://110.36.25.33:45409/i*' - '*http://182.112.29.45:59971/i*' - '*http://110.36.25.33:45409/bin.sh*' - '*http://107.170.109.82:8080/system*' - '*http://109.169.233.123:37175/i*' - '*http://45.225.135.18:1212/a92.elf*' - '*http://36.100.246.225:48336/i*' - '*http://42.231.90.113:57377/bin.sh*' - '*http://61.53.15.130:35056/i*' - '*http://36.100.246.225:48336/bin.sh*' - '*http://61.53.15.130:35056/bin.sh*' - '*http://182.116.115.146:50105/i*' - '*http://171.38.26.9:47753/i*' - '*http://110.38.207.151:46188/i*' - '*http://219.157.63.250:44957/i*' - '*http://182.116.115.146:50105/bin.sh*' - '*http://36.35.73.89:40757/bin.sh*' - '*http://219.157.63.250:44957/bin.sh*' - '*http://27.219.222.7:45729/i*' - '*http://27.219.222.7:45729/bin.sh*' - '*http://59.42.90.102:56735/i*' - '*http://115.56.156.177:33000/i*' - '*http://200.112.129.158:58803/i*' - '*http://59.42.90.102:56735/bin.sh*' - '*http://196.190.1.39:42645/i*' - '*http://200.112.129.158:58803/bin.sh*' - '*http://112.248.190.178:57119/i*' - '*http://196.190.1.39:42645/bin.sh*' - '*http://112.248.190.178:57119/bin.sh*' - '*http://110.37.85.150:52270/i*' - '*http://59.58.188.169:33841/i*' - '*http://123.5.133.104:36549/bin.sh*' - '*http://39.40.129.155:46621/i*' - '*http://42.226.69.32:57626/i*' - '*http://110.37.89.129:36645/i*' - '*http://27.216.199.130:36784/i*' - '*http://119.187.249.1:52457/i*' - '*http://115.61.114.107:37210/i*' - '*http://105.184.236.156:52227/i*' - '*http://115.61.114.107:37210/bin.sh*' - '*http://85.15.119.53:44457/i*' - '*http://205.237.110.232/proxy/mips*' - '*http://205.237.110.232/proxy/mpsl*' - '*http://205.237.110.232/proxyarm*' - '*http://205.237.110.232/proxy/arm7*' - '*http://205.237.110.232/proxy/x86*' - '*http://205.237.110.232/proxy/arm5*' - '*http://205.237.110.232/proxy/arm*' - '*http://205.237.110.232/proxy/aarch64*' - '*http://205.237.110.232/proxy232/mips*' - '*http://115.54.168.65:34275/bin.sh*' - '*http://196.189.198.193:36412/i*' - '*http://42.235.144.196:35570/i*' - '*http://196.189.198.193:36412/bin.sh*' - '*http://77.79.160.210:51525/bin.sh*' - '*http://42.59.119.187:37559/bin.sh*' - '*http://110.37.55.84:51036/i*' - '*http://124.131.129.41:41802/i*' - '*http://42.59.119.187:37559/i*' - '*http://110.37.55.84:51036/bin.sh*' - '*http://124.131.129.41:41802/bin.sh*' - '*http://119.117.244.27:40750/i*' - '*http://59.96.141.35:38742/i*' - '*http://115.55.160.48:43979/i*' - '*http://42.226.70.199:34323/i*' - '*http://27.215.126.24:54255/i*' - '*http://119.117.244.27:40750/bin.sh*' - '*http://115.55.160.48:43979/bin.sh*' - '*http://59.96.141.35:38742/bin.sh*' - '*http://124.135.10.58:51825/i*' - '*http://27.207.247.52:58330/i*' - '*http://61.52.40.139:48827/i*' - '*http://182.121.173.158:58649/i*' - '*http://110.36.3.201:35761/i*' - '*http://61.52.40.139:48827/bin.sh*' - '*http://123.5.133.104:36549/i*' - '*http://123.148.188.53:43457/i*' - '*http://60.211.69.105:35453/i*' - '*http://221.200.219.239:44866/bin.sh*' - '*http://123.148.188.53:43457/bin.sh*' - '*http://60.211.69.105:35453/bin.sh*' - '*http://119.138.108.37:45572/i*' - '*http://115.201.178.212:33823/i*' - '*http://119.138.108.37:45572/bin.sh*' - '*http://200.112.129.121:59253/bin.sh*' - '*http://115.201.178.212:33823/bin.sh*' - '*http://110.37.65.231:42876/i*' - '*http://123.13.105.115:60245/i*' - '*http://115.58.83.71:49039/bin.sh*' - '*http://182.126.120.207:41031/bin.sh*' - '*http://115.48.161.205:39646/bin.sh*' - '*http://115.57.255.92:34611/i*' - '*http://110.37.65.231:42876/bin.sh*' - '*http://182.114.198.221:59360/i*' - '*http://182.126.120.207:41031/i*' - '*http://221.15.15.97:58671/i*' - '*http://115.57.255.92:34611/bin.sh*' - '*http://112.228.60.185:57485/bin.sh*' - '*http://110.37.68.106:39865/i*' - '*http://110.37.68.106:39865/bin.sh*' - '*http://27.36.189.153:44919/i*' - '*http://27.222.149.160:34087/bin.sh*' - '*http://27.36.189.153:44919/bin.sh*' - '*http://219.155.128.89:54936/i*' - '*http://182.123.167.134:33188/i*' - '*http://112.232.60.189:43190/i*' - '*http://103.130.215.73/spc*' - '*http://103.130.215.73/i686*' - '*http://103.130.215.73/sh4*' - '*http://103.130.215.73/arc*' - '*http://103.130.215.73/ppc*' - '*http://103.130.215.73/x86*' - '*http://103.130.215.73/m68k*' - '*http://103.130.215.73/mpsl*' - '*http://125.41.76.32:44137/i*' - '*http://27.206.60.97:39258/i*' - '*http://59.103.116.172:39481/i*' - '*http://27.206.60.97:39258/bin.sh*' - '*http://27.202.243.236:52441/i*' - '*http://182.127.176.81:35574/i*' - '*http://182.127.176.81:35574/bin.sh*' - '*http://115.49.200.249:50975/i*' - '*http://105.224.36.90:33119/i*' - '*http://115.49.200.249:50975/bin.sh*' - '*http://115.55.248.253:37744/i*' - '*http://115.55.248.253:37744/bin.sh*' - '*http://39.78.250.114:43692/i*' - '*http://110.36.93.182:40122/i*' - '*http://125.47.238.195:35702/i*' - '*http://105.186.74.237:54017/i*' - '*http://39.78.250.114:43692/bin.sh*' - '*http://222.141.75.130:51486/i*' - '*http://115.58.83.71:49039/i*' - '*http://116.73.133.132:46071/i*' - '*http://222.141.75.130:51486/bin.sh*' - '*http://103.212.141.129:59505/bin.sh*' - '*http://105.186.74.237:54017/bin.sh*' - '*http://110.37.72.176:51225/bin.sh*' - '*http://105.225.90.107:40405/bin.sh*' - '*http://205.237.110.232/mpsl*' - '*http://205.237.110.232/arm*' - '*http://129.121.114.124/AfN*' - '*http://129.121.114.124/v9EB*' - '*http://129.121.114.124/82D6*' - '*http://205.237.110.232/arm5*' - '*http://205.237.110.232/arm7*' - '*http://205.237.110.232/mips*' - '*http://205.237.110.232/aarch64*' - '*http://205.237.110.232/x86*' - '*http://129.121.114.124/XoQw*' - '*http://129.121.114.124/wW6d*' - '*http://129.121.114.124/CKAK*' - '*http://129.121.114.124/QKtU*' - '*http://129.121.114.124/Qcl*' - '*http://129.121.114.124/uck*' - '*http://129.121.114.124/8l1*' - '*http://182.126.86.5:54523/i*' - '*http://59.58.188.169:33841/bin.sh*' - '*http://112.239.89.64:54455/i*' - '*http://42.231.227.52:50928/i*' - '*http://182.126.86.5:54523/bin.sh*' - '*http://59.96.142.204:39945/i*' - '*http://182.119.57.112:47570/i*' - '*http://42.231.227.52:50928/bin.sh*' - '*http://42.226.195.78:45403/i*' - '*http://42.226.195.78:45403/bin.sh*' - '*http://182.119.57.112:47570/bin.sh*' - '*http://115.52.225.49:55567/i*' - '*http://115.52.225.49:55567/bin.sh*' - '*http://105.225.90.107:40405/i*' - '*http://46.236.65.230:45153/i*' - '*http://78.171.62.85:50435/i*' - '*http://117.9.3.219:50790/i*' - '*http://115.46.158.248:38896/i*' - '*http://78.171.62.85:50435/bin.sh*' - '*http://123.5.170.80:52707/i*' - '*http://222.137.82.102:53022/i*' - '*http://115.46.158.248:38896/bin.sh*' - '*http://119.176.143.150:53616/i*' - '*http://117.9.3.219:50790/bin.sh*' - '*http://115.48.145.161:36348/i*' - '*http://115.61.115.235:43187/i*' - '*http://122.243.151.244:35817/bin.sh*' - '*http://112.242.108.23:56637/i*' - '*http://94.154.43.42/ar15.x86*' - '*http://94.154.43.42/bin/ar15.x86*' - '*http://42.229.220.65:34605/i*' - '*http://94.154.43.42/bins/ar15.x86*' - '*http://94.154.43.42/hiddenbin/ar15.x86*' - '*http://222.138.79.70:46480/i*' - '*http://115.61.115.235:43187/bin.sh*' - '*http://175.175.2.55:41358/i*' - '*http://221.15.216.128:52845/i*' - '*http://112.242.108.23:56637/bin.sh*' - '*http://61.52.80.33:56674/bin.sh*' - '*http://175.175.2.55:41358/bin.sh*' - '*http://218.93.57.127:46975/bin.sh*' - '*http://110.37.66.188:53108/i*' - '*http://42.225.203.208:44794/i*' - '*http://42.225.203.208:44794/bin.sh*' - '*http://42.54.2.44:50302/i*' - '*http://120.28.219.218:58497/i*' - '*http://175.173.120.231:46446/i*' - '*http://182.124.129.1:40347/i*' - '*http://182.121.104.206:34529/i*' - '*http://61.52.157.57:42493/i*' - '*http://42.54.2.44:50302/bin.sh*' - '*http://61.52.157.57:42493/bin.sh*' - '*http://61.52.80.33:56674/i*' - '*http://42.232.24.238:41409/i*' - '*http://120.28.219.218:58497/bin.sh*' - '*http://182.124.129.1:40347/bin.sh*' - '*http://175.107.16.92:50429/i*' - '*http://61.52.5.162:47162/i*' - '*http://61.52.5.162:47162/bin.sh*' - '*http://125.45.65.228:36488/i*' - '*http://196.190.229.115:35148/i*' - '*http://125.45.65.228:36488/bin.sh*' - '*http://64.89.163.215/bins/putita.sh4*' - '*http://104.168.4.206/ar-15/ar15.m68k*' - '*http://45.94.31.70/Ares.spc*' - '*http://104.168.4.206/ar-15/ar15.x86_64*' - '*http://104.168.4.206/ar-15/ar15.mpsl*' - '*http://104.168.4.206/ar-15/ar15.arm7*' - '*http://45.94.31.70/Ares.mpsl*' - '*http://104.168.4.206/ar-15/ar15.i686*' - '*http://45.90.163.37/GoonGang/XDi686*' - '*http://104.168.4.206/ar-15/ar15.mips*' - '*http://45.94.31.70/Ares.sh4*' - '*http://94.154.43.10/bins/parm*' - '*http://217.60.195.214/https/mips*' - '*http://45.90.163.37/GoonGang/XDx86_64*' - '*http://45.90.163.37/GoonGang/XDarc*' - '*http://45.94.31.70/Ares.arm6*' - '*http://217.60.195.214/https/aarch64*' - '*http://104.168.4.206/ar-15/ar15.arm6*' - '*http://104.168.4.206/ar-15/ar15.spc*' - '*http://104.168.4.206/ar-15/ar15.arm5*' - '*http://45.94.31.70/Ares.mips*' - '*http://104.168.4.206/ar-15/ar15.x86*' - '*http://45.94.31.70/Ares.arm*' - '*http://217.60.195.214/https/mpsl*' - '*http://217.60.195.214/https/arm7*' - '*http://217.60.195.214/https/arm*' - '*http://104.168.4.206/ar-15/ar15.ppc*' - '*http://104.168.4.206/ar-15/ar15.arm*' - '*http://104.168.4.206/ar-15/ar15.sh4*' - '*http://45.94.31.70/Ares.ppc*' - '*http://104.168.4.206/ar-15/ar15.arc*' - '*http://217.60.195.214/https/x86*' - '*http://45.94.31.70/Ares.arm5*' - '*http://217.60.195.214/https/arm5*' - '*http://45.94.31.70/Ares.arm7*' - '*http://45.90.163.37/GoonGang/XDi468*' - '*http://94.154.43.192/titanjr/titanjr.i468*' - '*http://104.168.4.206/ar-15/ar15.i468*' - '*http://45.94.31.70/x86*' - '*http://196.190.229.115:35148/bin.sh*' - '*http://196.251.121.185/bot*' - '*http://89.233.194.35:33044/i*' - '*http://111.70.13.127:55913/i*' - '*http://111.70.13.127:55913/bin.sh*' - '*http://89.233.194.35:33044/bin.sh*' - '*http://77.247.88.122:51350/i*' - '*http://112.239.89.64:54455/bin.sh*' - '*http://77.247.88.122:51350/bin.sh*' - '*http://27.45.177.94:49515/i*' - '*http://222.137.93.216:45563/i*' - '*http://27.45.177.94:49515/bin.sh*' - '*http://182.116.55.195:46508/i*' - '*http://27.222.149.160:34087/i*' - '*http://222.137.93.216:45563/bin.sh*' - '*http://115.55.144.131:44167/bin.sh*' - '*http://182.116.55.195:46508/bin.sh*' - '*http://119.186.204.76:49999/i*' - '*http://110.36.77.19:55731/i*' - '*http://42.231.66.147:33877/i*' - '*http://182.124.209.59:41906/i*' - '*http://119.186.204.76:49999/bin.sh*' - '*http://42.58.169.244:46645/i*' - '*http://110.36.77.19:55731/bin.sh*' - '*http://222.138.102.72:33000/bin.sh*' - '*http://108.168.0.60:45909/i*' - '*http://115.57.255.73:39772/bin.sh*' - '*http://115.57.215.161:51040/i*' - '*http://115.52.21.30:38573/i*' - '*http://108.168.0.60:45909/bin.sh*' - '*http://115.57.215.161:51040/bin.sh*' - '*http://95.182.89.105/data_arm6*' - '*http://95.182.89.105/data_mips-uclibc*' - '*http://95.182.89.105/data_arm5*' - '*http://95.182.89.105/data_arm4*' - '*http://95.182.89.105/data_mipsel*' - '*http://95.182.89.105/data_x86_64*' - '*http://95.182.89.105/data_arm7*' - '*http://95.182.89.105/data_mips*' - '*http://95.182.89.105/data_aarch64*' - '*http://95.182.89.105/womp*' - '*http://95.182.89.105/data_powerpc*' - '*http://95.182.89.105/data_mipsel-uclibc*' - '*http://95.182.89.105/data_x86*' - '*http://123.185.64.34:55053/i*' - '*http://64.89.163.215/bins/putita.arm5*' - '*http://64.89.163.215/bins/putita.x86_64*' - '*http://64.89.163.215/bins/putita.mips*' - '*http://64.89.163.215/bins/putita.ppc*' - '*http://64.89.163.215/bins/putita.m68k*' - '*http://64.89.163.215/bins/putita.x86*' - '*http://64.89.163.215/bins/putita.mpsl*' - '*http://64.89.163.215/bins/putita.arm6*' - '*http://64.89.163.215/bins/putita.arm*' - '*http://64.89.163.215/bins/putita.arm7*' - '*http://39.80.61.25:36540/i*' - '*http://219.156.98.16:41238/i*' - '*http://42.227.5.89:41311/i*' - '*http://123.185.64.34:55053/bin.sh*' - '*http://219.156.98.16:41238/bin.sh*' - '*http://94.156.166.84:53500/bin.sh*' - '*http://115.61.107.86:55727/i*' - '*http://115.61.107.86:55727/bin.sh*' - '*http://42.231.72.77:43672/i*' - '*http://115.230.66.84:47167/i*' - '*http://175.174.49.0:39916/i*' - '*http://27.206.79.184:57781/i*' - '*http://175.174.49.0:39916/bin.sh*' - '*http://27.206.79.184:57781/bin.sh*' - '*http://122.243.151.244:35817/i*' - '*http://110.36.15.1:47461/i*' - '*http://119.179.239.23:37650/bin.sh*' - '*http://39.90.185.248:48598/i*' - '*http://182.127.0.185:44672/i*' - '*http://157.66.146.183:48011/i*' - '*http://196.189.198.193:44465/i*' - '*http://157.66.146.183:48011/bin.sh*' - '*http://123.10.153.185:55114/i*' - '*http://1.61.201.77:37817/i*' - '*http://110.36.15.1:47461/bin.sh*' - '*http://123.10.153.185:55114/bin.sh*' - '*http://101.22.41.112:47649/i*' - '*http://162.255.251.91:36557/i*' - '*http://119.99.250.219:43060/i*' - '*http://94.154.43.42/bin/bot*' - '*http://94.154.43.42/bins/bot*' - '*http://94.154.43.42/hiddenbin/bot*' - '*http://219.156.99.10:45205/i*' - '*http://162.255.251.91:36557/bin.sh*' - '*http://27.207.225.43:40906/i*' - '*http://109.226.203.246:38639/i*' - '*http://61.52.172.124:42236/i*' - '*http://61.52.172.124:42236/bin.sh*' - '*http://219.156.99.10:45205/bin.sh*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 9 id: c5162941-f553-53f8-8fc4-a55d00a7ddbe status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 9). logsource: category: proxy detection: selection: c-uri: - '*http://115.52.177.97:60804/i*' - '*http://27.207.225.43:40906/bin.sh*' - '*http://27.215.95.48:60918/i*' - '*http://175.146.241.30:38131/i*' - '*http://27.202.235.64:47172/i*' - '*http://101.109.81.222:58644/i*' - '*http://42.230.35.67:58601/i*' - '*http://31.57.105.94/cache*' - '*http://115.52.177.97:60804/bin.sh*' - '*http://27.215.95.48:60918/bin.sh*' - '*http://220.201.66.237:51337/i*' - '*http://101.109.81.222:58644/bin.sh*' - '*http://175.146.241.30:38131/bin.sh*' - '*http://222.138.117.241:33500/i*' - '*http://42.230.35.67:58601/bin.sh*' - '*http://222.138.117.241:33500/bin.sh*' - '*http://39.90.187.107:37939/i*' - '*http://182.116.23.101:33716/i*' - '*http://59.97.253.52:38807/i*' - '*http://39.90.187.107:37939/bin.sh*' - '*http://222.136.52.228:41540/bin.sh*' - '*http://182.116.23.101:33716/bin.sh*' - '*http://59.44.133.78:57678/i*' - '*http://115.57.249.71:55271/i*' - '*http://115.57.249.71:55271/bin.sh*' - '*http://110.37.127.135:36933/i*' - '*http://59.44.133.78:57678/bin.sh*' - '*http://45.90.163.37/GoonGang/XDx86*' - '*http://45.90.163.37/GoonGang/XDspc*' - '*http://45.90.163.37/GoonGang/XDm68k*' - '*http://45.90.163.37/GoonGang/XDppc*' - '*http://45.90.163.37/GoonGang/XDmpsl*' - '*http://45.90.163.37/GoonGang/XDarm5*' - '*http://45.90.163.37/GoonGang/XDmips*' - '*http://45.90.163.37/GoonGang/XDsh4*' - '*http://45.90.163.37/GoonGang/XDarm*' - '*http://45.90.163.37/GoonGang/XDarm6*' - '*http://45.90.163.37/GoonGang/XDarm7*' - '*http://182.122.246.125:47263/i*' - '*http://196.188.141.17:38188/i*' - '*http://118.232.137.101:35632/i*' - '*http://118.232.137.101:35632/bin.sh*' - '*http://115.56.144.76:46286/i*' - '*http://115.56.144.76:46286/bin.sh*' - '*http://42.225.241.199:37473/bin.sh*' - '*http://124.131.186.170:45557/bin.sh*' - '*http://94.154.43.192/titanjr/titanjr.sh4*' - '*http://94.154.43.192/titanjr/debug*' - '*http://94.154.43.192/titanjr/titanjr.arm7*' - '*http://94.154.43.192/titanjr/titanjr.arm5*' - '*http://94.154.43.192/titanjr/titanjr.mpsl*' - '*http://94.154.43.192/titanjr/titanjr.ppc*' - '*http://94.154.43.192/titanjr/titanjr.mips*' - '*http://94.154.43.192/titanjr/titanjr.x86_64*' - '*http://94.154.43.192/titanjr/titanjr.arm*' - '*http://94.154.43.192/titanjr/titanjr.m68k*' - '*http://94.154.43.192/titanjr/titanjr.spc*' - '*http://94.154.43.192/titanjr/titanjr.arc*' - '*http://94.154.43.192/titanjr/titanjr.x86*' - '*http://94.154.43.192/titanjr/titanjr.i686*' - '*http://94.154.43.192/titanjr/titanjr.arm6*' - '*http://61.52.227.165:43809/i*' - '*http://194.48.248.48:9999/bot.csky*' - '*http://194.48.248.48:9999/bot.csky.sighup*' - '*http://194.48.248.48:9999/bot*' - '*http://182.127.176.119:59353/i*' - '*http://61.52.227.165:43809/bin.sh*' - '*http://182.127.133.102:55974/i*' - '*http://182.127.176.119:59353/bin.sh*' - '*http://61.137.135.148:54601/i*' - '*http://182.127.133.102:55974/bin.sh*' - '*http://61.137.135.148:54601/bin.sh*' - '*http://182.122.156.243:58718/i*' - '*http://182.123.192.2:44776/i*' - '*http://121.202.250.245:46599/i*' - '*http://182.122.156.243:58718/bin.sh*' - '*http://121.202.250.245:46599/bin.sh*' - '*http://112.239.99.96:39439/bin.sh*' - '*http://191.37.19.74:57023/i*' - '*http://182.123.192.2:44776/bin.sh*' - '*http://5.166.134.218:65197/i*' - '*http://5.166.134.218:65197/bin.sh*' - '*http://191.37.19.74:57023/bin.sh*' - '*http://182.122.192.15:54137/i*' - '*http://94.154.43.42/hiddenbin/arch86*' - '*http://94.154.43.42/hiddenbin/moobot.x86*' - '*http://94.154.43.42/bin/Ares.x86_64*' - '*http://94.154.43.42/bins/arch86*' - '*http://94.154.43.42/hiddenbin/Ares.x86_64*' - '*http://94.154.43.42/hiddenbin/arch64*' - '*http://94.154.43.42/bin/moobot.x86*' - '*http://94.154.43.42/bins/moobot.x86_64*' - '*http://94.154.43.42/bins/arch64*' - '*http://94.154.43.42/hiddenbin/moobot.x86_64*' - '*http://94.154.43.42/bins/moobot.x86*' - '*http://94.154.43.42/bins/Ares.x86*' - '*http://94.154.43.42/bins/Ares.x86_64*' - '*http://94.154.43.42/bin/moobot.x86_64*' - '*http://94.154.43.42/hiddenbin/Ares.x86*' - '*http://94.154.43.42/services.apk*' - '*http://110.36.30.184:40020/bin.sh*' - '*http://182.122.192.15:54137/bin.sh*' - '*http://115.53.45.31:51298/i*' - '*http://112.239.99.96:39439/i*' - '*http://42.5.230.39:56817/i*' - '*http://123.12.223.132:35960/i*' - '*http://115.48.142.20:33158/i*' - '*http://61.54.253.200:50374/bin.sh*' - '*http://200.112.129.57:55695/i*' - '*http://61.52.49.215:52908/i*' - '*http://200.112.129.57:55695/bin.sh*' - '*http://42.5.230.39:56817/bin.sh*' - '*http://217.60.195.214/no_killer/mips*' - '*http://217.60.195.214/dlr.mips*' - '*http://217.60.195.214/dlr.mpsl*' - '*http://217.60.195.214/no_killer/arm5*' - '*http://217.60.195.214/dlr.arm5*' - '*http://217.60.195.214/aarch64*' - '*http://217.60.195.214/no_killer/mpsl*' - '*http://217.60.195.214/no_killer/arm7*' - '*http://217.60.195.214/no_killer/x86*' - '*http://217.60.195.214/dlr.arm7*' - '*http://217.60.195.214/dlr.arm4*' - '*http://217.60.195.214/tftp.sh*' - '*http://217.60.195.214/ftpget.sh*' - '*http://182.126.111.147:40314/bin.sh*' - '*http://115.48.142.20:33158/bin.sh*' - '*http://61.52.49.215:52908/bin.sh*' - '*http://45.94.31.70/bins/Ares.mips*' - '*http://182.127.59.178:52016/i*' - '*http://61.162.203.210:47214/i*' - '*http://45.94.31.70/bins/Ares.m68k*' - '*http://45.94.31.70/bins/Ares.spc*' - '*http://45.94.31.70/bins/Ares.arm5*' - '*http://45.94.31.70/bins/Ares.ppc*' - '*http://45.94.31.70/bins/Ares.arm6*' - '*http://45.94.31.70/w.sh*' - '*http://45.94.31.70/c.sh*' - '*http://45.94.31.70/bins/Ares.arm*' - '*http://45.94.31.70/bins/Ares.sh4*' - '*http://45.94.31.70/bins/Ares.x86*' - '*http://45.94.31.70/bins/Ares.mpsl*' - '*http://61.162.203.210:47214/bin.sh*' - '*http://110.85.98.154:38787/i*' - '*http://182.127.59.178:52016/bin.sh*' - '*http://45.135.193.114/ntp*' - '*http://110.85.98.154:38787/bin.sh*' - '*http://115.45.152.67:59339/i*' - '*http://41.216.189.92/nz/nz.i468*' - '*http://217.60.195.160/test/arm7*' - '*http://217.60.195.160/test/arm5*' - '*http://217.60.195.160/test/mipsel*' - '*http://217.60.195.160/test/arm*' - '*http://217.60.195.160/test/mips*' - '*http://217.60.195.160/test/x86*' - '*http://125.44.252.215:43662/i*' - '*http://125.44.252.215:43662/bin.sh*' - '*http://115.48.161.205:39646/i*' - '*http://42.87.90.117:47695/bin.sh*' - '*http://115.52.66.240:34144/i*' - '*http://175.147.222.58:35517/i*' - '*http://110.36.75.16:59542/i*' - '*http://115.52.66.240:34144/bin.sh*' - '*http://182.119.188.133:49576/i*' - '*http://175.147.159.138:45619/i*' - '*http://151.233.193.84:34458/i*' - '*http://110.36.90.129:53385/i*' - '*http://110.36.75.16:59542/bin.sh*' - '*http://182.119.188.133:49576/bin.sh*' - '*http://110.36.90.129:53385/bin.sh*' - '*http://110.37.64.27:34779/i*' - '*http://36.36.250.231:34986/i*' - '*http://59.103.121.32:41365/bin.sh*' - '*http://36.36.250.231:34986/bin.sh*' - '*http://110.37.64.27:34779/bin.sh*' - '*http://175.174.98.247:39760/i*' - '*http://175.147.222.58:35517/bin.sh*' - '*http://151.232.235.118:41810/i*' - '*http://41.216.189.92/nz/nz.ppc*' - '*http://41.216.189.92/nz/nz.arc*' - '*http://41.216.189.92/nz/nz.m68k*' - '*http://41.216.189.92/nz/nz.mips*' - '*http://41.216.189.92/nz/nz.x86*' - '*http://41.216.189.92/nz/nz.sh4*' - '*http://41.216.189.92/nz/nz.mpsl*' - '*http://41.216.189.92/nz/nz.i686*' - '*http://41.216.189.92/nz/nz.arm6*' - '*http://41.216.189.92/nz/nz.spc*' - '*http://41.216.189.92/nz/nz.arm*' - '*http://41.216.189.92/nz/nz.x86_64*' - '*http://41.216.189.92/nz/nz.arm5*' - '*http://41.216.189.92/nz/nz.arm7*' - '*http://41.216.189.92/nz/debug*' - '*http://175.174.98.247:39760/bin.sh*' - '*http://115.56.66.242:58971/i*' - '*http://217.60.195.214/arm5*' - '*http://217.60.195.214/mips*' - '*http://217.60.195.214/mipsel*' - '*http://217.60.195.214/arm7*' - '*http://217.60.195.214/arm*' - '*http://217.60.195.214/mpsl*' - '*http://151.232.235.118:41810/bin.sh*' - '*http://115.210.139.16:38843/bin.sh*' - '*http://222.134.174.155:34862/i*' - '*http://141.11.88.144/bins/arm6*' - '*http://141.11.88.144/bins/arm5*' - '*http://141.11.88.144/bins/sh4*' - '*http://141.11.88.144/bins/m68k*' - '*http://141.11.88.144/bins/spc*' - '*http://141.11.88.144/bins/i686*' - '*http://141.11.88.144/bins/x86*' - '*http://141.11.88.144/bins/x86_64*' - '*http://141.11.88.144/bins/arm7*' - '*http://141.11.88.144/bins/arm*' - '*http://141.11.88.144/bins/ppc*' - '*http://141.11.88.144/bins/mips*' - '*http://141.11.88.144/bins/mpsl*' - '*http://171.213.197.151:38419/i*' - '*http://115.48.19.30:56226/i*' - '*http://125.42.30.19:53035/i*' - '*http://115.48.19.30:56226/bin.sh*' - '*http://59.96.138.172:53425/bin.sh*' - '*http://125.42.30.19:53035/bin.sh*' - '*http://110.37.74.11:52121/i*' - '*http://27.207.229.230:41353/i*' - '*http://27.207.229.230:41353/bin.sh*' - '*http://182.116.10.34:59342/i*' - '*http://182.116.10.34:59342/bin.sh*' - '*http://110.37.44.158:46803/i*' - '*http://110.36.31.132:41531/bin.sh*' - '*http://27.223.204.195:43479/bin.sh*' - '*http://110.37.44.158:46803/bin.sh*' - '*http://110.36.20.227:35555/i*' - '*http://125.126.254.194:46369/i*' - '*http://124.131.128.105:43733/bin.sh*' - '*http://110.36.20.227:35555/bin.sh*' - '*http://39.87.231.179:45494/i*' - '*http://45.171.177.193:35757/i*' - '*http://45.171.177.193:35757/bin.sh*' - '*http://110.36.80.169:35496/i*' - '*http://174.34.242.49:34523/i*' - '*http://182.113.205.250:48613/i*' - '*http://61.52.52.87:43810/i*' - '*http://27.200.103.187:39089/i*' - '*http://110.36.80.169:35496/bin.sh*' - '*http://27.200.103.187:39089/bin.sh*' - '*http://5.172.22.97:42567/i*' - '*http://182.116.114.190:47798/i*' - '*http://27.203.173.154:43816/i*' - '*http://123.11.67.105:35213/i*' - '*http://42.227.177.147:33531/bin.sh*' - '*http://113.231.16.175:48587/i*' - '*http://182.116.114.190:47798/bin.sh*' - '*http://27.203.173.154:43816/bin.sh*' - '*http://123.11.67.105:35213/bin.sh*' - '*http://115.50.29.225:33764/i*' - '*http://42.239.243.8:47499/i*' - '*http://115.50.29.225:33764/bin.sh*' - '*http://122.190.164.82:42684/i*' - '*http://42.239.243.8:47499/bin.sh*' - '*http://115.50.67.156:59200/i*' - '*http://182.119.233.137:52462/i*' - '*http://190.115.80.35:49166/i*' - '*http://115.55.199.160:48900/bin.sh*' - '*http://141.11.88.138/hiddenbin/boatnet.x86*' - '*http://141.11.88.138/hiddenbin/boatnet.arm5*' - '*http://141.11.88.138/hiddenbin/boatnet.arm6*' - '*http://141.11.88.138/hiddenbin/boatnet.ppc*' - '*http://141.11.88.138/hiddenbin/boatnet.arm*' - '*http://141.11.88.138/hiddenbin/boatnet.sh4*' - '*http://141.11.88.138/hiddenbin/boatnet.mpsl*' - '*http://115.50.67.156:59200/bin.sh*' - '*http://103.249.199.3:34843/i*' - '*http://103.249.199.3:34843/bin.sh*' - '*http://190.115.80.35:49166/bin.sh*' - '*http://182.119.233.137:52462/bin.sh*' - '*http://110.36.11.225:60680/i*' - '*http://47.212.193.38:46802/i*' - '*http://115.96.128.94:46071/i*' - '*http://47.212.193.38:46802/bin.sh*' - '*http://200.112.129.135:45948/i*' - '*http://112.254.156.154:45877/i*' - '*http://110.36.64.245:49947/i*' - '*http://221.15.214.106:36783/i*' - '*http://200.112.129.135:45948/bin.sh*' - '*http://42.87.90.117:47695/i*' - '*http://221.15.214.106:36783/bin.sh*' - '*http://110.72.20.62:45114/i*' - '*http://59.180.153.186:52019/i*' - '*http://222.139.113.235:51129/i*' - '*http://222.139.113.235:51129/bin.sh*' - '*http://59.180.153.186:52019/bin.sh*' - '*http://110.72.20.62:45114/bin.sh*' - '*http://103.130.215.73/arm*' - '*http://103.130.215.73/x86_64*' - '*http://103.130.215.73/arm6*' - '*http://103.130.215.73/arm5*' - '*http://103.130.215.73///arm5*' - '*http://103.130.215.73/mips*' - '*http://103.130.215.73/mipsel*' - '*http://103.130.215.73/arm7*' - '*http://115.194.37.2:55595/bin.sh*' - '*http://123.4.189.98:48149/i*' - '*http://42.231.88.168:37199/i*' - '*http://46.45.24.187:60415/i*' - '*http://46.45.24.187:60415/bin.sh*' - '*http://110.39.237.192:41559/i*' - '*http://220.202.67.32:41461/i*' - '*http://42.239.154.159:35456/i*' - '*http://115.61.119.253:35178/i*' - '*http://220.202.67.32:41461/bin.sh*' - '*http://59.96.138.224:40577/i*' - '*http://176.65.148.194/hiddenbin/boatnet.arm*' - '*http://176.65.148.194/hiddenbin/boatnet.ppc*' - '*http://176.65.148.194/hiddenbin/boatnet.arm6*' - '*http://176.65.148.194/hiddenbin/boatnet.arc*' - '*http://176.65.148.194/hiddenbin/boatnet.spc*' - '*http://42.227.177.147:33531/i*' - '*http://110.37.72.176:34841/i*' - '*http://112.244.136.230:33171/bin.sh*' - '*http://112.244.136.230:33171/i*' - '*http://59.180.134.44:59174/i*' - '*http://123.188.79.78:45414/i*' - '*http://115.57.166.32:58178/i*' - '*http://61.54.253.200:50374/i*' - '*http://115.49.193.51:58246/i*' - '*http://123.11.37.190:60685/i*' - '*http://110.36.86.0:37487/i*' - '*http://222.136.23.106:45812/i*' - '*http://123.11.37.190:60685/bin.sh*' - '*http://110.36.91.33:48724/i*' - '*http://200.112.129.121:59253/i*' - '*http://222.136.23.106:45812/bin.sh*' - '*http://182.126.99.164:43603/bin.sh*' - '*http://110.36.91.33:48724/bin.sh*' - '*http://221.3.122.78:42109/bin.sh*' - '*http://222.137.85.38:51752/i*' - '*http://222.137.85.38:51752/bin.sh*' - '*http://45.5.138.3:59029/bin.sh*' - '*http://105.187.33.138:33631/i*' - '*http://182.123.211.0:55917/i*' - '*http://105.187.33.138:33631/bin.sh*' - '*http://115.195.212.157:57971/i*' - '*http://222.137.23.22:54815/i*' - '*http://182.123.211.0:55917/bin.sh*' - '*http://222.137.23.22:54815/bin.sh*' - '*http://42.226.220.88:59642/i*' - '*http://115.195.212.157:57971/bin.sh*' - '*http://39.64.9.139:43526/bin.sh*' - '*http://182.115.74.126:34759/bin.sh*' - '*http://42.237.59.190:37182/bin.sh*' - '*http://27.215.127.151:60783/bin.sh*' - '*http://117.253.62.162:59112/i*' - '*http://115.55.199.160:48900/i*' - '*http://84.22.221.124:4908/bin.sh*' - '*http://115.55.59.63:52041/bin.sh*' - '*http://105.186.220.123:43043/bin.sh*' - '*http://219.154.173.110:60949/i*' - '*http://124.131.186.170:45557/i*' - '*http://117.253.62.162:59112/bin.sh*' - '*http://219.154.173.110:60949/bin.sh*' - '*http://119.14.97.112:60013/i*' - '*http://119.109.212.35:35093/i*' - '*http://196.251.121.142/a3f8d2/kaizen.arm7sf_srv*' - '*http://196.251.121.142/a3f8d2/kaizen.x86_64_srv*' - '*http://119.109.212.35:35093/bin.sh*' - '*http://182.126.80.218:60746/i*' - '*http://27.215.179.32:43009/i*' - '*http://182.117.9.51:48515/i*' - '*http://111.179.159.2:52029/bin.sh*' - '*http://27.215.179.32:43009/bin.sh*' - '*http://156.146.26.225:48881/i*' - '*http://182.117.9.51:48515/bin.sh*' - '*http://123.5.187.3:44799/i*' - '*http://141.11.88.120/i686*' - '*http://141.11.88.120/mips*' - '*http://141.11.88.120/mipsel*' - '*http://141.11.88.120/x86*' - '*http://141.11.88.120/ppc64*' - '*http://141.11.88.120/armv5l*' - '*http://141.11.88.120/armv7l*' - '*http://141.11.88.120/armv6l*' - '*http://112.248.110.0:35255/bin.sh*' - '*http://39.87.30.92:47241/bin.sh*' - '*http://110.39.226.207:38554/bin.sh*' - '*http://202.163.107.97:32772/i*' - '*http://178.75.62.197:34193/i*' - '*http://123.12.165.33:57440/bin.sh*' - '*http://218.252.93.200:52226/i*' - '*http://178.75.62.197:34193/bin.sh*' - '*http://42.86.113.243:40712/bin.sh*' - '*http://110.37.82.255:42356/i*' - '*http://45.198.224.249/void/void.mpsl*' - '*http://45.198.224.249/void/void.x86_64*' - '*http://45.198.224.249/void/void.ppc*' - '*http://45.198.224.249/void/void.i686*' - '*http://45.198.224.249/void/void.arm*' - '*http://45.198.224.249/void/void.x86*' - '*http://45.198.224.249/void/void.arm5*' - '*http://45.198.224.249/void/void.arc*' - '*http://45.198.224.249/void/void.i468*' - '*http://45.198.224.249/void/void.spc*' - '*http://45.198.224.249/void/void.m68k*' - '*http://45.198.224.249/void/void.sh4*' - '*http://45.198.224.249/void/void.arm7*' - '*http://45.198.224.249/void/void.mips*' - '*http://45.198.224.249/void/void.arm6*' - '*http://182.112.79.205:54539/bin.sh*' - '*http://219.71.131.225:58125/i*' - '*http://116.76.167.16:35883/i*' - '*http://219.71.131.225:58125/bin.sh*' - '*http://42.5.247.125:37951/i*' - '*http://123.14.126.17:51315/i*' - '*http://221.15.191.16:48827/i*' - '*http://123.14.126.17:51315/bin.sh*' - '*http://39.86.12.236:49045/bin.sh*' - '*http://182.113.205.234:33954/bin.sh*' - '*http://221.15.191.16:48827/bin.sh*' - '*http://61.52.104.230:40878/i*' - '*http://185.9.139.117:35150/i*' - '*http://123.5.127.246:50700/i*' - '*http://182.121.157.183:54728/i*' - '*http://123.5.127.246:50700/bin.sh*' - '*http://185.9.139.117:35150/bin.sh*' - '*http://182.121.157.183:54728/bin.sh*' - '*http://110.36.29.195:46973/i*' - '*http://120.28.68.44:57208/bin.sh*' - '*http://42.224.192.126:59717/i*' - '*http://110.36.29.195:46973/bin.sh*' - '*http://27.215.124.209:35364/bin.sh*' - '*http://39.87.36.107:57053/i*' - '*http://45.187.105.203:54379/bin.sh*' - '*http://222.140.183.206:40838/i*' - '*http://42.235.83.217:33845/bin.sh*' - '*http://115.63.246.10:53651/i*' - '*http://208.85.17.8/api/payload?arch=$(uname*' - '*http://115.63.246.10:53651/bin.sh*' - '*http://112.248.110.0:35255/i*' - '*http://60.17.72.69:55483/i*' - '*http://59.42.89.50:56735/i*' - '*http://42.229.223.233:45318/i*' - '*http://219.156.53.53:52805/i*' - '*http://60.17.72.69:55483/bin.sh*' - '*http://39.74.90.207:56876/i*' - '*http://219.156.53.53:52805/bin.sh*' - '*http://183.62.222.13:39203/i*' - '*http://59.42.89.50:56735/bin.sh*' - '*http://123.188.6.166:48522/i*' - '*http://115.52.176.31:38829/bin.sh*' - '*http://222.139.228.144:44143/i*' - '*http://222.139.228.144:44143/bin.sh*' - '*http://123.188.6.166:48522/bin.sh*' - '*http://95.106.139.40:55875/i*' - '*http://95.106.139.40:55875/bin.sh*' - '*http://115.61.16.231:35960/i*' - '*http://183.23.132.114:53767/bin.sh*' - '*http://105.225.26.19:45883/bin.sh*' - '*http://115.60.248.91:59455/i*' - '*http://115.61.16.231:35960/bin.sh*' - '*http://42.224.69.24:42321/i*' - '*http://lynxsecurity.ru:2022/mips*' - '*http://lynxsecurity.ru:2022/armv7l*' - '*http://lynxsecurity.ru:2022/i586*' - '*http://lynxsecurity.ru:2022/powerpc*' - '*http://lynxsecurity.ru:2022/x86_64*' - '*http://lynxsecurity.ru:2022/armv4l*' - '*http://lynxsecurity.ru:2022/sparc*' - '*http://lynxsecurity.ru:2022/armv6l*' - '*http://lynxsecurity.ru:2022/sh4*' - '*http://lynxsecurity.ru:2022/armv5l*' - '*http://lynxsecurity.ru:2022/m68k*' - '*http://lynxsecurity.ru:2022/mipsel*' - '*http://115.60.248.91:59455/bin.sh*' - '*http://125.44.222.231:44025/i*' - '*http://221.15.95.167:51542/i*' - '*http://182.126.82.26:59104/i*' - '*http://115.55.63.187:50975/i*' - '*http://125.44.222.231:44025/bin.sh*' - '*http://27.215.124.209:35364/i*' - '*http://94.244.36.34:37146/bin.sh*' - '*http://115.52.243.121:35977/bin.sh*' - '*http://115.55.63.187:50975/bin.sh*' - '*http://123.14.97.76:44096/i*' - '*http://182.126.82.26:59104/bin.sh*' - '*http://110.36.4.89:46260/i*' - '*http://182.127.39.168:35362/i*' - '*http://183.23.132.114:53767/i*' - '*http://94.244.36.34:37146/i*' - '*http://182.127.39.168:35362/bin.sh*' - '*http://98.91.254.110/bins/kalon.arm7*' - '*http://98.91.254.110/bins/kalon.x86*' - '*http://98.91.254.110/bins/kalon.ppc*' - '*http://98.91.254.110/bins/kalon.mpsl*' - '*http://98.91.254.110/bins/kalon.mips*' - '*http://98.91.254.110/bins/kalon.m68k*' - '*http://98.91.254.110/bins/kalon.arm6*' - '*http://98.91.254.110/bins/kalon.sh4*' - '*http://98.91.254.110/bins/kalon.arm5*' - '*http://98.91.254.110/bins/kalon.arm4*' - '*http://110.36.4.89:46260/bin.sh*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 10 id: 3c3635eb-a678-50be-966a-6b274b6b3133 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 10). logsource: category: proxy detection: selection: c-uri: - '*http://222.137.172.198:52845/i*' - '*http://112.87.56.240:54271/i*' - '*http://90.224.208.190:36646/i*' - '*http://219.155.171.209:48935/i*' - '*http://219.155.171.209:48935/bin.sh*' - '*http://90.224.208.190:36646/bin.sh*' - '*http://123.4.190.17:48149/bin.sh*' - '*http://112.87.56.240:54271/bin.sh*' - '*http://182.117.148.156:56226/i*' - '*http://182.117.148.156:56226/bin.sh*' - '*http://42.239.229.103:59896/i*' - '*http://39.73.108.18:46667/bin.sh*' - '*http://222.93.207.246:39950/i*' - '*http://42.226.231.9:53591/bin.sh*' - '*http://196.190.133.180:53994/i*' - '*http://115.63.230.109:35501/bin.sh*' - '*http://196.190.133.180:53994/bin.sh*' - '*http://182.127.108.91:46070/bin.sh*' - '*http://171.213.165.238:39667/i*' - '*http://163.142.85.203:60512/i*' - '*http://59.180.135.36:49750/i*' - '*http://27.211.58.158:54183/i*' - '*http://163.142.85.203:60512/bin.sh*' - '*http://182.183.140.79:56313/i*' - '*http://182.121.225.7:36317/bin.sh*' - '*http://42.231.74.60:57686/i*' - '*http://117.223.143.129:40270/i*' - '*http://182.112.79.205:54539/i*' - '*http://42.234.102.64:35903/i*' - '*http://112.249.247.168:46267/bin.sh*' - '*http://42.234.102.64:35903/bin.sh*' - '*http://117.223.143.129:40270/bin.sh*' - '*http://42.231.74.60:57686/bin.sh*' - '*http://110.37.39.234:40735/bin.sh*' - '*http://110.138.10.168:48528/i*' - '*http://45.166.188.48:50003/i*' - '*http://221.201.66.140:50027/i*' - '*http://110.138.10.168:48528/bin.sh*' - '*http://82.114.181.233:44817/i*' - '*http://196.190.69.149:43566/bin.sh*' - '*http://221.201.66.140:50027/bin.sh*' - '*http://115.50.221.105:43847/i*' - '*http://222.140.183.170:40303/i*' - '*http://115.50.221.105:43847/bin.sh*' - '*http://115.49.4.215:59360/i*' - '*http://115.49.4.215:59360/bin.sh*' - '*http://115.55.177.183:36148/bin.sh*' - '*http://115.58.154.52:46622/i*' - '*http://203.177.28.149:45551/bin.sh*' - '*http://66.212.186.197:33407/i*' - '*http://222.140.183.170:40303/bin.sh*' - '*http://27.215.176.9:57162/i*' - '*http://27.215.176.9:57162/bin.sh*' - '*http://112.239.102.152:57314/i*' - '*http://103.44.136.115:60710/i*' - '*http://42.239.157.9:55135/i*' - '*http://115.48.163.18:39646/i*' - '*http://112.239.102.152:57314/bin.sh*' - '*http://42.239.157.9:55135/bin.sh*' - '*http://110.36.4.89:53768/i*' - '*http://162.255.251.91:33439/i*' - '*http://220.135.42.30:53519/i*' - '*http://115.63.230.109:35501/i*' - '*http://61.52.61.209:54559/i*' - '*http://123.9.104.69:34901/i*' - '*http://110.36.4.89:53768/bin.sh*' - '*http://162.255.251.91:33439/bin.sh*' - '*http://123.9.104.69:34901/bin.sh*' - '*http://220.135.42.30:53519/bin.sh*' - '*http://39.73.108.18:46667/i*' - '*http://105.224.33.217:41583/i*' - '*http://42.238.254.190:33907/i*' - '*http://105.224.33.217:41583/bin.sh*' - '*http://42.238.254.190:33907/bin.sh*' - '*http://61.52.47.54:36456/bin.sh*' - '*http://27.153.196.115:50179/i*' - '*http://216.126.86.26:36797/i*' - '*http://112.93.137.16:35671/i*' - '*http://110.37.102.129:42317/i*' - '*http://109.236.44.113:54968/bin.sh*' - '*http://27.153.196.115:50179/bin.sh*' - '*http://123.4.238.122:50867/i*' - '*http://188.19.147.138:45305/i*' - '*http://188.19.147.138:45305/bin.sh*' - '*http://123.7.226.252:39722/bin.sh*' - '*http://103.19.49.134:50928/i*' - '*http://112.240.206.31:53993/i*' - '*http://105.225.113.253:36827/i*' - '*http://105.225.113.253:36827/bin.sh*' - '*http://115.48.14.97:44539/i*' - '*http://61.53.206.243:54006/i*' - '*http://61.52.78.136:39827/i*' - '*http://115.48.14.97:44539/bin.sh*' - '*http://61.52.78.136:39827/bin.sh*' - '*http://112.240.206.31:53993/bin.sh*' - '*http://125.44.217.16:45814/i*' - '*http://130.0.44.29:48255/bin.sh*' - '*http://218.59.14.73:36944/i*' - '*http://222.137.161.211:52847/i*' - '*http://115.50.69.1:59335/i*' - '*http://222.137.161.211:52847/bin.sh*' - '*http://218.59.14.73:36944/bin.sh*' - '*http://113.190.61.94:29420/i*' - '*http://42.235.181.25:38851/i*' - '*http://113.190.61.94:29420/bin.sh*' - '*http://105.186.143.79:49489/bin.sh*' - '*http://42.235.181.25:38851/bin.sh*' - '*http://27.207.228.158:46589/i*' - '*http://163.142.92.59:56422/i*' - '*http://200.112.129.57:42371/i*' - '*http://108.170.136.155:37272/i*' - '*http://182.116.51.13:39041/i*' - '*http://222.136.52.228:56020/bin.sh*' - '*http://163.142.95.89:43256/i*' - '*http://200.112.129.57:42371/bin.sh*' - '*http://108.170.136.155:37272/bin.sh*' - '*http://42.224.89.156:57932/i*' - '*http://42.224.89.156:57932/bin.sh*' - '*http://105.186.143.79:49489/i*' - '*http://163.142.95.89:43256/bin.sh*' - '*http://123.14.219.127:41338/i*' - '*http://218.61.126.54:57066/i*' - '*http://123.11.77.40:40335/bin.sh*' - '*http://123.14.219.127:41338/bin.sh*' - '*http://175.147.243.250:35517/i*' - '*http://45.90.163.37/GOONGANGONTOP/i468*' - '*http://112.93.137.16:35671/bin.sh*' - '*http://223.10.4.70:55867/bin.sh*' - '*http://221.15.20.68:48684/bin.sh*' - '*http://163.142.93.90:45440/bin.sh*' - '*http://187.121.141.137:59432/i*' - '*http://77.247.88.83:46373/bin.sh*' - '*http://219.156.60.141:46448/i*' - '*http://83.219.1.198:42561/i*' - '*http://110.39.239.253:40635/i*' - '*http://141.11.88.126/bins/sora.mpsl*' - '*http://141.11.88.126/bins/sora.x86_64*' - '*http://141.11.88.126/bins/sora.arm7*' - '*http://141.11.88.126/bins/sora.mips*' - '*http://141.11.88.126/bins/sora.sh4*' - '*http://141.11.88.126/bins/sora.spc*' - '*http://141.11.88.126/bins/sora.m68k*' - '*http://141.11.88.126/bins/sora.x86*' - '*http://141.11.88.126/bins/sora.ppc*' - '*http://141.11.88.126/bins/sora.arm*' - '*http://141.11.88.126/bins/sora.arm5*' - '*http://141.11.88.126/bins/sora.arm6*' - '*http://113.9.240.142:42978/i*' - '*http://83.219.1.198:42561/bin.sh*' - '*http://113.9.240.142:42978/bin.sh*' - '*http://116.139.183.228:43439/bin.sh*' - '*http://115.55.192.200:33588/i*' - '*http://115.55.192.200:33588/bin.sh*' - '*http://163.142.78.118:39139/i*' - '*http://175.167.76.60:53013/bin.sh*' - '*http://81.60.210.194:52127/i*' - '*http://163.142.78.118:39139/bin.sh*' - '*http://119.179.249.198:60598/i*' - '*http://39.64.9.139:43526/i*' - '*http://81.60.210.194:52127/bin.sh*' - '*http://110.36.27.207:33177/i*' - '*http://119.179.249.198:60598/bin.sh*' - '*http://151.192.135.88:41726/i*' - '*http://110.36.27.207:33177/bin.sh*' - '*http://105.184.91.145:44637/i*' - '*http://151.192.135.88:41726/bin.sh*' - '*http://42.177.78.235:35262/i*' - '*http://123.14.97.76:44096/bin.sh*' - '*http://105.184.91.145:44637/bin.sh*' - '*http://61.137.129.191:59754/i*' - '*http://42.229.160.104:58096/bin.sh*' - '*http://222.139.122.118:42542/i*' - '*http://61.54.43.201:39395/i*' - '*http://123.8.55.58:53035/bin.sh*' - '*http://61.137.129.191:59754/bin.sh*' - '*http://105.184.76.93:57607/i*' - '*http://61.54.43.201:39395/bin.sh*' - '*http://27.37.100.207:54087/i*' - '*http://105.184.76.93:57607/bin.sh*' - '*http://91.92.40.118/kworkerd-blkcg*' - '*http://91.92.40.118/kworkerd*' - '*http://91.92.40.118/kworkerd-irq-bal*' - '*http://91.92.40.118/kworkerd-crypto*' - '*http://91.92.40.118/kworkerd-softirq*' - '*http://91.92.40.118/kworkerd-events*' - '*http://91.92.40.118/kworkerd-writeback*' - '*http://91.92.40.118/kworkerd-irq*' - '*http://91.92.40.118/kworkerd-netns-rt*' - '*http://91.92.40.118/kworkerd-netns*' - '*http://91.92.40.118/kworkerd-rcu*' - '*http://207.34.149.169:32877/i*' - '*http://178.176.107.122:33136/bin.sh*' - '*http://5.175.192.197/bot.sh*' - '*http://5.175.192.197/bot*' - '*http://5.175.192.197/bot_x86_64*' - '*http://222.137.96.242:55578/i*' - '*http://110.37.14.156:33710/i*' - '*http://59.103.86.89:52040/i*' - '*http://110.37.14.156:33710/bin.sh*' - '*http://115.56.64.251:58971/i*' - '*http://59.97.251.109:44801/i*' - '*http://45.80.230.17/arm5*' - '*http://45.80.230.17/arm/*' - '*http://45.80.230.17/arm*' - '*http://45.80.230.17/ppc*' - '*http://45.80.230.17/mpsl*' - '*http://45.80.230.17/arm7*' - '*http://45.80.230.17/spc*' - '*http://45.80.230.17/sh4*' - '*http://45.80.230.17/x86_64*' - '*http://27.222.178.246:42909/bin.sh*' - '*http://59.97.251.109:44801/bin.sh*' - '*http://37.78.170.42:46944/i*' - '*http://37.78.170.42:46944/Mozi.m*' - '*http://37.78.170.42:46944/Mozi.a*' - '*http://37.78.170.42:46944/bin.sh*' - '*http://222.141.141.177:46554/i*' - '*http://182.127.112.76:42224/i*' - '*http://222.141.141.177:46554/bin.sh*' - '*http://182.127.112.76:42224/bin.sh*' - '*http://171.83.236.10:58951/i*' - '*http://163.142.94.218:38525/i*' - '*http://171.83.236.10:58951/bin.sh*' - '*http://163.142.94.218:38525/bin.sh*' - '*http://120.43.54.158:51830/i*' - '*http://120.43.54.158:51830/bin.sh*' - '*http://182.123.208.197:53380/i*' - '*http://182.191.88.160:60630/bin.sh*' - '*http://182.123.208.197:53380/bin.sh*' - '*http://123.9.245.88:57945/i*' - '*http://123.8.175.1:35967/i*' - '*http://45.90.163.37/arm5*' - '*http://45.90.163.37/ppc*' - '*http://45.90.163.37/sh4*' - '*http://45.90.163.37/spc*' - '*http://45.90.163.37/arc*' - '*http://45.90.163.37/i686*' - '*http://45.90.163.37/arm7*' - '*http://45.90.163.37/i486*' - '*http://45.90.163.37/m68k*' - '*http://45.90.163.37/arm*' - '*http://45.90.163.37/arm6*' - '*http://45.90.163.37/x86*' - '*http://45.90.163.37/mpsl*' - '*http://45.90.163.37/mips*' - '*http://123.8.175.1:35967/bin.sh*' - '*http://45.185.93.188:35009/i*' - '*http://45.185.93.188:35009/bin.sh*' - '*http://221.15.88.221:34763/bin.sh*' - '*http://39.79.135.18:44755/i*' - '*http://60.19.195.252:45381/i*' - '*http://45.90.163.37/GOONGANGONTOP/i486*' - '*http://60.19.195.252:45381/bin.sh*' - '*http://42.228.42.161:33531/i*' - '*http://122.232.98.183:38843/i*' - '*http://185.248.14.255:42675/i*' - '*http://218.101.27.83:15716/i*' - '*http://187.45.95.254:43736/i*' - '*http://125.43.106.36:48081/i*' - '*http://122.232.98.183:38843/bin.sh*' - '*http://187.45.95.254:43736/bin.sh*' - '*http://46.236.65.27:41504/i*' - '*http://115.49.201.102:56448/i*' - '*http://27.7.61.26:52305/bin.sh*' - '*http://110.39.253.204:41644/i*' - '*http://42.227.206.223:58585/i*' - '*http://59.58.190.51:57831/i*' - '*http://42.227.206.223:58585/bin.sh*' - '*http://94.154.43.22/arm5*' - '*http://94.154.43.22/arm*' - '*http://111.70.13.127:37514/i*' - '*http://61.52.47.54:36456/i*' - '*http://111.70.13.127:37514/bin.sh*' - '*http://115.50.3.250:59914/i*' - '*http://115.50.3.250:59914/bin.sh*' - '*http://101.66.43.107:34135/bin.sh*' - '*http://182.126.121.9:52719/i*' - '*http://212.73.53.163:60046/i*' - '*http://221.214.181.197:57741/i*' - '*http://221.214.181.197:57741/bin.sh*' - '*http://110.37.44.250:37106/i*' - '*http://105.184.194.116:48473/i*' - '*http://110.38.223.172:34248/i*' - '*http://119.118.90.115:60669/i*' - '*http://110.37.44.250:37106/bin.sh*' - '*http://105.184.194.116:48473/bin.sh*' - '*http://123.12.182.213:60797/i*' - '*http://60.177.40.254:37223/i*' - '*http://182.117.166.24:42869/i*' - '*http://39.74.91.180:35444/i*' - '*http://182.117.166.24:42869/bin.sh*' - '*http://123.12.182.213:60797/bin.sh*' - '*http://60.162.194.130:46369/i*' - '*http://42.224.27.77:34533/bin.sh*' - '*http://39.74.91.180:35444/bin.sh*' - '*http://196.190.69.149:54767/bin.sh*' - '*http://60.162.194.130:46369/bin.sh*' - '*http://110.36.24.140:39849/i*' - '*http://222.220.238.211:40579/bin.sh*' - '*http://110.38.207.151:35142/i*' - '*http://113.239.73.143:56396/i*' - '*http://27.207.230.65:33257/i*' - '*http://113.239.73.143:56396/bin.sh*' - '*http://119.99.250.219:43060/bin.sh*' - '*http://110.38.207.151:35142/bin.sh*' - '*http://119.185.182.34:48182/i*' - '*http://42.224.1.128:35228/i*' - '*http://27.217.110.83:59029/i*' - '*http://27.217.110.83:59029/bin.sh*' - '*http://222.136.102.188:51298/i*' - '*http://141.11.88.114/arm/*' - '*http://141.11.88.114/x86*' - '*http://141.11.88.114/arm6*' - '*http://141.11.88.114/sh4*' - '*http://141.11.88.114/mips*' - '*http://141.11.88.114/mpsl*' - '*http://141.11.88.114/spc*' - '*http://141.11.88.114/ppc*' - '*http://141.11.88.114/x86_64*' - '*http://94.154.43.42/atomic/komaru.x86*' - '*http://94.154.43.42/bins/femboy.x86_64*' - '*http://94.154.43.42/bin/px86*' - '*http://94.154.43.42/pelerberjembudpeler/vanilla.x86*' - '*http://94.154.43.42/atomic/nz.x86_64*' - '*http://94.154.43.42/bin/untouchable.x86_64*' - '*http://94.154.43.42/n2/bin.x86_64*' - '*http://94.154.43.42/00101010101001/kimwolf.x86*' - '*http://94.154.43.42/n2/iran.x86*' - '*http://94.154.43.42/bins/untouchable.x86*' - '*http://94.154.43.42/hiddenbin/nova.x86_64*' - '*http://94.154.43.42/bin/unkillable.x86*' - '*http://94.154.43.42/bins/wife.x86*' - '*http://94.154.43.42/n2/nova.x86*' - '*http://94.154.43.42/n2/atomic.x86_64*' - '*http://94.154.43.42/main_x86_64*' - '*http://94.154.43.42/bins/kia.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/flutter.x86_64*' - '*http://94.154.43.42/vcimanagement.x86_64*' - '*http://94.154.43.42/00101010101001/kia.x86_64*' - '*http://94.154.43.42/n2/x86.ghost*' - '*http://94.154.43.42/GOONGANGONTOP/perc.x86_64*' - '*http://94.154.43.42/hiddenbin/px.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/sora.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/tuxbot.x86_64*' - '*http://94.154.43.42/chunky/mossad.x86_64*' - '*http://94.154.43.42/bins/komaru.x86_64*' - '*http://94.154.43.42/00101010101001/bin.x86_64*' - '*http://94.154.43.42/bin/sora.x86*' - '*http://94.154.43.42/hiddenbin/perc.x86_64*' - '*http://94.154.43.42/atomic/bot.x86*' - '*http://94.154.43.42/main_x86*' - '*http://94.154.43.42/atomic/nerv.x86_64*' - '*http://94.154.43.42/chunky/nova.x86_64*' - '*http://94.154.43.42/00101010101001/main_x86*' - '*http://94.154.43.42/pelerberjembudpeler/null.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/nova.x86_64*' - '*http://94.154.43.42/aisuru.x86*' - '*http://94.154.43.42/chunky/vcimanagement.x86*' - '*http://94.154.43.42/hiddenbin/kokuryu.x86*' - '*http://94.154.43.42/GOONGANGONTOP/px.x86*' - '*http://94.154.43.42/n2/kimwolf.x86*' - '*http://94.154.43.42/chunky/bin.x86*' - '*http://94.154.43.42/bin/px.x86*' - '*http://94.154.43.42/pelerberjembudpeler/rebirth.x86_64*' - '*http://94.154.43.42/bin/wife.x86*' - '*http://94.154.43.42/atomic.x86*' - '*http://94.154.43.42/n2/sorrow.x86*' - '*http://94.154.43.42/n2/condi.x86_64*' - '*http://94.154.43.42/chunky/unkillable.x86*' - '*http://94.154.43.42/pelerberjembudpeler/sorrow.x86*' - '*http://94.154.43.42/pelerberjembudpeler/rebirth.x86*' - '*http://94.154.43.42/bin/wife.x86_64*' - '*http://94.154.43.42/bot_x86_64*' - '*http://94.154.43.42/kokuryu.x86_64*' - '*http://94.154.43.42/00101010101001/kamru.x86_64*' - '*http://94.154.43.42/chunky/atomic.x86*' - '*http://94.154.43.42/chunky/nova.x86*' - '*http://94.154.43.42/bins/px86*' - '*http://94.154.43.42/pelerberjembudpeler/morte.x86*' - '*http://94.154.43.42/pelerberjembudpeler/perc.x86_64*' - '*http://94.154.43.42/chunky/x86.ghost*' - '*http://94.154.43.42/n2/untouchable.x86*' - '*http://94.154.43.42/GOONGANGONTOP/monero.x86_64*' - '*http://94.154.43.42/atomic/flutter.x86*' - '*http://94.154.43.42/00101010101001/px.x86_64*' - '*http://94.154.43.42/hiddenbin/komaru.x86*' - '*http://94.154.43.42/mossad.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/femboy.x86*' - '*http://94.154.43.42/00101010101001/peler.x86_64*' - '*http://94.154.43.42/chunky/atomic.x86_64*' - '*http://94.154.43.42/hiddenbin/main_x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/x86*' - '*http://94.154.43.42/GOONGANGONTOP/wife.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/kamru.x86_64*' - '*http://94.154.43.42/n2/atomic.x86*' - '*http://94.154.43.42/bins/kokuryu.x86_64*' - '*http://94.154.43.42/00101010101001/kokuryu.x86_64*' - '*http://94.154.43.42/atomic/tuxbot.x86*' - '*http://94.154.43.42/bin/mossad.x86*' - '*http://94.154.43.42/bin/atomic.x86_64*' - '*http://94.154.43.42/00101010101001/boatnet.x86*' - '*http://94.154.43.42/chunky/rebirth.x86*' - '*http://94.154.43.42/n2/x86*' - '*http://94.154.43.42/null.x86*' - '*http://94.154.43.42/00101010101001/rebirth.x86*' - '*http://94.154.43.42/pelerberjembudpeler/px86_64*' - '*http://94.154.43.42/n2/px.x86*' - '*http://94.154.43.42/pelerberjembudpeler/unkillable.x86*' - '*http://94.154.43.42/hiddenbin/juan.x86*' - '*http://94.154.43.42/n2/femboy.x86_64*' - '*http://94.154.43.42/bins/vanilla.x86*' - '*http://94.154.43.42/vanilla.x86*' - '*http://94.154.43.42/pelerberjembudpeler/main_x86*' - '*http://94.154.43.42/GOONGANGONTOP/null.x86_64*' - '*http://94.154.43.42/bins/bot_x86_64*' - '*http://94.154.43.42/unkillable.x86_64*' - '*http://94.154.43.42/hiddenbin/nz.x86_64*' - '*http://94.154.43.42/nerv.x86_64*' - '*http://94.154.43.42/chunky/px.x86*' - '*http://94.154.43.42/n2/kia.x86*' - '*http://94.154.43.42/n2/sorrow.x86_64*' - '*http://94.154.43.42/chunky/komaru.x86*' - '*http://94.154.43.42/atomic/px.x86*' - '*http://94.154.43.42/atomic/null.x86*' - '*http://94.154.43.42/00101010101001/data.x86_64*' - '*http://94.154.43.42/bins/x86.ghost*' - '*http://94.154.43.42/bins/wife.x86_64*' - '*http://94.154.43.42/bins/unkillable.x86_64*' - '*http://94.154.43.42/rebirth.x86*' - '*http://94.154.43.42/00101010101001/iran.x86_64*' - '*http://94.154.43.42/bin/x86*' - '*http://94.154.43.42/untouchable.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/kokuryu.x86_64*' - '*http://94.154.43.42/atomic/main_x86_64*' - '*http://94.154.43.42/hiddenbin/data.x86_64*' - '*http://94.154.43.42/bins/boatnet.x86*' - '*http://94.154.43.42/hiddenbin/ducky.x86_64*' - '*http://94.154.43.42/chunky/monero.x86*' - '*http://94.154.43.42/pelerberjembudpeler/kokuryu.x86*' - '*http://94.154.43.42/n2/tuxbot.x86*' - '*http://94.154.43.42/bins/untouchable.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/vcimanagement.x86*' - '*http://94.154.43.42/atomic/px.x86_64*' - '*http://94.154.43.42/hiddenbin/mossad.x86*' - '*http://94.154.43.42/n2/bot.x86_64*' - '*http://94.154.43.42/n2/sora.x86_64*' - '*http://94.154.43.42/atomic/vanilla.x86_64*' - '*http://94.154.43.42/n2/femboy.x86*' - '*http://94.154.43.42/bin/iran.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/px86*' - '*http://94.154.43.42/hiddenbin/sora.x86*' - '*http://94.154.43.42/hiddenbin/atomic.x86_64*' - '*http://94.154.43.42/00101010101001/juan.x86*' - '*http://94.154.43.42/n2/unkillable.x86*' - '*http://94.154.43.42/GOONGANGONTOP/perc.x86*' - '*http://94.154.43.42/pelerberjembudpeler/kimwolf.x86_64*' - '*http://94.154.43.42/kimwolf.x86*' - '*http://94.154.43.42/n2/nerv.x86*' - '*http://94.154.43.42/00101010101001/condi.x86*' - '*http://94.154.43.42/pelerberjembudpeler/kimwolf.x86*' - '*http://94.154.43.42/GOONGANGONTOP/nz.x86_64*' - '*http://94.154.43.42/bins/ducky.x86_64*' - '*http://94.154.43.42/atomic/nz.x86*' - '*http://94.154.43.42/hiddenbin/x86_64.ghost*' - '*http://94.154.43.42/chunky/kokuryu.x86*' - '*http://94.154.43.42/atomic/mossad.x86_64*' - '*http://94.154.43.42/ducky.x86_64*' - '*http://94.154.43.42/bin/xpe.x86_64*' - '*http://94.154.43.42/n2/boatnet.x86_64*' - '*http://94.154.43.42/hiddenbin/unkillable.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/iran.x86*' - '*http://94.154.43.42/00101010101001/x86_64.ghost*' - '*http://94.154.43.42/chunky/tuxbot.x86_64*' - '*http://94.154.43.42/n2/ducky.x86*' - '*http://94.154.43.42/hiddenbin/tuxbot.x86*' - '*http://94.154.43.42/GOONGANGONTOP/bin.x86*' - '*http://94.154.43.42/hiddenbin/femboy.x86_64*' - '*http://94.154.43.42/bin/rebirth.x86*' - '*http://94.154.43.42/bin/femboy.x86_64*' - '*http://94.154.43.42/atomic/ducky.x86*' - '*http://94.154.43.42/n2/unkillable.x86_64*' - '*http://94.154.43.42/hiddenbin/data.x86*' - '*http://94.154.43.42/bin/px.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/peler.x86*' - '*http://94.154.43.42/bins/aisuru.x86_64*' - '*http://94.154.43.42/n2/iran.x86_64*' - '*http://94.154.43.42/bin/flutter.x86*' - '*http://94.154.43.42/bins/rebirth.x86*' - '*http://94.154.43.42/atomic/main_x86*' - '*http://94.154.43.42/pelerberjembudpeler/nerv.x86*' - '*http://94.154.43.42/pelerberjembudpeler/atomic.x86_64*' - '*http://94.154.43.42/00101010101001/nova.x86*' - '*http://94.154.43.42/iran.x86*' - '*http://94.154.43.42/n2/tuxbot.x86_64*' - '*http://94.154.43.42/bins/vanilla.x86_64*' - '*http://94.154.43.42/wife.x86*' - '*http://94.154.43.42/hiddenbin/x86*' - '*http://94.154.43.42/chunky/main.x86*' - '*http://94.154.43.42/pelerberjembudpeler/x86_64*' - '*http://94.154.43.42/atomic/boatnet.x86*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 11 id: 561883e0-6e84-5ac2-9d91-44406eb83c2c status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 11). logsource: category: proxy detection: selection: c-uri: - '*http://94.154.43.42/bin/juan.x86_64*' - '*http://94.154.43.42/bins/bin.x86*' - '*http://94.154.43.42/atomic/bot.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/condi.x86*' - '*http://94.154.43.42/chunky/untouchable.x86_64*' - '*http://94.154.43.42/hiddenbin/condi.x86*' - '*http://94.154.43.42/00101010101001/nova.x86_64*' - '*http://94.154.43.42/00101010101001/tuxbot.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/kia.x86_64*' - '*http://94.154.43.42/kamru.x86*' - '*http://94.154.43.42/condi.x86*' - '*http://94.154.43.42/hiddenbin/flutter.x86*' - '*http://94.154.43.42/bin/vcimanagement.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/sorrow.x86*' - '*http://94.154.43.42/hiddenbin/bin.x86*' - '*http://94.154.43.42/atomic/iran.x86*' - '*http://94.154.43.42/n2/main_x86*' - '*http://94.154.43.42/hiddenbin/nz.x86*' - '*http://94.154.43.42/chunky/kokuryu.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/monero.x86*' - '*http://94.154.43.42/GOONGANGONTOP/condi.x86*' - '*http://94.154.43.42/00101010101001/unkillable.x86*' - '*http://94.154.43.42/bins/condi.x86_64*' - '*http://94.154.43.42/atomic/peler.x86_64*' - '*http://94.154.43.42/n2/sora.x86*' - '*http://94.154.43.42/pelerberjembudpeler/bot.x86_64*' - '*http://94.154.43.42/bins/px.x86*' - '*http://94.154.43.42/mossad.x86*' - '*http://94.154.43.42/atomic/nova.x86*' - '*http://94.154.43.42/n2/untouchable.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/juan.x86_64*' - '*http://94.154.43.42/n2/condi.x86*' - '*http://94.154.43.42/nz.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/wife.x86*' - '*http://94.154.43.42/bin/main.x86*' - '*http://94.154.43.42/bins/sorrow.x86*' - '*http://94.154.43.42/bin/sorrow.x86_64*' - '*http://94.154.43.42/hiddenbin//kokuryu.x86_64*' - '*http://94.154.43.42/n2/rebirth.x86_64*' - '*http://94.154.43.42/chunky/vanilla.x86*' - '*http://94.154.43.42/bins/flutter.x86*' - '*http://94.154.43.42/unreverseable.x86_64*' - '*http://94.154.43.42/n2/monero.x86*' - '*http://94.154.43.42/n2/nerv.x86_64*' - '*http://94.154.43.42/hiddenbin/unkillable.x86*' - '*http://94.154.43.42/sora.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/nova.x86*' - '*http://94.154.43.42/bins/main.x86_64*' - '*http://94.154.43.42/chunky/sorrow.x86*' - '*http://94.154.43.42/hiddenbin/px.x86*' - '*http://94.154.43.42/00101010101001/wife.x86_64*' - '*http://94.154.43.42/bin/main_x86*' - '*http://94.154.43.42/GOONGANGONTOP/kokuryu.x86*' - '*http://94.154.43.42/boatnet.x86*' - '*http://94.154.43.42/pelerberjembudpeler/monero.x86*' - '*http://94.154.43.42/bin/aisuru.x86*' - '*http://94.154.43.42/bins/juan.x86_64*' - '*http://94.154.43.42/atomic/morte.x86_64*' - '*http://94.154.43.42/chunky/null.x86*' - '*http://94.154.43.42/GOONGANGONTOP/morte.x86*' - '*http://94.154.43.42/00101010101001/sora.x86_64*' - '*http://94.154.43.42/00101010101001/tuxbot.x86*' - '*http://94.154.43.42/chunky/aisuru.x86*' - '*http://94.154.43.42/bins/bin.x86_64*' - '*http://94.154.43.42/bins/nz.x86*' - '*http://94.154.43.42/atomic/komaru.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/tuxbot.x86*' - '*http://94.154.43.42/bin/perc.x86*' - '*http://94.154.43.42/chunky/perc.x86*' - '*http://94.154.43.42/00101010101001/bin.x86*' - '*http://94.154.43.42/GOONGANGONTOP/nz.x86*' - '*http://94.154.43.42/n2/flutter.x86*' - '*http://94.154.43.42/n2/bin.x86*' - '*http://94.154.43.42/00101010101001/nz.x86*' - '*http://94.154.43.42/chunky/femboy.x86*' - '*http://94.154.43.42/chunky/boatnet.x86_64*' - '*http://94.154.43.42/nova.x86*' - '*http://94.154.43.42/hiddenbin/femboy.x86*' - '*http://94.154.43.42/bins/ducky.x86*' - '*http://94.154.43.42/00101010101001/bot.x86_64*' - '*http://94.154.43.42/hiddenbin/main.x86_64*' - '*http://94.154.43.42/hiddenbin/juan.x86_64*' - '*http://94.154.43.42/00101010101001/atomic.x86_64*' - '*http://94.154.43.42/hiddenbin/wife.x86*' - '*http://94.154.43.42/GOONGANGONTOP/untouchable.x86_64*' - '*http://94.154.43.42/bin/sora.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/condi.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/bin.x86_64*' - '*http://94.154.43.42/atomic/unreverseable.x86_64*' - '*http://94.154.43.42/bins/x86*' - '*http://94.154.43.42/chunky/mossad.x86*' - '*http://94.154.43.42/pelerberjembudpeler/bin.x86*' - '*http://94.154.43.42/00101010101001/condi.x86_64*' - '*http://94.154.43.42/00101010101001/sorrow.x86*' - '*http://94.154.43.42/hiddenbin/aisuru.x86*' - '*http://94.154.43.42/n2/ducky.x86_64*' - '*http://94.154.43.42/bins/morte.x86*' - '*http://94.154.43.42/pelerberjembudpeler/tuxbot.x86_64*' - '*http://94.154.43.42/00101010101001/px86*' - '*http://94.154.43.42/bin/femboy.x86*' - '*http://94.154.43.42/monero.x86*' - '*http://94.154.43.42/atomic/atomic.x86*' - '*http://94.154.43.42/n2/nova.x86_64*' - '*http://94.154.43.42/bin/rebirth.x86_64*' - '*http://94.154.43.42/n2/perc.x86*' - '*http://94.154.43.42/atomic/mossad.x86*' - '*http://94.154.43.42/pelerberjembudpeler/unkillable.x86_64*' - '*http://94.154.43.42/bot_x86*' - '*http://94.154.43.42/GOONGANGONTOP/nerv.x86_64*' - '*http://94.154.43.42/n2/px86_64*' - '*http://94.154.43.42/atomic/aisuru.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/atomic.x86*' - '*http://94.154.43.42/GOONGANGONTOP/boatnet.x86*' - '*http://94.154.43.42/unkillable.x86*' - '*http://94.154.43.42/bins/iran.x86*' - '*http://94.154.43.42/hiddenbin/main.x86*' - '*http://94.154.43.42/pelerberjembudpeler/sorrow.x86_64*' - '*http://94.154.43.42/chunky/bot_x86*' - '*http://94.154.43.42/bins/boatnet.x86_64*' - '*http://94.154.43.42/bin/mossad.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/nerv.x86_64*' - '*http://94.154.43.42/bins/flutter.x86_64*' - '*http://94.154.43.42/chunky/kamru.x86*' - '*http://94.154.43.42/nerv.x86*' - '*http://94.154.43.42/chunky/unkillable.x86_64*' - '*http://94.154.43.42/bin/komaru.x86*' - '*http://94.154.43.42/00101010101001/komaru.x86_64*' - '*http://94.154.43.42/hiddenbin/kimwolf.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/monero.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/bot_x86_64*' - '*http://94.154.43.42/00101010101001/femboy.x86*' - '*http://94.154.43.42/n2/xpe.x86*' - '*http://94.154.43.42/n2/bot_x86*' - '*http://94.154.43.42/hiddenbin/komaru.x86_64*' - '*http://94.154.43.42/chunky/x86*' - '*http://94.154.43.42/bin/kokuryu.x86_64*' - '*http://94.154.43.42/n2/vanilla.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/perc.x86*' - '*http://94.154.43.42/n2/boatnet.x86*' - '*http://94.154.43.42/GOONGANGONTOP/untouchable.x86*' - '*http://94.154.43.42/chunky/iran.x86*' - '*http://94.154.43.42/bins/nova.x86*' - '*http://94.154.43.42/juan.x86*' - '*http://94.154.43.42/atomic/bot_x86*' - '*http://94.154.43.42/atomic.x86_64*' - '*http://94.154.43.42/bin/untouchable.x86*' - '*http://94.154.43.42/chunky/perc.x86_64*' - '*http://94.154.43.42/hiddenbin/untouchable.x86_64*' - '*http://94.154.43.42/x86.ghost*' - '*http://94.154.43.42/pelerberjembudpeler/bot_x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/nz.x86*' - '*http://94.154.43.42/tuxbot.x86_64*' - '*http://94.154.43.42/chunky/ducky.x86_64*' - '*http://94.154.43.42/hiddenbin/sorrow.x86*' - '*http://94.154.43.42/n2/x86_64.ghost*' - '*http://94.154.43.42/hiddenbin/x86.ghost*' - '*http://94.154.43.42/atomic/xpe.x86*' - '*http://94.154.43.42/GOONGANGONTOP/kimwolf.x86*' - '*http://94.154.43.42/chunky/ducky.x86*' - '*http://94.154.43.42/hiddenbin/kia.x86*' - '*http://94.154.43.42/n2/data.x86_64*' - '*http://94.154.43.42/atomic/nova.x86_64*' - '*http://94.154.43.42/00101010101001/vanilla.x86_64*' - '*http://94.154.43.42/bin/main_x86_64*' - '*http://94.154.43.42/bin/morte.x86*' - '*http://94.154.43.42/GOONGANGONTOP/aisuru.x86*' - '*http://94.154.43.42/hiddenbin/sorrow.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/main_x86_64*' - '*http://94.154.43.42/aisuru.x86_64*' - '*http://94.154.43.42/atomic/x86_64*' - '*http://94.154.43.42/bin/kia.x86_64*' - '*http://94.154.43.42/bins/kimwolf.x86_64*' - '*http://94.154.43.42/00101010101001/peler.x86*' - '*http://94.154.43.42/00101010101001/kimwolf.x86_64*' - '*http://94.154.43.42/hiddenbin/vcimanagement.x86*' - '*http://94.154.43.42/GOONGANGONTOP/bot.x86*' - '*http://94.154.43.42/GOONGANGONTOP/bot_x86*' - '*http://94.154.43.42/bins/juan.x86*' - '*http://94.154.43.42/GOONGANGONTOP/juan.x86*' - '*http://94.154.43.42/atomic/perc.x86_64*' - '*http://94.154.43.42/bins/atomic.x86*' - '*http://94.154.43.42/bin/bin.x86*' - '*http://94.154.43.42/GOONGANGONTOP/xpe.x86*' - '*http://94.154.43.42/00101010101001/main.x86_64*' - '*http://94.154.43.42/atomic/px86*' - '*http://94.154.43.42/pelerberjembudpeler/komaru.x86_64*' - '*http://94.154.43.42/bin/sorrow.x86*' - '*http://94.154.43.42/sorrow.x86_64*' - '*http://94.154.43.42/atomic/sorrow.x86*' - '*http://94.154.43.42/atomic/femboy.x86_64*' - '*http://94.154.43.42/bin/tuxbot.x86_64*' - '*http://94.154.43.42/bin/monero.x86*' - '*http://94.154.43.42/00101010101001/bot.x86*' - '*http://94.154.43.42/bins/komaru.x86*' - '*http://94.154.43.42/00101010101001/komaru.x86*' - '*http://94.154.43.42/data.x86*' - '*http://94.154.43.42/bins/main_x86*' - '*http://94.154.43.42/hiddenbin/xpe.x86_64*' - '*http://94.154.43.42/n2/perc.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/data.x86*' - '*http://94.154.43.42/bin/ducky.x86*' - '*http://94.154.43.42/00101010101001/boatnet.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/mossad.x86*' - '*http://94.154.43.42/rebirth.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/komaru.x86*' - '*http://94.154.43.42/pelerberjembudpeler/ducky.x86*' - '*http://94.154.43.42/00101010101001/unkillable.x86_64*' - '*http://94.154.43.42/hiddenbin/condi.x86_64*' - '*http://94.154.43.42/bins/kia.x86*' - '*http://94.154.43.42/n2/aisuru.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/peler.x86_64*' - '*http://94.154.43.42/bins/aisuru.x86*' - '*http://94.154.43.42/GOONGANGONTOP/null.x86*' - '*http://94.154.43.42/pelerberjembudpeler/main_x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/vcimanagement.x86*' - '*http://94.154.43.42/atomic/kamru.x86*' - '*http://94.154.43.42/n2/komaru.x86*' - '*http://94.154.43.42/chunky/bot_x86_64*' - '*http://94.154.43.42/atomic/rebirth.x86*' - '*http://94.154.43.42/hiddenbin/bot.x86*' - '*http://94.154.43.42/n2/main.x86*' - '*http://94.154.43.42/GOONGANGONTOP/ducky.x86*' - '*http://94.154.43.42/morte.x86*' - '*http://94.154.43.42/n2/main_x86_64*' - '*http://94.154.43.42/hiddenbin/px86*' - '*http://94.154.43.42/atomic/kokuryu.x86_64*' - '*http://94.154.43.42/hiddenbin/boatnet.x86_64*' - '*http://94.154.43.42/bin/boatnet.x86*' - '*http://94.154.43.42/bins/mossad.x86_64*' - '*http://94.154.43.42/chunky/null.x86_64*' - '*http://94.154.43.42/bins/px86_64*' - '*http://94.154.43.42/pelerberjembudpeler/iran.x86*' - '*http://94.154.43.42/pelerberjembudpeler/x86.ghost*' - '*http://94.154.43.42/chunky/nerv.x86*' - '*http://94.154.43.42/atomic/unkillable.x86_64*' - '*http://94.154.43.42/00101010101001/nerv.x86_64*' - '*http://94.154.43.42/bins/nz.x86_64*' - '*http://94.154.43.42/bin/juan.x86*' - '*http://94.154.43.42/hiddenbin/rebirth.x86*' - '*http://94.154.43.42/00101010101001/rebirth.x86_64*' - '*http://94.154.43.42/n2/wife.x86_64*' - '*http://94.154.43.42/bins/px.x86_64*' - '*http://94.154.43.42/atomic/boatnet.x86_64*' - '*http://94.154.43.42/n2/px.x86_64*' - '*http://94.154.43.42/hiddenbin/nerv.x86_64*' - '*http://94.154.43.42/chunky/morte.x86_64*' - '*http://94.154.43.42/bins/sorrow.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/nz.x86_64*' - '*http://94.154.43.42/00101010101001/sorrow.x86_64*' - '*http://94.154.43.42/chunky/boatnet.x86*' - '*http://94.154.43.42/bin/null.x86*' - '*http://94.154.43.42/bins/peler.x86*' - '*http://94.154.43.42/atomic/null.x86_64*' - '*http://94.154.43.42/atomic/untouchable.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/nova.x86*' - '*http://94.154.43.42/bins/rebirth.x86_64*' - '*http://94.154.43.42/chunky/kimwolf.x86*' - '*http://94.154.43.42/chunky/morte.x86*' - '*http://94.154.43.42/n2/unreverseable.x86_64*' - '*http://94.154.43.42/chunky/wife.x86_64*' - '*http://94.154.43.42/n2/px86*' - '*http://94.154.43.42/n2/kamru.x86*' - '*http://94.154.43.42/bin.x86*' - '*http://94.154.43.42/flutter.x86*' - '*http://94.154.43.42/bin/condi.x86_64*' - '*http://94.154.43.42/chunky/kimwolf.x86_64*' - '*http://94.154.43.42/atomic/perc.x86*' - '*http://94.154.43.42/00101010101001/juan.x86_64*' - '*http://94.154.43.42/bin/peler.x86*' - '*http://94.154.43.42/bin/monero.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/kimwolf.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/px86_64*' - '*http://94.154.43.42/x86*' - '*http://94.154.43.42/hiddenbin/wife.x86_64*' - '*http://94.154.43.42/hiddenbin/kamru.x86_64*' - '*http://94.154.43.42/atomic/morte.x86*' - '*http://94.154.43.42/bins/nova.x86_64*' - '*http://94.154.43.42/00101010101001/wife.x86*' - '*http://94.154.43.42/bins/tuxbot.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/komaru.x86_64*' - '*http://94.154.43.42/atomic/flutter.x86_64*' - '*http://94.154.43.42/GOONGANGONTOP/nerv.x86*' - '*http://94.154.43.42/atomic/main.x86_64*' - '*http://94.154.43.42/peler.x86_64*' - '*http://94.154.43.42/atomic/kia.x86*' - '*http://94.154.43.42/bins/bot.x86_64*' - '*http://94.154.43.42/pelerberjembudpeler/x86*' - '*http://94.154.43.42/bin/nova.x86*' - '*http://94.154.43.42/bins/vcimanagement.x86*' - '*http://94.154.43.42/n2/data.x86*' - '*http://94.154.43.42/bin/bin.x86_64*' - '*http://94.154.43.42/bin/vanilla.x86_64*' - '*http://94.154.43.42/n2/nz.x86_64*' - '*http://110.39.237.185:38606/i*' - '*http://we.aibotnet.su/arm5*' - '*http://we.aibotnet.su/x86*' - '*http://we.aibotnet.su/sh4*' - '*http://we.aibotnet.su/x86_64*' - '*http://we.aibotnet.su/ppc*' - '*http://we.aibotnet.su/arm7*' - '*http://we.aibotnet.su/spc*' - '*http://we.aibotnet.su/m68k*' - '*http://we.aibotnet.su/arm6*' - '*http://we.aibotnet.su/arm*' - '*http://we.aibotnet.su/mpsl*' - '*http://151.115.99.253/dist/let*' - '*http://151.115.99.253/dist/node_server*' - '*http://151.115.99.253/dist/clientarm64*' - '*http://151.115.99.253/dist/node-server*' - '*http://151.115.99.253/dist/lrt*' - '*http://222.136.102.188:51298/bin.sh*' - '*http://123.4.255.215:36047/i*' - '*http://110.39.237.185:38606/bin.sh*' - '*http://110.85.99.216:38787/i*' - '*http://110.36.93.217:59434/bin.sh*' - '*http://175.168.245.77:55483/i*' - '*http://61.53.242.74:35577/i*' - '*http://123.12.20.55:39524/i*' - '*http://123.13.117.49:42663/i*' - '*http://123.12.20.55:39524/bin.sh*' - '*http://105.184.158.249:59541/bin.sh*' - '*http://61.53.242.74:35577/bin.sh*' - '*http://123.13.117.49:42663/bin.sh*' - '*http://149.71.39.60:44118/i*' - '*http://123.14.192.62:60059/i*' - '*http://123.14.192.62:60059/bin.sh*' - '*http://182.116.32.25:40170/i*' - '*http://42.224.67.141:45357/i*' - '*http://221.1.225.233:59986/i*' - '*http://182.116.32.25:40170/bin.sh*' - '*http://220.189.150.23:49446/i*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i686*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arc*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i486*' - '*http://129.121.114.124/7Hd*' - '*http://129.121.114.124/v1t*' - '*http://141.11.88.134/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k*' - '*http://152.70.4.175:5555/bot_x86*' - '*http://129.121.114.124/W8g*' - '*http://129.121.114.124/NOP*' - '*http://129.121.114.124/WBB*' - '*http://152.70.4.175:5555/bot*' - '*http://196.190.69.149:54767/i*' - '*http://221.1.225.233:59986/bin.sh*' - '*http://115.59.225.152:55523/bin.sh*' - '*http://42.238.135.242:55135/i*' - '*http://220.189.150.23:49446/bin.sh*' - '*http://123.189.141.164:56062/i*' - '*http://123.189.141.164:56062/bin.sh*' - '*http://27.215.213.232:56127/i*' - '*http://27.215.213.232:56127/bin.sh*' - '*http://115.59.61.161:44262/i*' - '*http://125.46.199.204:41231/bin.sh*' - '*http://42.234.206.174:46208/i*' - '*http://110.36.15.130:36163/bin.sh*' - '*http://42.234.206.174:46208/bin.sh*' - '*http://125.42.32.119:48294/i*' - '*http://27.215.179.148:39851/i*' - '*http://151.115.99.253/a.sh*' - '*http://115.54.118.34:42089/bin.sh*' - '*http://125.42.32.119:48294/bin.sh*' - '*http://125.41.75.221:39880/i*' - '*http://42.239.242.55:41810/i*' - '*http://119.117.252.95:53457/i*' - '*http://125.41.75.221:39880/bin.sh*' - '*http://115.59.225.152:55523/i*' - '*http://42.239.242.55:41810/bin.sh*' - '*http://119.117.252.95:53457/bin.sh*' - '*http://39.79.234.185:58649/i*' - '*http://42.224.67.141:45357/bin.sh*' - '*http://101.66.43.107:34135/i*' - '*http://61.163.148.179:34307/i*' - '*http://we.aibotnet.su/mips*' - '*http://42.228.45.67:33424/i*' - '*http://42.224.114.38:49973/i*' - '*http://182.127.108.91:46070/i*' - '*http://112.249.89.236:44363/i*' - '*http://182.126.103.204:46161/i*' - '*http://182.126.103.204:46161/bin.sh*' - '*http://42.232.228.31:53154/i*' - '*http://110.37.119.220:47156/i*' - '*http://119.179.238.246:33133/i*' - '*http://45.150.195.235/tarm*' - '*http://45.150.195.235/tarm5*' - '*http://45.150.195.235/tmpsl*' - '*http://45.150.195.235/tarm7*' - '*http://45.150.195.235/tarm6*' - '*http://119.179.238.246:33133/bin.sh*' - '*http://196.190.10.252:44170/bin.sh*' - '*http://123.132.156.131:50352/i*' - '*http://110.38.208.89:56690/i*' - '*http://110.38.208.89:56690/bin.sh*' - '*http://123.132.156.131:50352/bin.sh*' - '*http://105.184.158.249:59541/i*' - '*http://119.185.170.78:49993/bin.sh*' - '*http://42.87.34.157:56771/i*' - '*http://115.48.55.3:49980/bin.sh*' - '*http://110.37.43.119:43262/bin.sh*' - '*http://42.225.207.24:52041/i*' - '*http://110.36.28.45:56113/i*' - '*http://182.119.33.172:41900/i*' - '*http://42.225.207.24:52041/bin.sh*' - '*http://123.13.52.232:33331/i*' - '*http://182.121.40.102:58400/i*' - '*http://182.121.40.102:58400/bin.sh*' - '*http://119.186.232.222:41659/i*' - '*http://45.90.163.37/GOONGANGONTOP/mpsl*' - '*http://45.90.163.37/GOONGANGONTOP/sh4*' - '*http://45.90.163.37/GOONGANGONTOP/m68k*' - '*http://45.90.163.37/GOONGANGONTOP/x86_64*' - '*http://45.90.163.37/GOONGANGONTOP/ppc*' - '*http://45.90.163.37/GOONGANGONTOP/arm7*' - '*http://45.90.163.37/GOONGANGONTOP/arm6*' - '*http://45.90.163.37/GOONGANGONTOP/i686*' - '*http://45.90.163.37/GOONGANGONTOP/debug.dbg*' - '*http://45.90.163.37/GOONGANGONTOP/arc*' - '*http://45.90.163.37/GOONGANGONTOP/x86*' - '*http://45.90.163.37/GOONGANGONTOP/mips*' - '*http://45.90.163.37/GOONGANGONTOP/spc*' - '*http://45.90.163.37/GOONGANGONTOP/arm*' - '*http://45.90.163.37/GOONGANGONTOP/arm5*' - '*http://115.59.61.161:44262/bin.sh*' - '*http://110.36.1.200:38574/bin.sh*' - '*http://91.122.96.147:45382/i*' - '*http://103.63.231.168:33426/i*' - '*http://42.56.201.203:39764/i*' - '*http://42.56.201.203:39764/bin.sh*' - '*http://115.192.23.45:47957/i*' - '*http://122.189.24.34:55584/i*' - '*http://182.121.84.137:49014/i*' - '*http://115.192.23.45:47957/bin.sh*' - '*http://27.207.119.97:46059/i*' - '*http://41.216.189.157/atomic/debug*' - '*http://110.36.18.60:59232/i*' - '*http://41.216.189.157/atomic/atomic.sh4*' - '*http://41.216.189.157/atomic/atomic.arm*' - '*http://41.216.189.157/atomic/atomic.arc*' - '*http://41.216.189.157/atomic/atomic.arm6*' - '*http://41.216.189.157/atomic/atomic.x86*' - '*http://41.216.189.157/atomic/atomic.arm5*' - '*http://41.216.189.157/atomic/atomic.m68k*' - '*http://41.216.189.157/atomic/atomic.mips*' - '*http://41.216.189.157/atomic/atomic.i686*' - '*http://41.216.189.157/atomic/atomic.x86_64*' - '*http://41.216.189.157/atomic/atomic.mpsl*' - '*http://41.216.189.157/atomic/atomic.ppc*' - '*http://41.216.189.157/atomic/atomic.spc*' - '*http://41.216.189.157/atomic/atomic.i468*' - '*http://41.216.189.157/atomic/atomic.arm7*' - '*http://115.48.55.3:49980/i*' - '*http://110.36.18.60:59232/bin.sh*' - '*http://27.124.65.221:46362/bin.sh*' - '*http://110.36.89.2:50032/i*' - '*http://42.225.243.9:49648/i*' - '*http://221.203.85.117:58713/i*' - '*http://182.113.195.138:38334/i*' - '*http://64.89.163.8:1234/bot*' - '*http://125.40.8.194:60369/i*' - '*http://110.36.89.2:50032/bin.sh*' - '*http://175.167.76.60:53013/i*' - '*http://46.16.150.139:34223/i*' - '*http://115.62.40.100:36892/i*' - '*http://110.39.233.226:45519/i*' - '*http://61.53.132.21:58512/bin.sh*' - '*http://211.158.34.201:51581/i*' - '*http://182.116.121.171:48514/i*' - '*http://46.16.150.139:34223/bin.sh*' - '*http://211.158.34.201:51581/bin.sh*' - '*http://60.23.239.85:39741/i*' - '*http://60.23.239.85:39741/bin.sh*' - '*http://103.83.87.122/iran.m68k*' - '*http://103.83.87.122/iran.armv7l*' - '*http://103.83.87.122/iran.armv5l*' - '*http://103.83.87.122/iran.mipsel*' - '*http://103.83.87.122/iran.arc*' - '*http://103.83.87.122/iran.mips*' - '*http://103.83.87.122/iran.i486*' - '*http://103.83.87.122/iran.x86_64*' - '*http://103.83.87.122/iran.sh4*' - '*http://103.83.87.122/iran.armv6l*' - '*http://103.83.87.122/iran.armv4l*' - '*http://103.83.87.122/iran.powerpc*' - '*http://103.83.87.122/iran.sparc*' - '*http://103.83.87.122/iran.aarch64*' - '*http://182.117.78.197:48408/i*' - '*http://196.190.11.194:41845/i*' - '*http://144.31.151.138/main_arm5*' - '*http://144.31.151.138/main_arm*' - '*http://144.31.151.138/main_arm6*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 12 id: 49520dd0-8945-5b3c-a977-0e06ce206160 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 12). logsource: category: proxy detection: selection: c-uri: - '*http://144.31.151.138/main_sh4*' - '*http://144.31.151.138/main_arm7*' - '*http://144.31.151.138/main_ppc*' - '*http://144.31.151.138/main_mpsl*' - '*http://144.31.151.138/main_m68k*' - '*http://144.31.151.138/main_mips*' - '*http://144.31.151.138/main_x86_64*' - '*http://144.31.151.138/main_x86*' - '*http://178.16.54.93:8080/adb.sh*' - '*http://178.16.54.93:8080/mips64*' - '*http://178.16.54.93:8080/mips*' - '*http://178.16.54.93:8080/armv6l*' - '*http://178.16.54.93:8080/mipsel*' - '*http://178.16.54.93:8080/f*' - '*http://110.36.72.57:35196/i*' - '*http://178.16.54.93:8080/armv4l*' - '*http://178.16.54.93:8080/armv5l*' - '*http://178.16.54.93:8080/ok*' - '*http://222.141.45.240:51697/i*' - '*http://221.15.253.233:37178/i*' - '*http://110.36.72.57:35196/bin.sh*' - '*http://221.15.253.233:37178/bin.sh*' - '*http://45.177.32.104:53838/i*' - '*http://45.177.32.104:53838/bin.sh*' - '*http://110.37.91.29:49671/i*' - '*http://42.225.229.125:58290/i*' - '*http://42.239.228.62:59519/i*' - '*http://182.116.36.186:40311/i*' - '*http://110.37.91.29:49671/bin.sh*' - '*http://42.225.229.125:58290/bin.sh*' - '*http://42.54.3.130:55899/i*' - '*http://154.242.141.124:45417/bin.sh*' - '*http://78.26.48.22:56190/i*' - '*http://42.54.3.130:55899/bin.sh*' - '*http://119.185.170.78:49993/i*' - '*http://61.53.148.123:39856/i*' - '*http://77.247.88.121:34491/i*' - '*http://123.10.233.81:48866/i*' - '*http://77.247.88.121:34491/bin.sh*' - '*http://123.10.233.81:48866/bin.sh*' - '*http://222.141.136.202:55425/i*' - '*http://222.141.136.202:55425/bin.sh*' - '*http://182.113.26.10:54419/i*' - '*http://93.115.101.140:13677/bins/nerv.x86_32*' - '*http://93.115.101.140:13677/bins/nerv.sh4*' - '*http://93.115.101.140:13677/bins/nerv.mpsl*' - '*http://93.115.101.140:13677/bins/nerv.arm6*' - '*http://93.115.101.140:13677/bins/nerv.arm5*' - '*http://93.115.101.140:13677/bins/nerv.m68k*' - '*http://93.115.101.140:13677/bins/nerv.arm7*' - '*http://93.115.101.140:13677/bins/nerv.ppc*' - '*http://93.115.101.140:13677/bins/nerv.arm4*' - '*http://93.115.101.140:13677/bins/nerv.x86*' - '*http://93.115.101.140:13677/bins/nerv.sparc*' - '*http://93.115.101.140:13677/bins/nerv.mips*' - '*http://182.113.26.10:54419/bin.sh*' - '*http://42.239.229.103:57521/i*' - '*http://64.89.163.215/dg.mips*' - '*http://115.52.18.202:35725/i*' - '*http://160.177.10.207:39405/i*' - '*http://212.164.115.235:58235/i*' - '*http://115.52.18.202:35725/bin.sh*' - '*http://212.164.115.235:58235/bin.sh*' - '*http://39.87.224.93:60790/i*' - '*http://59.180.157.78:46393/i*' - '*http://220.167.188.228:48336/i*' - '*http://123.10.225.140:53465/bin.sh*' - '*http://42.224.145.94:45012/i*' - '*http://196.189.35.226:52716/bin.sh*' - '*http://220.167.188.228:48336/bin.sh*' - '*http://123.8.93.69:47494/i*' - '*http://42.224.145.94:45012/bin.sh*' - '*http://123.8.93.69:47494/bin.sh*' - '*http://221.15.212.44:36077/i*' - '*http://1.58.208.78:33017/bin.sh*' - '*http://94.181.6.67:36395/i*' - '*http://103.44.136.115:35447/i*' - '*http://110.37.61.44:49758/i*' - '*http://59.180.157.78:46393/bin.sh*' - '*http://94.181.6.67:36395/bin.sh*' - '*http://42.231.186.76:54013/i*' - '*http://110.37.61.44:49758/bin.sh*' - '*http://103.44.136.115:35447/bin.sh*' - '*http://110.36.11.225:36446/i*' - '*http://110.36.29.196:39125/bin.sh*' - '*http://112.246.16.106:42448/bin.sh*' - '*http://115.54.128.181:49195/bin.sh*' - '*http://110.36.11.225:36446/bin.sh*' - '*http://202.1.26.69:37695/i*' - '*http://117.208.46.126:33920/i*' - '*http://38.21.70.189:46846/bin.sh*' - '*http://117.208.46.126:33920/bin.sh*' - '*http://182.119.182.78:59445/bin.sh*' - '*http://202.1.26.69:37695/bin.sh*' - '*http://59.180.168.190:45133/i*' - '*http://112.255.27.172:53031/bin.sh*' - '*http://222.139.127.61:46244/i*' - '*http://125.27.11.15:43282/i*' - '*http://175.166.11.195:60468/i*' - '*http://123.10.225.140:53465/i*' - '*http://59.96.138.50:46384/i*' - '*http://59.180.168.190:45133/bin.sh*' - '*http://222.139.127.61:46244/bin.sh*' - '*http://125.27.11.15:43282/bin.sh*' - '*http://123.8.152.122:39204/bin.sh*' - '*http://219.139.228.9:37295/i*' - '*http://98.252.87.232:56188/bin.sh*' - '*http://119.185.140.136:34637/i*' - '*http://42.239.229.103:57521/bin.sh*' - '*http://219.139.228.9:37295/bin.sh*' - '*http://113.215.223.222:37449/i*' - '*http://113.201.215.46:33942/bin.sh*' - '*http://59.96.138.50:46384/bin.sh*' - '*http://42.239.147.11:40838/i*' - '*http://115.58.152.142:59468/i*' - '*http://113.215.223.222:37449/bin.sh*' - '*http://61.53.88.18:39858/i*' - '*http://190.109.227.246:60081/i*' - '*http://61.53.88.18:39858/bin.sh*' - '*http://190.109.227.246:60081/bin.sh*' - '*http://115.58.152.142:59468/bin.sh*' - '*http://98.252.87.232:56188/i*' - '*http://110.36.75.245:54373/i*' - '*http://110.36.75.245:54373/bin.sh*' - '*http://115.45.159.11:56906/i*' - '*http://121.205.208.201:40468/i*' - '*http://115.45.159.11:56906/bin.sh*' - '*http://182.113.251.49:36813/i*' - '*http://221.15.14.133:50700/i*' - '*http://110.39.239.253:40635/bin.sh*' - '*http://221.15.14.133:50700/bin.sh*' - '*http://112.98.97.83:34651/i*' - '*http://110.36.19.101:34815/bin.sh*' - '*http://110.36.29.195:52576/i*' - '*http://125.42.253.59:41364/bin.sh*' - '*http://182.181.233.179:56357/bin.sh*' - '*http://196.251.121.142/a3f8d2/kaizen.mips_r1_srv*' - '*http://39.65.28.69:43370/bin.sh*' - '*http://182.127.112.191:51027/i*' - '*http://196.251.121.142/a3f8d2/kaizen.mpsl_r1_srv*' - '*http://182.127.112.191:51027/bin.sh*' - '*http://118.253.80.19:46415/i*' - '*http://115.56.14.94:33368/i*' - '*http://118.253.80.19:46415/bin.sh*' - '*http://112.237.248.129:42645/i*' - '*http://119.184.44.61:54115/bin.sh*' - '*http://112.237.248.129:42645/bin.sh*' - '*http://182.127.36.99:42920/i*' - '*http://182.126.247.156:33809/i*' - '*http://182.127.36.99:42920/bin.sh*' - '*http://39.61.46.143:51598/i*' - '*http://152.70.4.175:5555/bot.sh*' - '*http://141.11.88.108:81/xpe.mips*' - '*http://141.11.88.108:81/xpe.armv5l*' - '*http://141.11.88.108:81/xpe.i486*' - '*http://141.11.88.108:81/xpe.armv6l*' - '*http://141.11.88.108:81/xpe.sh4*' - '*http://141.11.88.108:81/xpe.x86_64*' - '*http://141.11.88.108:81/xpe.sparc*' - '*http://141.11.88.108:81/xpe.armv4l*' - '*http://141.11.88.108:81/xpe.powerpc*' - '*http://141.11.88.108:81/xpe.aarch64*' - '*http://141.11.88.108:81/xpe.mipsel*' - '*http://141.11.88.108:81/xpe.m68k*' - '*http://141.11.88.108:81/xpe.arc*' - '*http://141.11.88.108:81/xpe.armv7l*' - '*http://223.151.249.23:38648/i*' - '*http://182.126.247.156:33809/bin.sh*' - '*http://61.53.103.253:34426/i*' - '*http://141.11.88.140/x86_64*' - '*http://2.56.10.3/gh*' - '*http://112.27.10.150:43475/i*' - '*http://61.53.103.253:34426/bin.sh*' - '*http://41.108.125.250:54664/i*' - '*http://115.63.33.3:51766/i*' - '*http://182.121.253.155:47156/bin.sh*' - '*http://112.27.10.150:43475/bin.sh*' - '*http://41.108.125.250:54664/bin.sh*' - '*http://182.121.75.3:57932/bin.sh*' - '*http://112.248.81.8:34763/i*' - '*http://125.110.30.30:43243/bin.sh*' - '*http://115.62.25.8:43410/bin.sh*' - '*http://125.110.30.30:43243/i*' - '*http://112.248.81.8:34763/bin.sh*' - '*http://112.255.27.172:53031/i*' - '*http://2.26.75.58/debug/loader.sh*' - '*http://2.26.75.58/loader.sh*' - '*http://2.26.75.58/payload.sh*' - '*http://113.226.249.222:51643/i*' - '*http://182.126.125.182:53937/i*' - '*http://42.237.51.222:33726/i*' - '*http://113.226.249.222:51643/bin.sh*' - '*http://46.151.182.239/bot*' - '*http://42.234.200.144:35100/i*' - '*http://42.237.51.222:33726/bin.sh*' - '*http://27.36.182.107:41949/i*' - '*http://27.36.182.107:41949/bin.sh*' - '*http://136.60.32.162:46640/i*' - '*http://42.227.239.205:36382/i*' - '*http://182.126.125.226:45639/i*' - '*http://182.126.125.226:45639/bin.sh*' - '*http://115.61.118.160:40467/i*' - '*http://42.235.96.8:33141/bin.sh*' - '*http://119.179.252.34:45658/i*' - '*http://141.11.88.113/a-r.m-5.Sakura*' - '*http://221.13.233.53:54758/i*' - '*http://182.113.24.216:48626/bin.sh*' - '*http://27.215.80.85:57219/i*' - '*http://27.215.80.85:57219/bin.sh*' - '*http://188.187.77.38:40502/i*' - '*http://188.187.77.38:40502/bin.sh*' - '*http://130.0.44.29:48255/i*' - '*http://27.207.246.54:49244/bin.sh*' - '*http://115.62.25.8:43410/i*' - '*http://182.121.196.75:55985/i*' - '*http://182.121.196.75:55985/bin.sh*' - '*http://221.13.233.53:54758/bin.sh*' - '*http://38.76.201.42/bins/cnc*' - '*http://125.42.253.59:41364/i*' - '*http://105.224.39.23:60245/i*' - '*http://103.176.139.23:51806/i*' - '*http://190.109.228.122:55441/i*' - '*http://110.37.61.166:45070/i*' - '*http://27.193.120.232:45080/i*' - '*http://123.14.251.239:39827/i*' - '*http://27.193.120.232:45080/bin.sh*' - '*http://110.37.61.166:45070/bin.sh*' - '*http://42.235.137.189:34050/i*' - '*http://123.14.251.239:39827/bin.sh*' - '*http://59.96.143.41:46534/i*' - '*http://175.148.164.160:36585/bin.sh*' - '*http://115.63.53.193:52757/bin.sh*' - '*http://182.116.112.56:56292/i*' - '*http://110.37.127.135:42553/i*' - '*http://182.126.114.127:37185/bin.sh*' - '*http://60.23.74.120:45619/i*' - '*http://182.116.112.56:56292/bin.sh*' - '*http://183.196.29.73:33404/bin.sh*' - '*http://61.54.43.140:33744/i*' - '*http://60.23.74.120:45619/bin.sh*' - '*http://123.9.83.74:40477/bin.sh*' - '*http://123.133.247.187:35137/bin.sh*' - '*http://141.11.88.126/bins/x86_64*' - '*http://141.11.88.126/bins/spc*' - '*http://141.11.88.126/bins/arm*' - '*http://219.155.209.119:60753/bin.sh*' - '*http://61.163.128.105:52708/i*' - '*http://61.163.128.105:52708/bin.sh*' - '*http://219.155.85.137:38740/i*' - '*http://182.121.85.46:40842/i*' - '*http://38.137.17.143:42164/i*' - '*http://219.157.53.107:38337/i*' - '*http://110.36.89.2:57851/bin.sh*' - '*http://59.96.143.119:54168/bin.sh*' - '*http://182.121.85.46:40842/bin.sh*' - '*http://123.10.233.146:44054/i*' - '*http://123.10.233.146:44054/bin.sh*' - '*http://112.98.97.83:34651/bin.sh*' - '*http://85.121.177.73:8080/mipsel*' - '*http://119.184.44.61:54115/i*' - '*http://125.41.3.221:55091/bin.sh*' - '*http://111.88.7.48:56651/i*' - '*http://38.137.17.143:42164/bin.sh*' - '*http://200.115.102.2:44642/i*' - '*http://200.115.102.2:44642/bin.sh*' - '*http://110.37.43.119:43262/i*' - '*http://115.55.252.77:54172/i*' - '*http://222.134.175.182:50209/bin.sh*' - '*http://182.173.199.8:48446/i*' - '*http://115.55.252.77:54172/bin.sh*' - '*http://60.243.211.104:40403/i*' - '*http://182.173.199.8:48446/bin.sh*' - '*http://170.84.134.171:51834/bin.sh*' - '*http://123.5.119.205:60755/i*' - '*http://27.207.246.54:49244/i*' - '*http://59.96.136.27:45649/bin.sh*' - '*http://123.5.119.205:60755/bin.sh*' - '*http://115.48.151.41:49645/i*' - '*http://115.48.151.41:49645/bin.sh*' - '*http://39.65.28.69:43370/i*' - '*http://60.243.211.104:40403/bin.sh*' - '*http://113.237.56.144:56535/i*' - '*http://69.178.13.137:38366/i*' - '*http://113.237.56.144:56535/bin.sh*' - '*http://119.154.123.126:49024/i*' - '*http://124.77.162.107:60096/i*' - '*http://141.11.88.114/arm7*' - '*http://141.11.88.114/m68k*' - '*http://141.11.88.114/bins/mpsl*' - '*http://141.11.88.114/arm*' - '*http://141.11.88.114/bins/arm6*' - '*http://141.11.88.114/bins/parm6*' - '*http://141.11.88.114/bins/pmips*' - '*http://141.11.88.114/bins/arm7*' - '*http://141.11.88.114/bins/mips*' - '*http://141.11.88.114/arm5*' - '*http://69.178.13.137:38366/bin.sh*' - '*http://219.157.151.100:60044/i*' - '*http://112.239.103.34:52706/i*' - '*http://42.227.207.52:56441/bin.sh*' - '*http://182.120.135.2:33979/i*' - '*http://119.154.123.126:49024/bin.sh*' - '*http://124.77.162.107:60096/bin.sh*' - '*http://110.36.15.1:42551/i*' - '*http://112.239.103.34:52706/bin.sh*' - '*http://112.242.60.119:36465/i*' - '*http://222.138.180.32:39696/i*' - '*http://115.53.220.63:42017/bin.sh*' - '*http://222.138.180.32:39696/bin.sh*' - '*http://112.242.60.119:36465/bin.sh*' - '*http://115.57.244.87:49172/i*' - '*http://110.36.31.247:43718/i*' - '*http://110.37.39.146:36079/i*' - '*http://175.147.94.54:57159/bin.sh*' - '*http://110.39.246.84:41557/bin.sh*' - '*http://119.179.239.235:35646/i*' - '*http://219.157.151.100:60044/bin.sh*' - '*http://115.57.244.87:49172/bin.sh*' - '*http://221.15.93.234:59335/i*' - '*http://221.15.9.154:44167/i*' - '*http://110.37.39.146:36079/bin.sh*' - '*http://59.42.89.184:56735/bin.sh*' - '*http://182.113.210.246:51745/i*' - '*http://119.179.239.235:35646/bin.sh*' - '*http://110.37.39.234:59950/i*' - '*http://119.117.84.80:59176/i*' - '*http://119.117.84.80:59176/bin.sh*' - '*http://61.53.74.97:43379/i*' - '*http://222.134.175.182:50209/i*' - '*http://42.224.5.208:59661/i*' - '*http://42.224.5.208:59661/bin.sh*' - '*http://218.101.27.83:50181/bin.sh*' - '*http://185.82.110.102:35885/bin.sh*' - '*http://112.246.16.106:53726/i*' - '*http://103.157.210.26:58597/i*' - '*http://112.246.16.106:53726/bin.sh*' - '*http://110.36.1.80:56243/i*' - '*http://123.7.221.249:47971/bin.sh*' - '*http://42.53.7.120:34795/i*' - '*http://42.227.207.52:56441/i*' - '*http://110.36.75.245:47805/i*' - '*http://110.37.5.157:38596/bin.sh*' - '*http://39.187.82.149:48322/i*' - '*http://110.37.12.8:54499/i*' - '*http://42.53.7.120:34795/bin.sh*' - '*http://119.115.113.217:40812/bin.sh*' - '*http://123.9.83.74:40477/i*' - '*http://110.36.75.245:47805/bin.sh*' - '*http://110.39.238.29:33704/i*' - '*http://219.154.172.232:59795/i*' - '*http://39.187.82.149:48322/bin.sh*' - '*http://122.138.231.189:54273/i*' - '*http://175.175.8.48:46446/i*' - '*http://219.154.172.232:59795/bin.sh*' - '*http://60.23.239.223:34262/i*' - '*http://213.66.68.29:49834/i*' - '*http://196.190.193.95:50192/bin.sh*' - '*http://122.138.231.189:54273/bin.sh*' - '*http://182.126.116.254:47212/i*' - '*http://110.39.238.29:33704/bin.sh*' - '*http://61.53.74.152:55571/i*' - '*http://115.48.150.182:60957/i*' - '*http://115.48.150.182:60957/bin.sh*' - '*http://222.138.181.53:41501/bin.sh*' - '*http://222.138.181.53:41501/i*' - '*http://182.117.1.181:43616/i*' - '*http://175.173.82.57:34376/i*' - '*http://149.71.39.60:46868/i*' - '*http://61.53.74.152:55571/bin.sh*' - '*http://39.87.224.93:60790/bin.sh*' - '*http://182.117.1.181:43616/bin.sh*' - '*http://175.173.82.57:34376/bin.sh*' - '*http://42.228.217.10:51228/bin.sh*' - '*http://123.133.247.187:35137/i*' - '*http://123.14.55.150:52462/i*' - '*http://110.36.23.67:42802/i*' - '*http://110.39.233.38:38476/bin.sh*' - '*http://182.120.33.255:40996/i*' - '*http://123.129.133.100:42215/bin.sh*' - '*http://115.56.173.57:33013/bin.sh*' - '*http://182.117.78.228:36174/i*' - '*http://222.91.248.119:49113/i*' - '*http://42.86.60.249:33410/i*' - '*http://222.91.248.119:49113/bin.sh*' - '*http://175.167.187.31:56527/bin.sh*' - '*http://200.115.102.16:50958/i*' - '*http://110.39.233.226:50831/i*' - '*http://110.36.3.201:46433/bin.sh*' - '*http://200.115.102.16:50958/bin.sh*' - '*http://182.112.180.216:46853/i*' - '*http://110.37.12.8:54499/bin.sh*' - '*http://39.79.131.68:33433/i*' - '*http://119.185.186.179:36531/i*' - '*http://124.131.6.21:47092/bin.sh*' - '*http://85.11.167.119/bot_mips*' - '*http://42.56.163.218:36078/bin.sh*' - '*http://123.188.87.204:50099/i*' - '*http://222.138.100.173:41269/i*' - '*http://46.162.69.46:54891/i*' - '*http://182.112.180.216:46853/bin.sh*' - '*http://103.179.240.227:59156/i*' - '*http://42.86.42.244:60834/i*' - '*http://119.185.186.179:36531/bin.sh*' - '*http://115.55.42.244:36978/i*' - '*http://58.216.71.10:51021/i*' - '*http://zov.ismak.icu/bins/nova.armv5l*' - '*http://zov.ismak.icu/bins/nova.i686*' - '*http://zov.ismak.icu/bins/nova.mipsel*' - '*http://zov.ismak.icu/bins/nova.mips*' - '*http://zov.ismak.icu/bins/nova.sh4*' - '*http://zov.ismak.icu/bins/nova.armv6l*' - '*http://zov.ismak.icu/bins/nova.x86_64*' - '*http://zov.ismak.icu/bins/nova.powerpc*' - '*http://zov.ismak.icu/bins/nova.armv4l*' - '*http://zov.ismak.icu/bins/nova.i586*' - '*http://zov.ismak.icu/bins/nova.armv7l*' - '*http://125.43.144.147:43040/i*' - '*http://46.162.69.46:54891/bin.sh*' - '*http://103.179.240.227:59156/bin.sh*' - '*http://115.55.42.244:36978/bin.sh*' - '*http://110.38.223.172:40368/bin.sh*' - '*http://88.231.100.176:40168/i*' - '*http://58.216.71.10:51021/bin.sh*' - '*http://42.86.42.244:60834/bin.sh*' - '*http://125.43.144.147:43040/bin.sh*' - '*http://123.188.87.204:50099/bin.sh*' - '*http://88.231.100.176:40168/bin.sh*' - '*http://110.36.78.121:37808/i*' - '*http://182.118.240.220:41525/i*' - '*http://39.79.131.68:33433/bin.sh*' - '*http://110.36.78.121:37808/bin.sh*' - '*http://110.37.39.234:59950/bin.sh*' - '*http://120.57.116.89:55269/i*' - '*http://115.63.53.193:52757/i*' - '*http://110.38.211.139:58721/i*' - '*http://219.155.20.211:49384/bin.sh*' - '*http://120.57.116.89:55269/bin.sh*' - '*http://117.223.141.181:60679/i*' - '*http://222.139.225.39:32796/i*' - '*http://118.125.24.87:36392/i*' - '*http://175.174.51.2:39916/i*' - '*http://110.36.18.60:39101/i*' - '*http://117.223.141.181:60679/bin.sh*' - '*http://222.139.225.39:32796/bin.sh*' - '*http://110.36.18.60:39101/bin.sh*' - '*http://110.36.2.240:60096/bin.sh*' - '*http://59.58.42.9:51830/i*' - '*http://175.167.187.31:56527/i*' - '*http://118.125.24.87:36392/bin.sh*' - '*http://123.7.221.249:47971/i*' - '*http://175.174.51.2:39916/bin.sh*' - '*http://110.38.210.180:54238/bin.sh*' - '*http://59.58.42.9:51830/bin.sh*' - '*http://182.127.114.75:57190/bin.sh*' - '*http://123.129.133.100:42215/i*' - '*http://171.8.21.66:44209/i*' - '*http://27.215.127.167:42001/i*' - '*http://171.8.21.66:44209/bin.sh*' - '*http://110.39.247.200:58559/i*' - '*http://136.60.32.162:46640/bin.sh*' - '*http://94.154.43.12/gg10*' - '*http://110.39.247.200:58559/bin.sh*' - '*http://115.49.200.26:50281/i*' - '*http://103.249.199.3:59703/i*' - '*http://200.115.102.246:56243/bin.sh*' - '*http://182.113.24.216:48626/i*' - '*http://42.86.60.249:33410/bin.sh*' - '*http://115.49.200.26:50281/bin.sh*' - '*http://59.97.250.154:33677/i*' - '*http://42.239.158.240:55135/i*' - '*http://110.37.13.213:60984/i*' - '*http://182.127.179.208:41725/i*' - '*http://42.56.163.218:36078/i*' - '*http://116.248.83.127:42340/i*' - '*http://59.97.250.154:33677/bin.sh*' - '*http://117.245.234.55:57208/bin.sh*' - '*http://42.239.158.240:55135/bin.sh*' - '*http://182.127.179.208:41725/bin.sh*' - '*http://115.56.173.57:33013/i*' - '*http://182.123.209.66:57452/bin.sh*' - '*http://116.74.231.24:32784/i*' - '*http://113.232.21.227:51734/bin.sh*' - '*http://42.54.89.80:37559/bin.sh*' - '*http://182.123.209.66:57452/i*' - '*http://59.180.163.145:60352/bin.sh*' - '*http://117.245.234.55:57208/i*' - '*http://222.139.125.75:42542/i*' - '*http://123.9.206.98:42587/i*' - '*http://110.37.39.32:38623/i*' - '*http://115.56.65.198:58971/i*' - '*http://125.43.38.188:55148/i*' - '*http://116.74.231.24:32784/bin.sh*' - '*http://42.225.58.122:36608/i*' - '*http://60.23.239.223:42497/bin.sh*' - '*http://222.139.125.75:42542/bin.sh*' - '*http://110.37.39.32:38623/bin.sh*' - '*http://219.157.66.199:42321/i*' - '*http://42.239.74.140:48416/i*' - '*http://182.180.151.150:42383/i*' - '*http://42.239.74.140:48416/bin.sh*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 13 id: 21ef8f6b-f05f-5da6-9fed-29d17c2d0321 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 13). logsource: category: proxy detection: selection: c-uri: - '*http://123.129.1.230:35858/i*' - '*http://123.10.227.134:53465/i*' - '*http://182.121.224.35:36741/i*' - '*http://123.129.1.230:35858/bin.sh*' - '*http://123.10.227.134:53465/bin.sh*' - '*http://61.52.4.161:56319/i*' - '*http://182.121.224.35:36741/bin.sh*' - '*http://77.79.160.210:43243/i*' - '*http://218.101.27.83:50181/i*' - '*http://77.79.160.210:43243/bin.sh*' - '*http://27.216.188.219:41392/i*' - '*http://27.44.147.6:47311/i*' - '*http://141.11.88.126/bins/arm5*' - '*http://141.11.88.126/bins/arm6*' - '*http://141.11.88.126/bins/arm7*' - '*http://141.11.88.126/bins/mips*' - '*http://141.11.88.126/bins/sh4*' - '*http://141.11.88.126/bins/x86*' - '*http://141.11.88.126/bins/m68k*' - '*http://141.11.88.126/bins/ppc*' - '*http://42.54.89.80:37559/i*' - '*http://110.36.70.238:36253/i*' - '*http://27.44.147.6:47311/bin.sh*' - '*http://115.51.120.193:58795/i*' - '*http://27.215.77.128:60676/i*' - '*http://115.51.120.193:58795/bin.sh*' - '*http://61.52.4.161:56319/bin.sh*' - '*http://110.36.70.238:36253/bin.sh*' - '*http://27.124.65.221:46362/i*' - '*http://42.228.217.10:51228/i*' - '*http://185.248.14.255:42675/bin.sh*' - '*http://42.238.241.117:47417/i*' - '*http://42.232.233.56:45959/i*' - '*http://39.90.188.188:48139/i*' - '*http://27.215.77.128:60676/bin.sh*' - '*http://105.224.57.207:46167/bin.sh*' - '*http://42.232.233.56:45959/bin.sh*' - '*http://110.38.201.35:50310/i*' - '*http://39.90.188.188:48139/bin.sh*' - '*http://105.225.64.238:54357/bin.sh*' - '*http://112.248.29.133:45436/bin.sh*' - '*http://110.38.201.35:50310/bin.sh*' - '*http://115.55.115.215:46705/i*' - '*http://42.59.227.42:45414/i*' - '*http://175.164.108.49:48663/i*' - '*http://61.54.253.251:36887/i*' - '*http://193.187.101.68:39683/i*' - '*http://27.204.226.41:40289/i*' - '*http://27.204.226.41:40289/bin.sh*' - '*http://110.39.231.61:56056/i*' - '*http://61.54.253.251:36887/bin.sh*' - '*http://123.188.4.167:48522/i*' - '*http://110.39.231.61:56056/bin.sh*' - '*http://85.12.205.35:38385/i*' - '*http://117.146.92.46:51303/i*' - '*http://180.245.47.188:38673/i*' - '*http://123.188.4.167:48522/bin.sh*' - '*http://117.146.92.46:51303/bin.sh*' - '*http://36.100.34.57:48336/i*' - '*http://193.187.101.68:39683/bin.sh*' - '*http://180.245.47.188:38673/bin.sh*' - '*http://42.233.147.89:55111/bin.sh*' - '*http://45.186.37.201:43806/bin.sh*' - '*http://36.100.34.57:48336/bin.sh*' - '*http://222.246.40.85:36278/i*' - '*http://42.224.254.133:54137/bin.sh*' - '*http://182.119.198.230:39634/i*' - '*http://182.117.42.205:40920/bin.sh*' - '*http://223.167.60.30:40918/i*' - '*http://110.39.231.36:59118/bin.sh*' - '*http://123.11.235.113:45689/bin.sh*' - '*http://60.177.86.115:58811/i*' - '*http://182.117.42.205:40920/i*' - '*http://105.224.57.207:46167/i*' - '*http://68.235.251.87:42402/i*' - '*http://60.177.86.115:58811/bin.sh*' - '*http://61.53.205.13:47798/i*' - '*http://112.248.115.148:45179/bin.sh*' - '*http://141.11.88.113/a-r.m-6.Sakura*' - '*http://141.11.88.113/x-8.6-.Sakura*' - '*http://141.11.88.113/m-6.8-k.Sakura*' - '*http://61.53.205.13:47798/bin.sh*' - '*http://141.11.88.113/m-p.s-l.Sakura*' - '*http://141.11.88.113/i-5.8-6.Sakura*' - '*http://141.11.88.113/s-h.4-.Sakura*' - '*http://141.11.88.113/x-3.2-.Sakura*' - '*http://141.11.88.113/a-r.m-4.Sakura*' - '*http://141.11.88.113/m-i.p-s.Sakura*' - '*http://141.11.88.113/p-p.c-.Sakura*' - '*http://141.11.88.113/a-r.m-7.Sakura*' - '*http://45.184.19.72:35922/i*' - '*http://182.121.170.194:45501/i*' - '*http://39.79.15.194:37416/i*' - '*http://105.224.71.15:54389/i*' - '*http://110.36.3.201:46433/i*' - '*http://115.49.4.59:52130/i*' - '*http://45.184.19.72:35922/bin.sh*' - '*http://115.55.8.197:54012/i*' - '*http://115.49.4.59:52130/bin.sh*' - '*http://182.121.170.194:45501/bin.sh*' - '*http://105.225.64.238:54357/i*' - '*http://42.229.200.225:60685/i*' - '*http://120.84.215.46:34093/i*' - '*http://115.51.104.177:51026/i*' - '*http://42.224.51.147:36172/i*' - '*http://39.79.15.194:37416/bin.sh*' - '*http://115.55.8.197:54012/bin.sh*' - '*http://115.50.93.34:37693/i*' - '*http://125.44.243.245:44944/i*' - '*http://42.224.51.147:36172/bin.sh*' - '*http://42.229.200.225:60685/bin.sh*' - '*http://222.220.145.105:51630/i*' - '*http://105.224.71.15:54389/bin.sh*' - '*http://115.52.16.242:37666/bin.sh*' - '*http://115.50.93.34:37693/bin.sh*' - '*http://125.44.243.245:44944/bin.sh*' - '*http://110.37.91.29:45945/bin.sh*' - '*http://222.220.145.105:51630/bin.sh*' - '*http://110.85.111.205:41787/i*' - '*http://171.37.127.210:41472/i*' - '*http://212.164.115.235:33213/bin.sh*' - '*http://110.39.230.2:52121/i*' - '*http://27.44.144.79:39967/i*' - '*http://205.250.173.210:32877/i*' - '*http://110.39.230.2:52121/bin.sh*' - '*http://110.37.39.129:40520/i*' - '*http://110.85.111.205:41787/bin.sh*' - '*http://110.37.39.129:40520/bin.sh*' - '*http://171.37.127.210:41472/bin.sh*' - '*http://27.44.144.79:39967/bin.sh*' - '*http://61.52.159.219:49548/i*' - '*http://115.52.16.242:37666/i*' - '*http://39.74.0.246:56363/i*' - '*http://221.15.145.214:39615/i*' - '*http://110.36.80.166:60321/i*' - '*http://60.18.9.243:54601/i*' - '*http://182.119.179.36:59445/i*' - '*http://39.74.0.246:56363/bin.sh*' - '*http://110.36.80.166:60321/bin.sh*' - '*http://27.44.147.40:37399/i*' - '*http://60.18.9.243:54601/bin.sh*' - '*http://27.44.147.40:37399/bin.sh*' - '*http://222.139.35.92:50019/i*' - '*http://59.103.116.68:50760/i*' - '*http://182.121.253.155:47156/i*' - '*http://221.15.145.214:39615/bin.sh*' - '*http://182.121.115.145:35642/i*' - '*http://42.233.104.16:42433/i*' - '*http://171.213.135.23:40087/i*' - '*http://125.44.209.117:39250/bin.sh*' - '*http://111.185.147.232:52770/i*' - '*http://42.233.104.16:42433/bin.sh*' - '*http://182.121.115.145:35642/bin.sh*' - '*http://42.231.248.246:50019/i*' - '*http://182.122.198.147:41266/i*' - '*http://171.213.135.23:40087/bin.sh*' - '*http://42.231.248.246:50019/bin.sh*' - '*http://111.185.147.232:52770/bin.sh*' - '*http://182.122.198.147:41266/bin.sh*' - '*http://129.121.114.124/KlqK*' - '*http://129.121.114.124/5uk*' - '*http://141.11.88.129/main_mipsel*' - '*http://129.121.114.124/OEr*' - '*http://141.11.88.128/bins/mpsl*' - '*http://129.121.114.124/fO0*' - '*http://129.121.114.124/gil*' - '*http://129.121.114.124/0Rw*' - '*http://129.121.114.124/76G*' - '*http://129.121.114.124/Bt7G*' - '*http://129.121.114.124/E8mc*' - '*http://129.121.114.124/TwnE*' - '*http://129.121.114.124/UbM*' - '*http://129.121.114.124/Jvbm*' - '*http://141.11.88.129/main_sparc*' - '*http://129.121.114.124/N5r*' - '*http://141.11.88.129/main_i586*' - '*http://141.11.88.129/main_i686*' - '*http://141.11.88.129/main_arm5*' - '*http://129.121.114.124/Yex*' - '*http://129.121.114.124/rXF*' - '*http://141.11.88.129/main_arc*' - '*http://182.121.168.77:35257/i*' - '*http://58.37.101.152:39822/i*' - '*http://119.118.88.63:60669/i*' - '*http://109.120.178.196/downloads/sshd/ubuntu/log*' - '*http://123.12.152.20:56168/i*' - '*http://59.103.116.68:50760/bin.sh*' - '*http://58.37.101.152:39822/bin.sh*' - '*http://42.85.135.133:46174/bin.sh*' - '*http://182.121.168.77:35257/bin.sh*' - '*http://178.176.107.122:33136/i*' - '*http://123.12.152.20:56168/bin.sh*' - '*http://61.52.61.0:41421/i*' - '*http://182.127.38.31:48902/bin.sh*' - '*http://123.188.80.212:40750/i*' - '*http://110.38.223.172:40368/i*' - '*http://171.38.25.33:47753/i*' - '*http://123.188.80.212:40750/bin.sh*' - '*http://61.52.61.0:41421/bin.sh*' - '*http://182.116.113.116:51117/bin.sh*' - '*http://115.56.151.194:33173/i*' - '*http://115.50.32.178:53978/i*' - '*http://171.38.25.33:47753/bin.sh*' - '*http://219.156.244.153:56879/i*' - '*http://123.9.10.105:57001/bin.sh*' - '*http://125.42.14.44:45793/bin.sh*' - '*http://211.158.167.180:34707/i*' - '*http://59.97.254.241:38566/bin.sh*' - '*http://115.56.151.194:33173/bin.sh*' - '*http://196.188.135.20:43927/i*' - '*http://219.156.244.153:56879/bin.sh*' - '*http://41.216.225.118:42776/i*' - '*http://115.55.131.138:58970/i*' - '*http://115.55.238.163:60080/bin.sh*' - '*http://196.191.137.44:57674/i*' - '*http://42.224.96.177:49851/i*' - '*http://115.48.134.141:40038/i*' - '*http://196.188.135.20:43927/bin.sh*' - '*http://182.112.191.11:55226/i*' - '*http://115.55.131.138:58970/bin.sh*' - '*http://221.15.189.93:41948/i*' - '*http://196.191.137.44:57674/bin.sh*' - '*http://221.15.189.93:41948/bin.sh*' - '*http://123.9.10.105:57001/i*' - '*http://222.142.204.217:40536/i*' - '*http://182.124.136.107:33062/i*' - '*http://125.45.11.81:43611/bin.sh*' - '*http://27.14.64.82:53279/i*' - '*http://182.124.136.107:33062/bin.sh*' - '*http://110.36.93.217:58047/i*' - '*http://182.124.23.49:34691/i*' - '*http://110.36.11.225:60909/bin.sh*' - '*http://27.14.64.82:53279/bin.sh*' - '*http://182.124.27.40:45499/i*' - '*http://119.180.48.67:58294/i*' - '*http://125.42.14.44:45793/i*' - '*http://110.39.248.117:41257/i*' - '*http://42.224.99.236:38337/i*' - '*http://119.180.48.67:58294/bin.sh*' - '*http://200.112.129.57:39849/i*' - '*http://119.180.93.194:41642/i*' - '*http://110.39.248.117:41257/bin.sh*' - '*http://110.36.11.225:60909/i*' - '*http://27.37.229.70:60470/bin.sh*' - '*http://42.224.99.236:38337/bin.sh*' - '*http://222.138.181.61:41501/i*' - '*http://182.121.218.204:56695/i*' - '*http://123.129.57.162:51272/i*' - '*http://123.129.57.162:51272/bin.sh*' - '*http://222.138.181.61:41501/bin.sh*' - '*http://5.167.233.192:27250/i*' - '*http://182.121.218.204:56695/bin.sh*' - '*http://200.112.129.57:39849/bin.sh*' - '*http://61.53.196.243:55492/bin.sh*' - '*http://115.55.254.93:57845/i*' - '*http://115.55.238.163:60080/i*' - '*http://5.167.233.192:27250/bin.sh*' - '*http://78.167.39.24:33270/i*' - '*http://115.55.199.182:58593/i*' - '*http://141.11.88.128/bins/arm*' - '*http://141.11.88.128/bins/arm6*' - '*http://141.11.88.128/bins/arm7*' - '*http://141.11.88.128/bins/sh4*' - '*http://141.11.88.128/bins/mips*' - '*http://141.11.88.128/bins/spc*' - '*http://141.11.88.128/bins/m68k*' - '*http://141.11.88.128/bins/ppc*' - '*http://141.11.88.128/bins/x86_64*' - '*http://141.11.88.128/bins/arm5*' - '*http://141.11.88.128/bins/x86*' - '*http://115.55.199.182:58593/bin.sh*' - '*http://105.224.7.232:34437/i*' - '*http://42.56.188.21:39137/i*' - '*http://105.224.7.232:34437/bin.sh*' - '*http://182.112.101.179:40289/i*' - '*http://27.44.146.188:33389/bin.sh*' - '*http://125.40.122.103:34325/i*' - '*http://200.112.129.200:56833/i*' - '*http://59.97.255.146:44379/bin.sh*' - '*http://42.56.188.21:39137/bin.sh*' - '*http://124.131.146.166:56253/i*' - '*http://200.112.129.200:56833/bin.sh*' - '*http://125.40.122.103:34325/bin.sh*' - '*http://221.200.115.88:52073/i*' - '*http://221.200.115.88:52073/bin.sh*' - '*http://124.131.146.166:56253/bin.sh*' - '*http://38.21.70.189:46846/i*' - '*http://116.248.83.127:42340/bin.sh*' - '*http://116.75.202.115:48857/i*' - '*http://218.16.164.107:53377/i*' - '*http://119.179.214.253:43723/i*' - '*http://27.44.147.17:41763/i*' - '*http://218.16.164.107:53377/bin.sh*' - '*http://125.26.202.115:42337/i*' - '*http://42.234.144.170:60670/i*' - '*http://119.179.214.253:43723/bin.sh*' - '*http://110.37.61.44:46599/i*' - '*http://221.200.217.109:45652/i*' - '*http://112.248.163.173:35273/bin.sh*' - '*http://27.44.147.17:41763/bin.sh*' - '*http://42.234.144.170:60670/bin.sh*' - '*http://27.44.145.136:35384/bin.sh*' - '*http://110.37.61.44:46599/bin.sh*' - '*http://221.200.217.109:45652/bin.sh*' - '*http://120.85.61.36:43042/i*' - '*http://182.127.153.219:39011/i*' - '*http://123.190.17.73:54809/i*' - '*http://123.188.73.220:49388/i*' - '*http://120.85.61.36:43042/bin.sh*' - '*http://182.121.44.209:50823/i*' - '*http://182.127.153.219:39011/bin.sh*' - '*http://182.121.44.209:50823/bin.sh*' - '*http://59.52.102.114:58391/i*' - '*http://115.48.134.141:40038/bin.sh*' - '*http://27.44.146.166:56374/i*' - '*http://182.124.212.108:50577/bin.sh*' - '*http://61.176.199.111:39760/i*' - '*http://59.52.102.114:58391/bin.sh*' - '*http://61.176.199.111:39760/bin.sh*' - '*http://42.57.30.166:47468/i*' - '*http://125.47.236.237:53999/i*' - '*http://45.150.195.235/tmips*' - '*http://27.44.146.166:56374/bin.sh*' - '*http://14.102.34.66:34449/bin.sh*' - '*http://196.191.104.40:53453/i*' - '*http://223.108.82.26:33367/i*' - '*http://42.57.30.166:47468/bin.sh*' - '*http://182.127.83.209:39677/i*' - '*http://182.127.83.209:39677/bin.sh*' - '*http://182.127.164.4:42448/i*' - '*http://182.127.164.4:42448/bin.sh*' - '*http://123.190.17.73:54809/bin.sh*' - '*http://217.60.195.155/bins/fenrir.sh*' - '*http://39.89.167.243:55515/bin.sh*' - '*http://115.48.161.185:59481/i*' - '*http://223.108.82.26:33367/bin.sh*' - '*http://112.234.31.244:45755/i*' - '*http://160.30.142.2:54265/i*' - '*http://160.30.142.2:54265/bin.sh*' - '*http://115.48.161.185:59481/bin.sh*' - '*http://112.234.31.244:45755/bin.sh*' - '*http://222.139.228.93:43545/i*' - '*http://59.42.89.184:56735/i*' - '*http://125.41.230.212:42327/bin.sh*' - '*http://27.206.141.206:34519/i*' - '*http://182.120.160.52:48518/i*' - '*http://222.139.228.93:43545/bin.sh*' - '*http://185.39.181.103:33952/i*' - '*http://27.206.141.206:34519/bin.sh*' - '*http://116.109.134.228:44305/bin.sh*' - '*http://182.120.160.52:48518/bin.sh*' - '*http://34.45.47.180:8082/file.so*' - '*http://34.45.47.180:8082/file-grey.elf*' - '*http://34.45.47.180:8082/file-suspicious-elf-header-amd64.elf*' - '*http://112.246.25.21:38549/bin.sh*' - '*http://112.246.25.21:38549/i*' - '*http://200.115.102.2:44905/i*' - '*http://110.37.39.88:50697/bin.sh*' - '*http://222.127.154.48:60730/bin.sh*' - '*http://200.115.102.2:44905/bin.sh*' - '*http://125.160.139.235:52365/bin.sh*' - '*http://110.37.39.88:50697/i*' - '*http://110.37.90.59:54109/bin.sh*' - '*http://46.158.180.6:46944/bin.sh*' - '*http://117.131.92.150:57313/i*' - '*http://123.157.168.214:34135/bin.sh*' - '*http://123.157.168.214:34135/i*' - '*http://185.89.157.150:52670/bin.sh*' - '*http://27.14.64.17:53279/bin.sh*' - '*http://185.89.157.150:52670/i*' - '*http://222.127.154.48:60730/i*' - '*http://112.66.102.11:34465/bin.sh*' - '*http://61.53.127.109:43033/bin.sh*' - '*http://89.200.85.114:46980/bin.sh*' - '*http://27.14.64.17:53279/i*' - '*http://203.204.157.55:58654/i*' - '*http://119.183.225.232:54115/bin.sh*' - '*http://185.39.181.103:33952/bin.sh*' - '*http://81.230.148.181:51631/bin.sh*' - '*http://60.216.131.62:43868/i*' - '*http://60.216.131.62:43868/bin.sh*' - '*http://27.203.158.156:60406/bin.sh*' - '*http://201.149.107.50:39048/i*' - '*http://39.65.135.99:47796/bin.sh*' - '*http://36.25.102.17:57513/bin.sh*' - '*http://36.25.102.17:57513/i*' - '*http://182.112.147.45:46853/bin.sh*' - '*http://140.237.36.85:50794/i*' - '*http://190.109.227.76:35385/bin.sh*' - '*http://182.112.32.14:40996/i*' - '*http://182.38.191.105:56615/i*' - '*http://182.112.32.14:40996/bin.sh*' - '*http://39.65.135.99:47796/i*' - '*http://112.230.240.181:32925/bin.sh*' - '*http://39.89.161.184:52061/i*' - '*http://39.89.161.184:52061/bin.sh*' - '*http://45.186.77.55:33323/bin.sh*' - '*http://45.186.77.55:33323/i*' - '*http://153.152.44.153:48312/i*' - '*http://58.115.221.12:42159/i*' - '*http://111.178.127.16:37411/i*' - '*http://58.115.221.12:42159/bin.sh*' - '*http://140.237.36.85:50794/bin.sh*' - '*http://94.244.36.34:46341/bin.sh*' - '*http://115.50.170.197:54137/bin.sh*' - '*http://81.230.148.181:51631/i*' - '*http://111.178.127.16:37411/bin.sh*' - '*http://27.203.158.156:60406/i*' - '*http://153.152.44.153:48312/bin.sh*' - '*http://182.38.191.105:56615/bin.sh*' - '*http://94.244.36.34:46341/i*' - '*http://115.55.223.146:43386/bin.sh*' - '*http://117.81.162.7:57288/bin.sh*' - '*http://176.193.90.36:52422/bin.sh*' - '*http://219.157.182.202:45634/bin.sh*' - '*http://222.136.103.97:36868/bin.sh*' - '*http://222.142.254.59:37969/bin.sh*' - '*http://61.52.62.177:34846/bin.sh*' - '*http://41.142.44.195:44714/i*' - '*http://125.47.229.79:44527/i*' - '*http://98.252.87.232:45093/bin.sh*' - '*http://115.63.112.218:52933/bin.sh*' - '*http://182.127.6.242:42318/bin.sh*' - '*http://222.136.103.97:36868/i*' - '*http://42.228.37.47:60455/bin.sh*' - '*http://219.156.97.163:56436/bin.sh*' - '*http://175.11.240.242:50915/bin.sh*' - '*http://221.15.20.62:53403/bin.sh*' - '*http://219.156.97.163:56436/i*' - '*http://182.122.224.134:55128/i*' - '*http://119.154.118.204:35060/bin.sh*' - '*http://182.122.224.134:55128/bin.sh*' - '*http://59.88.228.67:41081/bin.sh*' - '*http://111.88.7.48:60648/bin.sh*' - '*http://158.255.83.110:55846/i*' - '*http://158.255.83.110:55846/bin.sh*' - '*http://219.157.182.202:45634/i*' - '*http://103.30.181.210:44811/i*' - '*http://42.224.91.105:43505/bin.sh*' - '*http://59.88.228.67:41081/i*' - '*http://42.224.91.105:43505/i*' - '*http://45.2.24.251:56142/bin.sh*' - '*http://61.52.62.177:34846/i*' - '*http://125.41.140.82:40678/i*' - '*http://110.36.93.217:41778/i*' - '*http://222.142.254.59:37969/i*' - '*http://160.177.18.91:38725/i*' - '*http://5.134.249.10:39464/bin.sh*' - '*http://41.142.44.195:44714/bin.sh*' - '*http://125.47.229.79:44527/bin.sh*' - '*http://119.154.118.204:35060/i*' - '*http://182.113.26.29:53084/i*' - '*http://39.38.206.242:56740/i*' - '*http://182.120.99.85:38935/i*' - '*http://98.252.87.232:45093/i*' - '*http://219.155.126.106:32875/bin.sh*' - '*http://39.38.206.242:56740/bin.sh*' - '*http://182.120.99.85:38935/bin.sh*' - '*http://182.121.136.18:55245/bin.sh*' - '*http://110.37.91.29:52579/bin.sh*' - '*http://110.37.67.68:49124/bin.sh*' - '*http://182.127.6.242:42318/i*' - '*http://110.37.45.99:50425/bin.sh*' - '*http://42.227.185.241:58452/bin.sh*' - '*http://222.137.180.237:56072/bin.sh*' - '*http://5.134.249.10:39464/i*' - '*http://117.81.162.7:57288/i*' - '*http://160.177.18.91:38725/bin.sh*' - '*http://110.36.64.245:48889/bin.sh*' - '*http://182.113.26.29:53084/bin.sh*' - '*http://182.127.46.49:37395/bin.sh*' - '*http://42.227.131.169:60480/bin.sh*' - '*http://110.37.45.99:50425/i*' - '*http://115.48.11.195:46496/i*' - '*http://115.48.11.195:46496/bin.sh*' - '*http://110.39.227.81:56486/bin.sh*' - '*http://222.142.236.53:43699/bin.sh*' - '*http://42.230.188.82:51392/bin.sh*' - '*http://203.99.187.86:55852/bin.sh*' - '*http://103.30.181.210:44811/bin.sh*' - '*http://42.229.188.40:43125/i*' - '*http://45.2.24.251:56142/i*' - '*http://115.98.39.235:51735/i*' - '*http://110.36.23.67:58576/bin.sh*' - '*http://203.99.187.86:55852/i*' - '*http://110.39.227.81:56486/i*' - '*http://175.11.240.242:50915/i*' - '*http://222.142.236.53:43699/i*' - '*http://110.36.93.217:41778/bin.sh*' - '*http://112.248.153.174:35834/bin.sh*' - '*http://112.248.153.174:35834/i*' - '*http://39.89.211.69:40146/i*' - '*http://115.49.66.46:35257/bin.sh*' - '*http://39.89.211.69:40146/bin.sh*' - '*http://124.131.159.64:47993/bin.sh*' - '*http://182.121.241.215:45876/bin.sh*' - '*http://61.54.42.65:53052/bin.sh*' - '*http://119.183.55.125:59507/bin.sh*' - '*http://146.66.251.22:44932/i*' - '*http://61.54.42.65:53052/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 14 id: b494997b-2667-5f08-b021-c051710205fd status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 14). logsource: category: proxy detection: selection: c-uri: - '*http://27.215.55.176:43194/bin.sh*' - '*http://39.63.148.114:34727/i*' - '*http://146.66.251.22:44932/bin.sh*' - '*http://24.95.54.96:59979/bin.sh*' - '*http://115.49.66.46:35257/i*' - '*http://123.130.59.140:49195/i*' - '*http://123.14.238.199:59716/bin.sh*' - '*http://125.44.247.83:53681/bin.sh*' - '*http://158.255.83.141:46249/bin.sh*' - '*http://125.99.206.137:56905/bin.sh*' - '*http://158.255.83.99:51212/i*' - '*http://219.157.176.73:45634/bin.sh*' - '*http://123.10.6.48:56270/i*' - '*http://27.215.55.176:43194/i*' - '*http://115.55.226.184:51245/i*' - '*http://219.157.176.73:45634/i*' - '*http://182.124.130.236:59353/bin.sh*' - '*http://158.255.83.141:46249/i*' - '*http://115.55.168.68:57536/i*' - '*http://222.137.96.242:47558/bin.sh*' - '*http://78.38.18.178:35902/bin.sh*' - '*http://115.55.224.3:42315/i*' - '*http://39.63.148.114:34727/bin.sh*' - '*http://219.156.34.86:37807/bin.sh*' - '*http://115.57.123.15:43098/i*' - '*http://42.227.204.171:60203/bin.sh*' - '*http://42.227.204.171:60203/i*' - '*http://78.38.18.178:35902/i*' - '*http://182.121.241.215:45876/i*' - '*http://115.56.102.218:44950/bin.sh*' - '*http://78.85.166.108:54845/bin.sh*' - '*http://115.57.123.15:43098/bin.sh*' - '*http://61.52.54.253:40951/bin.sh*' - '*http://115.55.224.3:42315/bin.sh*' - '*http://182.120.8.10:43181/i*' - '*http://42.112.74.32:49168/i*' - '*http://123.4.234.71:37120/bin.sh*' - '*http://123.129.153.224:35024/bin.sh*' - '*http://115.49.232.75:57111/i*' - '*http://221.15.22.116:57599/bin.sh*' - '*http://115.63.243.58:33251/bin.sh*' - '*http://182.117.40.46:45913/i*' - '*http://182.120.8.10:43181/bin.sh*' - '*http://125.41.225.162:59124/bin.sh*' - '*http://42.228.220.15:41991/bin.sh*' - '*http://182.117.40.46:45913/bin.sh*' - '*http://78.85.166.108:54845/i*' - '*http://42.112.74.32:49168/bin.sh*' - '*http://42.231.94.246:51421/bin.sh*' - '*http://42.231.249.130:52311/i*' - '*http://123.10.6.48:56270/bin.sh*' - '*http://123.130.59.140:49195/bin.sh*' - '*http://27.215.109.89:49173/bin.sh*' - '*http://61.53.148.55:54247/i*' - '*http://61.53.148.55:54247/bin.sh*' - '*http://43.252.159.100:43612/i*' - '*http://158.255.83.99:51212/bin.sh*' - '*http://42.231.249.130:52311/bin.sh*' - '*http://43.252.159.100:43612/bin.sh*' - '*http://115.55.226.184:51245/bin.sh*' - '*http://125.99.206.137:56905/i*' - '*http://123.5.168.44:37849/bin.sh*' - '*http://123.5.168.44:37849/i*' - '*http://42.224.5.211:53756/bin.sh*' - '*http://112.249.57.185:33486/bin.sh*' - '*http://182.114.49.53:50476/bin.sh*' - '*http://117.215.53.240:46513/bin.sh*' - '*http://117.215.53.240:46513/i*' - '*http://125.47.33.188:56086/i*' - '*http://125.47.33.188:56086/bin.sh*' - '*http://27.12.202.246:56834/bin.sh*' - '*http://115.54.176.108:46244/bin.sh*' - '*http://42.224.5.211:53756/i*' - '*http://27.217.3.117:50573/bin.sh*' - '*http://61.53.193.102:36717/bin.sh*' - '*http://27.12.202.246:56834/i*' - '*http://221.15.8.91:56640/bin.sh*' - '*http://115.54.121.49:59905/bin.sh*' - '*http://115.54.176.108:46244/i*' - '*http://110.36.26.130:56170/i*' - '*http://174.27.8.146:59146/i*' - '*http://27.217.3.117:50573/i*' - '*http://39.74.85.255:50311/bin.sh*' - '*http://115.55.239.183:47050/bin.sh*' - '*http://182.117.42.205:52117/bin.sh*' - '*http://110.36.26.130:56170/bin.sh*' - '*http://39.74.85.255:50311/i*' - '*http://110.36.0.107:59269/bin.sh*' - '*http://27.8.230.240:57451/i*' - '*http://27.215.76.142:47738/bin.sh*' - '*http://219.157.66.34:60571/bin.sh*' - '*http://43.245.39.21:36791/i*' - '*http://158.255.83.238:60237/bin.sh*' - '*http://2.181.198.232:40941/i*' - '*http://182.114.33.45:53667/i*' - '*http://146.66.249.166:59922/i*' - '*http://2.181.198.232:40941/bin.sh*' - '*http://112.248.143.42:48431/i*' - '*http://123.4.250.54:51663/i*' - '*http://112.248.143.42:48431/bin.sh*' - '*http://27.215.76.142:47738/i*' - '*http://146.66.249.166:59922/bin.sh*' - '*http://61.53.13.78:60950/bin.sh*' - '*http://43.245.39.21:36791/bin.sh*' - '*http://182.126.126.219:56041/bin.sh*' - '*http://105.158.234.57:53893/i*' - '*http://39.87.122.119:49614/i*' - '*http://110.39.235.94:43418/bin.sh*' - '*http://158.255.83.238:60237/i*' - '*http://202.163.107.168:59593/bin.sh*' - '*http://105.158.234.57:53893/bin.sh*' - '*http://39.87.122.119:49614/bin.sh*' - '*http://110.39.235.94:43418/i*' - '*http://182.127.178.20:57125/bin.sh*' - '*http://123.4.250.54:51663/bin.sh*' - '*http://182.127.178.20:57125/i*' - '*http://158.255.83.87:58503/i*' - '*http://158.255.83.87:58503/bin.sh*' - '*http://115.57.180.159:40951/bin.sh*' - '*http://219.157.147.122:57139/bin.sh*' - '*http://125.40.115.195:49809/bin.sh*' - '*http://123.14.235.214:39466/bin.sh*' - '*http://27.215.126.180:40935/bin.sh*' - '*http://182.114.211.11:42818/bin.sh*' - '*http://115.57.250.151:60360/i*' - '*http://115.52.122.102:47032/bin.sh*' - '*http://27.215.211.129:50886/bin.sh*' - '*http://27.44.144.66:40003/i*' - '*http://182.117.40.235:47546/bin.sh*' - '*http://182.126.112.168:57141/bin.sh*' - '*http://150.107.92.27:55149/bin.sh*' - '*http://60.211.71.3:54741/bin.sh*' - '*http://115.63.49.95:58696/i*' - '*http://117.215.58.98:36075/bin.sh*' - '*http://27.215.79.78:35300/i*' - '*http://117.215.58.98:36075/i*' - '*http://2.177.17.39:44746/bin.sh*' - '*http://112.254.223.118:43542/bin.sh*' - '*http://94.188.162.243:49848/bin.sh*' - '*http://112.254.223.118:43542/i*' - '*http://94.188.162.243:49848/i*' - '*http://115.49.209.232:39719/i*' - '*http://112.248.6.136:55486/i*' - '*http://72.255.30.244:38898/bin.sh*' - '*http://198.58.133.193:54645/bin.sh*' - '*http://27.222.52.27:47349/bin.sh*' - '*http://27.215.139.11:38006/bin.sh*' - '*http://198.58.133.193:54645/i*' - '*http://157.211.252.240:56836/i*' - '*http://58.217.188.162:38059/i*' - '*http://115.59.231.34:52676/bin.sh*' - '*http://117.245.84.209:57482/bin.sh*' - '*http://78.38.18.210:34087/bin.sh*' - '*http://203.160.9.182:43948/bin.sh*' - '*http://27.215.143.81:41304/i*' - '*http://182.119.8.223:46128/i*' - '*http://221.15.191.138:45552/i*' - '*http://203.160.9.182:43948/i*' - '*http://158.255.83.149:46576/bin.sh*' - '*http://27.215.143.81:41304/bin.sh*' - '*http://124.229.32.123:34133/i*' - '*http://158.255.83.113:59254/i*' - '*http://27.215.79.78:35300/bin.sh*' - '*http://117.245.84.209:57482/i*' - '*http://115.59.231.34:52676/i*' - '*http://115.63.49.95:58696/bin.sh*' - '*http://157.211.252.240:56836/bin.sh*' - '*http://39.90.149.223:43063/bin.sh*' - '*http://39.90.149.223:43063/i*' - '*http://115.49.209.232:39719/bin.sh*' - '*http://2.177.17.39:44746/i*' - '*http://58.217.188.162:38059/bin.sh*' - '*http://78.38.18.210:34087/i*' - '*http://60.211.71.3:54741/i*' - '*http://202.1.26.13:39277/i*' - '*http://27.222.52.27:47349/i*' - '*http://221.15.191.138:45552/bin.sh*' - '*http://182.119.8.223:46128/bin.sh*' - '*http://202.1.26.13:39277/bin.sh*' - '*http://27.215.139.11:38006/i*' - '*http://96.245.232.247:53738/i*' - '*http://124.229.32.123:34133/bin.sh*' - '*http://96.245.232.247:53738/bin.sh*' - '*http://115.48.161.61:44538/bin.sh*' - '*http://158.255.83.113:59254/bin.sh*' - '*http://158.255.83.149:46576/i*' - '*http://72.255.30.244:38898/i*' - '*http://182.113.44.169:55321/i*' - '*http://95.165.187.102:52854/i*' - '*http://123.10.233.251:57888/bin.sh*' - '*http://42.237.25.245:35268/i*' - '*http://113.120.56.231:44651/i*' - '*http://42.237.25.245:35268/bin.sh*' - '*http://110.39.233.38:38476/i*' - '*http://95.165.187.102:52854/bin.sh*' - '*http://27.8.230.240:57451/bin.sh*' - '*http://141.11.88.129/main_sh4*' - '*http://141.11.88.129/main_arm6*' - '*http://141.11.88.129/main_arm*' - '*http://141.11.88.129/main_ppc*' - '*http://141.11.88.129/main_mpsl*' - '*http://141.11.88.129/main_arm7*' - '*http://141.11.88.129/main_m68k*' - '*http://141.11.88.129/main_x86_64*' - '*http://141.11.88.129/main_mips*' - '*http://123.10.233.251:57888/i*' - '*http://27.44.144.66:40003/bin.sh*' - '*http://165.22.248.57/peler.x86_64*' - '*http://165.22.248.57/peler.arm5*' - '*http://165.22.248.57/peler.i686*' - '*http://165.22.248.57/peler.sh4*' - '*http://165.22.248.57/ppc*' - '*http://165.22.248.57/peler.ppc*' - '*http://165.22.248.57/arm*' - '*http://165.22.248.57/peler.mips*' - '*http://165.22.248.57/peler.arc*' - '*http://165.22.248.57/arc*' - '*http://165.22.248.57/sh4*' - '*http://165.22.248.57/peler.m68k*' - '*http://165.22.248.57/i686*' - '*http://165.22.248.57/peler.arm*' - '*http://165.22.248.57/peler.arm6*' - '*http://165.22.248.57/x86_64*' - '*http://165.22.248.57/arm6*' - '*http://165.22.248.57/peler.spc*' - '*http://165.22.248.57/spc*' - '*http://165.22.248.57/arm7*' - '*http://165.22.248.57/m68k*' - '*http://165.22.248.57/x86*' - '*http://165.22.248.57/peler.x86*' - '*http://165.22.248.57/arm5*' - '*http://42.231.94.11:51798/i*' - '*http://42.231.94.11:51798/bin.sh*' - '*http://113.120.56.231:44651/bin.sh*' - '*http://196.190.69.149:55290/i*' - '*http://123.133.59.188:33725/bin.sh*' - '*http://110.36.80.171:51872/bin.sh*' - '*http://196.190.69.149:55290/bin.sh*' - '*http://36.33.105.221:40757/i*' - '*http://27.44.145.195:56018/i*' - '*http://36.33.105.221:40757/bin.sh*' - '*http://110.36.2.23:39187/i*' - '*http://123.14.181.25:39080/bin.sh*' - '*http://125.160.189.83:38673/i*' - '*http://27.44.145.195:56018/bin.sh*' - '*http://125.160.189.83:38673/bin.sh*' - '*http://222.139.106.119:35776/i*' - '*http://110.36.18.169:34631/i*' - '*http://115.48.45.245:55111/i*' - '*http://120.37.212.235:50179/bin.sh*' - '*http://222.139.106.119:35776/bin.sh*' - '*http://115.48.45.245:55111/bin.sh*' - '*http://60.19.210.238:56692/i*' - '*http://78.26.48.22:60239/i*' - '*http://45.177.33.164:56402/i*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.mpsl*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.arm7*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.i486*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.arm*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.mips*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.sh4*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.ppc*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.arm5*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.m68k*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.arc*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.arm6*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.i686*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.x86*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.x86_64*' - '*http://179.43.182.70/KKveTTgaAAsecNNaaaa/KKveTTgaAAsecNNaaaa.spc*' - '*http://125.45.66.153:40467/i*' - '*http://27.206.189.240:58978/bin.sh*' - '*http://60.19.210.238:56692/bin.sh*' - '*http://37.232.128.5:58602/i*' - '*http://39.77.170.74:59529/i*' - '*http://125.45.66.153:40467/bin.sh*' - '*http://45.177.33.164:56402/bin.sh*' - '*http://115.48.161.61:44538/i*' - '*http://182.239.81.126:43623/bin.sh*' - '*http://182.114.198.64:59795/i*' - '*http://39.77.170.74:59529/bin.sh*' - '*http://182.114.198.64:59795/bin.sh*' - '*http://124.135.141.173:48830/bin.sh*' - '*http://45.188.159.254:42432/i*' - '*http://110.39.228.78:53304/i*' - '*http://221.15.184.63:56527/i*' - '*http://42.234.234.38:46462/i*' - '*http://37.232.128.5:58602/bin.sh*' - '*http://45.185.93.188:50249/i*' - '*http://45.188.159.254:42432/bin.sh*' - '*http://110.39.228.78:53304/bin.sh*' - '*http://222.136.36.83:44446/i*' - '*http://45.185.93.188:50249/bin.sh*' - '*http://123.97.70.82:37522/bin.sh*' - '*http://222.141.135.164:44986/i*' - '*http://42.231.216.73:49020/i*' - '*http://119.183.225.232:54115/i*' - '*http://103.249.199.3:49713/i*' - '*http://182.112.31.145:43036/i*' - '*http://222.136.36.83:44446/bin.sh*' - '*http://125.44.209.117:39250/i*' - '*http://42.234.234.38:46462/bin.sh*' - '*http://175.107.16.92:35222/i*' - '*http://175.107.16.92:35222/bin.sh*' - '*http://196.191.102.114:38503/i*' - '*http://222.141.135.164:44986/bin.sh*' - '*http://123.148.191.5:43457/bin.sh*' - '*http://27.44.146.241:41434/i*' - '*http://42.231.216.73:49020/bin.sh*' - '*http://103.249.199.3:49713/bin.sh*' - '*http://39.90.178.76:33468/i*' - '*http://27.44.146.241:41434/bin.sh*' - '*http://103.24.110.240:56640/i*' - '*http://46.163.134.250:44332/i*' - '*http://46.163.134.250:44332/bin.sh*' - '*http://110.39.232.190:60500/i*' - '*http://39.90.178.76:33468/bin.sh*' - '*http://110.39.232.190:60500/bin.sh*' - '*http://103.24.110.240:56640/bin.sh*' - '*http://119.179.255.178:46276/i*' - '*http://182.127.38.31:48902/i*' - '*http://112.242.46.30:39449/i*' - '*http://41.201.226.25:51089/i*' - '*http://119.179.255.178:46276/bin.sh*' - '*http://115.48.144.123:35521/i*' - '*http://110.36.69.52:44150/i*' - '*http://103.143.167.155:46548/i*' - '*http://5.175.217.137/SBIDIOT/x86_64*' - '*http://129.121.114.124/m6db*' - '*http://5.175.217.137/SBIDIOT/sparc*' - '*http://5.175.217.137/SBIDIOT/i586*' - '*http://5.175.217.137/SBIDIOT/mips64*' - '*http://129.121.114.124/XVj*' - '*http://129.121.114.124/xZPw*' - '*http://5.175.217.137/SBIDIOT/arm7*' - '*http://5.175.217.137/SBIDIOT/arm5*' - '*http://129.121.114.124/v9c9*' - '*http://129.121.114.124/VyS5*' - '*http://129.121.114.124/lyV*' - '*http://129.121.114.124/DsI5*' - '*http://129.121.114.124/eXE*' - '*http://129.121.114.124/5KP*' - '*http://129.121.114.124/jR6*' - '*http://129.121.114.124/82L*' - '*http://129.121.114.124/4wIL*' - '*http://129.121.114.124/l4dw*' - '*http://129.121.114.124/hUf*' - '*http://129.121.114.124/egV*' - '*http://103.143.167.155:46548/bin.sh*' - '*http://5.182.210.61/290f4c*' - '*http://5.182.210.61/879e82*' - '*http://5.182.210.61/194f8f*' - '*http://5.182.210.61/2c3233*' - '*http://5.182.210.61/807837*' - '*http://5.182.210.61/154b5a*' - '*http://5.182.210.61/81b63c*' - '*http://5.182.210.61/d204cb*' - '*http://5.182.210.61/552826*' - '*http://5.182.210.61/a6c968*' - '*http://5.182.210.61/300614*' - '*http://5.182.210.61/2eb685*' - '*http://42.230.29.8:33974/i*' - '*http://5.175.217.137/SBIDIOT/spc*' - '*http://5.175.217.137/SBIDIOT/arc*' - '*http://5.175.217.137/SBIDIOT/root*' - '*http://5.175.217.137/SBIDIOT/yarn*' - '*http://5.175.217.137/SBIDIOT/zte*' - '*http://5.175.217.137/SBIDIOT/m68k*' - '*http://5.175.217.137/SBIDIOT/rtk*' - '*http://5.175.217.137/SBIDIOT/mpsl*' - '*http://5.175.217.137/SBIDIOT/mips*' - '*http://5.175.217.137/SBIDIOT/sh4*' - '*http://182.114.35.68:53667/i*' - '*http://5.175.217.137/SBIDIOT/x86*' - '*http://5.175.217.137/SBIDIOT/arm6*' - '*http://5.175.217.137/SBIDIOT/arm*' - '*http://5.175.217.137/SBIDIOT/ppc*' - '*http://42.231.113.62:56786/i*' - '*http://182.127.38.188:36121/i*' - '*http://39.86.128.16:42483/i*' - '*http://141.11.88.128/bins/vcimanagement.x86_64*' - '*http://42.231.113.62:56786/bin.sh*' - '*http://125.45.11.81:43611/i*' - '*http://39.86.128.16:42483/bin.sh*' - '*http://141.11.88.129/main_x86*' - '*http://141.11.88.129/mq.xml*' - '*http://113.238.105.18:35549/i*' - '*http://42.229.188.40:49877/i*' - '*http://94.154.43.31/data_mipsel-uclibc*' - '*http://141.11.88.128/bins/vcimanagement.arm7*' - '*http://141.11.88.128/bins/vcimanagement.arm5*' - '*http://141.11.88.128/bins/vcimanagement.ppc*' - '*http://141.11.88.128/bins/vcimanagement.mips*' - '*http://141.11.88.128/bins/vcimanagement.arm6*' - '*http://141.11.88.128/bins/vcimanagement.x86*' - '*http://141.11.88.128/bins/vcimanagement.spc*' - '*http://141.11.88.128/bins/vcimanagement.sh4*' - '*http://141.11.88.128/bins/vcimanagement.m68k*' - '*http://141.11.88.128/bins/vcimanagement.mpsl*' - '*http://141.11.88.128/bins/vcimanagement.arm*' - '*http://113.238.105.18:35549/bin.sh*' - '*http://124.29.223.148:57930/i*' - '*http://124.29.223.148:57930/bin.sh*' - '*http://42.237.35.241:54669/i*' - '*http://42.238.170.65:54036/bin.sh*' - '*http://94.154.43.10/ipmiv2.xml*' - '*http://42.229.188.40:49877/bin.sh*' - '*http://42.237.35.241:54669/bin.sh*' - '*http://110.36.93.182:56299/i*' - '*http://115.51.97.86:53978/bin.sh*' - '*http://115.55.242.119:41853/i*' - '*http://110.36.93.182:56299/bin.sh*' - '*http://222.134.174.174:44847/bin.sh*' - '*http://115.55.242.119:41853/bin.sh*' - '*http://42.236.148.20:39529/i*' - '*http://115.48.36.219:50199/bin.sh*' - '*http://42.236.148.20:39529/bin.sh*' - '*http://123.4.201.122:37030/bin.sh*' - '*http://124.131.136.162:57903/i*' - '*http://124.131.136.162:57903/bin.sh*' - '*http://94.154.43.31/data_powerpc*' - '*http://94.154.43.31/data_arm7*' - '*http://94.154.43.31/data_aarch64*' - '*http://94.154.43.31/data_mipsel*' - '*http://94.154.43.31/data_arm4*' - '*http://94.154.43.31/data_mips*' - '*http://94.154.43.31/data_arm6*' - '*http://94.154.43.31/data_arm5*' - '*http://94.154.43.31/data_x86_64*' - '*http://94.154.43.31/data_x86*' - '*http://42.235.92.168:52481/bin.sh*' - '*http://165.22.248.57//arm5*' - '*http://165.22.248.57/peler.arm7*' - '*http://165.22.248.57/mpsl*' - '*http://165.22.248.57/mips*' - '*http://165.22.248.57/peler.mpsl*' - '*http://42.227.201.101:56640/i*' - '*http://110.37.67.68:37534/i*' - '*http://94.154.43.31/bbc*' - '*http://222.139.97.94:38399/i*' - '*http://42.227.201.101:56640/bin.sh*' - '*http://110.37.67.68:37534/bin.sh*' - '*http://115.201.118.175:46369/i*' - '*http://182.116.118.121:50605/i*' - '*http://222.139.97.94:38399/bin.sh*' - '*http://182.116.118.121:50605/bin.sh*' - '*http://165.22.248.57/massload*' - '*http://195.123.4.249/bbc*' - '*http://196.191.137.44:49775/i*' - '*http://125.44.42.45:53083/i*' - '*http://123.5.168.10:36741/i*' - '*http://123.5.168.10:36741/bin.sh*' - '*http://123.14.221.183:52277/i*' - '*http://123.14.221.183:52277/bin.sh*' - '*http://119.179.208.110:34766/i*' - '*http://27.44.144.253:43603/i*' - '*http://125.44.42.45:53083/bin.sh*' - '*http://119.179.208.110:34766/bin.sh*' - '*http://123.14.93.231:50448/bin.sh*' - '*http://105.184.182.42:54111/i*' - '*http://27.44.145.224:36350/i*' - '*http://182.127.38.188:36121/bin.sh*' - '*http://42.231.250.215:59905/i*' - '*http://27.37.229.70:60470/i*' - '*http://219.155.251.103:43616/i*' - '*http://105.184.182.42:54111/bin.sh*' - '*http://125.44.244.56:44944/bin.sh*' - '*http://182.113.248.145:35518/i*' - '*http://115.48.27.166:55311/i*' - '*http://42.85.135.133:46174/i*' - '*http://219.155.251.103:43616/bin.sh*' - '*http://220.249.175.20:58631/bin.sh*' - '*http://123.10.15.235:48416/bin.sh*' - '*http://115.48.27.166:55311/bin.sh*' - '*http://110.36.19.101:43670/i*' - '*http://110.36.19.101:43670/bin.sh*' - '*http://115.55.52.84:57152/i*' - '*http://125.41.8.228:47846/i*' - '*http://42.231.46.107:47290/bin.sh*' - '*http://115.55.52.84:57152/bin.sh*' - '*http://115.52.176.66:44658/i*' - '*http://180.252.221.210:54024/bin.sh*' - '*http://112.232.34.216:50450/i*' - '*http://45.225.135.18/w.sh*' - '*http://61.53.81.68:44744/i*' - '*http://42.235.92.168:52481/i*' - '*http://61.53.81.68:44744/bin.sh*' - '*http://112.232.34.216:50450/bin.sh*' - '*http://27.44.144.207:60780/i*' - '*http://42.224.172.49:46579/i*' - '*http://42.224.172.49:46579/bin.sh*' - '*http://182.119.8.139:38635/i*' - '*http://27.215.126.180:40935/i*' - '*http://182.119.8.139:38635/bin.sh*' - '*http://123.14.244.78:53002/bin.sh*' - '*http://124.131.155.158:43263/bin.sh*' - '*http://115.49.7.17:57272/i*' - '*http://27.44.147.223:50746/i*' - '*http://115.49.7.17:57272/bin.sh*' - '*http://182.113.31.70:50018/i*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 15 id: b9a70b5c-7ec8-5cd7-b6b5-34cf56a8d1ac status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 15). logsource: category: proxy detection: selection: c-uri: - '*http://115.51.97.86:53978/i*' - '*http://39.89.167.243:55515/i*' - '*http://125.43.225.145:45606/i*' - '*http://115.57.250.151:60360/bin.sh*' - '*http://125.43.225.145:45606/bin.sh*' - '*http://27.44.145.3:59660/i*' - '*http://27.44.145.3:59660/bin.sh*' - '*http://115.57.180.159:40951/i*' - '*http://219.154.173.162:35040/i*' - '*http://115.50.220.128:59661/bin.sh*' - '*http://42.231.113.62:50049/i*' - '*http://219.154.173.162:35040/bin.sh*' - '*http://61.52.2.248:59819/i*' - '*http://115.48.36.219:50199/i*' - '*http://42.231.113.62:50049/bin.sh*' - '*http://61.52.2.248:59819/bin.sh*' - '*http://27.44.147.60:52992/i*' - '*http://141.11.88.119/dg.mips*' - '*http://110.36.15.18:48106/i*' - '*http://110.36.15.18:48106/bin.sh*' - '*http://27.215.211.129:50886/i*' - '*http://182.114.211.11:42818/i*' - '*http://182.112.147.45:46853/i*' - '*http://113.231.232.102:45482/i*' - '*http://123.10.15.235:48416/i*' - '*http://115.52.242.165:44405/i*' - '*http://190.109.227.76:35385/i*' - '*http://98.252.87.232:50861/i*' - '*http://124.135.141.173:48830/i*' - '*http://154.249.119.56:56033/i*' - '*http://112.111.110.124:58732/i*' - '*http://115.52.242.165:44405/bin.sh*' - '*http://115.56.149.232:57552/i*' - '*http://112.111.110.124:58732/bin.sh*' - '*http://220.202.66.197:46907/bin.sh*' - '*http://42.234.234.120:35755/i*' - '*http://125.27.11.175:37871/bin.sh*' - '*http://61.53.140.107:60429/i*' - '*http://171.114.231.42:44119/i*' - '*http://123.7.42.213:48968/i*' - '*http://171.114.231.42:44119/bin.sh*' - '*http://123.7.42.213:48968/bin.sh*' - '*http://110.36.89.246:55146/i*' - '*http://123.14.244.78:53002/i*' - '*http://123.14.235.214:39466/i*' - '*http://110.36.89.246:55146/bin.sh*' - '*http://42.224.92.52:52299/i*' - '*http://141.11.88.127/x86_64*' - '*http://141.11.88.127/arm7*' - '*http://141.11.88.125/bins/arm6*' - '*http://141.11.88.127/arm*' - '*http://141.11.88.127/x86*' - '*http://141.11.88.127/arm5*' - '*http://141.11.88.127/mips*' - '*http://141.11.88.127/mipsel*' - '*http://141.11.88.127/arm6*' - '*http://141.11.88.125/bins/m68k*' - '*http://141.11.88.125/bins/ppc*' - '*http://141.11.88.125/bins/sh4*' - '*http://141.11.88.125/bins/x86*' - '*http://141.11.88.125/bins/arm5*' - '*http://141.11.88.125/bins/mips*' - '*http://141.11.88.127/ppc*' - '*http://141.11.88.127/m68k*' - '*http://141.11.88.125/bins/arm7*' - '*http://85.204.125.67:8080/a-r.m-4.SativaC2*' - '*http://85.204.125.67:8080/x-3.2-.SativaC2*' - '*http://85.204.125.67:8080/m-p.s-l.SativaC2*' - '*http://85.204.125.67:8080/a-r.m-5.SativaC2*' - '*http://85.204.125.67:8080/p-p.c-.SativaC2*' - '*http://85.204.125.67:8080/x-8.6-.SativaC2*' - '*http://85.204.125.67:8080/a-r.m-6.SativaC2*' - '*http://85.204.125.67:8080/a-r.m-7.SativaC2*' - '*http://85.204.125.67:8080/a-r.m-8.SativaC2*' - '*http://129.121.114.124/mnkk*' - '*http://129.121.114.124/HqhC*' - '*http://129.121.114.124/82Y*' - '*http://129.121.114.124/XzsJ*' - '*http://129.121.114.124/tJTB*' - '*http://85.204.125.67:8080/s-h.4-.SativaC2*' - '*http://42.224.92.52:52299/bin.sh*' - '*http://150.107.92.27:55149/i*' - '*http://222.139.35.187:53691/bin.sh*' - '*http://222.133.125.171:42470/i*' - '*http://112.248.6.136:55486/bin.sh*' - '*http://201.149.107.50:39048/bin.sh*' - '*http://222.133.125.171:42470/bin.sh*' - '*http://125.41.225.17:40569/bin.sh*' - '*http://110.37.53.25:58088/i*' - '*http://123.12.20.109:60932/i*' - '*http://123.12.20.109:60932/bin.sh*' - '*http://182.120.9.25:43181/i*' - '*http://219.157.58.156:47845/i*' - '*http://182.120.9.25:43181/bin.sh*' - '*http://112.27.10.150:34339/Mozi.m*' - '*http://14.0.131.161:38465/i*' - '*http://39.71.205.224:59523/i*' - '*http://14.0.131.161:38465/bin.sh*' - '*http://39.71.205.224:59523/bin.sh*' - '*http://115.55.48.153:41344/i*' - '*http://115.55.48.153:41344/bin.sh*' - '*http://113.239.220.232:50902/bin.sh*' - '*http://27.44.147.71:34846/i*' - '*http://115.62.144.248:37028/i*' - '*http://175.149.67.175:47768/i*' - '*http://119.185.184.69:58314/i*' - '*http://123.5.114.211:45571/i*' - '*http://115.62.144.248:37028/bin.sh*' - '*http://124.131.128.105:45466/i*' - '*http://27.215.142.155:55051/i*' - '*http://119.185.184.69:58314/bin.sh*' - '*http://27.215.142.155:55051/bin.sh*' - '*http://110.85.99.118:38787/i*' - '*http://182.117.40.235:47546/i*' - '*http://79.40.72.79:49414/i*' - '*http://124.131.128.105:45466/bin.sh*' - '*http://123.11.169.71:35373/i*' - '*http://218.73.96.40:35801/i*' - '*http://123.11.169.71:35373/bin.sh*' - '*http://61.53.124.244:44174/i*' - '*http://112.248.106.51:49798/bin.sh*' - '*http://61.53.124.244:44174/bin.sh*' - '*http://27.215.124.157:46921/i*' - '*http://115.52.122.102:47032/i*' - '*http://110.37.7.53:40503/i*' - '*http://112.248.184.22:53198/i*' - '*http://110.36.28.183:55326/bin.sh*' - '*http://115.50.7.73:45913/i*' - '*http://27.215.124.157:46921/bin.sh*' - '*http://110.37.7.53:40503/bin.sh*' - '*http://112.248.184.22:53198/bin.sh*' - '*http://115.50.7.73:45913/bin.sh*' - '*http://110.36.19.51:47699/i*' - '*http://94.26.88.19/bbcl*' - '*http://94.26.88.19/wwg*' - '*http://94.26.88.19/ccl*' - '*http://82.144.86.37:40445/i*' - '*http://94.26.88.19/bwwg*' - '*http://110.37.73.3:33880/i*' - '*http://42.234.234.120:35755/bin.sh*' - '*http://110.36.19.51:47699/bin.sh*' - '*http://119.116.237.200:35093/i*' - '*http://78.167.39.24:37232/i*' - '*http://177.86.229.12:36888/i*' - '*http://219.157.147.122:57139/i*' - '*http://200.6.91.43:54683/i*' - '*http://82.144.86.37:40445/bin.sh*' - '*http://110.37.65.212:58484/i*' - '*http://110.37.65.212:58484/bin.sh*' - '*http://110.37.73.3:33880/bin.sh*' - '*http://119.116.237.200:35093/bin.sh*' - '*http://115.57.254.117:54013/bin.sh*' - '*http://110.36.2.23:57677/i*' - '*http://177.86.229.12:36888/bin.sh*' - '*http://200.6.91.43:54683/bin.sh*' - '*http://110.36.2.23:57677/bin.sh*' - '*http://103.249.199.3:58356/i*' - '*http://113.238.163.48:44689/i*' - '*http://103.249.199.3:58356/bin.sh*' - '*http://175.146.155.175:48594/bin.sh*' - '*http://110.181.234.143:60663/i*' - '*http://59.97.248.205:44550/i*' - '*http://59.97.248.205:44550/bin.sh*' - '*http://27.44.147.24:60944/i*' - '*http://27.44.144.30:46745/i*' - '*http://110.181.234.143:60663/bin.sh*' - '*http://113.238.163.48:44689/bin.sh*' - '*http://125.44.244.56:44944/i*' - '*http://119.186.208.40:57766/bin.sh*' condition: selection level: high tags: - attack.t1059.004 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 2eeb4fa0-4662-528b-8c27-15d3c50965da status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://39.79.8.107:37917/i*' - '*http://125.42.234.9:57998/i*' - '*http://39.79.8.107:37917/bin.sh*' - '*http://115.57.167.137:36060/i*' - '*http://182.126.80.22:38169/i*' - '*http://115.52.16.174:60929/i*' - '*http://182.126.80.22:38169/bin.sh*' - '*http://115.60.210.98:38606/i*' - '*http://125.44.18.143:47375/i*' - '*http://42.232.229.33:38671/i*' - '*http://125.44.18.143:47375/bin.sh*' - '*http://115.55.55.237:44372/i*' - '*http://42.232.229.33:38671/bin.sh*' - '*http://115.55.55.237:44372/bin.sh*' - '*http://182.116.119.204:59196/i*' - '*http://182.118.247.213:49630/i*' - '*http://42.231.94.251:49336/i*' - '*http://115.54.167.221:35167/i*' - '*http://91.92.242.236/files-129312398/files/file_aa7f06411e2b4e88.exe*' - '*http://129.121.114.124/CCJt*' - '*http://125.44.18.151:41954/i*' - '*https://panel.b2brouter-secure.com/load123.bin*' - '*https://panel.b2brouter-secure.com/doc-fac.bin*' - '*https://uploadloop.com/bhatta.exe*' - '*http://91.92.242.236/files-129312398/files/file_851477f5539ff9f4.exe*' - '*http://61.52.36.48:44407/i*' - '*http://62.60.226.140/files/7997280925/yXhtFdg.exe*' - '*http://62.60.226.140/files/7782139129/4u8cR3O.exe*' - '*http://42.178.108.127:46519/bin.sh*' - '*http://182.122.226.129:51459/i*' - '*http://115.49.202.106:57597/bin.sh*' - '*http://42.239.148.94:55549/i*' - '*http://27.44.146.231:35671/i*' - '*http://61.53.94.172:55649/i*' - '*http://192.176.50.190:59653/bin.sh*' - '*http://42.230.43.158:46355/bin.sh*' - '*http://42.235.139.148:53135/bin.sh*' - '*http://72.194.227.46:46986/bin.sh*' - '*http://42.5.10.179:34276/bin.sh*' - '*http://42.237.24.31:58345/i*' - '*http://125.41.8.198:53946/bin.sh*' - '*http://112.248.155.54:45383/bin.sh*' - '*http://61.53.119.246:55252/i*' - '*http://182.112.191.184:37971/i*' - '*http://222.138.151.245:57357/bin.sh*' - '*http://192.176.50.190:59653/i*' - '*http://116.139.178.90:48866/i*' - '*http://112.248.124.80:59151/i*' - '*http://115.63.53.171:45975/i*' - '*http://27.215.78.91:34053/i*' - '*http://110.36.70.28:44081/i*' - '*http://42.235.139.148:53135/i*' - '*http://42.239.224.234:40836/i*' - '*http://61.52.195.88:41949/bin.sh*' - '*http://222.138.151.245:57357/i*' - '*http://120.84.212.124:46261/i*' - '*http://110.36.70.28:44081/bin.sh*' - '*http://222.138.119.202:39204/i*' - '*http://119.113.75.65:47752/bin.sh*' - '*http://221.15.229.1:44028/i*' - '*http://110.36.93.253:39502/i*' - '*http://182.113.36.141:44588/i*' - '*http://115.58.94.53:43384/i*' - '*http://37.78.46.29:60032/bin.sh*' - '*http://182.119.14.41:37659/i*' - '*http://123.234.150.188:39289/bin.sh*' - '*http://112.237.5.204:52050/i*' - '*http://183.196.29.73:25166/bin.sh*' - '*http://42.239.224.234:40836/bin.sh*' - '*http://182.112.191.184:37971/bin.sh*' - '*http://115.55.197.75:43640/bin.sh*' - '*http://123.14.83.24:47055/i*' - '*http://27.44.147.155:35378/i*' - '*http://36.36.197.20:38356/i*' - '*http://42.239.148.94:55549/bin.sh*' - '*http://112.237.5.204:52050/bin.sh*' - '*http://42.230.41.186:49271/i*' - '*http://42.233.89.1:40478/i*' - '*http://115.50.71.156:33700/bin.sh*' - '*http://61.53.119.246:55252/bin.sh*' - '*http://37.78.46.29:60032/i*' - '*http://42.230.159.16:32825/bin.sh*' - '*http://61.53.94.172:55649/bin.sh*' - '*http://112.248.124.80:59151/bin.sh*' - '*http://222.142.193.59:37884/i*' - '*http://182.112.14.147:47198/i*' - '*http://115.50.71.156:33700/i*' - '*http://115.49.224.14:36948/i*' - '*http://182.113.24.58:35366/i*' - '*http://42.5.10.179:34276/i*' - '*http://120.84.214.100:50458/i*' - '*http://42.231.237.89:57399/bin.sh*' - '*http://123.5.186.218:58556/i*' - '*http://115.55.197.75:43640/i*' - '*http://42.230.159.16:32825/i*' - '*http://182.116.93.174:58308/i*' - '*http://221.15.229.1:44028/bin.sh*' - '*http://182.116.38.225:55685/bin.sh*' - '*http://182.119.14.41:37659/bin.sh*' - '*http://115.55.240.45:36409/i*' - '*http://115.55.240.45:36409/bin.sh*' - '*http://123.14.85.100:42355/bin.sh*' - '*http://42.226.71.247:52557/i*' - '*http://110.36.29.195:56053/i*' - '*http://61.53.153.17:45226/i*' - '*http://61.53.153.17:45226/bin.sh*' - '*https://roblox-xeno.info/uploads/Boots%D0%B5%D1%85%D0%B5cn64.zip*' - '*http://v2202606372363474129.happysrv.de:8033/a.exe*' - '*http://94.16.122.201:8033/a.exe*' - '*http://27.220.11.19:34692/i*' - '*http://42.226.68.162:50573/i*' - '*http://42.226.68.162:50573/bin.sh*' - '*http://5.182.210.61/995a0b*' - '*http://5.182.210.61/5d7d3b*' - '*http://5.182.210.61/13f62b*' - '*http://5.182.210.61/76705d*' - '*http://5.182.210.61/94115c*' - '*http://5.182.210.61/e9cc83*' - '*http://5.182.210.61/53bd7e*' - '*http://5.182.210.61/519e48*' - '*http://5.182.210.61/1dc272*' - '*http://5.182.210.61/522f30*' - '*http://5.182.210.61/18e6dd*' - '*http://5.182.210.61/cdb6cf*' - '*http://5.182.210.61/d87017*' - '*http://5.182.210.61/7e26a6*' - '*http://5.182.210.61/fa3fc2*' - '*http://5.182.210.61/7e73d7*' - '*http://5.182.210.61/a0e5aa*' - '*http://5.182.210.61/2dde2f*' - '*http://5.182.210.61/62a68f*' - '*http://5.182.210.61/597b65*' - '*http://5.182.210.61/06fe0b*' - '*http://5.182.210.61/5a9b45*' - '*http://5.182.210.61/6dfc96*' - '*http://5.182.210.61/6d7e02*' - '*https://gmbh-hunt-dividend-arena.trycloudflare.com/updhfjsbfs.bat*' - '*https://firebasestorage.googleapis.com/v0/b/new-era-14dfd/o/Lincoln.ps1?alt=media&token=0b1e9378-0fc3-468d-9a3e-e5c215ea5f49*' - '*http://88.84.222.217:64193/i*' - '*http://123.5.8.154:53588/i*' - '*http://115.48.151.195:47978/i*' - '*http://115.48.151.195:47978/bin.sh*' - '*http://110.36.80.169:39924/i*' - '*https://88.212.109.208.host.secureserver.net/?get=1*' - '*http://31.56.209.153/release/$bin*' - '*http://72.255.30.244:53657/i*' - '*http://72.255.30.244:53657/bin.sh*' - '*http://182.117.70.170:58166/i*' - '*http://182.117.70.170:58166/bin.sh*' - '*http://103.31.103.204:56179/i*' - '*http://125.43.18.25:48430/i*' - '*http://103.31.103.204:56179/bin.sh*' - '*http://42.235.102.203:44955/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_3bc9ccd02805e1bd.exe*' - '*http://115.49.72.114:35444/bin.sh*' - '*http://112.240.254.56:37927/i*' - '*http://222.140.180.134:47266/i*' - '*http://222.140.180.134:47266/bin.sh*' - '*http://42.227.238.90:35374/bin.sh*' - '*http://222.141.214.75:35349/bin.sh*' - '*http://89.34.90.130/kxunkw4z-u2qv2kxd-qd76zt3x-kmcbgxy3/package.msi*' - '*http://45.13.186.129:8080/verify.ps1*' - '*http://222.141.189.99:39391/i*' - '*http://119.179.253.64:33876/i*' - '*http://219.154.78.241:55576/bin.sh*' - '*http://222.138.151.105:36654/i*' - '*https://vmwrvtools.com/rvtools4.8.1.msi*' - '*http://5.182.210.61/449ce2*' - '*http://5.182.210.61/f3bb28*' - '*http://5.182.210.61/4317af*' - '*http://5.182.210.61/4404fc*' - '*http://5.182.210.61/dc20a8*' - '*http://5.182.210.61/12c344*' - '*http://5.182.210.61/76f32c*' - '*http://5.182.210.61/4a720d*' - '*http://5.182.210.61/32f59e*' - '*http://5.182.210.61/655399*' - '*http://5.182.210.61/75745b*' - '*http://5.182.210.61/38e096*' - '*http://129.121.110.105/c0v*' - '*http://129.121.110.105/IwH*' - '*http://129.121.110.105/phtN*' - '*http://129.121.110.105/bSLw*' - '*http://129.121.110.105/yHy*' - '*http://129.121.110.105/LAI*' - '*http://129.121.110.105/ouwR*' - '*http://129.121.110.105/gTrF*' - '*http://129.121.110.105/HFpa*' - '*http://129.121.110.105/FGx2*' - '*http://182.115.185.8:58576/bin.sh*' - '*http://110.37.30.28:44380/bin.sh*' - '*http://42.231.237.89:57399/i*' - '*http://61.52.46.142:56039/bin.sh*' - '*http://78.25.170.214:39654/bin.sh*' - '*http://42.225.218.190:50793/i*' - '*http://42.57.20.156:58713/i*' - '*http://59.97.251.206:57600/bin.sh*' - '*http://61.53.85.165:50764/i*' - '*http://61.53.125.19:44440/i*' - '*http://42.224.96.227:59132/i*' - '*http://61.53.124.207:36096/i*' - '*http://61.53.138.220:59679/i*' - '*http://27.206.197.243:40813/bin.sh*' - '*http://220.202.64.91:60576/i*' - '*http://42.178.108.127:46519/i*' - '*http://61.53.124.207:36096/bin.sh*' - '*http://221.15.190.248:42078/i*' - '*http://42.231.228.31:33018/i*' - '*http://222.139.198.161:46321/i*' - '*http://222.139.198.161:46321/bin.sh*' - '*http://42.234.149.52:58456/bin.sh*' - '*http://93.157.253.209:45451/bin.sh*' - '*http://83.219.1.198:37564/i*' - '*http://42.229.221.24:46586/i*' - '*http://222.140.216.218:58438/bin.sh*' - '*http://221.15.190.248:42078/bin.sh*' - '*http://42.224.193.224:50332/bin.sh*' - '*http://221.13.235.74:47487/i*' - '*http://98.252.87.232:48121/bin.sh*' - '*http://27.44.145.11:32896/i*' - '*http://42.224.75.194:49216/i*' - '*https://filmchill.net/install.sh*' - '*http://42.234.149.52:58456/i*' - '*http://42.231.92.30:54518/i*' - '*http://61.52.195.88:41949/i*' - '*http://222.138.78.28:58707/i*' - '*http://42.230.43.158:46355/i*' - '*http://27.206.197.243:40813/i*' - '*http://42.228.103.211:38030/bin.sh*' - '*http://222.140.185.252:49125/bin.sh*' - '*http://27.215.49.246:49132/bin.sh*' - '*http://27.215.49.246:49132/i*' - '*http://46.236.65.142:42054/bin.sh*' - '*https://hackers.krd/*' - '*http://47.239.191.177:6270/linux*' - '*http://47.243.208.30:8329/linux*' - '*http://120.77.79.42:9290/linux*' - '*http://39.97.246.227:9613/linux*' - '*http://115.57.14.26:51264/i*' - '*http://119.118.245.179:48407/bin.sh*' - '*https://github.com/hexmostafa/SshCracker/releases/download/SshCrackerV1.0.0/SshCracker.exe*' - '*https://github.com/chaitin/xray/releases/download/1.9.11/xray_linux_amd64.zip*' - '*https://github.com/Fahrj/reverse-ssh/releases/download/v1.2.0/upx_reverse-sshx64*' - '*https://www.dra.com.ve/wp-content/languages/plugins/ds5.txt*' - '*http://108.168.10.70:51473/i*' - '*http://14.189.246.11:46338/bin.sh*' - '*http://2.57.122.159/dom/show*' - '*http://123.11.243.157:52735/bin.sh*' - '*http://47.121.184.138:9823/linux*' - '*https://github.com/mingkwind/sshcrack/releases/download/sshcrack/sshcrack_linux.zip*' - '*https://github.com/xmrig/xmrig/releases/download/v6.26.0/xmrig-6.26.0-linux-static-x64.tar.gz*' - '*https://release-assets.githubusercontent.com/github-production-release-asset/88327406/ecfabc02-9e68-4cec-a6d1-a0e7773d900e?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-05-07T10%3A13%3A53Z&rscd=attachment%3B+filename%3Dxmrig-6.26.0-linux-static-x64.tar.gz&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-05-07T09%3A13%3A04Z&ske=2026-05-07T10%3A13%3A53Z&sks=b&skv=2018-11-09&sig=tqkUB8UR8dDaWsq4EPd8gk73jfcczAUzxFvWcl1k7Ks%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3ODE0NTU3MiwibmJmIjoxNzc4MTQ1MjcyLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.AoUYU6vHNh7_Rqn7cD0BnhiAUg92Hu2skK6zWJr2qBg&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.26.0-linux-static-x64.tar.gz&response-content-type=application%2Foctet-stream*' - '*http://106.14.58.169:60145/linux*' - '*https://sistemasyusa.icu/admin/productimages/unkillbot_x86_64*' - '*http://221.15.15.204:47329/i*' - '*http://112.248.22.180:39279/i*' - '*http://182.122.238.5:52461/i*' - '*http://195.177.94.72:3594/t/kal64*' - '*http://27.44.147.57:59459/bin.sh*' - '*http://38.137.250.91:35423/i*' - '*http://37.48.254.120/arm7%20-O%20/tmp/arm7*' - '*http://27.215.179.89:43720/i*' - '*http://195.177.94.72:3594/s/kswpad*' - '*http://83.168.69.141/sh4*' - '*http://210.8.142.189:51232/i*' - '*http://82.86.65.140:53909/i*' - '*http://159.203.181.169:7452/linux*' - '*http://91.196.32.55/release/dlr.ppc*' - '*http://42.87.110.50:36534/bin.sh*' - '*http://88.85.199.186:35073/bin.sh*' - '*http://125.47.70.246:46454/bin.sh*' - '*http://182.176.116.4:33388/i*' - '*http://124.95.27.115:35134/bin.sh*' - '*http://124.131.136.156:39021/i*' - '*http://61.216.48.105:60961/i*' - '*http://177.22.88.133:8080/.x/pax.txt*' - '*http://113.237.63.22:56535/i*' - '*http://216.167.26.154:1337/bot.py*' - '*http://37.232.219.81:58602/i*' - '*http://110.37.32.51:45529/i*' - '*http://venom.rotero.vc/mot*' - '*http://115.50.24.219:46717/i*' - '*http://204.116.34.34:39881/i*' - '*http://46.236.65.142:42054/i*' - '*http://113.228.134.22:50099/i*' - '*http://220.180.99.71:60105/linux*' - '*http://31.25.28.110:51445/i*' - '*http://125.42.41.80:44594/i*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arc*' - '*http://126.76.103.220:37207/i*' - '*http://120.77.237.174:7494/linux*' - '*https://raw.githubusercontent.com/mahdiMGF2/botmirzapanel/main/install.sh*' - '*http://27.44.147.57:59459/i*' - '*http://113.237.133.146:46175/i*' - '*http://182.118.245.231:49078/i*' - '*http://5.202.46.59:57264/i*' - '*https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-linux-x64.tar.gz*' - '*http://115.55.241.127:38210/bin.sh*' - '*http://107.190.130.2/zed*' - '*https://pastefy.app/5KBTIGfN/raw*' - '*http://115.52.238.183:36452/i*' - '*http://109.236.44.113:47095/bin.sh*' - '*http://176.193.95.152:54903/bin.sh*' - '*http://119.179.248.219:38911/i*' - '*https://www.dra.com.ve/wp-content/languages/plugins/ds5.txt)*' - '*http://77.90.185.28/mot*' - '*http://110.36.77.19:49305/bin.sh*' - '*https://github.com/kryptex-miners-org/kryptex-miners/releases/download/lolminer-1-98a/lolMiner_v1.98a_Lin64.tar.gz*' - '*http://39.81.37.15:40232/i*' - '*http://110.36.80.162:51552/i*' - '*http://120.222.159.43/syss*' - '*http://180.76.137.37:60135/linux*' - '*http://195.177.94.72:3594/b/kswpad*' - '*http://31.170.22.205/dl601*' - '*http://194.238.79.215:22/6zmH9qt2?VjCN9t7=GR*' - '*http://39.74.83.192:39533/bin.sh*' - '*http://119.179.254.52:57194/i*' - '*http://105.225.83.20:45207/i*' - '*http://72.194.227.46:46986/i*' - '*http://42.55.49.152:38131/bin.sh*' - '*http://112.225.114.172:46225/i*' - '*http://125.43.228.202:38024/bin.sh*' - '*http://113.237.98.82:45619/bin.sh*' - '*http://185.242.3.96/dropper.sh*' - '*https://pastefy.app/7ft24YRx/raw)/*' - '*http://182.116.34.84:44018/bin.sh*' - '*http://115.52.121.91:41466/i*' - '*http://221.15.15.204:47329/bin.sh*' - '*http://42.7.240.14:46174/bin.sh*' - '*http://83.168.69.141/sparc*' - '*http://110.39.237.185:54089/i*' - '*http://172.245.148.28:9950/linux*' - '*http://123.14.253.226:44829/i*' - '*http://91.196.32.55/release/dlr.arm6*' - '*http://hackerai.co/*' - '*http://123.234.150.188:39289/i*' - '*http://185.9.139.117:43976/i*' - '*http://110.37.10.113:44933/i*' - '*http://91.196.32.55/release/dlr.sh4*' - '*http://98.252.87.232:48121/i*' - '*http://182.117.107.220:49098/i*' - '*http://110.36.25.33:49089/i*' - '*http://42.87.110.50:36534/i*' - '*http://115.51.32.177:42311/i*' - '*http://47.113.113.162:60122/linux*' - '*http://195.177.94.72:3594/b/amd64*' - '*http://110.37.76.236:35351/Mozi.m*' - '*http://183.11.226.207:7125/linux*' - '*http://163.142.92.39:50864/i*' - '*http://123.8.28.66:41963/i*' - '*http://113.231.233.62:60585/i*' - '*http://124.131.58.223:46191/i*' - '*http://175.174.91.18:40312/i*' - '*http://175.146.153.129:51494/bin.sh*' - '*http://43.252.159.117:47232/i*' - '*http://182.116.34.84:44018/i*' - '*http://147.182.224.216/des*' - '*http://85.12.205.35:42988/bin.sh*' - '*http://123.5.171.18:54921/bin.sh*' - '*http://194.238.79.215:22/AQxPUO2J13NgF?JAFpEdNM=cAGs*' - '*http://115.52.121.91:41466/bin.sh*' - '*http://39.108.72.32:9177/linux*' - '*http://nossl.segfault.net/ssh-it-deploy.sh*' - '*http://194.238.79.215:22/0rG1EPq6?yPEH4dqh=DKpx*' - '*http://43.252.159.79:51512/i*' - '*http://195.177.94.72:3594/s/linux*' - '*http://221.1.226.113:53898/i*' - '*http://110.37.85.150:43109/i*' - '*http://147.182.224.216/max*' - '*http://46.236.65.141:58189/i*' - '*http://91.196.32.55/release/dlr.m68k*' - '*http://59.110.9.189:9684/linux*' - '*http://123.14.86.29:47055/i*' - '*http://119.118.245.179:48407/i*' - '*http://1.222.167.7:2405/i*' - '*http://182.121.72.50:38226/i*' - '*http://83.168.69.141/m68k*' - '*http://27.37.103.182:39139/bin.sh*' - '*http://121.158.55.2:3931/i*' - '*http://117.146.92.46:35129/i*' - '*http://77.90.185.39/dots*' - '*http://110.37.118.111:34504/bin.sh*' - '*http://112.229.203.112:37340/i*' - '*http://47.103.197.73:6288/linux*' - '*http://85.12.205.35:42988/i*' - '*http://194.238.79.215:22/AlDmQ0VWeP8?ifbkQo2=IWZ*' - '*http://204.116.34.34:39881/bin.sh*' - '*https://curlservice.com/download/install-agent.sh*' - '*http://115.63.84.79:53096/bin.sh*' - '*http://91.196.32.55/release/dlr.arm5*' - '*http://115.50.217.82:54037/i*' - '*http://194.238.79.215:22/4QyNx?oJtCyP4=Ti16*' - '*http://43.245.39.42:53867/i*' - '*http://194.238.79.215:22/BVO2DWpHuFc0?7bNQaG=lEo14*' - '*http://151.242.30.40/loader.sh*' - '*http://84.201.25.69/dot*' - '*http://110.36.77.19:49305/i*' - '*http://195.177.94.72:3594/t/amd64*' - '*http://31.77.227.104/shitmloversishere.sh*' - '*https://raw.githubusercontent.com/jokowiajg623/do/refs/heads/main/passwd.sh*' - '*http://182.124.253.109:56188/i*' - '*http://108.170.136.155:60430/i*' - '*http://195.177.94.72:3594/t/kswpad*' - '*http://115.50.217.82:54037/bin.sh*' - '*http://147.182.224.216/kes.pl*' - '*http://110.36.12.61:48489/i*' - '*http://110.36.2.23:33298/i*' - '*http://109.236.44.113:47095/i*' - '*https://filmchill.net/chrono*' - '*http://106.15.6.205:9030/linux*' - '*http://46.236.65.141:58189/bin.sh*' - '*http://36.36.197.20:38356/bin.sh*' - '*http://115.50.168.252:40017/bin.sh*' - '*http://112.232.60.36:44141/i*' - '*http://221.1.226.113:53898/bin.sh*' - '*http://123.5.171.18:54921/i*' - '*http://108.168.10.70:51473/bin.sh*' - '*https://tpkpolus.ru/wp-content/plugins/dvgfltm/onelife/loader.sh*' - '*http://182.119.230.69:32999/i*' - '*http://220.134.84.236:36135/i*' - '*https://github.com/xmrig/xmrig/releases/download/v6.25.0/xmrig-6.25.0-linux-static-x64.tar.gz*' - '*http://110.37.85.150:43109/bin.sh*' - '*http://101.133.172.172:7147/linux*' - '*https://ssc.nexajs.com/setup.sh*' - '*http://147.182.224.216/bss*' - '*http://221.15.186.144:42073/bin.sh*' - '*http://178.238.27.138:48994/i*' - '*http://115.55.241.127:38210/i*' - '*http://38.179.101.160:35971/i*' - '*http://177.22.88.133:8080/.x/sys_users*' - '*http://207.34.149.169:34385/i*' - '*http://183.159.218.169:51266/i*' - '*http://195.177.94.72:3594/s/kal64*' - '*http://178.208.248.77:55949/bin.sh*' - '*http://110.36.80.162:51552/bin.sh*' - '*http://27.215.108.44:35834/i*' - '*http://182.114.34.162:50206/bin.sh*' - '*http://195.177.94.72:3594/s/amd64*' - '*http://115.49.4.159:41971/bin.sh*' - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i486*' - '*http://113.231.233.62:60585/bin.sh*' - '*http://43.245.39.127:43496/i*' - '*http://88.85.199.186:35073/i*' - '*http://113.238.96.14:50295/i*' - '*http://221.15.187.87:44407/i*' - '*http://209.99.186.235/api/beacon?k=n4d-2ff16c75b1d2&h=ipcam*' - '*http://60.205.248.70:6352/linux*' - '*http://113.233.224.20:44021/bin.sh*' - '*http://113.237.133.146:46175/bin.sh*' - '*http://188.121.201.22:55724/bin.sh*' - '*http://89.189.181.54:35016/bin.sh*' - '*http://178.208.248.77:55949/i*' - '*http://123.188.73.21:40312/i*' - '*https://github.com/R00tS3c/DDOS-RootSec/raw/refs/heads/master/DDOS%20Scripts/AMP%20Methods/DNP%20Amplification/d.c*' - '*http://83.168.69.141/arc*' - '*http://120.222.159.43/amd*' - '*http://91.196.32.55/release/dlr.mips*' - '*http://118.190.161.42:60129/linux*' - '*http://123.11.243.157:52735/i*' - '*http://112.247.87.36:50709/i*' - '*http://195.177.94.72:3594/b/linux*' - '*http://124.131.136.156:39021/bin.sh*' - '*http://78.38.19.88:35262/i*' - '*http://110.38.208.89:56622/bin.sh*' - '*https://download1532.mediafire.com/21oatf109angbYHS_5E13zp2tv1nrhFnvJ0gg1xu8cNiNYmpQsqQwVIBDhtgZbv502QKPRty_f7v0Q1YDIezAPki058YoTyUvQlPPV9imHcjinAmWK9TX8k4_hyBIdy1VXZlUYZsvrAIT9T28Ci2sqpYM_8WaPe4Cldt3koHikpZbNg/efqgjl6i8zrh9vw/x86*' - '*http://43.252.159.101:43938/i*' - '*http://89.189.181.54:35016/i*' - '*http://125.46.149.240:44327/i*' - '*http://124.95.27.115:35134/i*' - '*http://91.196.32.55/release/dlr.mpsl*' - '*http://113.238.96.14:50295/bin.sh*' - '*http://78.38.16.176:38479/i*' - '*http://83.168.69.141/powerpc*' - '*http://123.8.155.232:33297/i*' - '*https://femboy.center/FEMBOYSec-Intelligence-Team/sdsjkasndjaskdnaskjdnaskjdnaskjdnaskjdnakjdnasjdnasjnasdkjdnaskd/FEMBOYSe.c*' - '*http://115.50.168.252:40017/i*' - '*http://120.84.215.97:39888/i*' - '*https://pastefy.app/5KBTIGfN/raw)/*' - '*http://123.12.236.117:57801/bin.sh*' - '*http://178.238.27.138:48994/bin.sh*' - '*http://47.115.37.164:60137/linux*' - '*http://110.37.25.189:45750/bin.sh*' - '*http://123.12.27.213:44894/i*' - '*https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-linux-static-x64.tar.gz*' - '*http://82.197.93.215/cp*' - '*http://27.202.20.139:40967/i*' - '*http://60.170.253.77:60105/linux*' - '*http://119.179.254.52:57194/bin.sh*' - '*http://110.37.118.111:34504/i*' - '*https://pastefy.app/7ft24YRx/raw)*' - '*http://27.156.155.98:39152/bin.sh*' - '*http://163.142.94.183:60512/bin.sh*' - '*http://126.76.103.220:37207/bin.sh*' - '*http://91.196.32.55/Zehir.sh*' - '*http://119.179.249.223:48082/i*' - '*http://43.245.39.127:34590/i*' - '*http://125.44.188.95:41419/i*' - '*http://123.8.155.232:33297/bin.sh*' - '*http://195.177.94.72:3594/b/kal64*' - '*http://123.129.128.50:55611/i*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 2 id: f0f1da02-f953-5e15-a98f-7a14254d6f5d status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 2). logsource: category: proxy detection: selection: c-uri: - '*http://31.77.227.104/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i686*' - '*http://115.51.32.177:42311/bin.sh*' - '*http://176.193.95.152:54903/i*' - '*http://112.248.187.137:46314/bin.sh*' - '*http://182.124.253.109:56188/bin.sh*' - '*http://91.143.172.196:57666/i*' - '*https://pastefy.app/7ft24YRx/raw*' - '*http://221.15.186.144:42073/i*' - '*http://106.54.223.106/phpmyadmin/setup/lib/888.sh*' - '*http://43.252.159.100:51638/i*' - '*http://110.36.12.61:48489/bin.sh*' - '*http://125.47.70.246:46454/i*' - '*http://115.59.239.53:39489/i*' - '*http://78.25.170.214:39654/i*' - '*http://197.255.229.88:1987/favico.ico*' - '*http://tpkpolus.ru/wp-content/plugins/dvgfltm/onelife/loader.sh*' - '*http://164.215.103.113:6996/pikujyhtcxz/loader.sh*' - '*http://2.187.38.183:45336/i*' - '*http://110.37.25.189:45750/i*' - '*https://dl.proxiespool.wiki/25730http2flooder.zip*' - '*http://116.162.55.77:10000/*' - '*https://dl.proxiespool.wiki/1.zip*' - '*https://raw.githubusercontent.com/gkbrk/slowloris/master/slowloris.py*' - '*https://download.bt.cn/install/install_panel.sh*' - '*https://dl.proxiespool.wiki/0.zip*' - '*https://free.tiurl.top/setup.sh*' - '*http://47.76.79.220:60141/linux*' - '*https://github.com/hackerschoice/gsocket/releases/download/v1.4.43/gs-netcat_linux-x86_64*' - '*https://github.com/xmrig/xmrig/releases/download/v6.24.0/xmrig-6.24.0-linux-static-x64.tar.gz*' - '*http://147.182.224.216/red*' - '*http://91.199.45.108/?q={random.randint(1,1000000)}&rnd={random.random()}*' - '*http://91.199.45.108:80*' - '*http://91.199.45.108*' - '*https://11-4xt.pages.dev/apt*' - '*http://162.251.62.103*' - '*https://github.com/hamerderta/lzxhcjhsdajfslfgdsgh/releases/download/malware/xeno.V1.3.55.exe*' - '*https://kemaxglobalshippings.com/Psl.zip*' - '*https://ufavalkplus.com/wp-admin/bin.exe*' - '*http://110.37.84.212:50663/bin.sh*' - '*http://192.162.199.78/public_files/VjIFy5P.txt*' - '*http://42.228.103.211:38030/i*' - '*https://hindustanagency.com/3.exe*' - '*http://182.115.185.8:58576/i*' - '*http://110.37.64.31:60162/bin.sh*' - '*http://62.60.226.140/files/7782139129/QsXEP8I.exe*' - '*http://219.157.51.222:34177/i*' - '*http://5.182.210.61/463bc8*' - '*http://5.182.210.61/45b5ab*' - '*http://5.182.210.61/193fbf*' - '*http://5.182.210.61/4e7801*' - '*http://5.182.210.61/eb6627*' - '*http://5.182.210.61/2b88f1*' - '*http://5.182.210.61/ae1b25*' - '*http://5.182.210.61/716d57*' - '*http://5.182.210.61/93e25d*' - '*http://182.118.244.55:36915/i*' - '*http://5.182.210.61/56708e*' - '*http://5.182.210.61/8f0b0c*' - '*http://5.182.210.61/e04648*' - '*http://182.118.244.55:36915/bin.sh*' - '*http://182.121.204.65:58922/i*' - '*http://182.121.204.65:58922/bin.sh*' - '*https://1d2ef215ce65986951fe48e70c16d6d4.r2.cloudflarestorage.com/my-files/5.msi?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=6483d30e4e635518dc3375a0d3ab56a6/20260727/auto/s3/aws4_request&X-Amz-Date=20260727T191829Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=a9992d87e82deb0062b4299448b1050236e325aeaef616a16debb9690a8ca832*' - '*https://orienttaxtile.com/weds/crypted.ps1*' - '*http://123.12.229.234:36096/i*' - '*http://182.116.38.123:33625/i*' - '*http://182.116.38.123:33625/bin.sh*' - '*http://42.229.163.26:43881/i*' - '*http://119.179.253.64:33876/bin.sh*' - '*http://42.229.163.26:43881/bin.sh*' - '*http://59.97.251.121:39714/bin.sh*' - '*http://221.15.14.213:38445/i*' - '*http://178.16.54.109/16.exe*' - '*http://175.166.39.238:54134/bin.sh*' - '*http://123.11.15.19:59770/i*' - '*http://221.15.14.213:38445/bin.sh*' - '*http://182.127.58.250:59093/i*' - '*http://2.177.76.111:52967/i*' - '*http://219.154.78.241:55576/i*' - '*http://182.127.58.250:59093/bin.sh*' - '*http://219.156.17.95:54845/bin.sh*' - '*http://123.8.28.66:41963/bin.sh*' - '*http://61.53.99.227:39335/bin.sh*' - '*http://61.52.7.114:43442/i*' - '*http://61.52.7.114:43442/bin.sh*' - '*http://61.52.89.194:38198/bin.sh*' - '*http://125.41.5.24:59925/i*' - '*http://222.138.78.28:58707/bin.sh*' - '*http://42.234.235.135:44027/bin.sh*' - '*http://115.55.46.154:38247/bin.sh*' - '*http://125.47.209.21:53999/bin.sh*' - '*http://120.84.212.124:46261/bin.sh*' - '*http://182.122.238.5:52461/bin.sh*' - '*http://115.52.241.0:42092/i*' - '*http://115.52.241.0:42092/bin.sh*' - '*http://27.215.124.45:58615/bin.sh*' - '*http://37.52.153.132:32934/bin.sh*' - '*http://110.36.15.1:48651/bin.sh*' - '*http://115.63.32.249:39602/bin.sh*' - '*http://110.36.15.1:48651/i*' - '*http://61.53.99.227:39335/i*' - '*http://115.63.32.249:39602/i*' - '*http://123.11.10.208:37180/i*' - '*http://115.54.175.252:34283/i*' - '*http://123.11.10.208:37180/bin.sh*' - '*http://125.47.209.21:53999/i*' - '*http://125.43.228.202:38024/i*' - '*http://110.37.30.28:44380/i*' - '*http://222.142.220.59:50033/i*' - '*http://62.60.226.140/files/8646908407/oVRg7dS.exe*' - '*http://62.60.226.140/files/7782139129/tbXaQZF.exe*' - '*https://hindustanagency.com/2.exe*' - '*http://157.245.34.109:8080/update.cmd*' - '*http://144.31.148.204/sdYUSAgyisdfdYGUFS*' - '*https://pub-45a83f302a1943ed8d62418c2af947ef.r2.dev/ttt.png*' - '*https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/hGziy*' - '*https://sunix-technology.com/admin/niceimg_122852.png*' - '*https://sunix-technology.com/admin/newMSI_PRO.png*' - '*https://fine-work-team.com/6272*' - '*http://62.60.226.140/files/5851730241/zxnBt4G.exe*' - '*http://reservphotoinstaynow.shop/*' - '*https://res.cloudinary.com/dun0uclxi/image/upload/v1785205268/img_191949_mvcfdt.jpg*' - '*http://129.121.110.105/fqAz*' - '*http://129.121.110.105/YI8*' - '*http://129.121.110.105/2rL1*' - '*http://129.121.110.105/Sa0*' - '*http://129.121.110.105/s9W*' - '*http://222.142.220.59:50033/bin.sh*' - '*https://cuttingedgefencing.ca/odot/download.php*' - '*http://222.137.85.152:55205/i*' - '*http://182.121.197.90:57398/i*' - '*http://182.121.197.90:57398/bin.sh*' - '*http://222.137.85.152:55205/bin.sh*' - '*http://123.11.15.96:57440/bin.sh*' - '*http://178.66.229.151:47258/i*' - '*http://39.87.15.172:39137/i*' - '*http://178.66.229.151:47258/bin.sh*' - '*http://219.157.153.223:59732/i*' - '*http://125.40.86.16:47732/i*' - '*http://182.126.84.5:50897/i*' - '*http://219.157.153.223:59732/bin.sh*' - '*http://123.9.244.135:59466/bin.sh*' - '*http://61.53.75.251:59632/i*' - '*http://125.40.86.16:47732/bin.sh*' - '*http://115.63.201.204:60388/bin.sh*' - '*http://27.213.145.140:54344/i*' - '*http://125.45.58.188:34980/bin.sh*' - '*http://27.213.145.140:54344/bin.sh*' - '*http://182.119.163.66:49885/i*' - '*http://182.119.163.66:49885/bin.sh*' - '*http://61.53.85.165:50764/bin.sh*' - '*http://37.52.153.132:32934/i*' - '*http://85.108.65.212:50272/i*' - '*http://125.43.18.233:33659/i*' - '*http://123.12.27.213:44894/bin.sh*' - '*http://85.108.65.212:50272/bin.sh*' - '*http://27.215.77.0:37447/bin.sh*' - '*http://123.7.220.246:56408/bin.sh*' - '*http://115.49.202.73:57357/i*' - '*http://219.156.41.53:40923/i*' - '*http://42.54.83.67:37559/i*' - '*http://119.167.3.49:55650/bin.sh*' - '*http://115.49.202.73:57357/bin.sh*' - '*http://219.156.41.53:40923/bin.sh*' - '*http://42.225.69.32:47660/i*' - '*http://61.54.43.141:40215/i*' - '*http://42.225.69.32:47660/bin.sh*' - '*http://61.54.43.141:40215/bin.sh*' - '*https://breakneckridgefarm.com/payload.dat*' - '*https://breakneckridgefarm.com/p.dat*' - '*https://babydiapersinturkey.com/s.dat*' - '*http://178.16.55.240/corp_/a*' - '*http://5.182.210.61/548a4b*' - '*http://5.182.210.61/60972b*' - '*http://5.182.210.61/efdf59*' - '*http://5.182.210.61/847891*' - '*http://5.182.210.61/68cf32*' - '*http://5.182.210.61/e5149f*' - '*http://5.182.210.61/416c24*' - '*http://5.182.210.61/4f0ee7*' - '*http://5.182.210.61/f4213d*' - '*http://5.182.210.61/8918c0*' - '*http://5.182.210.61/b40728*' - '*http://5.182.210.61/e00c4f*' - '*http://5.182.210.61/af1816*' - '*http://5.182.210.61/ffc936*' - '*http://5.182.210.61/3f3707*' - '*http://5.182.210.61/13916c*' - '*http://5.182.210.61/1f75c8*' - '*http://5.182.210.61/c41752*' - '*http://5.182.210.61/1d7077*' - '*http://5.182.210.61/c55748*' - '*http://5.182.210.61/1f7e12*' - '*http://5.182.210.61/07add9*' - '*http://5.182.210.61/574f6b*' - '*http://5.182.210.61/6e493b*' - '*http://5.182.210.61/294511*' - '*http://5.182.210.61/30c219*' - '*http://5.182.210.61/2cf376*' - '*http://5.182.210.61/29dce8*' - '*http://5.182.210.61/e68974*' - '*http://5.182.210.61/774855*' - '*http://5.182.210.61/e5f05f*' - '*http://5.182.210.61/0a97c9*' - '*http://5.182.210.61/04c7aa*' - '*http://5.182.210.61/0c5ead*' - '*http://5.182.210.61/4b1651*' - '*http://5.182.210.61/361156*' - '*http://159.223.110.159/all.sh*' - '*http://91.92.242.236/files-129312398/files/file_d6c984cb6c46bf3c.exe*' - '*http://115.48.32.46:54570/bin.sh*' - '*http://115.55.62.51:51147/i*' - '*http://115.55.62.51:51147/bin.sh*' - '*http://125.47.237.231:60396/i*' - '*http://125.47.237.231:60396/bin.sh*' - '*http://222.138.149.25:37984/bin.sh*' - '*http://110.36.15.250:39555/i*' - '*http://27.215.126.188:58957/i*' - '*http://125.47.75.31:38821/i*' - '*http://110.36.15.250:39555/bin.sh*' - '*http://123.9.102.198:42427/i*' - '*http://115.62.150.8:33705/i*' - '*http://115.62.150.8:33705/bin.sh*' - '*http://110.37.4.69:36657/i*' - '*http://103.20.240.9/pinimg.png*' - '*https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/nDbnK*' - '*https://cryptefilea.infy.click/img_094830.png*' - '*https://heroestales.com/1.exe*' - '*http://119.179.255.108:50390/i*' - '*http://221.15.7.226:53425/i*' - '*http://221.15.7.226:53425/bin.sh*' - '*http://5.182.210.61/332a0c*' - '*http://5.182.210.61/b07ab1*' - '*http://5.182.210.61/f1ed24*' - '*http://5.182.210.61/2297af*' - '*http://5.182.210.61/2051fb*' - '*http://5.182.210.61/81d631*' - '*http://5.182.210.61/3cbe86*' - '*http://5.182.210.61/599506*' - '*http://5.182.210.61/2573fd*' - '*http://5.182.210.61/156c25*' - '*http://5.182.210.61/370ad5*' - '*http://5.182.210.61/2864e0*' - '*http://115.48.133.253:49007/i*' - '*http://115.48.133.253:49007/bin.sh*' - '*https://uafsoftware.in/yzKGWy.html*' - '*http://42.237.3.199:60716/i*' - '*http://60.212.121.42:58599/i*' - '*http://182.112.0.151:44947/i*' - '*http://101.59.79.119:40993/i*' - '*http://60.212.121.42:58599/bin.sh*' - '*https://roblox-xeno.net/uploads/Bootsexec64.zip*' - '*http://115.56.149.89:38790/i*' - '*http://115.56.149.89:38790/bin.sh*' - '*http://123.10.131.161:43807/i*' - '*https://media-aviation.run.place/qqFYNkCe/stego_g4dez65hk6.png*' - '*http://163.142.92.245:42822/i*' - '*http://222.134.164.39:49784/i*' - '*http://42.230.44.235:53498/bin.sh*' - '*http://110.37.14.156:55942/i*' - '*http://110.37.53.25:36181/i*' - '*http://110.37.68.65:46243/i*' - '*http://182.126.120.131:56874/i*' - '*http://24.54.95.49:58467/i*' - '*http://42.230.44.235:53498/i*' - '*http://124.29.194.115:54361/Mozi.a*' - '*http://116.76.255.32:35156/Mozi.m*' - '*http://83.177.220.128:33134/Mozi.a*' - '*https://github.com/wubejack-cmd/yopyop/releases/download/yop/Launcher.dmg*' - '*http://122.116.172.87:48027/i*' - '*http://24.54.95.49:58467/bin.sh*' - '*http://reservphotoinstay.one/*' - '*http://5.182.210.61/a58066*' - '*http://5.182.210.61/35ca8a*' - '*http://5.182.210.61/7f36d6*' - '*http://5.182.210.61/46d337*' - '*http://5.182.210.61/a33a57*' - '*http://5.182.210.61/f13ecd*' - '*http://5.182.210.61/5f6d8c*' - '*http://5.182.210.61/2e59c4*' - '*http://5.182.210.61/6e47c0*' - '*http://5.182.210.61/0a1285*' - '*http://5.182.210.61/3e6376*' - '*http://5.182.210.61/72f275*' - '*https://tenis-team-km.com/tenis-team-km.zip*' - '*http://123.134.47.18:41066/i*' - '*http://115.61.112.57:41776/i*' - '*http://219.155.83.61:41860/i*' - '*http://123.134.47.18:41066/bin.sh*' - '*http://115.61.112.57:41776/bin.sh*' - '*http://110.36.1.200:42015/i*' - '*http://42.178.135.78:48726/i*' - '*http://110.36.1.200:42015/bin.sh*' - '*http://110.36.15.218:52926/bin.sh*' - '*http://42.178.135.78:48726/bin.sh*' - '*http://219.155.83.61:41860/bin.sh*' - '*http://27.206.131.190:40981/bin.sh*' - '*http://175.147.154.140:40485/bin.sh*' - '*http://123.11.172.243:59690/i*' - '*http://125.44.19.78:54105/bin.sh*' - '*http://221.15.15.188:48560/bin.sh*' - '*http://27.215.77.0:37447/i*' - '*http://110.37.108.39:34859/i*' - '*http://61.53.147.48:44702/i*' - '*http://182.121.82.226:49051/i*' - '*http://182.112.29.57:60054/bin.sh*' - '*http://182.126.180.81:42718/i*' - '*http://221.15.191.13:38155/i*' - '*http://182.126.180.81:42718/bin.sh*' - '*http://125.44.34.3:57095/i*' - '*http://182.116.34.54:52262/bin.sh*' - '*http://182.127.3.76:52608/i*' - '*http://110.38.214.61:56577/i*' - '*http://182.127.3.76:52608/bin.sh*' - '*http://125.44.34.3:57095/bin.sh*' - '*http://115.50.69.215:47140/bin.sh*' - '*http://42.224.85.143:49216/i*' - '*http://5.182.210.61/1da144*' - '*http://5.182.210.61/305fff*' - '*http://5.182.210.61/ec7f34*' - '*http://5.182.210.61/2f2c84*' - '*http://5.182.210.61/090c4c*' - '*http://5.182.210.61/905c95*' - '*http://5.182.210.61/60bf57*' - '*http://5.182.210.61/d930ad*' - '*http://5.182.210.61/c6f42c*' - '*http://5.182.210.61/0faa38*' - '*http://5.182.210.61/c0db3a*' - '*http://5.182.210.61/acba5d*' - '*http://42.224.85.143:49216/bin.sh*' - '*http://182.113.45.237:49587/i*' - '*http://163.142.93.247:42822/i*' - '*http://110.36.86.148:37106/i*' - '*http://192.162.199.78/public_files/AvLeMQb.txt*' - '*http://61.52.159.127:52647/bin.sh*' - '*https://broadwalkindia.com/1.exe*' - '*http://64.89.163.215/ipmiv2.xml*' - '*http://115.63.230.144:33297/i*' - '*http://45.94.47.226/cursor*' - '*http://105.184.18.189:43225/bin.sh*' - '*http://5.182.210.61/fe4ca4*' - '*http://5.182.210.61/27976f*' - '*http://5.182.210.61/91b24a*' - '*http://5.182.210.61/92cc1f*' - '*http://5.182.210.61/ea2ba2*' - '*http://5.182.210.61/635745*' - '*http://5.182.210.61/70f214*' - '*http://5.182.210.61/d35236*' - '*http://5.182.210.61/8365ed*' - '*http://5.182.210.61/2a6676*' - '*http://5.182.210.61/e6e76d*' - '*http://5.182.210.61/e6381a*' - '*http://5.182.210.61/76fe4e*' - '*http://5.182.210.61/d12003*' - '*http://5.182.210.61/d1e4e6*' - '*http://5.182.210.61/dcce92*' - '*http://5.182.210.61/e77be8*' - '*http://5.182.210.61/9989a1*' - '*http://5.182.210.61/fb6e84*' - '*http://5.182.210.61/e6873a*' - '*http://5.182.210.61/cf8b70*' - '*http://5.182.210.61/b07b84*' - '*http://5.182.210.61/5f7fe7*' - '*http://5.182.210.61/bf96dc*' - '*http://129.121.110.105/QAK*' - '*http://129.121.110.105/g9zj*' - '*http://129.121.110.105/YBR*' - '*http://129.121.110.105/1un*' - '*http://129.121.110.105/HMXW*' - '*http://91.92.242.236/files-129312398/files/file_f037712e757a5b4c.exe*' - '*https://158.94.209.17/Yipibul*' - '*http://219.156.105.152:51559/bin.sh*' - '*http://42.232.103.253:39629/i*' - '*http://42.230.54.12:34745/i*' - '*http://2.58.56.170:8080/payload.tgz*' - '*http://42.230.54.12:34745/bin.sh*' - '*http://178.128.151.248/update.bin*' - '*http://46.236.65.230:45153/bin.sh*' - '*http://123.5.144.53:54738/i*' - '*http://181.79.85.69:8614/i*' - '*http://112.248.155.45:45383/bin.sh*' - '*http://181.79.85.69:8614/bin.sh*' - '*http://2.187.249.41:50886/i*' - '*http://31.56.209.70/bins/xnxnxnxnxnxnxnxnaarch64xnxn*' - '*http://31.56.209.70/bins/xnxnxnxnxnxnxnxni386xnxn*' - '*http://31.56.209.70/bins/xnxnxnxnxnxnxnxnloongarch64xnxn*' - '*http://31.56.209.70/bins/xnxnxnxnxnxnxnxnm68kxnxn*' - '*https://pub-da43c68507c44a0f89782831aed83484.r2.dev/0e649edddaf-12.msi*' - '*https://pub-272fd20f9e3d49d5864e441b0c7a4fb8.r2.dev/L2-17-1-WRK-JSDH.msi*' - '*https://pub-991af6d525914bda8f213aaa6c77e161.r2.dev/SC-2-RM-KJDS17-P.exe*' - '*https://pub-8a311f63df364529b264fa273304d2d9.r2.dev/L2-PRM-WRKSC.msi*' - '*https://dl.dropboxusercontent.com/scl/fi/rtn5r2ig6gqvsv2vasqbx/krypton-1.21.1-v15.jar?rlkey=q48p4pfjgt1ygsmd0moc6ihnv&st=qlzqzgsy*' - '*http://125.42.30.72:37218/i*' - '*http://42.227.0.122:47625/i*' - '*http://42.227.0.122:47625/bin.sh*' - '*http://125.42.30.72:37218/bin.sh*' - '*http://110.37.68.65:38450/i*' - '*http://123.8.47.4:60225/i*' - '*http://123.8.47.4:60225/bin.sh*' - '*http://182.116.80.226:45470/i*' - '*http://125.40.83.123:47230/bin.sh*' - '*http://78.165.115.123:50272/i*' - '*http://123.14.102.112:54726/i*' - '*http://182.126.249.0:50475/i*' - '*http://182.126.249.0:50475/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_26542a4270d4c3a5.exe*' - '*http://91.92.242.236/files-129312398/files/file_c7fcb2e3eb5326e6.exe*' - '*http://61.52.159.127:52647/i*' - '*http://91.92.242.236/files-129312398/files/file_2e5f4b42399cbea0.exe*' - '*http://110.36.25.33:43664/i*' - '*http://182.112.29.57:60054/i*' - '*https://cleenfoecleen22.com/cleen_trs1.exe*' - '*http://123.8.82.72:41082/i*' - '*http://221.15.11.99:49531/i*' - '*http://182.124.41.191:41705/i*' - '*http://182.124.41.191:41705/bin.sh*' - '*http://123.8.82.72:41082/bin.sh*' - '*http://182.113.193.242:56108/i*' - '*http://125.47.239.251:37472/i*' - '*http://115.55.218.131:33616/i*' - '*http://182.113.193.242:56108/bin.sh*' - '*http://125.43.107.168:57386/i*' - '*http://125.43.107.168:57386/bin.sh*' - '*http://115.55.218.131:33616/bin.sh*' - '*http://119.183.25.240:40130/i*' - '*http://14.0.131.161:53823/i*' - '*http://42.225.60.179:39180/i*' - '*http://125.47.34.218:35283/bin.sh*' - '*http://27.207.231.96:35454/bin.sh*' - '*http://115.57.60.150:53294/i*' - '*http://115.63.241.84:51474/i*' - '*http://115.56.157.26:40856/i*' - '*http://115.63.241.84:51474/bin.sh*' - '*http://115.57.60.150:53294/bin.sh*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/jTMHu*' - '*http://5.182.210.61/425e20*' - '*http://5.182.210.61/9700c7*' - '*http://5.182.210.61/b36640*' - '*http://5.182.210.61/5e69cf*' - '*http://5.182.210.61/fcbe11*' - '*http://5.182.210.61/b725d8*' - '*http://5.182.210.61/d42f5a*' - '*http://5.182.210.61/bf991a*' - '*http://5.182.210.61/2576b4*' - '*http://5.182.210.61/bbc647*' - '*http://5.182.210.61/3ac63b*' - '*http://5.182.210.61/dfcbd2*' - '*https://drive.google.com/uc?export=download&id=1Et9JUkcXhkVLaqgXWDXVzYLZKQGwl0bO*' - '*https://semprecardsecure.com/variants/variant_11.apk*' - '*http://5.182.210.61/05503f*' - '*http://5.182.210.61/a80f96*' - '*http://5.182.210.61/08481b*' - '*http://5.182.210.61/4e59cd*' - '*https://semprecardsecure.com/variants/variant_01.apk*' - '*https://semprecardsecure.com/variants/variant_12.apk*' - '*https://semprecardsecure.com/variants/variant_13.apk*' - '*https://semprecardsecure.com/variants/variant_05.apk*' - '*https://semprecardsecure.com/variants/variant_16.apk*' - '*https://semprecardsecure.com/variants/variant_03.apk*' - '*https://semprecardsecure.com/variants/variant_20.apk*' - '*https://semprecardsecure.com/variants/variant_17.apk*' - '*https://semprecardsecure.com/variants/variant_08.apk*' - '*https://semprecardsecure.com/variants/variant_04.apk*' - '*https://semprecardsecure.com/variants/variant_10.apk*' - '*https://semprecardsecure.com/variants/variant_06.apk*' - '*https://semprecardsecure.com/variants/variant_14.apk*' - '*https://semprecardsecure.com/variants/variant_07.apk*' - '*https://semprecardsecure.com/variants/variant_19.apk*' - '*https://semprecardsecure.com/variants/variant_02.apk*' - '*https://semprecardsecure.com/variants/variant_15.apk*' - '*https://semprecardsecure.com/variants/variant_09.apk*' - '*https://semprecardsecure.com/variants/variant_18.apk*' - '*http://bore.pub:6668/kapubot*' - '*http://222.140.182.83:51928/i*' - '*http://222.140.182.83:51928/bin.sh*' - '*http://125.45.48.19:38849/i*' - '*http://222.141.252.99:45146/i*' - '*http://221.15.147.147:37999/i*' - '*http://115.59.33.18:57465/i*' - '*http://115.55.225.239:35996/i*' - '*http://115.55.225.239:35996/bin.sh*' - '*http://62.60.226.140/files/8997935526/KQ1uX1d.bat*' - '*http://110.36.77.162:52593/i*' - '*http://110.36.77.162:52593/bin.sh*' - '*http://42.232.239.106:53746/i*' - '*http://42.232.239.106:53746/bin.sh*' - '*http://42.234.233.100:59738/i*' - '*http://42.234.233.100:59738/bin.sh*' - '*http://62.60.226.140/files/7559850987/hcXbK7A.exe*' - '*http://27.194.170.188:47698/i*' - '*http://27.194.170.188:47698/bin.sh*' - '*http://61.53.138.170:42460/i*' - '*http://77.236.74.65:43745/i*' - '*http://115.53.247.204:34385/i*' - '*http://77.236.74.65:43745/bin.sh*' - '*http://123.189.138.169:50295/i*' - '*http://61.53.138.170:42460/bin.sh*' - '*https://drive.google.com/uc?export=download&id=1hmv4jE4yoqoxD1AY-GLVrKhWLDFYpHsl*' - '*https://drive.google.com/uc?export=download&id=1Rhcgg7EaQrUIkjLvarbmj1TCBlLac2kS*' - '*https://pub-45a83f302a1943ed8d62418c2af947ef.r2.dev/jjj.png*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 3 id: 57a265e2-388b-56f9-8a04-c37d8f690b1d status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 3). logsource: category: proxy detection: selection: c-uri: - '*https://misty-cherry-cea3.uploadsimg.workers.dev/JRVVL*' - '*http://193.142.58.29/60/img_214748.png*' - '*http://107.173.143.56/xampp/MSI_PRO.png*' - '*http://112.248.163.115:59935/i*' - '*http://62.60.226.140/files/rdx/random.exe*' - '*http://110.39.239.253:52520/i*' - '*http://5.182.210.61/3d9525*' - '*http://5.182.210.61/ff249f*' - '*http://5.182.210.61/46318a*' - '*http://5.182.210.61/cbff42*' - '*http://5.182.210.61/b451e5*' - '*http://5.182.210.61/8fc4a8*' - '*http://5.182.210.61/e71574*' - '*http://5.182.210.61/c7510c*' - '*http://5.182.210.61/4ac21f*' - '*http://5.182.210.61/de3b50*' - '*http://5.182.210.61/616a18*' - '*http://5.182.210.61/db9a65*' - '*http://5.182.210.61/5a9313*' - '*http://5.182.210.61/16a477*' - '*http://5.182.210.61/c9c667*' - '*http://5.182.210.61/861d9d*' - '*http://5.182.210.61/1fde74*' - '*http://5.182.210.61/c36308*' - '*http://5.182.210.61/86c2fe*' - '*http://5.182.210.61/0a2607*' - '*http://5.182.210.61/921aba*' - '*http://5.182.210.61/6e3cdd*' - '*http://5.182.210.61/67e5dc*' - '*http://5.182.210.61/657761*' - '*http://5.182.210.61/c9aac4*' - '*http://5.182.210.61/e9a935*' - '*http://5.182.210.61/2c2a7c*' - '*http://5.182.210.61/479e00*' - '*http://5.182.210.61/fd2e2f*' - '*http://5.182.210.61/5110d4*' - '*http://5.182.210.61/7d1894*' - '*http://5.182.210.61/2397cd*' - '*http://129.121.110.105/Nlil*' - '*http://5.182.210.61/00f5fa*' - '*http://5.182.210.61/915582*' - '*http://129.121.110.105/dPU3*' - '*http://5.182.210.61/1caa7d*' - '*http://129.121.110.105/ZnY*' - '*http://129.121.110.105/Ah5*' - '*http://129.121.110.105/vCy*' - '*http://5.182.210.61/9d94af*' - '*https://softwarecdn.net/downloads/JCP_ENTREPRISE_da933e3a.exe*' - '*https://softwarecdn.net/downloads/McPherson_Rocamora_Nicholson_and_Hinkle_PLLC_02b45a00.exe*' - '*https://biltonuglimited2.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest*' - '*https://pub-3485d58cdced4843b5ee0f8b3be655c2.r2.dev/McPherson_Rocamora_Nicholson_and_Hinkle_PLLC.zip*' - '*https://policework2307zlo.vercel.app/?download=1*' - '*http://112.248.81.107:49525/i*' - '*http://27.219.137.55:46415/bin.sh*' - '*http://119.187.246.164:58458/i*' - '*http://119.187.246.164:58458/bin.sh*' - '*http://27.219.137.55:46415/i*' - '*http://115.48.146.47:51489/i*' - '*http://125.41.4.249:60482/i*' - '*http://219.155.17.245:57142/i*' - '*http://125.41.4.249:60482/bin.sh*' - '*http://62.60.226.140/files/8847994138/mkgO5wr.exe*' - '*http://125.44.220.50:54584/i*' - '*http://119.116.239.44:35093/i*' - '*http://119.116.239.44:35093/bin.sh*' - '*https://always-undetected.com/launches/XXM9V3ZP2EEOROO/a11ede7be1bb7732ffe370c06c2449f94f05b37f.exe*' - '*http://103.75.189.141/img_210452.png*' - '*https://always-undetected.com/launches/YL4KL92INBD3CET/96a59073b2b8979b8af96577f398dc37b81313c9.exe*' - '*https://always-undetected.com/launches/IGBZGJ0A0ZUE8TD/5af3a9ba934e306391239119006a360d7f81d053.exe*' - '*https://packetget.com/launches/QZ6UHO0BSD4L61F/3846d01d2740fe4b8138241fdb8b6a0e9f9f5bbc.exe*' - '*https://always-undetected.com/launches/HYWN6S2PSO9S821/5611f247d3b95bb26a0cf61fc4e1d0e49f50cab2.exe*' - '*https://always-undetected.com/launches/UZCWR27D2L42QTL/9ff8f73f6e5f0b09659251f57d9de6cf0231353d.exe*' - '*https://always-undetected.com/launches/CRQK8RLW6VN1UE1/2856de503f6b499bbfaec17089654696003112bc.exe*' - '*https://always-undetected.com/launches/VHT2G7KCJE3YEVT/39d5a541cdab7baa1778a3fcd6998770cb233524.exe*' - '*https://packetget.com/launches/FBFI1R0BT8CBMXM/3d225bceb5a7efd54ad401d1eb1b706930f8c5a5.exe*' - '*http://103.75.189.141/MSI_DWW.png*' - '*https://packetget.com/launches/QXX3UIOZS81E0JW/df71a9c04058b20b1a0465e1640d4dcd23e6fd73.exe*' - '*https://always-undetected.com/launches/JK1OWM8EELX5BWU/6998c8e268689f9f15c90a65d5aa35a03a921bcb.exe*' - '*https://packetget.com/launches/A497JWDML7SKSR5/42b955f63ff5a80c7d9fced0b38a8397e3b0dd07.exe*' - '*https://packetget.com/launches/MRVD7IIMUWXEV76/f7ce44dd3638351f7acf1eb997b14c5c6d76c325.exe*' - '*https://always-undetected.com/launches/I3F3DGBP8YFNLKI/9f8d56ef86326147df94f0dd40e3173fea4f4a29.exe*' - '*https://packetget.com/launches/XYUGR8RZWYJKZDK/d975c0ffa27d21f9eae02cb838e61324acd5fc6c.exe*' - '*https://always-undetected.com/launches/DA517V14XST9R45/f18bebfae65ba62028dc2adc652d65de06f59eb0.exe*' - '*https://packetget.com/launches/YUARE359ZQZ26MP/c19193f9b8ebf07bda15b04ed86a41cdf826d083.exe*' - '*https://always-undetected.com/launches/GRAL1K0GVJE4Q4G/080a48702d5b45b1616b4f736bdbd6f56c9951fb.exe*' - '*https://packetget.com/launches/EHN82T117RTC860/e5a8c87b0d1331cce621832d9be947878629dded.exe*' - '*https://always-undetected.com/launches/QC0SMMITMVSQC05/41d2a54eabff4aea219adfbbced8de869e673603.exe*' - '*https://always-undetected.com/launches/DSXGCJGL7ECB66O/4a777a0d4c32d407b3b48dd0bf29cf77af081998.exe*' - '*https://packetget.com/launches/XRHACRFXZR1AXFK/42b2ec2b94067fc487073988dde09b9eaaad3685.exe*' - '*https://cloudstorage-hub.com/launches/RSNJBHKR333FRHP/6cba58b5b78c74a05647653c1b3200a3e9f4578b.exe*' - '*https://always-undetected.com/launches/LAYIVSU1Q4AE84D/f55e1196ebb2b1665f2e59913af712a21c14e36d.exe*' - '*https://always-undetected.com/launches/GPCV2VDU2685YP4/8132cbe96d3baee4d7587c5d0e1a67c047e2ff97.exe*' - '*https://packetget.com/launches/Y6SZ9Y5LZXKCOCV/a005c6864965bf5fc7897defbe022e5eb128eed8.exe*' - '*https://always-undetected.com/launches/KXI09DGEK3EBZM8/cb6aa444a7e78cdf05f178939ce180f9642fa04f.exe*' - '*https://always-undetected.com/launches/PG30PC5WISA8EF5/4aa7026556690bde1f179f33aeae4b6d8e8bee0b.exe*' - '*https://always-undetected.com/launches/DO9GDU6R8F64RCU/91ccf8efef2677218097e427ffc47393b7fb33ed.exe*' - '*https://undetected-always.com/launches/MN9WUBKQDSM9GGT/5f29967d213b9de67857d94b279157bf1dddf1f9.exe*' - '*https://firebasestorage.googleapis.com/v0/b/dropfile-ff5b9-j0mm4/o/lovethiursdayLincoln.ps1?alt=media&token=b1fba6a1-799d-4b8b-8b14-d48f34e19bba*' - '*https://packetget.com/launches/X8C8OWBTAR74PDF/f4cdcd30fef4876e45a5605d2a3555f9e24a8528.exe*' - '*https://drive.google.com/uc?export=download&id=1uP6eeZrFYoO4FDTkMKWOHntx-Hx7ULJj*' - '*https://always-undetected.com/launches/0F7N6Q3W6CTRB1R/8ab80aa4601ecd91b16725d92046a7f1b106aa7e.exe*' - '*https://packetget.com/launches/NUU83HKTEN38VUM/8b1a7bf85e604e82b3343718bf4fba842b2d36b9.exe*' - '*https://always-undetected.com/launches/C63V2NAD96EWEA3/0cf8118c17eb50c48cc21642551ff37f5dfbccdb.exe*' - '*https://always-undetected.com/launches/865KNZ34KC2MRAX/950007e7709ff71b3a4ee648005cc913b30fa099.exe*' - '*https://always-undetected.com/launches/J1K5IEMLQHDBKJ6/b17b5e5383899b4e43d49c90ee89e02013cdc32b.exe*' - '*https://always-undetected.com/launches/KEO74X9XZZCT99K/6f89721c9cbb0446b6002fe82646d0a4b817bf09.exe*' - '*https://always-undetected.com/launches/XAOSPX1PIL799GL/a523cff45e023a31a98c0134262b6e5b2531a648.exe*' - '*https://undetected-always.com/launches/P0O9BO4OLMYZZIN/844f399ebc83c847d788b1e512183d187993d068.exe*' - '*https://always-undetected.com/launches/JHK9V9BCF3334ZE/6ce93929a60fd627702f7ac973d2dac3c6c78099.exe*' - '*https://always-undetected.com/launches/BXRZHHH2JP6535W/860178f2aa5d45f012531f67045c42264f1986c8.exe*' - '*https://always-undetected.com/launches/AIHEF2OL4C6W8MY/2832dfd71d903d0ed74679a360a7295eaecaa7d4.exe*' - '*https://always-undetected.com/launches/S3LPYKD3EMU39MA/f585634c0d19d94ba9b1d16f71dfa13389c11c91.exe*' - '*https://always-undetected.com/launches/YQKWXTFQLRHDUHG/60a2f10f96296830b9964262fd0916d814825169.exe*' - '*https://always-undetected.com/launches/NV2EIAIFEBXLCSH/b98f88dfbf8680e7644449a75c0aba2bbd3dcaaa.exe*' - '*https://packetget.com/launches/Z45CRO2U2HZMBE7/e2485807cbcd23ed8bed6681020edc0fa82a2cbe.exe*' - '*https://always-undetected.com/launches/8RB5KTD5PQEYRKG/df40159a22c3246a82ea621214e298f8839aca2a.exe*' - '*https://undetected-always.com/launches/ZR4XDCKC9G1MQ9I/bb8792fd03cc192fce0c967470becedd33fd7df5.exe*' - '*https://always-undetected.com/launches/CYW9HPSENM7ESIM/8ec64bb7171c9d11c716992bfaaf28d78b064a3d.exe*' - '*https://packetget.com/launches/UN2JDH9NBWKLKB7/e4e12fa078c8d52b31ca292f950f35fd7f638ead.exe*' - '*https://cloudstorage-hub.com/launches/S2CIBV53LXNGESC/12657712f87d167084c83305765023c250c76dc7.exe*' - '*https://cloudstorage-hub.com/launches/HR7KD85I58VE4BI/bf114213fe739599e7637b601ae64cea72b928f6.exe*' - '*https://packetget.com/launches/SF0ZN3LSLY3F3RG/ec4f5d6b6147d648a6cb43cbdb6eee4472c78c70.exe*' - '*https://packetget.com/launches/SX6RF8AI5IP7MXB/0230a1f9e51a1eec12499a400f83bf3dc6b221cb.exe*' - '*https://always-undetected.com/launches/8KTV8QQD58E1A8E/3c0c60494dd7f5f7bf8d476efc184b63a863f683.exe*' - '*https://always-undetected.com/launches/IB6G2XUX3QLJD1X/291c916cbd458fffb2d6dfe6a7bd42ae1052cfce.exe*' - '*https://always-undetected.com/launches/UZYE2VSQ7BEDJD4/aa41408253241b4ec900866a23bf01940fd1bec5.exe*' - '*https://always-undetected.com/launches/Y5TU60HDR9GGQPT/55d279ac4e2acd98776e1377a13da74d7eeef3cb.exe*' - '*https://always-undetected.com/launches/UC8LQ1EBN3YGMC0/492fd05bc88dc6fe9f67d71fbe03868a791d8cf8.exe*' - '*https://always-undetected.com/launches/13WR0PG6ZBDO4ZZ/d69476afe3e56206989c044e370b803af6883994.exe*' - '*https://packetget.com/launches/3A5DL5X4DLUE6WJ/690402c4215685bce5f3b4523b5fde8cc9758393.exe*' - '*https://packetget.com/launches/2YIPW8ZUN2KGEF2/38992527398fd4ee000ea1337de3a9f0ffa38110.exe*' - '*https://always-undetected.com/launches/I9K47K2ENM1MHCA/75d003486a1211d2899192df27c75a5c3846b401.exe*' - '*https://packetget.com/launches/ODLTES7X3GK6RUR/3c04622991dddbc31c259eb6a566fc0871dc5f51.exe*' - '*https://always-undetected.com/launches/JGVZWT65T5PJ0EJ/383ce1a249b3e89fe79521c81cee9325118eb49f.exe*' - '*https://always-undetected.com/launches/W7T02X6GNYNDWFF/d8acea97c1e8dd08de84a7b56eca7ff479c397e9.exe*' - '*https://always-undetected.com/launches/GEKU9KMMO886DS5/f0c2be4d55d3ee5da603caf9499d3f4103800796.exe*' - '*https://always-undetected.com/launches/RTY23TYECK6FVUV/8e5f72a48563479251914ffa1cde9f3438a967d8.exe*' - '*https://always-undetected.com/launches/GN1LVBGTZJ0ZVAS/326c93cd59879d9e3fccc9c25b6d0e84a7e53e2f.exe*' - '*https://always-undetected.com/launches/XVY2CBMA9DA2RZP/f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe*' - '*https://always-undetected.com/launches/9L6F9PPL6654JD6/4a4697b8a793337f02392bd83cb5e3c3bd786934.exe*' - '*https://packetget.com/launches/LW7S3PVEAYPEM5Z/72ae6b0641e30aa2ac1f6fc73ce6e0e306cbc180.exe*' - '*https://always-undetected.com/launches/YWU5LB0G35GSH7M/7600bb8dddf1909bdfb4e10b277f67ae9a92b6eb.exe*' - '*https://always-undetected.com/launches/PP7CXMO8Q4V6OFQ/235de2d1a09eb9f1a997530849bb3cc89b61119f.exe*' - '*https://always-undetected.com/launches/IYK4UK26JL2HQHA/2828d2c4a6bb6213fa05861eaccdd21e9c0619bd.exe*' - '*https://always-undetected.com/launches/S3259G3W35658F6/da38970eb1964f5d6635bd74906ad5981640d215.exe*' - '*https://always-undetected.com/launches/9E1KP7CH48PZSM6/e1e914bc687acd6a66a0dd937bbb012d661b0487.exe*' - '*http://115.63.50.113:53912/bin.sh*' - '*https://always-undetected.com/launches/RFRZJX1SIIYJK21/24aa27461eb99d324a500c20d182350d05273e81.exe*' - '*https://always-undetected.com/launches/A1DRWPYIOOT5KKN/0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe*' - '*https://always-undetected.com/launches/H7RH2V6D2FBUFHW/c312ea3379bd12897cbfe694b432223ffabb5753.exe*' - '*https://always-undetected.com/launches/TQZ008OOIQW9CB1/c8d4d8550513daebf5f66930a6ca890813617f43.exe*' - '*https://always-undetected.com/launches/H7ON5V0OLWA8A13/86625e37ce60b2b132e4ddc6ebcbe8804946b2cd.exe*' - '*https://cloudstorage-hub.com/launches/5C39OHQYHZF3OVY/c77dd496a870199d33c13a0f3fef50f011dd4f13.exe*' - '*https://cloudstorage-hub.com/launches/ZW4A8RJ2SNE6KF7/1feaad524f604230d4cf9803e9050a8fd1fe0358.exe*' - '*https://cloudstorage-hub.com/launches/09HWL43NZ6Q2TUE/3933eca3d2883f0995aab36f0c53f87aebfc595f.exe*' - '*https://cloudstorage-hub.com/launches/8EEZZTSI74ISYG3/9948164e8b1e938e00c89f937a12b897a8c08c1e.exe*' - '*https://cloudstorage-hub.com/launches/YOZP2U7WF8FVFJ3/7c199dfe5733e8f59769b1b1cc9b4f5add04089e.exe*' - '*https://always-undetected.com/launches/5468NGHNPJLSBD7/380a00f40fd3f56d9d7005182b19891841f10002.exe*' - '*https://undetected-always.com/launches/UBEY941RXJ8LPUT/259d5e4be2bcfd484cb72eac125d651ac7c52e5a.exe*' - '*https://always-undetected.com/launches/3IFFU70TIOYDAHU/ae76ed3729f4f1f5ba24280f07958d947ed203b0.exe*' - '*https://always-undetected.com/launches/1C65OYRB1LKBP7J/d38b28254a8300b383e07b82b1cf52829eeb89f4.exe*' - '*https://always-undetected.com/launches/81OV5M46UMMCVFJ/13711b1a1a1d137e38971439c9e6af83066e65a1.exe*' - '*https://always-undetected.com/launches/1BDU7YEGWQVE7Y9/87b03e80b07524c94d805f0c60e0c5b80f8a8da8.exe*' - '*https://always-undetected.com/launches/44GGU218UZJIP5N/ebeb97dd2813004e9f3819d069aae98d31f93078.exe*' - '*https://always-undetected.com/launches/73MCRL8B51KE04B/857a3e4fd7aeac690efc7a5d1820a1b274f3c2c3.exe*' - '*https://undetected-always.com/launches/7N8BHLWB7S2HS6W/d1961c9d9a74c3ad2e8547f92515a43ba14cd69b.exe*' - '*https://undetected-always.com/launches/LZ5X83TZPP3NRU4/0fa682ad100993c1935055a5cd6936223feff12b.exe*' - '*https://always-undetected.com/launches/31QVAJ7OSG8ZD2O/c4770837dd25568d369b368135c2dd084cabb675.exe*' - '*https://always-undetected.com/launches/3N1GCAIA376T5EL/979125dc40a536e3ad029d388bdf5619934d4271.exe*' - '*https://always-undetected.com/launches/7JE3ODDO1WRO7HH/18cd9cfbf2f0e896b59430c309d0ff12ecd23818.exe*' - '*https://undetected-always.com/launches/PK8HDC0L9T23H86/5c4e970974ae7855658dae0f7761b77fdae78d81.exe*' - '*https://undetected-always.com/launches/6ORJJ48DXDHX0ZF/b32d26298e998f1e2e91399e35a0a22ef5fb4567.exe*' - '*https://undetected-always.com/launches/O6AK8B9G8DPG1YG/d67e6ae1d34b03bffc121b5f6c6f7449be15364b.exe*' - '*https://undetected-always.com/launches/8JVWH30NUB5P4HD/354db487e61b17df2148adf9a70e26000602a3a8.exe*' - '*https://undetected-always.com/launches/JWUWSUB2PX952PM/ab388bc1f0635fa3c0cea9d57e2b7155119ca0ec.exe*' - '*https://undetected-always.com/launches/J7B75S0DJN2RVYJ/a17b0fd88915a1eb05f3a2c0987cfa45b5368ef1.exe*' - '*https://always-undetected.com/launches/7RLNS5YKVKSYU7O/10d1140834f07257e8d2f476a789e42819b30ab6.exe*' - '*https://always-undetected.com/launches/60DR2FENRDJX4S1/865fe58959d3dd47904f3091753667b8486012a0.exe*' - '*https://always-undetected.com/launches/6AC64UI1HX30XMD/be9d27849c4c302b4dfe65b2709988e0c352896f.exe*' - '*https://always-undetected.com/launches/03XPBIT61KFB1LM/e389dc966d42c7cf9ae97e00bcd8f94f0777f64d.exe*' - '*https://always-undetected.com/launches/11JO8CO7M5ZMHLQ/164a5ecd2b08a29e453600d9378a941e0ee939a8.exe*' - '*https://undetected-always.com/launches/E5L5NSVQKGHENZG/4e21e9c9ba1713a1ef2aee9c2d4df016c7ad7072.exe*' - '*https://always-undetected.com/launches/0EMA4JLGOYLOK4W/2c191363ea68140df531832ba123d698b1d56748.exe*' - '*https://always-undetected.com/launches/1GF8YABV16PMUDP/319f1b3495cd02507644bc7598f6566db3e8e7ee.exe*' - '*https://undetected-always.com/launches/DJESFRPT3SQ15GY/846578344ddc3d1385ceb5b631ee912c87bfac86.exe*' - '*https://always-undetected.com/launches/4XOP3ZYEMZW4YSU/52b9bbb9026165e0593c1791e9e7c3babdde55fd.exe*' - '*https://undetected-always.com/launches/K9G6AYG7HYXX4I3/0816ed6b8cefc1f99a6d0457ae8fc574ac4df8cb.exe*' - '*https://undetected-always.com/launches/32J7X3RG5N4JOT3/176778e1b34d4bf18b67e0208431237741f75255.exe*' - '*https://undetected-always.com/launches/TRVQU4LD6KPMNNY/9eefb2370f859fd1a83b2f074baf3aaba02af521.exe*' - '*https://always-undetected.com/launches/5RIJE8IAMBQKTNC/9d4cfc3e700aa9aaa40d18db8d7e912670578b21.exe*' - '*https://always-undetected.com/launches/26C12QS8LEMY78E/84b4a6719d32105eb76e5cc8c2ac8c4aef1f759d.exe*' - '*https://always-undetected.com/launches/0Y4ATWO5QWHZXV8/cbe043745bd41487bcc0ac26557a0262bfad5b25.exe*' - '*https://undetected-always.com/launches/TJU8JR9A1KTKCO3/1dff82d32565dfe58da620824b2596cc3f01844c.exe*' - '*https://undetected-always.com/launches/78DVC90S8II2AVG/14364d2b3a2683f1e90f58bad2981fb4b6d8e416.exe*' - '*https://undetected-always.com/launches/JUP6331XJY36KRN/8122011c5f910191302d968ef18429091f744c88.exe*' - '*https://always-undetected.com/launches/0GYXRAVN76SKHAL/2a2e29ee7d027bf6f2c5bf619bf4b63d69960ab9.exe*' - '*https://undetected-always.com/launches/VUM3RNXKGR6P6H4/acbe9a644834173f01de61f3b9a10878fa522a36.exe*' - '*https://pub-3e266bf2bf6b4d6299ab2e84824e6e80.r2.dev/PorProfiler3.msi*' - '*http://123.7.236.222:55776/bin.sh*' - '*http://182.119.57.249:43354/i*' - '*http://182.116.116.44:50607/i*' - '*http://182.116.116.44:50607/bin.sh*' - '*http://220.202.66.227:33265/i*' - '*http://193.31.201.20:53638/bin.sh*' - '*http://110.37.57.144:57092/i*' - '*http://27.215.48.232:38181/i*' - '*http://27.215.48.232:38181/bin.sh*' - '*http://42.239.144.5:56231/i*' - '*http://42.239.144.5:56231/bin.sh*' - '*http://62.60.226.140/files/801754686/fFofFj4.exe*' - '*http://62.60.226.140/files/7782139129/oiH8FPV.exe*' - '*http://123.7.240.199:39194/i*' - '*http://123.7.240.199:39194/bin.sh*' - '*http://182.120.11.86:50293/i*' - '*http://113.238.64.130:58713/bin.sh*' - '*http://61.53.72.74:60455/i*' - '*http://110.38.201.196:45114/i*' - '*http://115.63.50.101:40566/i*' - '*http://42.237.82.11:37448/i*' - '*http://115.63.50.101:40566/bin.sh*' - '*https://shell-node-7uxe.vercel.app/activator/windows?id=s*' - '*https://shell-node-7uxe.vercel.app/activator/windows?id=e*' - '*https://shell-node-7uxe.vercel.app/task/parser/windows?token=912*' - '*http://42.85.135.109:46174/bin.sh*' - '*https://pub-cc9d5dea66b0416b9dea589e3bdd8f2e.r2.dev/Safe-1.zip*' - '*http://110.36.16.143:35116/i*' - '*https://pub-7080e0c20a0e47ca95a476869c532367.r2.dev/libEGL.zip*' - '*http://124.29.223.148:41988/i*' - '*http://bore.pub:6668/deploy.zip*' - '*http://123.13.0.125:49649/bin.sh*' - '*http://115.63.50.113:53912/i*' - '*http://115.50.73.98:51034/i*' - '*https://cryptefilea.infy.click/img_064021.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/MczSa*' - '*http://115.50.73.98:51034/bin.sh*' - '*https://vjy888.com/zwev1nb/hamscid/yqagovc/MSI_PRODJ5TH.png*' - '*https://vjy888.com/zwev1nb/hamscid/yqagovc/sdy.png*' - '*https://cripter.xo.je/img_070139.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/lOYxX*' - '*http://119.117.157.236:43300/i*' - '*http://61.52.82.2:52366/i*' - '*http://125.40.39.31:55959/i*' - '*http://115.63.146.6:54046/i*' - '*http://125.40.39.31:55959/bin.sh*' - '*http://42.239.235.199:39303/i*' - '*http://115.57.199.189:44029/i*' - '*http://110.37.76.64:57726/i*' - '*http://115.57.199.189:44029/bin.sh*' - '*http://110.37.76.64:57726/bin.sh*' - '*https://xss.gumminessheap.in.net/jquery.uo.js*' - '*https://194.116.236.163/38/goodthinkgsforbetterwayscoming.hta/*' - '*https://194.116.236.163/aHR0cDovLzE5NC4xMTYuMjM2LjE2My8zOC9nb29kdGhpbmtnc2ZvcmJldHRlcndheXNjb21pbmcuaHRh.php/*' - '*http://194.116.236.163/aHR0cDovLzE5NC4xMTYuMjM2LjE2My8zOC9nb29kdGhpbmtnc2ZvcmJldHRlcndheXNjb21pbmcuaHRh.php*' - '*http://194.116.236.163/38/goodthinkgsforbetterwayscoming.hta/*' - '*http://194.116.236.163/img/img_184307.png/*' - '*https://194.116.236.163/37/newkingisbackgorbesttreatmentsneedforallthismethodsforfind.hta/*' - '*http://194.116.236.163/35/img_180337.png/*' - '*http://194.116.236.163/35/weneedbestthingsforeverywheretounderstand.hta/*' - '*http://194.116.236.163/http:/194.116.236.163/35/img_180337.png.php*' - '*http://61.53.75.206:44584/i*' - '*https://tangentwaves.com/moll.psm*' - '*http://108.181.197.32:8080/NL-Brute-TITAN.zip*' - '*http://42.235.80.131:51699/i*' - '*https://drive.google.com/uc?export=download&id=1U1bAZqvHkNDYfPoNmwWpJqCrZehgen_2*' - '*https://anus-staylard.xyz/avast_update*' - '*http://125.40.1.120:40654/i*' - '*http://110.36.0.157:47046/i*' - '*https://eykrqioydzqaehcektgd.supabase.co/storage/v1/object/public/files/e300ccc0-36ee-4d33-9cc6-c5b52fb0d060/svchostplayer.exe*' - '*https://eykrqioydzqaehcektgd.supabase.co/storage/v1/object/public/files/66c36288-2df0-4b5f-9c8a-a7a4adbc418c/panel-file.exe*' - '*https://drive.usercontent.google.com/download?id=1LInRSBrwtgNtxBC8T-a3JpQDqwaVJiqy&export=download*' - '*http://110.36.0.157:47046/bin.sh*' - '*http://182.127.44.223:38986/i*' - '*http://182.127.44.223:38986/bin.sh*' - '*http://27.193.169.9:35982/bin.sh*' - '*http://115.63.55.58:56860/i*' - '*http://219.155.232.225:47229/i*' - '*http://42.227.203.2:48499/i*' - '*http://42.227.203.2:48499/bin.sh*' - '*http://78.165.227.71:50272/i*' - '*http://110.36.91.33:39433/i*' - '*http://110.36.91.33:39433/bin.sh*' - '*http://221.200.215.15:58631/i*' - '*http://221.200.215.15:58631/bin.sh*' - '*http://182.127.113.50:35965/i*' - '*http://182.127.113.50:35965/bin.sh*' - '*http://46.236.65.158:43368/i*' - '*http://103.176.139.56:38161/i*' - '*http://115.49.200.94:49949/bin.sh*' - '*http://125.43.19.178:55986/i*' - '*http://125.43.19.178:55986/bin.sh*' - '*http://46.216.199.241:53041/i*' - '*http://115.51.251.252:56965/bin.sh*' - '*http://182.114.199.247:37976/bin.sh*' - '*http://42.232.57.246:60697/i*' - '*http://27.194.244.206:42513/i*' - '*http://27.194.244.206:42513/bin.sh*' - '*http://62.60.226.140/files/8180653200/xNlSXnC.exe*' - '*http://27.204.197.113:48129/i*' - '*http://110.36.27.209:46596/i*' - '*http://62.60.226.140/files/6306648329/70HzJdg.exe*' - '*http://110.36.77.19:60321/i*' - '*http://123.12.22.154:55714/bin.sh*' - '*http://188.233.80.29:46107/i*' - '*http://59.180.185.87:53154/i*' - '*http://59.180.185.87:53154/bin.sh*' - '*http://100.83.3.144:55420/i*' - '*https://www.dropbox.com/scl/fi/oknv4pn19fgybla5mqapr/xwcha.ps1?rlkey=2a71ypt7mm7ypocciv63lpoj5&st=vau4oec2&dl=1*' - '*http://222.138.103.55:54775/bin.sh*' - '*http://219.155.82.113:33700/bin.sh*' - '*http://175.146.241.62:38131/i*' - '*http://61.52.35.168:53123/i*' - '*http://61.52.35.168:53123/bin.sh*' - '*http://27.215.44.41:60969/bin.sh*' - '*http://103.193.173.199/download-agent*' - '*https://mailsonbelle.com.br/cjr.jpg*' - '*https://drive.google.com/uc?export=download&id=1s45gglC1FGrJqCVH0xWvxDTuUtYabt83*' - '*http://182.116.10.52:57826/i*' - '*https://46.183.25.232:45000/icons/1*' - '*https://46.183.25.232:45000/icons/300*' - '*http://110.36.30.184:43935/i*' - '*http://110.36.30.184:43935/bin.sh*' - '*https://firebasestorage.googleapis.com/v0/b/dropfile-ff5b9/o/FRIDAYLincoln.txt?alt=media&token=839d459b-c819-45c5-8748-9e7d70ba4570*' - '*https://afonja.nfy.fyi/img_072539.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/kQOMR*' - '*https://drive.google.com/uc?export=download&id=1sEvolmYg_3fl5D7LUb5SYZlnlWmu2-0c*' - '*https://firebasestorage.googleapis.com/v0/b/june-july-dd5c8-91uk3/o/22mondayLincoln.txt?alt=media&token=ce3b0c87-e670-4b32-940c-675bdc4fc8d2*' - '*https://firebasestorage.googleapis.com/v0/b/dropfile-ff5b9-j0mm4/o/day1mondasyLincoln.txt?alt=media&token=975f86e4-4fbf-4963-84df-9d68ea0a1dc3*' - '*https://awarenessexhibition.com/img_092444.png*' - '*http://103.75.189.141/siruspng.png*' - '*http://103.75.189.141/pin.png*' - '*http://103.75.189.141/pin_mxi.png*' - '*http://103.75.189.141/sirusmsi.png*' - '*https://res.cloudinary.com/lhut8kxv/image/upload/v1784686086/img_190733_usxsxv.jpg*' - '*http://152.89.28.248/SK/img_142820.png*' - '*https://91.219.23.183/riches/New.dat*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/OagdK*' - '*http://107.173.227.98/2012/AkIrpdm.txt*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/nTAVK*' - '*https://afonja.nfy.fyi/img_120651.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/zYwUb*' - '*http://61.53.135.168:33597/i*' - '*https://drive.google.com/uc?export=download&id=1Y0UocBsXy6UDAkSEAlXRPVJN5nnRYmwb*' - '*https://chrome.browserapp.ru/downloads/ru/YChromeSetup.exe*' - '*https://chrome-desktop.net/ChromeSetup.exe*' - '*https://chrome-windows.ru/ChromeSetup.exe*' - '*http://91.92.242.236/files-129312398/files/file_cd3429bd160288c0.exe*' - '*http://119.185.189.150:57194/i*' - '*http://39.90.184.70:50776/i*' - '*http://178.16.54.109/loader_domain.exe*' - '*http://178.16.54.109/loader.exe*' - '*http://110.37.84.212:50663/i*' - '*http://158.94.208.44/pb7Ulzhaae3xpSNrEvJH5yqqyMyIbnNF/gM9anpOuZNKX8zHj.exe*' - '*http://158.94.208.44/pb7Ulzhaae3xpSNrEvJH5yqqyMyIbnNF/9z7BGnRGpgs8cZv7.exe*' - '*http://158.94.208.44/pb7Ulzhaae3xpSNrEvJH5yqqyMyIbnNF/6eq5gvOfRvNmCi54.exe*' - '*http://60.18.101.77:54830/i*' - '*http://123.12.22.154:55714/i*' - '*http://222.138.132.216:53522/i*' - '*http://42.235.177.79:59093/i*' - '*http://42.235.177.79:59093/bin.sh*' - '*http://167.172.76.242/co*' - '*http://115.52.240.177:46862/i*' - '*http://222.138.103.55:54775/i*' - '*http://182.124.112.153:49490/i*' - '*http://91.92.242.236/files-129312398/files/file_75b746fbff1c4fad.exe*' - '*http://115.52.240.177:46862/bin.sh*' - '*http://115.56.165.63:50293/i*' - '*http://91.92.242.236/files-129312398/files/file_dfaf71226362a1a6.exe*' - '*http://123.188.214.188:44236/i*' - '*http://112.248.191.227:55049/i*' - '*http://115.59.16.168:38244/i*' - '*http://115.59.16.168:38244/bin.sh*' - '*http://39.81.218.190:60892/i*' - '*http://91.92.242.236/files-129312398/files/file_b2017df304847a64.exe*' - '*http://39.81.218.190:60892/bin.sh*' - '*http://182.126.90.227:37215/i*' - '*http://221.15.21.169:35571/i*' - '*http://42.228.221.60:34020/i*' - '*http://123.11.15.146:37492/i*' - '*http://221.15.21.169:35571/bin.sh*' - '*http://42.234.233.100:57803/i*' - '*http://115.49.16.251:48030/i*' - '*http://115.49.16.251:48030/bin.sh*' - '*http://42.234.233.100:57803/bin.sh*' - '*http://182.113.28.236:53434/i*' - '*http://123.132.167.175:45301/i*' - '*http://125.43.225.155:59802/i*' - '*https://curl-shell-teal.vercel.app/task/parser/windows?token=rkCiMn9*' - '*http://182.116.119.43:37779/bin.sh*' - '*http://110.37.12.8:54030/bin.sh*' - '*http://42.231.94.253:60922/i*' - '*http://182.123.210.111:51084/i*' - '*http://182.123.210.111:51084/bin.sh*' - '*http://182.121.108.126:43885/bin.sh*' - '*https://zapier-logos.s3.amazonaws.com/gregbfdah.png*' - '*http://115.63.50.54:53912/bin.sh*' - '*https://pub-8fb294ca87ed4b37a3aae4d1de7afa7f.r2.dev/zalionma.png*' - '*https://pub-e590ce8b583843f89e6756c910264198.r2.dev/vaqolnf.png*' - '*https://americanmanchester.org/americanserve/MSI_PRO.png*' - '*https://americanmanchester.org/americanserve/img_021847.png*' - '*https://srv335762319.host.ultaserver.net:45000/icons/106*' - '*https://ezpz.link:45000/icons/106*' - '*https://www.ezpz.link:45000/icons/106*' - '*https://46.183.25.232:45000/icons/106*' - '*http://46.183.25.232:45000/icons/106*' - '*http://182.121.108.126:43885/i*' - '*http://115.48.133.253:34024/i*' - '*http://129.121.110.105/j25h*' - '*http://129.121.110.105/VRQh*' - '*https://gbgl.kafekarachi.com/c40723f4-afe3-4387-a5f0-30ad263a13f0*' - '*https://qbmuv.loganlooneyresume.com/becf487a-8807-4073-8b1e-228ae74750cb*' - '*https://res.cloudinary.com/lhut8kxv/image/upload/v1784598632/img_184926_y2v0fe.jpg*' - '*https://tmnpc.lnlsealcoating.com/6066c921-0fcc-466e-bf63-fa48e3fccad7*' - '*http://112.255.198.69:54682/i*' - '*https://jb.mywwjj.xyz/G/c2b8.zip*' - '*http://112.255.198.69:54682/bin.sh*' - '*http://110.37.49.99:37589/i*' - '*http://196.251.107.186/build_x32.exe*' - '*http://216.9.224.48/2/njhgdmm.txt*' - '*http://216.9.224.48/1/IeFrcro.txt*' - '*http://216.9.224.48/7/FFmfmSm.txt*' - '*http://216.9.224.48/7/emAhacg.txt*' - '*http://216.9.224.48/7/kmdadfd.txt*' - '*http://216.9.224.48/7/rjiidem.txt*' - '*http://216.9.224.48/7/aSraAmf.txt*' - '*http://216.9.224.48/8/hgkArda.txt*' - '*https://7wzfqmf9.behtarin-site-shartbandi.com/?ublib=d8041874-6dcf-44fd-9b89-39d9d0470ace*' - '*https://ynwe.jetourmexico.com/6f3e5baf-84aa-4952-a834-2615f584986a*' - '*https://mqljf.newcoservicemower.com/8b387895-4192-4f22-8bdd-87ebeb462596*' - '*http://192.255.195.158/13/img_050556.png*' - '*https://nameless-scene-7204.uploadeeeesclientess.workers.dev/FTM0-40PO-AO28-G98E/img_b0utd5.png*' - '*http://125.43.36.237:40379/i*' - '*http://129.121.110.105/gwF*' - '*http://129.121.110.105/jtt*' - '*http://129.121.110.105/HCgx*' - '*http://129.121.114.124/Rmw*' - '*http://129.121.114.124/Qymm*' - '*http://129.121.114.124/P0J*' - '*http://129.121.114.124/XrnG*' - '*http://129.121.114.124/3uv*' - '*http://129.121.114.124/0si6*' - '*http://129.121.110.105/MENG*' - '*http://129.121.114.124/5mwh*' - '*http://129.121.114.124/UHCP*' - '*http://129.121.114.124/ErF*' - '*http://129.121.114.124/eCn5*' - '*http://129.121.114.124/BM3y*' - '*http://129.121.114.124/BjPE*' - '*http://129.121.114.124/sgms*' - '*http://129.121.110.105/Fzuk*' - '*http://129.121.114.124/s5i*' - '*http://129.121.114.124/Tz4*' - '*http://125.43.36.237:40379/bin.sh*' - '*https://afonja.nfy.fyi/img_124441.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/gYQdW*' - '*https://drive.google.com/uc?export=download&id=17saTMMaSIsOn3pxj6fVN-ycCQjlwWu38*' - '*https://imffy.com/cnkaFkm.txt*' - '*http://192.255.195.158/133/onaidka.txt*' - '*http://216.9.224.48/ai/Ambro-4.0fix-phamupload.txt*' - '*http://216.9.224.48/ai/montana-pw-sc-4.0fixupload.txt*' - '*http://192.255.195.158/13/goodthignsforbestfeelingforbetterplacecoming.hta*' - '*http://107.173.227.98/img/1.jpg*' - '*http://109.248.151.201/img/1.jpg*' - '*http://157.254.223.141/img/img_171906.png*' - '*http://157.254.223.141/25/goingbestplacecomingforbetterwaysinthelifegoodformebest.hta*' - '*http://157.254.223.141/22/goosthingsneedtohappenedgoodways.hta*' - '*http://110.37.127.45:53303/i*' - '*https://jpsym.mystic-brews.com/526f77db-6be6-466b-95cc-daabb487bcfb*' - '*https://ewmc.jenslittlerugrats.org/186a909f-6d0c-4629-8114-c1893b96ba93*' - '*http://182.121.172.86:34608/i*' - '*https://manurso.aigroupfood.com/update.sh*' - '*http://46.236.65.252:37163/bin.sh*' - '*http://94.26.90.210/acc-1421/verify.ps1*' - '*https://bopyq.myhillcountrygrass.com/1462137f-a0a1-4149-a3d0-b3fb22145353*' - '*https://hvao.jbgroup21.com/60861fb4-c42e-4d32-9d1e-7f445fbb4fbe*' - '*https://1s3hqwvr.varzeshlife.ir/?ublib=cd0b6f11-a34d-4a81-9087-a118ff73ef35*' - '*https://byrio.muscle-up-yavne.com/d9e941bc-da38-4f4a-8058-b188c7bc39aa*' - '*https://ndpyt.mechanic-on-site.com/69f00767-c261-4953-9b5b-7ce9db167107*' - '*http://222.137.146.104:47031/i*' - '*https://avfzq.maia-bentley.com/0020bcd1-6a71-46a9-870e-d085f887b423*' - '*https://ewyjl357.flashhomebuyerskc.com/?ublib=8f40f8ff-c354-43fa-b6e2-991f98fcadc0*' - '*https://iahg2idr.evansunitedspringcarnivalsherman.com/?ublib=0202b498-8baa-4e4f-aee6-34d67b88f431*' - '*https://gytm.onjabet1.com/709bfa6e-d8ce-4285-baa7-738ddff35f9e*' - '*https://foivs.highkickstkd.com/b587247e-b619-4a2c-82fb-0ff450dbae2f*' - '*https://xhtn.nextbahis.one/3077d047-0c1b-4078-904b-2a4508da1841*' - '*https://luy6lvmh.site-takhtenard-sharti-betland.com/?ublib=0ddfa623-06c6-448d-8761-efa19ee90ab9*' - '*https://ikkqh.dermexcel.net/2e3e1200-373b-4198-af2a-c84a3b584907*' - '*https://jilc.kaltourusa.com/2df62c3e-5896-4f28-bbef-99c5e43baefd*' - '*https://cstee.diamonddumpsterrental.net/794ff065-a08d-46f2-8d0c-27f4a0ddf0ac*' - '*https://xdox.groeschelcompany.com/ef30bc78-30f4-43a1-9f7a-c178ff72d4ca*' - '*https://dgctf.concretewestgj.com/7e06668f-b098-4430-afb9-0b5ba2c561f8*' - '*https://yeo0jmkq.kimsnailsalonmadison.com/?ublib=0c49ebf1-2e73-479d-bedc-597cc7bc4bff*' - '*http://27.216.121.201:46371/i*' - '*https://ovzdi.jetbet.download/602b43da-625c-426b-a782-272ac0a6c8cc*' - '*https://gjwc.kalientestore.com/6ee0abf6-51eb-4d7b-b11b-1f3523131050*' - '*http://182.116.75.200:44990/i*' - '*https://mlmgp.jenslittlerugrats.org/58ad489d-500f-4e06-bb9d-be1a9be5bdee*' - '*https://dwvygj31.dermatologycongress.org/?ublib=4a87ce31-5627-4984-b3f3-213004f88224*' - '*https://h51ee0ex.emeraldualzone.com/?ublib=6caa43cd-3d3f-4767-ac58-589098afb939*' - '*https://4gfsvs7l.jennyrussianbluepalace.com/?ublib=9fbb86a3-e407-4499-995d-976558bcd738*' - '*https://sutf.kafekarachi.com/9f2d1350-68ae-425a-8161-cb99132f828d*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 4 id: 2a2961fc-0e7f-57de-800d-3f51a87326ca status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 4). logsource: category: proxy detection: selection: c-uri: - '*http://182.121.153.253:60228/i*' - '*https://wakgo.jbgroup21.com/0567ff81-5dbc-40a1-b98d-1ba3437a4232*' - '*https://zztz.jetourmexico.com/d9e8d962-38f8-400f-ae35-703f4b691ef8*' - '*http://182.121.154.76:38424/bin.sh*' - '*https://txvii.hazaratbet.bet/099279dc-fd6f-4e77-817d-7f3f253dbc37*' - '*https://ttvsj7o9.jdexteriorcleaning.com/?ublib=1b43aaa0-088d-44ee-8594-2227175f98ea*' - '*https://xkzh.highkickstkd.com/48b72aed-fb42-46d2-89f9-0c4cdcda2b29*' - '*http://182.126.241.96:38509/bin.sh*' - '*http://222.138.206.175:44075/bin.sh*' - '*https://vuwvp.drdavidzweiback.com/53bc55ce-88c8-4f69-be49-de029abc157d*' - '*https://klca.hieliao-app.com/700c3420-57bc-4224-aadc-004a1e715479*' - '*https://iemb.hansikaenterprises.com/4e315a0d-067d-46c7-b417-0ddda75b3b49*' - '*http://62.60.226.140/files/1824233174/hvXHZSV.exe*' - '*http://115.63.50.54:53912/i*' - '*https://cunts.colg1.org/5c5e271c-0b7f-4832-ba4a-4ee1076c50c1*' - '*https://jnhygwu4.gulfbreezervrentals.com/?ublib=487e7990-fbe5-461f-b1ed-2cdc60d7c28f*' - '*http://123.11.200.204:51494/i*' - '*https://zvni.frizzhairforecast.com/7f060f0b-6e40-4eb1-be20-206f57a08efd*' - '*http://123.14.89.9:46520/i*' - '*http://123.11.200.204:51494/bin.sh*' - '*http://113.238.64.130:58713/i*' - '*https://syqmn.calirayalake.com/38a3f125-fd88-47a6-8294-032fd1b35b9f*' - '*http://182.126.95.171:58952/i*' - '*http://222.140.189.99:47229/i*' - '*http://123.14.89.9:46520/bin.sh*' - '*http://222.140.189.99:47229/bin.sh*' - '*https://z52rumys.customhomebuildersplainfield.com/?ublib=ca630a27-f58b-46a2-b197-40f67d2893f7*' - '*https://47ytdzjs.economywindowsparts.com/?ublib=f6eaaf11-9739-44b6-8ae2-ce258990f4d3*' - '*https://kzsf.concretewestgj.com/bd2827c7-4a4a-4ec8-9053-be9700991f77*' - '*https://tjhsq.onjabet1.com/ac91c374-280b-4adf-97ca-823ddd070968*' - '*http://27.207.185.31:55079/i*' - '*https://2zm9lhlg.groeschelcompany.com/?ublib=f222e963-a8d5-429b-8128-d672e5353e8e*' - '*http://94.154.43.97/x86*' - '*http://45.154.98.126/Vozeyuy*' - '*http://129.121.114.124/WYd*' - '*http://129.121.114.124/nFD*' - '*http://129.121.114.124/wu5*' - '*http://129.121.110.105/lsu*' - '*http://129.121.110.105/GFr2*' - '*http://129.121.110.105/Rh1F*' - '*http://129.121.114.124/jIQQ*' - '*http://129.121.114.124/00J*' - '*http://129.121.110.105/iCHG*' - '*http://129.121.110.105/gTks*' - '*http://129.121.110.105/mrHz*' - '*http://129.121.110.105/dV9*' - '*http://129.121.110.105/0lW6*' - '*http://129.121.110.105/KlW*' - '*http://129.121.114.124/4bX*' - '*http://129.121.114.124/VVl*' - '*http://129.121.114.124/Frzt*' - '*http://129.121.114.124/6G42*' - '*http://129.121.110.105/JFz1*' - '*http://129.121.110.105/eDl7*' - '*http://129.121.114.124/w1XG*' - '*http://129.121.114.124/6qU*' - '*http://129.121.114.124/y3G*' - '*http://129.121.110.105/oGe5*' - '*http://129.121.110.105/THKi*' - '*http://129.121.114.124/O2m4*' - '*http://129.121.110.105/U10T*' - '*http://129.121.114.124/1J5*' - '*http://129.121.114.124/F13*' - '*http://129.121.110.105/Jv0*' - '*https://nodemetrics9095.com/update/package*' - '*https://zpbn.comptonanimalrescue.com/73544089-4bf3-4db8-a557-12f35080b488*' - '*https://lxlwn.nextbahis.one/00a99672-f781-4f27-811f-8b413a9037d0*' - '*https://glmm.colg1.org/92c6b1d3-bc11-4483-a193-96a8e1e0db6c*' - '*https://lcare.mrslopezsings.org/6dec0d7f-ed1c-459f-baac-10b3625d1785*' - '*http://182.113.36.109:39127/i*' - '*https://wctvn.mrslopezsings.org/f4f2e98a-a4e4-4522-8a2d-2c9380c26d70*' - '*http://182.113.36.109:39127/bin.sh*' - '*https://lvcrn.monicarobles.org/6ee8c245-13af-4e7c-9eff-09d8b7505fac*' - '*https://drsvt.nextbahis.poker/376006c0-89eb-49b6-8f8b-1b232e72442a*' - '*http://222.137.159.214:44514/i*' - '*https://axoo.colg1.org/63b36ad3-1c67-4418-ad17-e73c334f5600*' - '*https://xhbgt.nextbahis.blog/14712a3f-82a5-450a-8965-25d6f3f5f047*' - '*https://aeiyi.jetbet.download/98c7fe44-971c-4f28-ada7-330a7e69093d*' - '*https://pjjuosk1.fredcoplumbingpros.com/?ublib=eff2ae2d-6abc-4002-9706-dbe04133ed31*' - '*https://igsx.closedfistllc.com/127c3bcd-412d-442c-bb65-395afc1c8977*' - '*https://aruhq.jbgroup21.com/92c34534-1b04-45c3-9531-0870fbbadbe1*' - '*http://123.189.138.169:50295/bin.sh*' - '*https://wbpypinui.generososbakerycafe.com/665f2c2b-4ee7-4dcf-8ac8-7a3999e87fe9*' - '*https://cglp.cleantruckchecksac.com/675b759f-393e-4c37-9d92-92f3098f145e*' - '*https://embvx.hazaratbet.bet/e9367ec9-7763-439e-8ab3-92f6e1f3ca5d*' - '*https://a6du2gsx.fit2leadconference.com/?ublib=51b0367e-da4d-4e48-bedc-f793ba541c01*' - '*https://hag0wqv7.estrelamardedetizadora.com/?ublib=96190ecb-9d69-44fa-9671-eed2a810ceb3*' - '*https://qaqatrf8.dermatologycongress.org/?ublib=d48c7d15-2c63-4849-a13c-eab1c676043b*' - '*https://bcmej6hr.goodlifelakerentals.com/?ublib=dd862fbe-b81b-419b-88fc-1a48c1b496d5*' - '*https://2gfxwchj.emeraldualzone.com/?ublib=27e557b5-2f8e-4937-844a-22ed6c5c0479*' - '*https://bhrbc90m.fredcoplumbingpros.com/?ublib=aafc397a-2716-4e43-8400-19f7082eef33*' - '*http://222.137.120.211:35666/i*' - '*https://xgu7k53h.economywindowsparts.com/?ublib=c7442bc8-768f-456f-9ede-fc5dd6a5349c*' - '*https://ea168jci.customhomebuildersplainfield.com/?ublib=e7fc92b5-e50a-4f25-a7c9-acc916a02668*' - '*https://kwgn9wkj.cupprimosouth.com/?ublib=3f1050fa-f3c3-44d6-bc33-43d2a2e90020*' - '*https://vrdh.calirayalake.com/30c1b90f-0e39-4964-8d38-60336d054e66*' - '*https://lodging-dictionaries-jill-ministry.trycloudflare.com/rec.wsh*' - '*https://excited-wagner-demonstrates-showing.trycloudflare.com/ent/pun.py*' - '*https://yywem.drdavidzweiback.com/9ee0ae0a-3908-469f-b46d-56fa5c05d6cc*' - '*http://182.123.210.60:41415/bin.sh*' - '*https://8iuwoa4l.of-tencent.com/?ublib=e1be6bd6-929b-4b85-8d42-7515c0ede2c9*' - '*https://kkid.hightidesuffolk.com/a7b2a204-6671-4975-925b-d9a6e341eed0*' - '*https://xcavl.crossonerecords.com/e24f5f1e-382e-4f10-bb4b-edcf37dbd103*' - '*https://54e20j57.mrslopezsings.org/?ublib=c49da253-83e4-413e-aba6-798da716eff2*' - '*https://y0fui15e.corgiwarehouse.com/?ublib=cc1a580c-8ac7-4e63-9c9e-1419f9b015c5*' - '*http://42.225.204.96:59601/i*' - '*https://20ntquqt.varzeshlife.ir/?ublib=1eedb288-0232-449f-99bd-bde3d3760339*' - '*https://1eriimge.consultingsolutionsjp.com/?ublib=a0556c25-d0c3-457c-bd71-50de5cf51c26*' - '*https://uz1hqtn3.phtaxiservices.com/?ublib=035f06f2-ff38-4267-af2e-60cfe7e37122*' - '*https://bjastqph.chrisbrownallegiantstadium.com/?ublib=b880e0be-bdad-429e-a12f-23a94ecf187c*' - '*http://42.225.204.96:59601/bin.sh*' - '*https://mevd0fjv.phimmoichilla.org/?ublib=9a2b5f72-bd2f-42ab-8b0a-3952b0f3f760*' - '*https://g2o19aql.charmedanddangerousplush.com/?ublib=f9379524-c484-4236-af06-2ffeb17b2a34*' - '*http://91.92.242.236/files-129312398/files/file_eae4cc343c8e98ac.exe*' - '*https://biirwl32.patxisdublin.com/?ublib=db9ead36-2332-4c11-96aa-88e14d48d101*' - '*https://tq6ay9c3.broadwaylotterytickets.com/?ublib=49682f49-749f-4eb4-9c18-2b6fa139cf0d*' - '*https://okv4iaii.contempoconstructiontx.com/?ublib=bf899dc8-3970-44c6-91d9-ef98725bc672*' - '*https://fgsnlppf.jadoou.lat/?ublib=64a192c0-962c-424d-903e-54510a2da4a6*' - '*https://giwl.highkickstkd.com/1854155f-d746-43c7-b8ec-ebfee2db5006*' - '*https://tgbft.countertops-dfw.com/fbc720fb-1dca-49ce-83bf-4b62ae663821*' - '*http://222.139.114.66:42224/i*' - '*https://3efofny3.cielohillsevents.com/?ublib=48c99f5d-2c24-469f-b1b2-095893b78703*' - '*https://hpnohznb.site-takhtenard-sharti-betland.com/?ublib=5a6f7179-e8d9-4949-a37f-724f98152a89*' - '*https://u9p8kb56.crvbl.com/?ublib=fa9bfa8f-5f78-4b54-8810-4b0b3e1f13a9*' - '*https://wnq8bmsb.derbi.promo/?ublib=8bff6e51-a5c7-4d41-966d-686e393c380b*' - '*http://61.52.39.66:37693/bin.sh*' - '*https://f9e2ff2h.site-asli-bedon-filter-1xbet.com/?ublib=80a0a0ac-39d2-4817-b176-b4bc034397c4*' - '*http://222.139.114.66:42224/bin.sh*' - '*http://113.239.240.245:59970/i*' - '*https://ddsr.hieliao-app.com/e5030470-e5b7-4f76-9985-68492a2a4f65*' - '*https://cnxst.jardins-do-mar.com/7195a1bf-198e-464d-a125-53d64356e8df*' - '*http://115.50.248.116:38317/i*' - '*https://ryr4q9kj.playantwatch.com/?ublib=17f39272-8c03-4f09-9605-cfb437a6ab64*' - '*http://42.226.90.121:52905/i*' - '*http://115.49.2.134:37786/i*' - '*https://jsthk.jademckenzieco.com/767003a7-808a-44f3-96a8-06b1aefb8529*' - '*https://cyki.hayleymarienorman.com/b3e609f1-7db6-4646-9c1c-e6ff8e560403*' - '*http://42.226.90.121:52905/bin.sh*' - '*http://42.227.204.153:42956/i*' - '*https://twyd6y14.elizabethspizzadenton.com/?ublib=19d3ce96-d829-4f78-82bd-ef47d3af9900*' - '*http://62.60.226.140/files/8425384370/MRsDoXR.exe*' - '*https://01ejjpa2.behtarin-site-shartbandi.com/?ublib=b569c285-0ed2-48fa-b99b-9e2498ac378c*' - '*https://pkspm.informatik-ai.com/92325a4a-031c-4206-b22d-42df3d927987*' - '*https://todn.hansikaenterprises.com/0e6d4bb4-bae9-405d-a7d8-3ea1327fd00c*' - '*http://59.180.171.2:44274/bin.sh*' - '*http://125.45.8.67:38689/i*' - '*http://112.249.186.196:53368/i*' - '*https://oqtr.haleywoodportfolio.com/0c513135-179c-4442-a973-e64e3ff22b23*' - '*https://tztgw.impactpromotionsclt.com/8971a430-05a1-4072-98c9-7f006923be63*' - '*https://down.unicron-cdn.click/Telegram_v12.8.3.apk*' - '*http://42.228.91.45:46856/bin.sh*' - '*https://t13ecldw.calculadoracomisiones.com/?ublib=6ce8654e-3676-4219-a88d-c679f847ec26*' - '*http://112.249.186.196:53368/bin.sh*' - '*http://61.52.39.66:37693/i*' - '*https://llttu.hurtigegevinster.com/3fc67304-49bd-411c-ab54-e8391c49f309*' - '*https://rbnz.hairbyniki.com/3592ab2a-0efd-4e5d-840d-1cc981c86e62*' - '*https://ksuqx.cnbgladespring.com/896f2de2-93f1-46cd-93e0-fc3641db9ec0*' - '*https://dduf.bolesfarms.com/3e8516f9-4d5e-4469-8628-2b0805131055*' - '*https://ldgcg.closedfistllc.com/40e7bcc9-6b01-48f7-8dad-f35e5ea3f352*' - '*https://xbwtz.cleantruckchecksac.com/d52aedd4-5743-4708-acd2-1bb26e16f0e2*' - '*https://dnrlgtwo.frizzhairforecast.com/?ublib=226675a3-31a3-4709-a031-7c2a31609a02*' - '*http://125.41.137.141:54358/i*' - '*https://alkh.jbgroup21.com/80a4abc2-c21b-42d8-af11-549f031c561b*' - '*http://182.127.163.187:42588/bin.sh*' - '*http://125.41.137.141:54358/bin.sh*' - '*https://hrykp.varzeshlife.ir/ed787865-55f5-4cbe-975a-11133e92978b*' - '*https://auyc.pikachuplush.com/19c1a35b-5d96-4d96-bff6-0e7bcac329e3*' - '*http://110.37.57.144:42393/i*' - '*https://fby6y3nd.illuigiitaliancuisine.com/?ublib=d92da383-bcd5-4b16-9181-1b5743568f5e*' - '*http://110.37.57.144:42393/bin.sh*' - '*https://hnhdl.hazaratbet.bet/d9a17e4a-fe85-4bf4-95de-f4827a45a73a*' - '*https://g1wgxqj5.nextbahis.one/?ublib=57f4a879-73ea-4cf6-b258-952fd17904c0*' - '*https://gofq.phtaxiservices.com/f0ae0c7b-a8b1-469d-ba4f-ef250b9fd053*' - '*http://182.112.29.150:39801/i*' - '*http://119.116.124.229:37559/i*' - '*https://uxlcj.fontanayoga.com/9fa7664b-265f-486c-a97a-7efa4dd35161*' - '*https://ftvfx.faux-paws.com/41790b44-6ec3-4d97-bf17-9ccc38878c0b*' - '*http://110.37.59.45:59524/i*' - '*http://110.37.59.45:59524/bin.sh*' - '*https://vqwj.phimmoichilla.org/fe107b55-ce65-4969-8242-cc0cbd9b2a21*' - '*http://110.39.233.38:37849/i*' - '*https://dbomd.famscargo.com/487a34f2-6b4a-4626-b276-2fc3116ed4b8*' - '*https://ijm1e9p4.chrisbrownstlouis.com/?ublib=db190de9-fde1-4c33-97d6-43b213133a44*' - '*https://dtzu.patxisdublin.com/68d31695-2977-40ec-b1f9-693c507242b6*' - '*http://59.97.248.23:53076/i*' - '*https://8g7kgrp5.frisbeeburgerllc.com/?ublib=7abd318e-a9b7-46f2-b43f-1debb37a97db*' - '*http://59.97.248.23:53076/bin.sh*' - '*https://imrmd.drdavidzweiback.com/c5c47653-232a-4c2f-9191-c2ec03cc3bcf*' - '*http://219.157.233.184:51727/i*' - '*https://moszp.jetbet.download/4d255a6d-38c8-4990-bd2c-d4eff5640c24*' - '*https://edtbi.jetbet.download/b442ea02-b255-4ea4-ba1c-bd62b55f54b4*' - '*https://zwhun.hazaratbet.bet/3e81d644-b985-4494-b806-e2741b0d5681*' - '*https://wxfwe0h3.chrisbrowndetroit.com/?ublib=16ce54de-7a0c-44c6-9dc2-f42f276c5ecf*' - '*http://178.16.55.240/corp/a*' - '*https://wz43qign.houseofhakka.com/?ublib=bd12a875-8182-4a0e-894a-957ceb8fd078*' - '*https://qpduk.hazaratbet.bet/e4d856d9-c0c8-476b-8cbd-2e4a75bd22cb*' - '*https://yvryz.gepco-energy.com/2280d7fe-c82a-4a12-9166-10ee49d6eb6b*' - '*http://61.53.87.113:47958/i*' - '*https://yferx.gepco-energy.com/60aeb789-814e-4ec9-b068-c60fb2f29805*' - '*https://xxklt.gamehazarat.bet/54b765ef-e7c4-4460-aa6b-046dee5d0504*' - '*https://atibr.gamehazarat.bet/339874c6-81c4-4391-a60a-41bb98dcae81*' - '*https://konr.domirunway.com/958ad0cd-8887-4ebb-9b64-352430b38e2c*' - '*https://oqjvp.gamehazarat.bet/12a8d55a-9265-4e0d-94b8-fff18dcb0261*' - '*https://etaru.oasis-active.com/8b6b36a0-bccc-447a-9b5e-7e60ae83b60d*' - '*https://canss.mountoliveccc.com/42cf8349-ce7d-4f41-ba67-b4ffa7792f4e*' - '*http://123.11.79.11:35843/i*' - '*https://uwaho.midiowagrowth.com/04b09226-f2ec-4073-a208-59182282aef3*' - '*https://donsoft.xyz/Bonavol_f2q6s*' - '*https://unixcheats.shop/downloads/Unix.zip*' - '*http://222.255.181.15/run.sh*' - '*http://193.148.56.98/WQUKDbdzO8yY5asDU6*' - '*https://recaptcha.boit.cloud/recaptcha-verify*' - '*https://w8sxay63.varzeshlife.ir/?ublib=9411c27b-1393-4e59-abb7-94360cf4748d*' - '*http://112.237.210.145:54894/i*' - '*https://ikyu.domirunway.com/be239d4e-bb8a-4b6a-b0f2-a45f5b372fb4*' - '*https://ivclr.mango-sushi.com/21b1147b-65a3-4896-9fa3-b5947b44fece*' - '*http://61.52.88.246:46118/i*' - '*https://fbbzh.mango-sushi.com/2032cbfe-57e1-4cce-9e7e-b32defe543b9*' - '*http://125.43.124.57:57410/i*' - '*https://cydm.domirunway.com/616715e4-df42-4523-9833-140172b48083*' - '*http://61.52.88.246:46118/bin.sh*' - '*https://fsjkul62.onjabet1.com/?ublib=65e30ac4-156c-4d4f-b8d3-71405d1a267e*' - '*https://bwwxd.polarstartire.com/da06a1dd-f060-4741-b34b-5a47c7ed63c3*' - '*https://wnbl.divanailsachse.com/413d2c48-926e-4bb6-b25f-927e36d57d00*' - '*https://umq3dj7m.tampabayspin.com/?ublib=dfb5443b-d3bd-430c-92c1-b31f3e489fa5*' - '*http://125.40.39.34:45222/i*' - '*https://dautw.playantwatch.com/c089d360-c5c9-47de-b629-0f7db08afa87*' - '*https://hxqt.faux-paws.com/ae9c44df-e6b0-4275-86f4-e2169e317547*' - '*https://h9fw1u0e.hanasushiorlando.com/?ublib=c34a1a48-f0b9-4e4a-9ac0-c2bdc524c746*' - '*http://110.36.70.136:48495/i*' - '*https://stqdx.gominhabjj.com/3a2d56d2-11d4-447f-90eb-ab2697a6b293*' - '*http://62.60.226.140/files/8036065901/fK31j6t.exe*' - '*https://wlgv.famscargo.com/c29834b0-962b-44ab-844b-609ac0cb6ef9*' - '*https://z15e6bey.nextbahis.poker/?ublib=0d17f058-35c9-4ae4-8f31-e87194c28f7e*' - '*http://113.231.233.199:60585/i*' - '*http://113.231.233.199:60585/bin.sh*' - '*http://110.37.5.166:33583/i*' - '*http://5.3.19.160:59263/i*' - '*http://182.126.122.177:56092/i*' - '*https://imccj.gobgem.com/e3c1083d-6f15-474a-ba3e-c52d8d94f2a9*' - '*https://uafu.fadedfractal.com/9cd401ce-3e34-4978-8e75-2b7a071d3d7e*' - '*http://182.126.122.177:56092/bin.sh*' - '*http://42.239.229.179:38649/i*' - '*https://uxddr.goatedcollection.com/58cc9737-eba2-488f-9da5-a376de675397*' - '*https://khob.formonstore.com/f6e12d5a-192b-4ed2-86ed-b4de7b10d126*' - '*http://110.37.53.25:60651/bin.sh*' - '*http://62.60.226.140/files/8036065901/Q3Sdoql.exe*' - '*http://62.60.226.140/files/8036065901/KqpPXIL.exe*' - '*https://uaycwz4b.nextbahis.blog/?ublib=2b6dce6e-51e1-4887-8b8d-0ee28eaa1a4d*' - '*https://wgp8mmcl.nextbahis.app/?ublib=c020d2bc-4d6a-4e5a-8d7c-0e3b726c909d*' - '*https://hzzgoxjvb.pdfbama.com/93dd4405-7316-456e-b98a-ed1266a1654f*' - '*https://ekjcg.gettalloway.com/ef448d49-2058-4687-8f9f-c5aeab18e933*' - '*https://mjca.fontanayoga.com/0e140845-b64b-486a-88a6-17d46ced9d2a*' - '*http://62.60.226.140/files/8036065901/Lqxxe50.exe*' - '*http://115.49.29.60:43667/i*' - '*http://115.49.29.60:43667/bin.sh*' - '*https://dyzjs.gepco-energy.com/ea2fa8b5-4dcf-48ff-88c6-c539f1254ad1*' - '*https://jasf.braverybeans.com/47175d7f-86cb-4df3-8bca-f0e300129625*' - '*https://zawzq25p.grupoelede.com/?ublib=0387854d-a830-4b39-9970-a7899625ca80*' - '*https://p5ymbof6.drdavidzweiback.com/?ublib=788c6f9e-4f75-43a2-8c8a-268957fc4675*' - '*http://222.138.206.175:44075/i*' - '*https://ifmpb.frizzhairforecast.com/917bc27c-d4ab-4e3e-b4a6-f248f671d0e0*' - '*http://93.171.80.160:10689/i*' - '*https://txwd.borrender.com/5c1b4fb5-8786-4c71-ba6c-9144253c5d95*' - '*https://productionai.shop/recaptcha-verify*' - '*https://znnop.frisbeeburgerllc.com/95671f7c-f2f5-42fa-b18b-04611bec7913*' - '*https://gwcs.bolesfarms.com/d0376c85-7693-477c-90a0-f5aa8ba10847*' - '*https://g5sy0m2g.calirayalake.com/?ublib=fd83772a-43fa-4861-8355-a259be9721a9*' - '*http://110.36.12.61:38059/i*' - '*http://42.228.192.221:45232/i*' - '*https://ystr.bittersweetkennel.com/58f140ad-e33d-4f57-a949-540bf2c98aae*' - '*https://zuibs.jetbet.download/b9bfd8cd-e410-48f8-a457-fa272d2aa9f3*' - '*http://27.44.147.25:46712/i*' - '*https://bzeg.bikertlane.com/34a038b6-b6ed-454b-817e-22730ead4dbc*' - '*https://m4jpiubh.royaldoorsspringdale.com/?ublib=85b3fe11-4a50-432f-8b23-ac138e4f85e4*' - '*https://4yl6u62i.pdfbama.com/?ublib=fd9f4cee-541f-49bf-8dc2-b8a07559cc06*' - '*https://otcgf.christorem.com/dbb18cc6-cebb-446b-8ce8-3f7ba6e70600*' - '*https://natural-health-news.com/Verify.msi?I*' - '*http://95.164.53.214:5554/d.bat*' - '*https://gerenland.click/flask/whales.msi*' - '*https://gerenland.click/api/stale.msi*' - '*http://178.17.59.195:5506/ll.vbs*' - '*https://deyetechnical.com/winsconsx86.zip*' - '*http://93.152.224.29/VMvDWLT7AqpC45hhHf*' - '*http://27.44.147.25:46712/bin.sh*' - '*https://dlvk.nextbahis.one/ad2e4456-58e2-49b0-844a-b6ffccd6b59a*' - '*https://ht326ul6.hazaratbet.bet/?ublib=ebf13cc2-cdc0-4ecf-90fb-36448cb22623*' - '*https://lqcah.cheaperthan-dirt.com/23be72bc-0ade-4140-8f87-a3bc07414e4e*' - '*http://222.142.252.58:35283/i*' - '*https://olotu.cardanaircraft.org/1dd6d0c4-ade7-435a-ac4f-0c9fef7085dc*' - '*http://182.116.116.107:37779/bin.sh*' - '*https://qjhi.taktikkbet.com/0c0de1f9-1f9a-4674-b154-ed5a96c25296*' - '*https://ybntipf1.ramenizakaya-himeji.com/?ublib=f9ba18e2-6b84-4dd7-9023-9ce1b40f77ab*' - '*https://xexop.burritodelight.com/82bd7cc4-cfe9-43df-8803-1b4430107a7b*' - '*http://110.37.7.7:51605/i*' - '*http://113.231.21.194:45502/i*' - '*https://bvxbg.buildableconcepts.com/f7ffb915-a6a6-43c6-9b70-ad371e3e171f*' - '*https://tomi.socialclub112.com/0b42d51b-72dc-479d-98b1-5b05ae4ad758*' - '*http://110.37.7.7:51605/bin.sh*' - '*https://vcjh.shimiaodaoflushing.com/d8966925-4173-48a0-b8bb-ebfbde50fb3c*' - '*https://wsfls.hazaratbet.game/1fc6b87f-44ce-452f-8c24-3a5ce905a0a0*' - '*https://6ytetbzh.quickandcleanfetish.com/?ublib=27e9ffa7-2d67-404a-b350-c49a89faf8c2*' - '*http://219.156.52.131:33086/i*' - '*http://42.226.90.121:43308/i*' - '*https://amse.senorgyros.com/c32fab7b-4abd-4f96-8481-247e95265d02*' - '*http://115.48.144.122:55166/i*' - '*http://219.156.52.131:33086/bin.sh*' - '*https://hcrty.funxbet.casino/ce0bd297-f5b4-4b33-a407-d1774700642e*' - '*https://ru4xmcs2.onjabet1.com/?ublib=ee1777d4-ab13-4af6-aecf-86a52e7447d2*' - '*https://uina.noodlesbymomi.com/2a0ff218-d68a-46b0-89dd-d88d117bf55d*' - '*https://yxzsj.derbi.promo/3f922363-2f4c-4493-a2a3-f57215a3f660*' - '*https://vftudd2r.gamehazarat.bet/?ublib=98bf6fdf-031a-4672-a4c1-6ab2e68363dd*' - '*https://a2wk5fd0.purity-pharmaceuticals.net/?ublib=6355d280-3db8-40f2-aeae-d49d67cc2d46*' - '*http://119.184.23.172:50431/bin.sh*' - '*https://hszy.nextbahis.blog/a343d3c2-1203-42fd-829a-8dd8971476e4*' - '*http://115.62.166.192:35375/i*' - '*http://115.62.166.192:35375/bin.sh*' - '*http://110.36.29.195:56713/i*' - '*http://115.55.231.244:46280/i*' - '*https://n5yqon6r.site-takhtenard-sharti-betland.com/?ublib=f84e79a0-8954-486d-bdb3-44ded1adac86*' - '*https://bzki.jetbet.download/92838afa-d142-4d89-a1ae-0c1cf0db6662*' - '*https://lfumk.winston.bet/c4ac8e20-09e1-4c6a-a631-91eacc6edb7d*' - '*https://jtab.jbgroup21.com/80b561a9-4cc3-444a-bfa3-4f5f66318625*' - '*https://ynzpk.varzeshlife.ir/ae3531c5-b304-4a34-a61e-1f5857a46c65*' - '*https://4dc5hwj8.nextbahis.poker/?ublib=b79287fd-1a4c-4395-a5e9-12a719bbbded*' - '*https://g9epkl53.site-asli-bedon-filter-1xbet.com/?ublib=dea575b0-75ed-46c9-8f98-a33531b6d0a9*' - '*https://flyi.jadoou.lat/d5b93ded-0a17-45fc-9966-6503327b5c0d*' - '*https://caycn.tampabayspin.com/afbc2c89-349f-41a4-9686-e69d92ff1f65*' - '*http://209.103.243.96:50476/i*' - '*https://o59dzghe.calculadoracomisiones.com/?ublib=0d295343-dcc5-48c3-af39-c23538444779*' - '*http://123.129.132.137:35336/i*' - '*https://fazv.jadoobet.pro/fc1af01c-888e-4ae6-b146-c765ed570eb1*' - '*https://inasa.pdfbama.com/1a9a7ecd-1619-40f5-b710-93ab35b33e72*' - '*http://222.139.74.170:37461/i*' - '*http://222.139.74.170:37461/bin.sh*' - '*https://u6ggk611.elizabethspizzadenton.com/?ublib=6ee01c55-7726-4a14-8db7-eb4f98c68f8a*' - '*https://jfwh.hazzarat.com/8a24b4c9-c882-422c-97f0-2be6703aafb2*' - '*https://xhozx.onjabet1.com/e127eaad-917e-4d5b-9385-96ab6b96d8d7*' - '*https://ncia.hazaratbet.games/3526568b-eed5-446e-8ea9-85225363b6b0*' - '*https://jxrml.luxurygoodscaree.com/c04629d2-2a9b-4a7e-b44a-2791db00d5e2*' - '*https://tommy-aa.lol/f*' - '*http://129.121.114.124/3AC*' - '*http://62.60.226.140/files/881715592/Ju43FnS.exe*' - '*http://129.121.114.124/rkq*' - '*http://129.121.114.124/guI*' - '*http://129.121.114.124/eiZ*' - '*http://129.121.114.124/RA6Q*' - '*http://129.121.114.124/wKBF*' - '*http://129.121.114.124/kzWP*' - '*http://129.121.114.124/jE6H*' - '*http://129.121.114.124/PLy*' - '*http://129.121.114.124/T71*' - '*http://129.121.110.105/LXZk*' - '*http://129.121.110.105/q5S*' - '*http://129.121.114.124/NLx*' - '*http://129.121.110.105/Kz59*' - '*http://129.121.114.124/PYj*' - '*http://129.121.114.124/aaYS*' - '*http://129.121.114.124/b8r*' - '*http://129.121.110.105/oNrI*' - '*http://129.121.114.124/n2w0*' - '*http://129.121.114.124/91Gv*' - '*http://129.121.110.105/JwbV*' - '*http://129.121.110.105/i69*' - '*http://129.121.110.105/YlU*' - '*http://129.121.110.105/E3ww*' - '*http://129.121.114.124/rKrg*' - '*http://129.121.110.105/EpD*' - '*http://129.121.114.124/gSE*' - '*http://129.121.110.105/NYDR*' - '*http://129.121.114.124/oyk*' - '*http://129.121.110.105/tDv*' - '*http://129.121.114.124/Aum*' - '*http://129.121.114.124/BnSy*' - '*http://129.121.110.105/m6T*' - '*http://129.121.110.105/W8H*' - '*http://129.121.110.105/xzy*' - '*http://129.121.114.124/X1x*' - '*http://129.121.114.124/FbVS*' - '*http://129.121.110.105/JHkP*' - '*http://129.121.110.105/0KXs*' - '*http://129.121.114.124/pO8*' - '*http://129.121.114.124/ugI*' - '*http://129.121.110.105/evq*' - '*http://129.121.114.124/CA3*' - '*http://129.121.114.124/sBO*' - '*http://129.121.114.124/ZLW*' - '*http://129.121.114.124/WmD*' - '*http://129.121.114.124/qcZ*' - '*http://78.165.217.136:49067/i*' - '*https://github.com/dm-7926/dz-nvd/raw/refs/heads/main/m1n.zip*' - '*https://github.com/dm-7926/dz-nvd/raw/refs/heads/main/udm-m.bat*' - '*https://6leriop4.littleitalypizzafortwashington.com/?ublib=87e11ab2-4ab7-4e0a-a2eb-6905af906f9c*' - '*http://62.60.226.198/uploads/a4cf9d8ac7bf416ebe66db6ab0118a96.exe*' - '*https://kqgn.fg777jbg.net/923863d2-d705-4e62-b77e-1ddddd8ed997*' - '*http://27.215.213.228:33210/i*' - '*https://nfghq.kmmits.com/4411db00-6248-40a8-8f86-5b2080cc4f85*' - '*http://78.25.166.66:39654/i*' - '*http://123.7.223.22:50656/i*' - '*https://bkmu.ronarcher.org/2e88cd13-2ef1-4821-9e18-6a8f4df65aa6*' - '*http://123.7.223.22:50656/bin.sh*' - '*https://rzaxl.switch-vodka.com/09e0c2a8-3957-4a80-937b-4feb05cad4b2*' - '*https://es2utu9l.samsann.com/?ublib=80b0b16c-f5e6-4a28-aa12-9dfbb4153fad*' - '*https://ajp3btj8.nextbahis.poker/?ublib=70f50ec5-5265-4cf9-a6b8-c0bbbba02f5e*' - '*https://47sat9ax.corpuschristiairporthotel.com/?ublib=bd61a310-515a-4e4b-85b0-a59586b8c3fd*' - '*https://yefu.rftmacncheese.com/3b10b3de-8b96-4cad-bd4a-975e807a6af6*' - '*https://qlzqh.sultankito.net/a0d42674-b115-4180-9d65-ad4c3eaabc4e*' - '*http://222.137.144.151:57974/i*' - '*http://222.137.144.151:57974/bin.sh*' - '*https://sjhofpgpz.rahmagrill.com/24852d75-53ec-4403-a8a9-2443c3413b25*' - '*https://gygor.sultankito.com/d35229c9-6f9c-4744-997c-000e9553eb77*' - '*https://iqr1pfqd.okegass.net/?ublib=2f901ae8-0510-45d9-90f3-a22ff5236206*' - '*https://aabqjhcdf.quickandcleanfetish.com/38240cae-11c9-4bfe-84bf-d31a6955d83e*' - '*https://mtvhf.socialclub112.com/432de9a7-2921-4539-8716-a5700d2d45e7*' - '*http://46.236.65.163:44489/i*' - '*http://108.170.136.155:59012/i*' - '*http://46.236.65.163:44489/bin.sh*' - '*http://123.5.158.212:49654/i*' - '*https://pouulacmu.phogoldencow.com/69e19308-c227-4e1e-a439-83e8b86221b4*' - '*https://ktkxw.shimiaodaoflushing.com/7e1ec835-3fbd-46e1-bf2f-16c135b18a52*' - '*https://8hrhd061.noodlesbymomi.com/?ublib=5c06ebba-5495-4a7e-b9be-659530b8a60b*' - '*https://subterranean-mineral-map.garden/440ca003-deeb-445c-a659-c09c09c88610/google.ct*' - '*https://spamgym.asia/7a28b2c1-d858-4730-a6c5-efb8b85d586d/ton.ch/*' - '*https://vtneuluzf.pathfindersafrica.com/6d80fda1-7efc-406f-bb5f-3fd34a450e61/gc.key*' - '*https://datastream-hub.christmas/c3c0cbce-a3e6-4612-bbf5-63accda14d8c/tk.dll*' - '*https://uemdkef.webyek.com/641a2ef9-42a0-48ee-9f4a-0c0b22c3b680/gc.key*' - '*https://zzya.bigsertonnet.com/80533ec0-75d2-4ca7-8fdd-153d0ba9d2f2/goog.ct*' - '*http://submerged-continental-shelf.garden/f600ff02-9b3d-437d-9f2d-da6a8bce13f0/google.ct*' - '*http://subdermal-biometric-chip.garden/d1fa4263-ad4d-4996-902e-9b346fa63d07/google.cl*' - '*https://ipsw.jetbet1.pro/11d7702e-18e8-4857-9e35-56cdf1ee063d/pf.ch*' - '*http://correction-pancake-seissy.courses/0085c648-3ab0-4c14-8cdc-ca79cba7700a/google.ct*' - '*https://xvc.motorbook.xyz/f553f21c-c901-47ba-9c99-529b4de5244d/google.cl*' - '*http://meadow-observability-core.garden/d51d997c-ac95-43e6-b436-c2c24e946c31/google.ct*' - '*https://cess.digishart.news/b1ad7276-9078-4de0-9bf4-896dfffa2264/pf.ch*' - '*http://meadowworkflowframework.garden/92649efe-7014-4314-8cb5-1d4b8517f4b2/google.cl*' - '*https://dows.sabad724.bio/95460196-1102-499d-9e6e-cd30b5a0cd4f/pf.ch*' - '*https://e.perspolis.pro/0fce9b5b-bb28-4c42-8d94-b381ed3944b8/pf.ch*' - '*https://asset.tasisathosseini.shop/bf1f72a0-1c71-4660-b1b1-40aa61cce93d/pf.ch*' - '*http://diphtongspecialchess.courses/8ab05d4b-08d8-41d4-925e-37f856bcdc23/google.ct*' - '*https://wgbkut.bet1roulette.com/be2375af-515a-4f60-a122-938bbd3f41c8/goog.ct*' - '*http://analytical-traffic-audit-record-file.wiki/21e19164-f354-4f6d-a26e-ea3c43ac773a/google.ct*' - '*http://stealth-bomber-radar-cross.garden/e0590aee-5a6b-492e-942f-43a332afd22a/google.cl*' - '*https://pfdtgkn.1bonus.bet/515286a1-6ad5-4777-bbf6-4ad3d5b49b5e/gc.key*' - '*http://leniniansexualbeginner.courses/08992efe-1d68-4486-8c19-fca8166fd914/google.cl*' - '*http://hppbtwyk.petal-growth-platform.garden/b08c1ddb-f037-4878-a85f-e2ccd6a769e6/google.ct*' - '*http://irrigationautomationhub.garden/99c57f7c-dcd4-4058-b88c-654819a34ef4/google.cl*' - '*http://agilebee-federate-growth-net.garden/69de6905-f1fc-408e-a612-a49a123cfe40/google.cl*' - '*http://virtual-pipeline-ten-it.courses/c352daa7-9e4e-4364-ad54-895ed35f9349/google.ct*' - '*http://edge-processing-network.wiki/c850bf60-243d-4cbb-b6ab-80f4def598ab/google.ct*' - '*http://seducingdelirium.surf/d2fb5564-3186-4722-98b3-a575e24ae86c/file.name*' - '*http://phase-shift-bridge-driver.garden/77ba6dfa-c0e0-4c28-982d-42f0146fdf04/google.cl*' - '*http://focus-mutovka-transfer-able.courses/a87982c8-b7e5-4323-8793-3b7232b68d90/google.ct*' - '*http://telemetrymesh.christmas/5a76e756-755c-46f4-bd25-fc5fb284423a/g.ch*' - '*http://root-system-irrigation.garden/8e8886f4-b375-4200-b706-eb380ebd0c17/google.cl*' - '*http://linguisticpuzzlesolver.christmas/d2cfd9d2-c83c-49b2-a54b-ae75333809dd/g.ch*' - '*http://infra-blue-high-print.garden/952d956c-4c8b-4d29-88b9-cda2b45adca7/google.cl*' - '*http://formkey.asia/d01af252-520e-49c5-bb8f-dedf96636d23/ton.ch/*' - '*http://hydraulic-actuator-valve.garden/fb3bee94-2817-46e3-b438-f2740a893218/google.ct*' - '*http://boblegvlist.christmas/2f58e8cb-6b6d-439c-97ec-6892fd7e9f07/zone.id*' - '*http://evergreentimberland.garden/aa85d475-72f2-4c64-9cab-57a7c8a4d3be/google.cl*' - '*http://holographic-projection-grid.garden/159a828e-c534-4ba8-b296-a70d4e6d7c01/google.cl*' - '*https://nxbv.sabad724.bio/9957f452-10ee-4604-9013-043730dd6937/pf.ch*' - '*https://greenhousemanagementengine.garden/8e0bfd9b-16bb-49de-ac8e-67fe2343371f/google.cl*' - '*http://meadow-observability-core.garden/aec518d1-92cf-4177-93a0-8228b8eef37a/google.ct*' - '*https://stp12.zabanenglishanari.xyz/f3c25482-2c44-4797-b0ac-c846daebee10/pf.ch*' - '*https://fds.jetbet1.online/4f3fcb88-9fb7-4fe9-8b62-4543a7de211b/pf.ch*' - '*http://fgbojhem.meadowprocessingframework.garden/fc3759bf-7e4e-41f2-a5d8-08a0b0dbd2b9/google.ct*' - '*https://kegeskyvw.sky7bet.casino/eabad912-3146-4f47-8ab9-bc3aaa13245e/gc.key*' - '*http://linguisticpuzzlesolver.christmas/237e77e4-e9dd-4832-ac74-7c08e36f8b19/g.ch*' - '*http://hypervisor-resource-grid.wiki/ecb2c516-4dc5-407e-a9fb-45e197c7aee6/google.ct*' - '*https://hgf.betfootbal1.com/cc26e844-5b30-4509-96dc-b06511806d17/bn.js*' - '*http://magnetic-levitation-train.garden/8790629d-d563-4917-87c0-4eae804e32e6/google.cl*' - '*https://gardenworkflowhub.garden/07065795-2495-45fe-9eb8-118832615332/google.ct*' - '*https://system-analytics-pro-guide.courses/8d542bfc-9171-410e-a43b-da5e9aae9c02/google.cl*' - '*https://ffyd.bahigo90bet.com/9ed36db2-dcb6-4c24-a1a7-2ad7c447709a/gc.key*' - '*https://crypto.betfakade.com/362f7789-461f-4890-9be3-2ac974c574b6/google.cl*' - '*https://esim.riverpoker.xyz/0eb706b2-ffe6-44f6-af5e-6995ac2ad8de/pf.ch*' - '*https://dvunixht.boroo.bet/666f5206-8f18-4374-8072-0c85859efdd4/gc.key*' - '*http://edge-network-on-hub.garden/f3c6c3f5-169c-4097-a716-caab93df632d/google.cl*' - '*http://baking-stone-thermal-mass.garden/74e5c988-4e1e-4b99-a3ad-2738f83a9000/google.ct*' - '*http://automated-sprout-labs.garden/bf6dc6b0-6316-4b67-b154-ca62d7502392/google.cl*' - '*http://botanicalprocessingengine.garden/a378e22b-2a49-4bb9-b54a-b4190c4edaa7/google.ct*' - '*http://mixed-on-storage-layer.garden/034bb288-66b3-4e1e-b8e6-247b202f7a5e/google.cl*' - '*http://floraresourcecontroller.garden/cfd2548e-d215-4117-8ece-17c3ee97e0ec/google.cl*' - '*https://sjc3.sabad724.bio/36580b02-9d9c-4a93-81a8-46f87779e789/pf.ch*' - '*http://tuplediskdkey.christmas/75a0c85c-cd34-4a9f-b671-b0a65c1638c5/zone.id*' - '*http://vintage-vinyl-restoration.garden/3cedeea1-8854-4539-af98-81e1310b6891/google.ct*' - '*https://thbejli.1xbeet.site/b117d7e5-0832-4ed3-af04-6f9e86ad813e/gc.key*' - '*http://containerized-plant-system.garden/35496a56-d84b-4eba-b61c-3e6370ecfc9c/google.ct*' - '*https://zjzffhbgt.efbetfarsi.com/6799cbdc-0585-44a3-91c5-c9f34d9f85ac/gc.key*' - '*https://kft.betball90kade.com/219338ea-00df-42ec-8c40-c3f78cbe68a7/dep.goog*' - '*http://botanicalprocessing.garden/474a6131-4608-4b21-95b8-4f47dd2a8766/google.ct*' - '*https://stg.1xfa.xyz/ddd40028-cc09-4fd5-96ef-36e91b5fad7a/goog.ct*' - '*http://ziti-multicooker-hacks.garden/f30eba81-4c5a-4080-a057-6df524e69f8c/google.ct*' - '*http://docsfan-flora-ability-system.garden/8f9c1eec-d56f-4a79-8274-ad9c72dbc6c4/google.cl*' - '*http://telemetry-grid.christmas/1372c504-375d-467b-9978-c2d199db2a80/g.ch*' - '*http://meadowprocessingcenter.garden/f2670c83-6691-485c-823d-bcc616e1e44a/google.cl*' - '*http://bcypppaq.asynchronous-growth-platform.garden/cc331331-caae-4f0b-a600-0d2f7330553a/google.ct*' - '*http://distributedgardenanalytics.garden/e2f7316c-f595-4f54-a6b3-acf48e330f4c/google.cl*' - '*https://pdf-srv.pdfbamaa.com/6d820228-fe3b-4240-98d7-bc2c5312e288/pf.ch*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 5 id: bcbf51ef-6931-5009-b910-915ff129e8c6 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 5). logsource: category: proxy detection: selection: c-uri: - '*http://virtual-routing-gateway.wiki/58ca6267-9c52-473b-a724-01e4ee71f78e/google.ct*' - '*http://codepit-rized-denengine.garden/f09ff42d-b909-4ff1-a435-32f0ac22a206/google.cl*' - '*https://ojpqxkm.one1x.bet/d974017e-43a8-43bf-b31b-804c70fad1a3/tf.ch*' - '*http://chickencutlethacks.fit/7322572c-c26a-4597-9a93-65fdebc11653/zone.id*' - '*http://signal-routing-framework.christmas/b369cfdf-60da-436a-9787-a65c01cdb3d3/g.ch*' - '*http://quantumvelocitylabs.christmas/78875570-5e84-486b-a61d-0005477244e6/g.ch*' - '*http://abandoned-asylum-expedition.garden/34701e8f-b8f0-4cce-b0cd-136c4553dbb8/google.ct*' - '*http://distrib-ost-penal-network.garden/6c92e176-5808-4b4f-9a53-360594bcc9ab/google.cl*' - '*http://backyard-harvest-planner.garden/429e5532-8c10-4da4-9aee-c2eec2d23872/google.cl*' - '*http://dengrep-resource-opencut-engine.garden/04c77659-d8ad-4025-a7bd-72ae821ca6cc/google.cl*' - '*http://meadow-observability-core.garden/99f784de-bd42-4afc-aef6-7881bdf3b17d/google.ct*' - '*http://ice-evergreen.christmas/6d7f4205-3be6-4111-b787-b7f7655dde07/zone.id*' - '*https://tuplediskdkey.christmas/6ecc93e0-b991-4fcd-a283-3e2fa1854582/zone.id*' - '*http://asynchronouswatering-system.garden/75aa3eb1-b155-444d-b5c4-d470f2b0c78e/google.cl*' - '*http://nxbv.sabad724.bio/9957f452-10ee-4604-9013-043730dd6937/pf.ch*' - '*http://pigtweet-kitdiff-it.christmas/1826589a-96d7-41c7-bf01-e6af60b1b115/zone.id*' - '*http://petalprocessingplatform.garden/fb173cbf-a417-4bb3-a8bb-90c095caa7a3/google.cl*' - '*http://hasmysql.christmas/fa603fda-db92-4076-9c6c-a89fa306b822/zone.id*' - '*http://federatedplantmesh.garden/9ff95e8f-34a8-4304-a526-fbdb2e2f349d/google.ct*' - '*http://neural-atlas-code-flat.courses/6c30840a-96be-4de0-ab56-885512b6a791/google.ct*' - '*http://gift-harbor.christmas/9ec27899-ba4e-4ba0-abf9-fa9e99593a25/zone.id*' - '*https://kzqlbit.sargarminovin.ir/0b8802d9-c4de-434f-8ead-7417f801bed0/gc.key*' - '*https://balancer.sabad724.xyz/55916664-4280-4560-b2dc-a390d580a331/pf.ch*' - '*http://leniniansexualbeginner.courses/d272ec44-3cb4-452d-9dd5-3dd48da53788/google.cl*' - '*http://system-analytics-pro-guide.courses/3da71941-fb0e-4331-ab54-9a79c00560e4/google.cl*' - '*http://stack-control-plane.christmas/eb055f0d-3036-411c-96cd-c7c7d05eb8e2/g.ch*' - '*https://rwcxxew.takbetkade.com/aa0c63b8-2358-4e3f-b816-c29bb46aff93/pf.ch*' - '*http://botanicalresourcecontroller.garden/aecf995d-327f-468d-99a3-86a9d06e1c0a/google.cl*' - '*http://expert-trading-academy.courses/65efc533-b83e-453a-b077-40dc11bfc29b/google.cl*' - '*https://nbv.prozhedownload.com/d3dbf8c3-6e72-4c90-ab16-ee266cf1d38f/pf.ch*' - '*https://ylfsby.n1betiran.com/4f422ec6-2f14-4347-9fca-8e917af0dba8/google.cl*' - '*http://stg.1xfa.xyz/ddd40028-cc09-4fd5-96ef-36e91b5fad7a/goog.ct*' - '*http://crispy-chicken-cutlets.garden/84e13c57-44fb-4a10-b48d-e94f63c9fc0a/google.cl*' - '*http://pub-f3382215b.1x1.cash/547c583f-542c-4374-a052-318589ca426d/goog.ct/*' - '*http://virtual-session-broker.wiki/dfc0d53a-d334-485d-8e2a-c27cc2d332e8/google.ct*' - '*http://glow-hub-herboron-sixoauth-work.garden/a4ee093e-4d2c-46b2-bcc4-07200a431043/google.ct*' - '*https://rwszncq.1bonus.bet/f67b2176-9be7-4244-b0f0-b7525c8410f6/gc.key*' - '*https://impur-treacheryperepelitsa.wiki/18924f17-62b7-43ce-b148-cd10bd5b180c/google.ct*' - '*http://federated-storage-cluster-system.wiki/f4b68dac-766d-43f1-85dc-a66eb321db00/google.ct*' - '*http://kft.betball90kade.com/219338ea-00df-42ec-8c40-c3f78cbe68a7/dep.goog*' - '*http://seducingdelirium.surf/c172d30d-a998-4815-a840-508f7cc098aa/file.name*' - '*https://c868.mabanishimi.xyz/6e91d58f-acdf-4ead-9a8b-853efda41a3d/pf.ch*' - '*http://wildfloragrowthsystem.garden/6fe1707e-a98f-4f73-8157-3b6a892fb21c/google.cl*' - '*http://packet-relay-engine.courses/e0d45b33-d679-49cb-bb09-cdb8deb90b47/google.cl*' - '*http://distributed-cache-storage-layer.wiki/807c3881-26e3-42b3-8737-15fdc96d991c/google.ct*' - '*https://lancer.shartboro.xyz/f599839a-06d8-4cd1-a1f9-e53d806052af/pf.ch*' - '*http://irrigation-control-network.garden/659ff5a6-9d6d-4f6c-ba32-75f10cdef407/google.ct*' - '*http://chronicle-archive-keeper.garden/385d21df-cce5-47e2-9dd4-c0bb9ed6bc55/google.ct*' - '*https://vygy.betropol.bet/7739fb0e-6287-48b1-897f-8b51f8ad683a/gc.key*' - '*http://tectonic-fault-seismograph.garden/bf5deffb-d9f1-44ae-9bf6-8a2b0e4c8341/google.cl*' - '*https://tt.falsafekonkour.site/73fe9118-7db1-4755-947a-f286b3b4e7b4/dep.goog*' - '*https://euphemism.1xfa.xyz/2ffc4ddb-7b9c-44cb-b774-bf347ec8c2d2/pf.ch*' - '*https://flwhdzos.1xbetmag.com/b07c151e-b14b-4d22-9f78-352b9ca3c9c1/pf.ch*' - '*http://meta-data-shredding-cleanup-utility.wiki/8f17c972-8dcd-48e2-9699-dd33797c674c/google.ct*' - '*http://brightestprocexchange.wiki/7eb749d9-f1bd-4d75-9e6a-ca1ed72667d7/google.ct*' - '*http://vintage-telemetry-receiver.garden/4f8006b4-9542-4bdc-8297-abe7ef4b020c/google.ct*' - '*https://vxcvebyr.btyek.site/fbf89bd0-87ae-45e1-9c0d-5dace534f4a3/gc.key*' - '*http://graphnewclass.christmas/b2160fdd-7269-4c68-8d6c-d5efad920c71/zone.id*' - '*http://flora-monitoring-core.garden/ca2b3a34-e3eb-4101-9b45-77579341b4df/google.ct*' - '*https://sjnpuvmy.bazisangkaqazgeychidancepoli.com/208fba33-ae9a-455b-ad57-7dd7491e1f73/api.rkey*' - '*http://distributed-cache-storage-layer.wiki/424567a5-eb5c-4b5e-bce3-eacf5b8df971/google.ct*' - '*http://labdjang.asia/ca6dcb4d-a7bd-4116-80f4-992b542c3567/ton.ch/*' - '*https://jkiw.1pishbini.com/710aa585-5487-4d98-952e-476796dc4d2b/goog.ct*' - '*https://ocgziav.test-ranandegi.com/6ab79bdc-73bc-4443-a287-1ed4408d3d34/gc.key*' - '*http://tt.falsafekonkour.site/73fe9118-7db1-4755-947a-f286b3b4e7b4/dep.goog*' - '*http://stackforgeacademy.courses/5c7004ae-5b57-4c34-b69f-b89ea7bedad7/google.cl*' - '*http://stackbridge.christmas/e5a01d55-d272-4e70-97f5-32f8da384549/g.ch*' - '*https://ewwfvy.bet1roulette.com/35bccc8e-e386-41c5-a983-5b74dc359fb6/goog.ct*' - '*https://sftp.maharatmodiran.xyz/e954485b-3042-4a53-bcf6-19bd8559d3ec/pf.ch*' - '*http://meadow-processing-core.garden/64bf73d9-7ab9-4010-bd91-6139f28aabc6/google.ct*' - '*https://nrksxqlgm.101motorsports.net/65f39603-026a-459e-96a1-cf7b2054b061/gc.key*' - '*http://baking-stone-thermal-mass.garden/98c54476-c660-4cde-8092-13f3f903c8a1/google.ct*' - '*https://xlkgryx.penalty.casino/26947f0f-164e-4919-bad3-63fce3edeee3/tf.ch*' - '*http://frost-marketplace.christmas/71e79d24-b3c3-4cf5-ae3c-b2dd7835ef59/zone.id*' - '*https://jjg.abt90shart.com/f83ad892-753c-403f-b0a9-17abbe0b91aa/pf.ch*' - '*http://byte-stream-encryption-standard-base.wiki/c64d4fb9-ead4-41fb-9029-6664aaef4b24/google.ct*' - '*https://github.com/dm-7926/dz-nvd/raw/main/udm-m.bat*' - '*https://github.com/dm-7926/dz-nvd/raw/main/m1n.zip*' - '*https://vtneuluzf.pathfindersafrica.com/6d80fda1-7efc-406f-bb5f-3fd34a450e61*' - '*http://119.114.152.67:56396/i*' - '*https://zaflv.senorgyros.com/aafdf4f7-6a58-4791-81c6-3509d0b01cea*' - '*https://ddj8f1ro.ruralrouterust.com/?ublib=e04186f5-ea51-4301-af9d-843cadba491e*' - '*https://nsbnqzdnv.pathfindersafrica.com/96efb0d6-e57f-4c82-bca9-aa42392dbaf5*' - '*https://p43qsij4.nextbahis.one/?ublib=b030b8fc-8b9c-4ad8-9b33-3554b0984efd*' - '*https://jeekd.senorgyros.com/8ead5b91-652a-4381-a42a-f5b038d19333*' - '*http://119.114.152.67:56396/bin.sh*' - '*https://23.27.180.36/icons/108*' - '*https://jsonhosting.com/api/json/e16583b1/raw*' - '*https://jsonhosting.com/api/json/3ea04c38/raw*' - '*https://filament-zap.vercel.app/service/assets/fetchBinary*' - '*https://jsonhosting.com/api/json/f1a66ab0/raw*' - '*http://123.12.234.194:36402/i*' - '*https://vwpanxmoc.orlandosmuncy.com/9405a702-74fe-4399-a260-180bfc6ad07c*' - '*https://yvzqh.hazaratbet.game/654d4f01-0b10-4a37-9bf7-0f776e4eaf1b*' - '*https://jifyi.gamehazarat.com/7f36ec19-3fac-44af-99b2-c7951863f721*' - '*https://7uaho90m.myluxurykitchenandbath.com/?ublib=169aad7a-f72d-48b3-b94d-d5acc64eed7a*' - '*http://123.12.234.194:36402/bin.sh*' - '*http://182.113.45.51:57826/i*' - '*http://123.10.143.34:45383/bin.sh*' - '*https://kgptwmgqf.taktikkbet.com/ed043999-1b44-4f74-9567-af7f6a924982*' - '*https://lbtzq.funxbet.casino/43549fd6-7800-4c87-8705-fbe79cbd7c94*' - '*https://yblfhadfu.mango90bet.com/4c6146f1-11cd-4268-98cf-fe98a519d427*' - '*https://rmxohycah.sky7bet.casino/88cbdf70-e54d-4d15-80c8-6ea2692bdd6e*' - '*https://heork.derbi.promo/e7b03feb-46d2-4e40-b088-c64649ad2433*' - '*http://61.52.172.124:56962/bin.sh*' - '*https://8862moud.mikespizzafairfield.com/?ublib=248d863c-9953-4ba1-8311-357833fc01da*' - '*https://uvxzsajar.lion1bet.com/50e0e0ee-0f02-40e1-a6c3-8e1fc242c721*' - '*https://mpuwd.deepspaceparker.com/83c48f54-3720-427b-a093-b64f5ffcd66d*' - '*https://atqfb.calirayalake.com/e0b68956-6852-40f7-a9c0-212b646cc5a7*' - '*https://jppxuuhae.imagederm.com/ee204b50-ce64-4666-a796-d47c131311b7*' - '*https://5ipju606.venus90bet.com/?ublib=6bb30fc5-584e-4d29-9a05-0f20337df1c2*' - '*http://110.37.127.45:52145/i*' - '*https://hdz7omr1.nextbahis.blog/?ublib=00d4f7ea-16b1-41d6-af41-493405c20829*' - '*https://i0bep9cj.medallionfoodsinctempura.com/?ublib=7c37f001-8260-46b0-bee9-82b217b2ec2e*' - '*https://olyqj.luxurygoodscaree.com/72b6a9eb-5d43-42ca-bed2-c68c30e3680d*' - '*https://dogfrpygx.hazzarat.com/22b404a4-79fa-424c-b6a7-0305e39e96f9*' - '*https://acvwd.lunapizzaco.com/c5f9bf04-f5ab-41ba-a2bc-57320785bb3a*' - '*https://ubwzdjejr.fun777game.org/d60dfc8d-b516-4111-843c-585ebd2b04cf*' - '*http://112.237.10.53:36676/i*' - '*https://4j6m037n.mcbelize.com/?ublib=85f2c8d0-1468-4b04-aa1a-5a99b75ea8f6*' - '*https://tygnu.lokercorp.com/9b90f956-086c-443c-8e77-d45929d961fb*' - '*http://42.226.75.55:48400/i*' - '*https://cgocpkfgd.fg777tasya.net/0be63bb9-ee10-4796-86ae-025c2853d718*' - '*https://cvyfg.kopicoffeeco.com/eaceebcc-f71a-4197-bc59-c4d7999dda4b*' - '*https://isrjnxfeb.fg777kito.com/bdb0016d-67f8-4a83-884c-939ef66be9c7*' - '*http://182.127.35.76:41368/i*' - '*https://nle3gi30.makingreview.com/?ublib=21d76ddd-5648-48ba-bf02-893c39cf9bcc*' - '*http://182.127.35.76:41368/bin.sh*' - '*https://nyenf.kmmits.com/4fac5202-4bbb-48f9-8f79-ffe8fe092038*' - '*https://cqjeqfltg.fg777jbg.net/af4e09e5-b8fc-4dfe-9044-2c651e35adfa*' - '*http://115.55.222.169:32872/i*' - '*https://no3htbxq.varzeshlife.ir/?ublib=a57307d3-16f3-4dbc-ad32-6d083137be20*' - '*https://y4h1lqu6.jadoou.lat/?ublib=b3338826-4dd6-4f36-8542-7964e2e114b0*' - '*https://uoxqk.kampongflowers.com/193b0ea0-54ea-412f-abc9-abdef30880bf*' - '*https://mcdejwixr.fg777depo5k.com/ecb842c1-5988-48f4-a938-6ac1bbc21e1e*' - '*http://115.54.151.222:41444/i*' - '*https://fiwvrsju.yekbetyek.com/?ublib=5bd14b87-0af8-4e11-916d-f24263fc7bf9*' - '*https://xwuuj.juragansolar.info/6347b051-fa25-4db4-8c3a-f804ad9763fd*' - '*https://xwjoalrqt.evohempstore.com/1ca60080-3e9c-443f-964d-c451f1c80ca2*' - '*https://yqlmrtdrf.event-scatter.net/b9176033-a58d-4a9a-a70a-af6697eb74f4*' - '*http://123.4.232.250:36156/i*' - '*http://27.202.212.132:44878/i*' - '*http://123.4.232.250:36156/bin.sh*' - '*https://gxcgc.jobsindeep.com/81d9b20b-8545-4ac7-b5f9-4da120f8d82a*' - '*https://wblfdanab.ethanhartyblacksmith.com/c2c585fd-1051-4ffb-8075-4c23e33ff10f*' - '*https://9t8bbts2.winston.bet/?ublib=cf714ffb-cd20-41f0-8b96-44baf201026f*' - '*https://lvdit.jenderalkito.xyz/50585acd-c3a4-4a98-be27-9dcb25d79c35*' - '*https://zafnuzmgt.emergingtalentllc.com/8d65c342-f9b6-4683-8b54-1c60fb2ad3b7*' - '*http://120.84.214.57:35671/i*' - '*https://pgfiv.jbgroup21.com/e887731f-9842-4886-a6a2-bbb588c2e5e3*' - '*https://maytwilcz.easternartmuseum.com/e30a5555-b3f7-4fa4-a367-39bb0c5baeb2*' - '*https://6mhijma6.tampabayspin.com/?ublib=58bc177a-ec4c-4834-8058-48b1c8880d42*' - '*https://acslkqpil.easternartmuseum.com/e8991979-98bd-465b-8632-7f82a934718a*' - '*https://nuqx7vo8.jadoobet.pro/?ublib=cb4185c1-4179-48e1-8ce9-dce5abeb48cc*' - '*https://5uat7o6m.pdfbama.com/?ublib=ea3ebccb-8934-4ceb-97c2-f05bc5b39f9a*' - '*https://eqxun.jayswraps.com/04738ac6-ec94-41c3-a327-ad2edcab661a*' - '*https://kmtdw.jayswraps.com/7838f4de-731a-4437-a7cf-c332e40acb32*' - '*https://rxaveihpg.drdavidzweiback.com/bb87a342-5664-4d66-a20f-47e5ebfaab93*' - '*https://vddrs.inkbossstudios.com/0299e008-d848-4e89-b7ee-f100bc8e5d8c*' - '*https://eabcewlhe.diloro.dev/c86e49ee-271c-4342-823c-7e4d762b3cd5*' - '*https://2lob5o1r.betbuf90.com/?ublib=ced7db03-a830-42fa-ba0a-4fd9aa483504*' - '*https://lmkxs.imagederm.com/c6c97233-a13a-45b1-aa61-05133d0ae3ca*' - '*https://beqbfjhnf.deepspaceparker.com/cb71c505-7ad3-4f95-a83b-b242574ab590*' - '*https://tiwdt.hazzarat.com/2e0a4ae6-ca52-4e97-92b4-bee8f79dc919*' - '*https://qzfhwillb.crazyhotchicken.net/419c651d-3ac0-4908-8a90-b91b09cfd002*' - '*https://sebw9xod.site-asli-bedon-filter-1xbet.com/?ublib=a4e3924c-ee0c-4fc4-875a-7395e6d6532c*' - '*https://3u06kg6l.onjabet1.com/?ublib=be80d80b-ea38-4df9-9dac-90a460157282*' - '*https://cgavi.derbi.promo/d6e80fff-2e24-465b-926e-f0e34cf98afb*' - '*https://prl0ivfr.hazaratbet.games/?ublib=2f73f89c-5f7f-40bf-8f90-14c99a3a997c*' - '*https://cachmkcqj.venus90bet.com/b50caccc-2a36-4eac-8794-4b7691a07688*' - '*http://182.127.168.154:47418/i*' - '*https://dtsmmaphe.tampabayspin.com/b3dbeb0a-c3be-456c-8be4-483b3b9aa9e6*' - '*https://caudzzwo.coop-fresh.com/1fa1a94e-c978-4007-ad34-bc36137cc1db*' - '*https://mlmaatvd.behtarin-site-shartbandi.com/?ublib=6b23d349-5136-417f-9963-dcbcc6a2f93c*' - '*https://galdum.ro/.well-known/pki-validation/bin.exe*' - '*https://djqiyxyx.calirayalake.com/a44ffab3-a516-40d3-b374-99a4528e5dd3*' - '*https://gkpaspaky.taktikkbet.com/8176d0b4-cbb9-4d74-aac9-e56f3221c9b6*' - '*https://gdtuyoor.gamehazarat.com/bf907055-15a3-4c05-aa55-f4282b144900*' - '*https://xfakmoduw.lion1bet.com/784bd67f-c023-4766-b599-adf2152d6189*' - '*https://8kq7qw7a.site-takhtenard-sharti-betland.com/?ublib=d67983c4-a644-44a4-a973-c24a4a018f8e*' - '*http://110.39.255.92:58416/i*' - '*http://91.92.242.236/files-129312398/files/file_9c2b9457cc9be247.exe*' - '*http://110.39.255.92:58416/bin.sh*' - '*https://wtkxprzu.funxbet.casino/16ea8481-3c31-4731-94a3-6cd4deb7745b*' - '*https://hzdmfcatc.sky7bet.casino/a4c342e5-03b8-4ed5-96c8-2442dae29d40*' - '*http://123.14.37.247:49617/i*' - '*http://42.239.246.177:48714/bin.sh*' - '*http://123.14.37.247:49617/bin.sh*' - '*https://vzsagfrw.derbi.football/a02b928d-c48d-4e91-a56e-b2f83f3a22a2*' - '*https://dvc734k1.hazaratbet.game/?ublib=72cb809a-c116-4cc8-986e-8a84d448199a*' - '*https://3x6v81kc.varzeshlife.ir/?ublib=9b8815ae-acf4-431e-a447-43d509809dc9*' - '*https://lhozmsokb.nextbahis.coupons/e8c2bba0-5bd1-43e4-93be-564b396e1fd1*' - '*https://eogwp3fe.site-shartbandi-pasor.online/?ublib=bcad3ea3-4741-4fee-ac5c-0afe561e6974*' - '*http://110.37.99.98:51865/i*' - '*http://110.37.99.98:51865/bin.sh*' - '*http://115.51.96.67:54272/i*' - '*https://pygnidup.gem90bet.com/f7acb2d0-d33a-4993-90b2-f65f68273383*' - '*https://dsdvsvqgy.jetbet.download/3132a032-1ae9-46a0-8ace-28746947f5e8*' - '*https://dlylkjaji.jetboro.fun/510aa0a0-d2cb-44e8-9f88-ff17a8893c33*' - '*http://110.36.26.134:41357/i*' - '*https://bgtnaqoc.fileboroo.com/8d0ecdf8-756a-421f-ba9b-d9bb001ac817*' - '*https://aefauhqwk.irani-music.com/52d561b5-b166-4aca-a561-96ee624363fc*' - '*https://iodz0i3f.behtarin-site-shartbandi-football.com/?ublib=e866450f-8093-4490-baff-a1bd8c740acb*' - '*http://41.216.189.236/nz/nz.i468*' - '*https://arvujwijm.irani-music.com/a892a6a3-4cfe-4227-bf44-35269c9f0eee*' - '*http://144.172.103.226/301/tokenlinux.sh*' - '*https://drive.google.com/uc?export=download&id=1Y4Di2kSB6tnWnVSOkS581g_wJgeu_BpT*' - '*https://itwynsuh.enfejartime.com/ad836539-a545-496d-a687-fa356ae76372*' - '*http://43.228.157.47/bot/bot.py*' - '*http://222.141.10.41:52985/i*' - '*https://scjzlqeyk.hazzarat.world/0de0d410-4251-423e-a572-31f8b40404ac*' - '*http://119.116.39.34:59036/i*' - '*https://suwqmlyd.efbetfarsi.com/ed371ff6-ec13-4e1b-bdd0-eabebfc2537b*' - '*http://119.116.39.34:59036/bin.sh*' - '*https://6j7gyyz9.barkerautoms.com/?ublib=17ae403e-2e67-41d9-b238-2c92ccbdfdf9*' - '*https://wexltdqtf.hazzarat.com/3902b062-a126-4a46-a793-4aea7b924426*' - '*https://los16zn2.celebritiesadda.com/?ublib=ed72eb04-0eb4-4617-a76a-835e64bdfc9a*' - '*https://dy6t0cul.hazarat.now/?ublib=2ff3e0e0-ea5c-4127-8443-baabc1076d07*' - '*http://200.112.129.195:35411/bin.sh*' - '*https://ggitkzzn.derbi.promo/fc18437a-cadc-4b3c-8dfe-5de5e6db4655*' - '*https://nruyvebwd.taktikkbet.com/df8b7aec-41ae-4670-8a03-c80316760afa*' - '*https://ovbeoktk.coop-fresh.com/007513b5-b10c-4cf4-a4a0-0043cba73581*' - '*https://jorjsrfgd.lion1bet.com/630ae8f0-d46e-41b7-811b-f78de57357bf*' - '*https://u5dn1e6x.bazisangkaqazgeychidancepoli.com/?ublib=5c5507fb-8db4-45f5-8f9b-49c5ed0e5fbe*' - '*http://60.17.65.212:55483/i*' - '*https://chsxhscsh.tampabayspin.com/27615a17-9875-4ff0-912b-145a3e31ac3c*' - '*https://vkvmygpg.betbuf90.com/d147e820-cdb8-4323-9223-a10149783d9f*' - '*http://60.17.65.212:55483/bin.sh*' - '*http://110.37.25.189:51719/bin.sh*' - '*http://115.59.85.238:43968/bin.sh*' - '*https://rdusnlyzh.sky7bet.casino/ae01177e-9d8a-412e-9194-0461e1dadfee*' - '*http://222.140.185.61:38999/i*' - '*https://iqgxtjfc.hazzarat.world/ed06acdd-b506-4c3e-8a8f-8f4b809ea96b*' - '*https://a1h9t4pt.venus90bet.com/?ublib=a024b7b0-8127-45cb-b600-0b9ba3c40352*' - '*https://dvzzqxef.gamehazarat.com/b45e31b8-0984-4252-af42-194e80784a26*' - '*http://42.237.53.42:60067/i*' - '*http://42.237.53.42:60067/bin.sh*' - '*https://g3b4hjbg.calculadoracomisiones.com/?ublib=ffe1997d-9b1b-48db-ac6b-c13fb2567aeb*' - '*https://wig5l9be.calirayalake.com/?ublib=5860d163-98ec-4f94-99ce-d496cf0e6137*' - '*https://zdgfs8pf.cacharreriamilenio.com/?ublib=c7b95fcd-84d0-4607-a443-6c5dd3dc1ea4*' - '*https://ahxpqhqnc.nextbahis.coupons/909c03b4-cb3e-46ee-a0ee-7b11d431aa54*' - '*https://bkgtqeai.derbi.football/2233564f-6d03-4137-a7c8-b9e0d778c79f*' - '*https://eprqnfyeb.hazzarat.com/f9e59df2-38ae-4d8e-ad09-8d33a886fbfc*' - '*https://zetkskre.funxbet.casino/a9f9fe03-3951-4393-966f-29574f80f358*' - '*https://eqodjhwk.enfejartime.com/8ff1732b-e6e2-4c17-8d2a-4dff9dc008ce*' - '*https://drkynxdcu.gem90bet.com/59c8c774-acd0-4a32-a95a-6ba802d66e2b*' - '*https://9zzh7dnw.coop-fresh.com/?ublib=702cc10c-3f54-4334-b30d-73804b4e20b5*' - '*https://edhabqne.taktikkbet.com/53d38096-d3a3-4bbb-b872-723d7ae93876*' - '*http://61.52.172.124:56962/i*' - '*https://tjcmwnljp.fileboroo.com/4dc2ed26-953e-4207-8f84-e6e9bab422df*' - '*https://arpumupr.site-shartbandi-pasor.online/559123be-6f59-4e24-8c8b-91b38129cbef*' - '*http://110.37.59.70:48021/i*' - '*http://110.37.59.70:48021/bin.sh*' - '*http://110.36.75.201:43761/i*' - '*https://xyoyfdeyf.efbetfarsi.com/868dcbbd-4c6a-4ead-a27d-c9a1d416176c*' - '*https://pzsbygor.radioshartbandi.bet/a61cc0ea-2b20-4a6c-aedd-693f8c6c939b*' - '*http://61.53.74.145:56615/i*' - '*http://110.36.75.201:43761/bin.sh*' - '*http://61.53.74.145:56615/bin.sh*' - '*https://r4iuquzx.cookeatrun.com/?ublib=e1f3eea3-8ca8-48f2-b301-ae1e1ae47e5f*' - '*http://219.155.231.210:46580/i*' - '*http://110.38.221.60:44122/bin.sh*' - '*https://qfphjme9.irani-music.com/?ublib=ec588e7e-fd7e-4643-be13-634ddd05179a*' - '*https://ic7s8w54.jetboro.fun/?ublib=ccce121c-c919-4dab-9cc8-a9e81a95eb43*' - '*http://219.155.231.210:46580/bin.sh*' - '*https://ojwvrerrm.derbi.promo/294a151c-18a3-4ac8-bfe5-99c24277ad91*' - '*https://auucqutq.pdfbama.com/58f77a02-c575-4832-be37-baa0a69daff0*' - '*http://91.92.242.236/files-129312398/files/file_f11f2be46d0267d1.exe*' - '*http://222.141.81.195:50923/i*' - '*http://222.141.81.195:50923/bin.sh*' - '*https://maxwhywtk.betbuf90.com/a285bef4-0a7b-4125-bd90-e9f6bdabee90*' - '*https://hdjdchgb.onjabet1.com/c4231bba-f5e5-458d-99c3-db5d8b68911d*' - '*http://182.113.41.101:50789/i*' - '*http://123.10.143.34:45383/i*' - '*https://2rhdb98z.comfortinnlaytonutah.com/?ublib=5c79b58c-608e-4320-be1d-232f6cc1b377*' - '*http://115.59.85.238:43968/i*' - '*http://115.55.234.36:41201/i*' - '*https://lvppjubyy.barkerautoms.com/66e4f288-cb93-4b0c-b5fe-b76df32c0559*' - '*https://qkvgzbcv.nextbahis.promo/b1ce8309-dab4-48dc-af11-ff88ced5c6ca*' - '*https://zkgeaxbs.nextbahis.promo/3627f39c-afa6-4f7d-89d9-de54f36d9333*' - '*https://rmlgnuvje.barkerautoms.com/30271084-4815-4598-9c95-7a00844519de*' - '*https://uvzbxwuc.gamehazarat.com/af4be38d-c3ae-4330-8476-4a5eb4a9488c*' - '*https://694j5tdy.behtarin-site-shartbandi-football.com/?ublib=b22fda4b-cb43-4dbb-8139-176a580adf21*' - '*https://vwwbeohrh.apolloconeyisland.com/a54b5257-49cf-4818-be40-187474d319ae*' - '*https://bhcivpxh.derbi.football/5978b0a2-3018-4bc8-9a77-e6f8309068f3*' - '*https://mseikoean.allboroughrealestate.com/c0515420-2d42-4430-bb8e-12bd04e24ac1*' - '*http://115.61.120.4:56046/i*' - '*http://125.47.115.21:36322/i*' - '*https://x35w4q0s.varzeshlife.ir/?ublib=b212a544-3fe6-43f7-99f9-2a39666d2ab5*' - '*https://74ock8ke.mahbetiran.com/?ublib=5f1b585d-9443-4cd4-a33d-c443c5ca8ef3*' - '*http://222.141.44.94:59475/i*' - '*http://222.141.44.94:59475/bin.sh*' - '*http://42.228.45.102:41754/i*' - '*http://42.228.45.102:41754/bin.sh*' - '*https://vwrgeckmh.adsbln5.xyz/bc01c4dd-d739-4bd5-925f-3b75fa29305c*' - '*https://dqgfzcgm.hazzarat.world/f94bdf0e-61c2-42ec-b612-778cbf286086*' - '*https://y4d9qpyb.bazisangkaqazgeychidancepoli.com/?ublib=129565b9-8b6d-491f-903b-33bf5e9da44c*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/yCnnu*' - '*https://leo-deluca.gamer.gd/img_063641.png*' - '*https://fortune-66seven.com/fe6502e7eadd0f3f*' - '*https://drive.google.com/uc?export=download&id=14YCYW8Y7jcnuPhQhABkQE-A5QJaUTFlk*' - '*https://drive.google.com/uc?export=download&id=1tNKN_M6pFSqKcKTD4fJT0w5-I-TJRm-Q*' - '*https://pub-ce02802067934e0eb072f69bf6427bf6.r2.dev/ichie.png*' - '*https://drive.google.com/uc?export=download&id=17JuKVHJTntEuxmW7r-IwQeFaEcTxl94U*' - '*https://drive.google.com/uc?export=download&id=1A0Hsca32tu5urggy-7oAxNE7bNE0jCV0*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/LpcVJ*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/zKQgB*' - '*https://obele.rf.gd/img_015012.png*' - '*https://protector.great-site.net/img_034330.png*' - '*https://01pr.com.tr/shed/sdy.png*' - '*https://tturfmcfk.adsbln4.xyz/92adb49f-a237-46d4-8470-2e6a6f7f1b51*' - '*https://01pr.com.tr/shed/MSI_PRODJ5TH.png*' - '*https://bjoqbxxh.hazzarat.com/3b94f365-ff7c-4171-a162-0d0f59145286*' - '*http://112.239.103.49:51162/i*' - '*http://110.38.221.182:56766/i*' - '*http://202.163.107.242:59201/i*' - '*http://112.239.103.49:51162/bin.sh*' - '*https://buaoqtgen.adsbln3.xyz/78a3d13a-8472-442a-b942-789e4cc67aef*' - '*https://eastbwxa.funxbet.casino/2530559d-2691-4dda-8251-969dfee77c95*' - '*https://j112srgz.bahigo90bet.com/?ublib=973ef4ab-ea9c-4601-9e45-47bb8ee30648*' - '*https://ftcfotjnd.adsbln2.xyz/85d96ca4-d374-4bd8-a864-c8c3ef38384f*' - '*https://rzecbgjw.enfejartime.com/c24f5964-b8c2-4604-a208-58163fee6cc4*' - '*https://iygfxiad.efcasino.bet/0298c610-f747-409f-a765-014959fc8cde*' - '*https://zwydarcig.adsbln1.xyz/1eb9ab7d-f0c2-4dd0-b0d9-8451da50d873*' - '*http://110.37.64.27:33864/bin.sh*' - '*https://cdmke7zf.sky7bet.casino/?ublib=bad75b0e-1fe7-46af-ac0d-054f3dd77496*' - '*https://x78boe03.lion1bet.com/?ublib=c463b47a-159e-4f16-a6ad-6eaf34cef61c*' - '*https://cfplyjmq.efcasino.bet/9efca702-0e2d-4da8-aec5-7190633de2f5*' - '*https://jii17zh7.yekbetyek.com/?ublib=68d40786-3560-4c8d-8e09-a9082809af4c*' - '*https://isbbetvcj.adsbln1.xyz/fd23f916-faae-4ed3-a371-d19fe06bec5d*' - '*https://mzzetrvqf.jadoou.space/9bdda670-24a1-450d-8a33-3a951410bb00*' - '*https://xhbmcyyao.adsbln1.xyz/f4c00721-249b-4a5f-9122-b3c800ca2e2a*' - '*http://112.248.191.34:58806/i*' - '*http://46.236.65.155:56627/i*' - '*https://tufxszft.efcasino.bet/e050fb25-b98c-4995-89b0-f4488459ac55*' - '*http://91.92.242.236/files-129312398/files/file_2f177fcc719bb6e5.exe*' - '*http://42.226.208.136:59139/bin.sh*' - '*http://110.37.64.27:33864/i*' - '*https://sesaddf.kesug.com/img_071015.png*' - '*https://sesaddf.kesug.com/img_084800.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/FpMeR*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/tIIXe*' - '*http://91.92.242.236/files-129312398/files/file_21835aedbc8ad4e1.exe*' - '*http://46.236.65.155:56627/bin.sh*' - '*https://drive.google.com/uc?export=download&id=1XDCI_1kQupUqDw_2gS8MLd8gAH3egA-D*' - '*https://drive.google.com/uc?export=download&id=1xxJQhh9VIruQt1tRuyVayBvvMYUOLwL7*' - '*https://res.cloudinary.com/lhut8kxv/image/upload/v1784166040/img_184016_d7agot.jpg*' - '*https://deliverymailreport.co.za/img_053354.png*' - '*https://deliverymailreport.co.za/MSI_230953.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/BSbzV*' - '*https://pub-e6f64f05a00d4309aec9508777bc43bc.r2.dev/img_190159.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/FtqFC*' - '*https://protector.great-site.net/img_081312.png*' - '*https://mukmnvwls.101motorsports.net/7aa27017-c3a8-4900-a451-c97cd29cf9e2*' - '*https://businesseconomics.in/uploads/sp.png*' - '*https://drive.google.com/uc?export=download&id=1Ilj9nZvE-p9PYMCjy-EgwCUWtlyPAdS8*' - '*https://aupzcajq.biabet90.com/13cbd195-59fe-451f-9454-f05cdd9b00c6*' - '*https://drive.google.com/uc?export=download&id=1QxzE9i3wrtFwazkRx_2SNJjccz_4LZVW*' - '*http://123.11.10.128:48314/i*' - '*http://182.113.47.114:33161/bin.sh*' - '*https://wp8zfvuu.sky7bet.casino/?ublib=c9cea445-dcb9-46e2-8521-cd0d936d6b63*' - '*http://123.11.10.128:48314/bin.sh*' - '*https://5m1ugnlr.yekbetyek.com/?ublib=37f72ae9-db89-49b1-a034-23fb999b3c09*' - '*https://kgfkfhqgg.gem90bet.com/37272ac5-96ce-4469-8462-a478b04fdadc*' - '*http://123.13.96.86:41253/i*' - '*https://ohdvttqo.tampabayspin.com/988124bc-6865-4532-8213-99b59c138374*' - '*http://110.39.232.208:45430/i*' - '*https://fmgvaoemg.jadoou.lat/040fb16f-1e98-4a55-94da-d769e10c25d4*' - '*https://cdctvukr.taktikkbet.com/e34f523c-1bb0-45b8-9709-289f647a13e0*' - '*https://bgzdrdniv.venus90bet.com/14c82ad9-595b-40af-982c-09f642d03a5b*' - '*http://91.92.242.236/files-129312398/files/file_7d20fbf29474d0e5.exe*' - '*https://cdbxemdoq.toofan90bet.com/7fd271f7-1281-47bc-ba3e-de40c76a1504*' - '*https://6lphdepl.sibbet90iran.com/?ublib=d202105e-e3d8-4000-9015-6dcdfe6b3d8d*' - '*https://i365pptc.lion1bet.com/?ublib=86c0a5e2-5c4e-46b6-803b-5762e5cfc797*' - '*https://fcmznlck.hazaratbet.games/9a557e4c-7670-4054-933e-9316a6ff6813*' - '*https://www.faster-cdn-hk.click/Telegram_v11.2.4.apk*' - '*http://144.172.103.226/301/301l*' - '*http://144.172.103.226/301/301m*' - '*http://95.216.64.240:1224/main*' - '*http://103.79.185.121/a7891.sh*' - '*http://144.172.103.226/301/301w*' - '*http://95.216.64.240:1224/client/36/700*' - '*http://95.217.102.138:1144/s/30620700*' - '*http://110.37.99.98:34388/i*' - '*https://xquxoceqj.radioshartbandi.bet/1e0e9053-8281-428b-8a5c-90a8269ad0f1*' - '*https://qfammnuy.hazaratbet.game/f01c9d30-4bab-4a35-8b02-6193b316f81f*' - '*https://vqsoqrdq.hazarat.now/b741ed62-eedb-4b5e-9d74-69fad8d9d0c1*' - '*https://rmxixoixm.pdfbama.com/7788a2e7-8243-4e1c-bbbb-dcbfa85ee93c*' - '*https://zdjnhqub.bingobet.bingo/?ublib=a62d2564-ae2e-4f2f-a50e-efa65802d2cd*' - '*http://110.39.247.200:45916/i*' - '*https://vusjrbtl.fileboroo.com/c56230fa-e363-40b4-bf38-3e13bad15880*' - '*https://eturxuynx.onjabet1.com/31e1c486-d72e-4e5e-a36a-80f2001ad300*' - '*https://paevzvhgt.efbetfarsi.com/c326ce5d-9671-4c9e-bf49-d7a14009a29d*' - '*https://54snw6zk.nextbahis.coupons/?ublib=fd67dbdb-8ecb-4aa1-aef0-479dc1125151*' - '*http://110.37.68.106:58162/i*' - '*https://kfpjbqczj.jadoobet.pro/0239bcbc-af19-4da4-86da-92ea24cc3d44*' - '*http://182.116.9.39:50685/i*' - '*http://110.37.68.106:58162/bin.sh*' - '*https://nboshbzcj.derbi.promo/45c1568e-dc23-4f0a-9285-65d6114e12b1*' - '*http://182.116.9.39:50685/bin.sh*' - '*https://e2u97o8c.betbuf90.com/?ublib=cd26ff60-72fa-418f-9929-b0b6e5bed817*' - '*http://112.239.122.181:44587/bin.sh*' - '*https://jmlhfhrif.derbi.football/5b90f6e2-08ad-4737-8c1a-79126a11690b*' - '*https://tiojsrajb.gem90bet.com/1a463eee-cbe4-40f3-a566-b622b35bf0bd*' - '*https://doj7trs7.kenzobet.casino/?ublib=9945188c-1ee3-463e-abeb-f940248f4da2*' - '*http://115.61.241.61:35832/i*' - '*https://acnuzqcgq.daddybetiran.live/5d40ffb8-636e-4e5c-9da4-864240ae0c13*' - '*http://203.177.28.149:35815/i*' - '*https://jtbbsdahq.gamehazarat.com/56bc3749-bac7-4b00-8f00-5519d8fa47d5*' - '*https://ueirqemz.behtarin-site-shartbandi-football.com/?ublib=993b537b-b7ce-4db0-b41d-6b96c5f9d32a*' - '*http://203.177.28.149:35815/bin.sh*' - '*http://219.157.57.21:45482/i*' - '*https://aweubyemm.boroo.bet/e825a402-4c35-47d5-96ef-fa527eb1df5f*' - '*http://219.157.57.21:45482/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_cbe1090e05d3909e.exe*' - '*https://sndexiwvd.boro3.bet/14839883-a425-4261-bf0c-0a978b23d655*' - '*https://vvopvrgbi.gamehazarat.bet/58cd7cc4-d94a-4f92-8666-2f9c73326a17*' - '*http://178.16.54.109/last.exe*' - '*https://ulzjpypuy.nextbahis.promo/cc1231d7-9c0f-4966-8171-01d023bac2c5*' - '*https://xpzjxywai.funxbet.casino/6850f23a-b8e1-411b-b415-169fab976492*' - '*https://wj3om1ni.bahigo90bet.com/?ublib=fe1cafec-19a3-4cfa-80aa-7257f8917995*' - '*https://tafhu17n.nextbahis.blog/?ublib=09cbd437-3986-4cc3-8bf7-0a388b6d0fe6*' - '*https://qzjihweyr.nextbahis.poker/a1979532-c634-492d-bea2-ccf723616ab2*' - '*http://175.175.96.62:47695/i*' - '*https://borcwefhl.esteglal.bet/97115229-7e20-426d-b8f2-c9d2b99f0c3c*' - '*https://ajzzqcazg.nextbahis.one/3d1b418d-9c8f-40fd-905f-c847013762fc*' - '*http://62.60.226.140/files/7782139129/QbWm8Dl.exe*' - '*http://61.53.85.95:40375/bin.sh*' - '*https://rxxcydjgk.enfejartime.com/895adee6-db86-4b2c-b9c1-d70698e4c525*' - '*https://tsexoxslh.nextbahis.free/1dd9c90d-8937-4a65-a8ff-d4e541050d67*' - '*https://6fk656iq.irani-music.com/?ublib=55d15460-fb25-405d-b3ec-9708a3aeee5c*' - '*https://gai1ehyu.jetboro.fun/?ublib=53551fbd-ba3a-4fd8-8a85-ee4df9e4fc9e*' - '*http://110.39.231.61:53539/i*' - '*http://113.239.220.99:34276/i*' - '*http://123.12.224.248:56618/bin.sh*' - '*http://110.39.231.61:53539/bin.sh*' - '*http://61.53.85.95:40375/i*' - '*http://123.4.254.47:41717/i*' - '*https://tom.bouesti.edu.ng/Installer_L_X64_x86_2024.zip*' - '*http://studiogioeli.it/trichloroflouromethane/Order.js*' - '*https://tssjiwjfx.hazzarat.com/7f175f53-0879-4742-b557-1f88036b536d*' - '*https://opeendacc.efcasino.bet/8ee23e79-2c0c-4087-8b6e-b35840ddef20*' - '*https://dohnx2bh.hazaratbet.bet/?ublib=87d1f993-736d-4238-a673-7a3432980c04*' - '*https://ckugvmkpg.hazarat.now/6ebf3df6-9d03-454a-98a5-8f761cae6fed*' - '*https://evfdqijee.efbetfarsi.com/7a5314d2-c4d9-4d3f-a1b4-319dfd311292*' - '*https://tfys92ie.hazzarat.world/?ublib=07e00fe4-ff5d-4dc8-8388-1c42430dc37a*' - '*https://llgrzomtw.hazaratbet.games/c7a6519c-88e7-4f31-8aa7-21fb46464ad1*' - '*https://pub-ce02802067934e0eb072f69bf6427bf6.r2.dev/tile.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/xyuvs*' - '*https://kxxpvutsn.derbi.promo/d6fbf832-147d-40c4-a3c6-5bc258bb035c*' - '*http://27.213.189.203:45517/i*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/Wyflg*' - '*http://204.168.223.135/va?s=c&r=20107*' - '*https://hqndcsdha.hazaratbet.game/539e0aa5-72a5-4d65-8ff9-125a530cab52*' - '*https://hkdcvzivw.site-shartbandi-khareji.com/ed9c5059-c061-49dd-be13-e2e84a6163c7*' - '*https://lzlptqkwc.site-shartbandi-farsi.com/876b4353-9d8a-4a92-9770-9451dfaa46ad*' - '*https://xtocpnhiv.jadoou.space/ee7bb359-de00-4b97-b261-da752965124b*' - '*https://pyjaihoat.derbi.football/320c67c4-9eba-41d1-8325-414b5b0f8ec2*' - '*https://cryztbbzl.site-shartbandi-farsi.com/f8b8b7a0-201b-4dcb-82a6-2f314fdff91b*' - '*https://uk1nymxr.varzeshlife.ir/?ublib=00d2797a-def8-4c45-8804-b5ccf8f54531*' - '*https://kdfjhkykz.site-shartbandi-farsi.com/*' - '*https://qmrmfxcme.jadoou.space/*' - '*https://hgbyapzpe.derbi.football/*' - '*https://tvknglirv.jadoou.space/*' - '*https://umkjldsnc.site-shartbandi-farsi.com/*' - '*https://xomsymkut.derbi.football/*' - '*https://zbxcdsga.site-shartbandi-farsi.com/*' - '*https://krswsgcg.jadoobet.pro/*' - '*https://ncfgesrw.derbi.football/*' - '*https://jtdi6w23.biabet90.com/?ublib=9f42af5c-3d6f-4b23-b426-842f3fec2051*' - '*https://yhiqsntq.fileboroo.com/*' - '*https://dbeasxyp.derbi.football/*' - '*https://hzbu0kgt.betyekios.app/?ublib=e4ce570c-ec66-4854-bf1c-e73a9120cc92*' - '*https://nxyhlvha.fileboroo.com/*' - '*https://pcipjcar.fileboroo.com/*' - '*https://i6s46ndy.site-takhtenard-sharti-betland.com/?ublib=5a752451-e0a9-4b9c-b910-d8502e29bb72*' - '*https://litwpjrq.casinomhub.bet/*' - '*https://mgnj.behtarin-site-shartbandi-football.com/*' - '*https://j1xayyip.bordbett10.com/?ublib=3094be8c-ed41-4bd6-a4c3-05505d7eafd9*' - '*https://frqbuzgo.bingobet.bingo/*' - '*https://mpygi.jadoou.space/*' - '*https://ycrarqcd.bingobet.bingo/*' - '*https://078zq932.betyek.bio/?ublib=824a9ab2-0433-44f5-b514-ea52ff0c725a*' - '*http://42.224.4.31:51808/i*' - '*https://0rlxki7g.bordbett10.com/?ublib=6577db6d-a247-4385-a5b4-571e6630c79e*' - '*https://vjs8k4dd.betyek.bio/?ublib=0b07568c-0ae1-4d6d-8f0e-6c04db7b4e22*' - '*https://brmzm.jadoou.space/d1a18065-4220-4288-9ef4-9d203819a90f*' - '*https://cgzt.behtarin-site-shartbandi-football.com/0e888cff-0881-48cf-8970-eacb0f78c572*' - '*https://krdqfpte.bingobet.bingo/b6baa5eb-3eb7-4b19-bbdf-c78d3dbd0218*' - '*https://nkqj.behtarin-site-shartbandi-football.com/56455686-a6fc-454f-bbb1-109ce77de960*' - '*https://zxpimegb.bingobet.bingo/a5abf05c-0a9e-496d-bbf2-85959ed38cb5*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/xnrtd*' - '*https://commercial.great-site.net/img_232527.png*' - '*https://destinationanywhere.ca/Stjk.sea*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/OoxAY*' - '*https://ford.great-site.net/img_034102.png*' - '*http://27.124.34.73/8/ndumon.sys*' - '*http://27.124.34.73/8/1181074577.bin*' - '*http://27.124.34.73/8/chart.exe*' - '*http://27.124.34.73/9/45202075.bin*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 6 id: 0a000a1a-31a1-5c27-87d5-9a4d50ed52f6 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 6). logsource: category: proxy detection: selection: c-uri: - '*http://27.124.34.73/9/chart.exe*' - '*https://xnshgwgf.bingobet.bingo/5b7a85e7-8610-4074-84a2-d4a225ee00f8*' - '*https://jw27s0al.site-takhtenard-sharti-betland.com/?ublib=af4dca3e-5adf-4abe-b28a-354aefc7078b*' - '*https://hcnmjrat.bingobet.bingo/f08720b0-82af-4e74-99c0-1940e8258ec4*' - '*https://redhiban.cfd/cn/enter/stego_payload.png*' - '*https://izehzccr.bet90forward.win/c390c01d-1161-4fb0-915e-6bf160003071*' - '*https://mhyp.bahigo90bet.com/82f7f408-5c5a-4908-ac83-04e3948263b5*' - '*http://gurdjieff-philadelphia.org/giavoni.net/Faldetuno.dwp*' - '*http://115.57.229.124:36477/i*' - '*https://magsa.com.pe/sorma/ogfileimg_110519.png*' - '*https://commercial.great-site.net/img_051220.png*' - '*https://pub-c6a410bb55ff4f0ab8cde9709320b7de.r2.dev/cavolx.png*' - '*http://203.99.148.83/simx.png*' - '*https://siaasesoria.com.mx/Awkwarderf80.java*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/oNJBE*' - '*https://securedisk.cfd/index/fileshared/dbk.png*' - '*https://magsa.com.pe/sorma/litxwimg_044130.png*' - '*https://magsa.com.pe/sorma/donlitMSI_PRO.png*' - '*https://icioinc.com/files/MSI_PRO.png*' - '*https://securedisk.cfd/index/fileshared/msi.png*' - '*https://commercial.great-site.net/img_011306.png*' - '*https://wxxlppea.onjabet1.com/9060edc9-cce1-4910-a259-6552f4b3e19f*' - '*https://unitedgs.lovestoblog.com/MSI_194837.png*' - '*https://unitedgs.lovestoblog.com/img_194824.png*' - '*https://surgeonperth.com.au/old-site/files/stegpayd.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/PnQFO*' - '*https://pub-8381079dd326488ba56aa107eec22aea.r2.dev/img_203655.png*' - '*https://surgeonperth.com.au/old-site/files/stegopy.png*' - '*http://115.57.229.124:36477/bin.sh*' - '*https://drive.google.com/uc?export=download&id=1DDG66RWlr80CwMBibI0Wp9hdJbOzInSK*' - '*http://sarinaglobal.sbs/schx/stego_payload.png*' - '*https://drive.google.com/uc?export=download&id=1L-7hViTvIAZcCPpxBfb9v7pyWQ7IXSEY*' - '*https://drive.google.com/uc?export=download&id=1klL-aGh2OWnpEWdO9JoyzYTNfbihhh2k*' - '*https://drive.google.com/uc?export=download&id=1Nbu2vQdv00nrp6cYhAs_LBfMKuUSpNyl*' - '*https://drive.google.com/uc?export=download&id=1mQxTfy9TD7zpXi4SeZxXEQj5QDScMXrU*' - '*https://pnsc.radioshartbandi.bet/bf5c32fe-8d24-4588-8525-a0c882a3bba2*' - '*http://lebsons.space/SUN/kNJFwiwLpfo156.bin*' - '*http://felomint.click/kom/ZGkCXrCgxnLjQQr98.bin*' - '*http://felomint.click/zom/Pynterevv.psm*' - '*http://lebsons.space/SUN/Underpu.inf*' - '*http://147.124.212.178/MSI_PRO12th.png*' - '*http://147.124.212.178/yurdphost.png*' - '*https://kavfquba.onjabet1.com/40bf7f2d-f2f0-41cd-aeb0-c5f043d77c53*' - '*https://drive.google.com/uc?export=download&id=1jxeYe4GOtlHDWw110rQomC0Huk4CahPT*' - '*https://drive.google.com/uc?export=download&id=1jhMPibvd1MY21br2S1yoqNhcernKJQUG*' - '*http://82.38.171.235:8091/files/online.exe*' - '*http://82.38.171.235:8091/files/watchdog.exe*' - '*http://182.126.124.158:50556/i*' - '*http://192.162.199.78/public_files/wdsos.jpg*' - '*http://192.162.199.78/public_files/AxxEMtz.txt*' - '*http://115.55.230.235:55507/bin.sh*' - '*https://pdzb.pdfbama.com/42daf813-564c-4f94-b6a0-334f42b8bb2e*' - '*https://sdtawdiq.niliafshar.com/97c9acd4-79cd-4776-b3d7-3f100aa4a8af*' - '*https://pub-620def1d93ef431dbdf24616a9b11c77.r2.dev/kB2025072926.exe*' - '*https://pub-4b56b0bd24274a89bb1d367d0cec866f.r2.dev/teele.ps1*' - '*https://productionai-shop.pages.dev/recaptcha-verify*' - '*http://61.220.155.123:52428/bin.sh*' - '*https://pub-b1bf26d4bdc541b2875ee6ba8e3948f3.r2.dev/docenlightmiro.vbs*' - '*https://mprwjkek.betwanaa.com/54dc2643-f934-475a-8f83-dc3a84bd0014*' - '*https://umnb.daddybetiran.live/e9a6e33e-fcb2-4769-b872-688aa1f2ffbe*' - '*http://27.194.12.97:51063/i*' - '*https://a9fh521j.bazisangkaqazgeychidancepoli.com/?ublib=008e4321-7e18-4db4-a58d-301ee77cf09b*' - '*https://kc2m8580.booro.bet/?ublib=acd72a09-9d59-431c-83ac-a16eacfd7d67*' - '*https://1og90icd.betyek.app/?ublib=dcacf491-3a8b-4726-8146-a09b2ce78931*' - '*http://42.225.228.53:45564/bin.sh*' - '*https://byqxztkz.bethazarat.app/71ca224e-a059-4690-b154-657b53f4ea6e*' - '*https://wpvz.boroo.bet/4296bef3-b124-4585-acc3-3a19bfabf6d1*' - '*http://110.39.229.188:33577/i*' - '*https://rvjbusgo.betbuf90.com/a327ed35-ca19-44cd-8983-e8dbe4c48d4f*' - '*https://qsry.boro3.bet/10ed95ca-baf4-4ee7-bf3d-5d5f0d660bf4*' - '*http://103.176.139.56:48126/i*' - '*https://12zjij7k.betrein90.com/?ublib=473366be-890f-47f7-8b9e-797d93513ca0*' - '*https://btlbbyxf.bet90forward.win/1c4b2d69-2812-4bd9-af2e-13493aaafc91*' - '*http://103.176.139.56:48126/bin.sh*' - '*http://27.207.73.215:50431/bin.sh*' - '*https://rnrx.site-takhtenard-sharti-betland.com/09267a5d-2e4f-42d4-82ce-a20f39560ef3*' - '*http://115.56.149.1:37779/i*' - '*https://yclhedrx.site-shartbandi-pasor.online/c3a93fd5-c08f-4b65-959c-a6a0d9b567a3*' - '*http://123.132.167.175:50794/i*' - '*http://59.97.248.167:57637/i*' - '*https://ibai.fileboroo.com/2b790e34-bf8e-494f-b749-42a340da81b9*' - '*http://42.225.202.91:38746/i*' - '*http://59.97.248.167:57637/bin.sh*' - '*https://sw10j5d9.behtarin-site-shartbandi-football.com/?ublib=1da2df24-88d8-4f8f-8617-64eca3a33d28*' - '*https://xnuleibw.site-shartbandi-khareji.com/187ddf12-7c5a-4355-88f2-fb8c196cf198*' - '*https://fnvr.casinomhub.bet/8ba3719e-dfed-43ca-a846-ee86243943b4*' - '*http://46.8.46.114:45299/i*' - '*https://6kqr6pgl.jadoou.lat/?ublib=efb06a20-7fc4-41b1-900b-eba1f4a52588*' - '*https://oqfrcpbn.site-shartbandi-farsi.com/69719b36-4fa7-4fa2-844c-099c20d221b4*' - '*https://5lbitou7.bomb90bet.com/?ublib=aeb89d9e-28ed-4225-8739-40c56ac11c1b*' - '*http://46.8.46.114:45299/bin.sh*' - '*https://hkfj.varzeshlife.ir/c83c69a0-29c4-45f7-b564-4b8a49bac8e6*' - '*https://nlxmperk.behtarin-site-shartbandi.com/c7104b7b-6dfa-4f01-8d7b-6a4bb8dd4d9b*' - '*https://1nto2x4n.bahigo90bet.com/?ublib=e05ed45f-f832-4881-96f9-7a470c2ae700*' - '*http://123.13.118.181:56651/i*' - '*https://bxto.site-shartbandi-variz-kam.com/21715b8f-fe63-4c01-89dc-d43f65a42ada*' - '*https://ssefhahu.bahsegel90.com/ca6247fc-e16e-425c-8e4a-8b15ea5c7be8*' - '*http://42.234.160.95:53035/bin.sh*' - '*http://110.36.2.23:41553/i*' - '*https://gejy.site-shartbandi-takhtenard.com/9a4c1e12-8abc-4231-a9bc-24a4d5d4b3f4*' - '*https://drive.google.com/uc?export=download&id=1NRsduJ2vafBwUGdsJJ5nT6VBAXYTk0eS*' - '*http://107.173.227.99/img/1.jpg*' - '*https://cckoient.boroo.bet/f3f3657a-48ef-4a53-9cd7-64e6c94334de*' - '*http://112.232.60.189:43190/bin.sh*' - '*https://u1uo84tz.dadyybet.com/?ublib=7a605453-d721-4bb3-ac72-8a251d1c4c87*' - '*https://kyfyltaw.boroo.bet/936d1f45-54fc-4601-8707-c3d2908b8d3b*' - '*https://tommy-n.lol/*' - '*http://124.92.80.242:60827/i*' - '*http://124.92.80.242:60827/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_72c201f53fd3667e.exe*' - '*https://hbxigpqk.boroo.bet/1ea9615d-23a1-49d0-8755-9728d1a0f19a*' - '*https://bhvj.betwanaa.com/5826e814-dd4b-421d-ace4-c05caca5072d*' - '*http://42.232.50.240:52692/i*' - '*https://ykkgplvw.boroo.bet/cc806c24-6972-433c-967f-90cb5e327b11*' - '*https://tptc.betrein90.com/47a10b13-84db-4d5d-8462-8f8653c1892c*' - '*http://110.36.2.23:41553/bin.sh*' - '*http://125.44.177.165:46392/i*' - '*https://m55uqh6r.daddybetiran.live/?ublib=61b22230-c1c2-444c-88ea-5db248e39bd0*' - '*https://ql1aii3f.jadoobet.pro/?ublib=6aca2c21-88a2-4fa8-9d67-8685ec0ca7fc*' - '*https://prb02wy1.bingobet.bingo/?ublib=39380ba4-ea58-47fb-b517-7799d6ddd60e*' - '*https://xmpjsaza.boro3.bet/6337e997-75c5-4019-b375-124610369d09*' - '*https://pnurgmjx.boro3.bet/89d7ea6f-03fc-4b22-956a-f128b2080197*' - '*https://ggot.betmajic90.com/837a8ed4-ac97-4625-9025-3844ea2657b7*' - '*https://gbntwgmi.boro2.bet/9efd7347-2fb2-444f-88b8-81d3132fea01*' - '*http://221.15.193.19:38741/i*' - '*http://42.234.160.95:53035/i*' - '*https://pdkj.betkhaneiran.com/dc296828-8fc7-41a7-9f8c-93fb5e2eb230*' - '*http://221.15.193.19:38741/bin.sh*' - '*http://123.4.202.133:35648/i*' - '*https://npa8g2x5.cozmo90bet.com/?ublib=69a590d7-2a62-4a72-89bb-2a62d30c1f7f*' - '*https://pbhwzixj.boro1.bet/4f9a7c78-781f-4987-9e83-e804fb9a98e2*' - '*https://fqul.betkhanee.com/1738b8c5-18fa-4d47-9282-790d06bcac12*' - '*https://bcouiutk.bordvipbet.com/27b7a282-689a-4066-8efb-4f38a29de9b0*' - '*http://42.234.139.119:50928/bin.sh*' - '*https://gwix.bethazarat.app/1ec51f6a-d26e-4f82-be0a-0fdb3c4c8515*' - '*http://78.71.218.122:3387/i*' - '*https://vrlr8kbu.couple.bet/?ublib=cc6c5e3a-7ab1-459a-b41d-e1eed204df21*' - '*https://ecourwue.takhtenard-online.com/af1a49fa-5a49-42a3-af4f-5a01d82317b8*' - '*https://drive.google.com/uc?export=download&id=1CeSAXlb1u0x4Dom5iQYyrSfDnJfUSIaz*' - '*https://drive.google.com/uc?export=download&id=1d0NKIFUNM_YfuBQ9NbmX7UCbhdCRm9Qn*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/YjCHf*' - '*https://freeluck.free.je/img_105450.png*' - '*https://sycr.betforward90.com/aca92e2b-9082-4d32-8a5a-179fadc22a07*' - '*http://185.143.223.115/payload.exe*' - '*https://nextjs2385.ngrok.io/cdn/higeleveltask_x64.exe*' - '*https://haqkrygx.site-takhtenard-sharti.online/5e9b93bc-4628-41bf-a609-40be62ea5230*' - '*https://2skmlgm2.motabartarin-site-shartbandi-jahan.com/?ublib=e77aa6c1-0198-4a70-9c5e-82c60844dde2*' - '*https://zsvipfhj.fileboroo.com/?ublib=72b7a857-8037-4ffa-ba6b-7dc93c3861ac*' - '*https://gbij.betbuf90.com/6d322289-b59a-4077-b290-cbf036ca1b0e*' - '*https://gufbylzl.site-takhtenard-sharti-betland.com/9855729e-4c35-4f66-8daf-4b98606f330e*' - '*https://jps9pmag.bw90bet.live/?ublib=3541485d-7009-483c-a39b-408803049180*' - '*https://zhnar.jadoou.space/deb9f322-0109-4b3f-9947-658dd7b94efb*' - '*http://123.132.182.115:56384/i*' - '*http://123.132.182.115:56384/bin.sh*' - '*https://ebju.betropol.bet/34ff7aa2-a647-40bf-803e-9a48a2f2e8a2*' - '*http://112.232.34.216:50553/i*' - '*https://kxwuxeow.site-shartbandi-variz-mostagim.com/c39cedc4-a43b-42d6-891f-3e9aeee6d770*' - '*http://112.232.34.216:50553/bin.sh*' - '*https://lqom.bet90forward.win/469bfc14-1e9d-489c-8cda-444a4e3d12d3*' - '*https://vgepnjpy.site-shartbandi-variz-kam.com/5523dd8d-22b3-463a-a8c1-319aa07aec0a*' - '*http://115.62.58.252:55568/i*' - '*https://kysv223u.zaribbala.bet/?ublib=1b659565-45d4-4b89-9019-78dba505feb1*' - '*http://115.62.58.252:55568/bin.sh*' - '*http://42.228.36.34:52410/i*' - '*https://bujybzpn.site-shartbandi-takhtenard.com/7623f534-9e81-43ee-a26f-dc6d6d15774a*' - '*https://zpuc.bekabet.casino/a8203ca5-ddd4-40bc-b336-9f9c712dc250*' - '*http://59.103.116.68:53661/bin.sh*' - '*http://64.22.81.244/style.exe*' - '*http://42.86.112.79:56396/bin.sh*' - '*https://vozzijig.site-shartbandi-pasor.online/6081ffcc-679c-4b34-92ec-98a6547d01cf*' - '*https://drij.bahsegel90.com/9f9d8bbf-a171-46f5-aa44-d9cf8ab3f8cc*' - '*https://fnexayyt.site-shartbandi-khareji.com/5b911a94-51f9-4132-b048-4dcded9ce8d6*' - '*https://ntegm9h9.varzeshlife.ir/?ublib=54a92e45-cae8-40a2-b1f4-de03b632c7bd*' - '*https://qhy0wolx.casinomhub.bet/?ublib=f390ed84-2040-4b46-9cdb-f22234bb7fc9*' - '*https://nwp4ut5h.madgal.life/?ublib=e194d45d-73d2-4185-af8a-5b82cc5903d1*' - '*http://192.255.195.146/25/img_191645.png*' - '*http://222.137.0.237:49157/i*' - '*https://gksn.bahigo90bet.com/b95e4343-fe35-4ace-b529-b1e660b824e3*' - '*http://104.168.70.168/img/im/MSI_PRO.png*' - '*http://194.116.236.163/img/img_184307.png*' - '*http://194.116.236.163/37/newkingisbackgorbesttreatmentsneedforallthismethodsforfind.hta*' - '*https://feulntzw.site-shartbandi-farsi.com/f3acb4ac-7c90-428c-a164-dfb6734fd327*' - '*http://125.44.56.240:34717/bin.sh*' - '*https://zrul.bahigo90bet.com/763701f2-b6eb-4e01-a48c-57ae58864b9b*' - '*https://zwtocirl.site-shartbandi-farsi.com/9fef95fb-a1ac-4c14-8713-41f950bf3587*' - '*http://192.236.217.68/65/exa/wegivenbestthingsaroundthecglogablforengaaged.hta*' - '*https://pub-be36e3aeb6404712971f081a2837a8fa.r2.dev/hakuna.png*' - '*https://pub-556e12d7b27c4eefad584f5b94bdff69.r2.dev/lazit.png*' - '*https://pub-acc3946ba34b4465b2606bf635365817.r2.dev/chivas.png*' - '*http://115.55.216.4:33318/i*' - '*http://198.23.144.23/130/euv/givemebestthignswithgreatoptionsforme.hta*' - '*https://17eqwy30.takhtenard.app/?ublib=93e9125e-0384-44f9-b638-0a32e5108951*' - '*https://cwkw.site-shartbandi-bedun-filter.com/49137bbe-989c-4e10-a119-ed9c4c9f8734*' - '*https://ghyrtamr.plinko-1xbet.games/d455844f-93ac-4a94-bd62-adccf27b15ef*' - '*https://yliw.site-asli-bedon-filter-1xbet.com/5d6be428-cb4e-4ac2-91bb-c6afd66179ef*' - '*https://tdzfnvda.plinko-1xbet.games/d8adcf01-928e-45e0-9da3-6b60aff918ba*' - '*http://125.44.56.240:34717/i*' - '*http://123.9.198.83:40146/i*' - '*https://ucpwcpfl.jadoou.lat/ef491f20-6343-451b-ba7d-c345a63aafda*' - '*http://103.134.117.13:60770/i*' - '*http://123.9.198.83:40146/bin.sh*' - '*http://blakcinwhitexn.cc/1557fad8649e638f43f20cccf5794a440c70eae03204f5af9fe9850b3197b8ff*' - '*https://dscf.radioshartbandi.bet/77d2cef4-22ca-4faf-9b8a-d5a45bf6e0c7*' - '*http://103.134.117.13:60770/bin.sh*' - '*https://ewdllypo.betropol.bet/a2ed53fa-8cf2-47be-b407-9a35b201474f*' - '*https://bjf54ffm.behtarin-site-shartbandi.com/?ublib=6d76d6bc-05c6-4b46-84fe-68d9d927932c*' - '*https://wcwe.onjabet1.com/349c14a3-d5e3-40a6-9f5e-00e38ddfd47f*' - '*https://euspwbzy.bet90forward.win/1d2d9da6-7d0f-4773-a771-718b4a5bf76a*' - '*https://jz8kpepi.jadoou.store/?ublib=45082086-91a1-4aab-9370-58dbd71c821d*' - '*https://mpdmwhr9.jadoobet.forum/?ublib=a4879063-0c2e-4d42-8570-c2a0c901695a*' - '*https://brfavfmp.bet90forward.win/c20cfdd6-61d9-4fd3-b9a7-8788f0fa990c*' - '*https://iowx.onjabet1.com/03fd785c-4ba8-4272-8d16-284397e51f2c*' - '*https://crehmoqz.bekabet.casino/89c15415-3b55-4d06-a177-c0264f9c539e*' - '*http://110.37.69.175:51409/i*' - '*http://182.127.127.192:34807/i*' - '*http://222.141.131.100:40368/i*' - '*https://s645gfw3.bahsegel90.com/?ublib=370be8fb-9552-4144-890b-2b3b0ab12300*' - '*https://nqzp.jadoou.mom/a3df109c-3498-43e9-abcb-49ecaf4d9d57*' - '*http://222.141.131.100:40368/bin.sh*' - '*https://sqbw.jadoou.makeup/945aca7b-aec5-4508-a7d4-e1a5dd245828*' - '*https://wmgbwskd.pdfbama.com/2e3f1faf-8ebf-48eb-818a-157de1faf62a*' - '*http://115.49.210.33:49963/i*' - '*https://hczzqwrl.pinbahis-bedon-filter.com/?ublib=e53b482c-b66a-48c5-91d6-917a1579c741*' - '*https://wjek.jadoou.lol/3deecc0e-2f9c-4789-b647-9f05d9db0f99*' - '*http://110.36.72.57:52269/i*' - '*http://123.5.191.238:60095/i*' - '*http://115.50.217.45:59698/i*' - '*http://5.59.107.34:57247/i*' - '*http://123.5.191.238:60095/bin.sh*' - '*https://cvjd.fileboroo.com/88e01120-9f66-4a2d-b646-d6c0d62bc4d5*' - '*https://hqmcfjqy.madgal.life/53f131a4-ca45-4b74-ab13-d929eb4d0cf8*' - '*https://uwkx2xdq.zaribbala.bet/?ublib=5f21ecb1-6984-4066-b901-ea0e59c65fca*' - '*https://xprba39f.jadoou.space/?ublib=84b3e683-bb20-42cf-aa2a-f727e70a5ad3*' - '*https://xt19c0ua.casinomhub.bet/?ublib=c534ce2e-bc8c-454c-a10f-e2bf582d8260*' - '*https://igowjhcd.madgal.life/58bee191-59f8-4a0f-a2f0-12d0f036f489*' - '*http://113.232.7.187:38276/i*' - '*https://vxqz.bahigo90bet.com/d0e57301-46d4-4b60-adbb-9f1f476ca788*' - '*http://175.151.83.136:52513/i*' - '*http://175.151.83.136:52513/bin.sh*' - '*https://bwimlqru.jetbet.download/6de085cd-42d2-4a0c-9be2-1a10c489b076*' - '*http://115.57.82.151:36930/i*' - '*http://107.172.247.123/45/renewcrypterforresults.hta*' - '*http://107.172.247.123/36/weneedbestthingscomingfromthegod.hta*' - '*https://www.mbowen.org/sUYQArZTfwvQYhC206.bin*' - '*http://107.172.247.123/226/eccr/vcc.exe*' - '*https://bfpu.rayeganmarket.com/3a83cb4d-11c1-4e91-887f-099e97bc5f77*' - '*http://42.227.236.130:42069/i*' - '*http://107.173.47.146/22/img_175356.png*' - '*http://107.173.47.146/22/goodthingsarebestofrbetterwayscomingformetogive.hta*' - '*http://217.160.121.177/34/secured_stub.ps1*' - '*http://87.106.48.217/113/wce/privatethignsareverygoodformaitiasentriethinsgs.hta*' - '*http://87.106.48.217/113/verygoodbirthdaycomingforeerytimefwithbestthigns.vbe*' - '*http://107.173.143.52/145/img_012558.png*' - '*http://46.183.223.88/57/img_021550.png*' - '*https://specsaversllc.online/mrkelly13/qk3FhjayJfgjjLonmTMtgt9pw6hrKmMImzjw2eqKGsHqMovE.js*' - '*http://204.44.93.68/img/img_013554.png*' - '*https://dawn-mud-d34f.phzinhoooo.workers.dev/FTM0-40PO-AO28-G98E/img_yh7kna.png*' - '*http://194.116.236.163/35/img_180337.png*' - '*https://lgmkszyl.site-shartbandi-farsi.com/21922487-a5a8-4607-864d-316e18529e77*' - '*https://qnu58lbv.varzeshlife.ir/?ublib=4d46975c-40a9-4757-b9c1-88917f25d18e*' - '*http://107.174.146.3/emqXijr191.bin*' - '*https://hxea.psikologer.com/fb469318-6810-412d-bc4b-fc84cb9eabad*' - '*http://59.103.116.68:53661/i*' - '*https://obsudfch.site-shartbandi-enfejar.bet/4ed9d899-1b76-4912-a54c-12b1e0d060d4*' - '*https://ecyz.plinko-1xbet.games/1427ff78-0347-4582-a70a-0b42a371875e*' - '*https://texjqbwa.site-shartbandi-bedun-filter.com/53513975-0ab6-448d-9de3-b77e36a4e3ce*' - '*https://ign0g5ax.site-shartbandi-khareji.com/?ublib=f5e33013-fea1-4dff-acaf-7fb9aa754359*' - '*https://wjyt.betturkey.bet/df0cac38-39b0-41ff-9c9f-6f17db7377ff*' - '*https://nswofmyl.site-shartbandi-50toman.com/1d4f406e-85a9-4e87-9be4-99ae4b016b79*' - '*https://p9kos7r3.scriptyek.com/?ublib=78ce0396-6765-4b9c-a78e-8a73ff3d54d8*' - '*https://kzjx.betropol.bet/ac0e1f83-9ee4-4487-8a47-f81e3e90755c*' - '*https://etomskuk.site-shartbandi5000toman.com/bb76e6aa-c5c8-4a03-b702-ac44a2ce14be*' - '*http://69.12.83.188/Upaavirkeligheden.exe*' - '*http://69.12.83.188/payload.ps1*' - '*http://204.44.93.68/img/MSI_PRO.png*' - '*http://172.245.195.209/80/img_194042.png*' - '*https://30zu55sj.radioshartbandi.bet/?ublib=38edcbc4-8597-4604-8ecc-d35afe796600*' - '*https://bycl.betpublic.casino/cad59a90-7290-4b4c-9a90-a970375fe9e3*' - '*https://stvdwyqw.site-asli-bedon-filter-1xbet.com/eea74b7a-53a5-4a14-b38b-82e93b4a8f8b*' - '*https://zzcg.bet90forward.win/2345400b-ec91-42b8-97d5-0023e8d71552*' - '*https://kaumdowe.jadoou.sbs/c4085954-4a4d-40a9-8098-6fad2c939e17*' - '*https://2cca57zt.onjabet1.com/?ublib=6e5cbd31-6374-4350-842c-0fb23e05a639*' - '*https://ulgqmzld.jadoou.online/bb7eb0e3-5f84-420b-817e-9bbffc51623a*' - '*https://dzjr.bekabet.casino/0b8ec5af-51b5-41d2-a6f6-52672aa99344*' - '*https://kaleda.pro/50bf4317.exe*' - '*https://kaleda.pro/96de8ea9.exe*' - '*http://noventis8.com/lxnew.png*' - '*http://42.230.17.60:42266/i*' - '*https://yxxyqkkf.jadoou.one/5f5d1b02-aca5-4491-a0ee-e53048a627c0*' - '*https://genesis-cheats.com/files/Genesis.zip*' - '*https://hnzi.behtarin-site-shartbandi.com/2a563779-d2bb-492c-9164-4dd12c9dd8d0*' - '*http://175.175.13.148:55899/i*' - '*http://62.60.226.140/files/8130232421/rb0yFh2.exe*' - '*http://175.175.13.148:55899/bin.sh*' - '*https://5dov6pg7.jadoou.yachts/?ublib=2942e19d-e648-4773-ac5a-ec92c91e64e2*' - '*https://k7d5sjnk.jadoobet.club/?ublib=cea18345-3e45-4dc5-9d5e-b2cf1d9f8e71*' - '*https://bzd7mk6q.parsalip.bio/?ublib=05713f42-f9d4-42b0-b12b-b214ee3822f9*' - '*https://zigeoavk.jadoou.click/30db1ecc-d221-497d-96ff-02a27a553918*' - '*https://vzcr.bahigo.casino/7ca83116-6045-48b9-89d9-600b25614c94*' - '*https://576m4hgs.jadoobet.click/?ublib=8e0e9e79-9fd9-4add-88d9-36754b1a79d3*' - '*https://imjbwe71.jadoou.xyz/?ublib=2fcdccc0-9442-4581-8f0a-e9c1d2c4187a*' - '*http://62.60.226.140/files/8079848160/5cPfAMH.exe*' - '*https://lqljywai.jadoou.christmas/66f64986-340d-4be7-8c4b-2f6e5fd4d3ec*' - '*https://zxx1gpmw.pars90.download/?ublib=064f99d4-76a2-4eea-9e0e-56421ee3d280*' - '*https://ovcvaphj.jadoou.cfd/1db42ea1-b1e4-4362-a6a2-401372c0a395*' - '*https://zxco.madgal.life/616c555d-6508-42f9-a266-2ba19cdef127*' - '*http://182.121.105.160:39775/i*' - '*http://193.177.220.9/36/greatideadscomingwithbetterwaystobe.hta*' - '*http://193.177.220.9/70/bestnetowrkingskillforbetterplaceformebetter.hta*' - '*http://193.177.220.9/13/goodthingsarebestforbetterpeoples.hta*' - '*http://64.44.156.79/15/givemebestthings.hta*' - '*http://64.44.156.79/15/img_052816.png*' - '*http://193.177.220.9/60/wereturntothegamewithbestpeoplesmarking.hta*' - '*https://5ufm19dl.pdfbama.com/?ublib=f0a96d5f-e04e-4681-a5c9-ba9d89fd9085*' - '*https://qcancmnq.jadoou.store/4d64f004-5d6b-4488-aebe-70eb2a743f52*' - '*https://vfld.jadoou.my/57f4b136-b251-4f84-9cde-a704fd972d86*' - '*http://93.177.151.72:41198/i*' - '*http://182.121.105.160:39775/bin.sh*' - '*http://125.41.3.43:57288/bin.sh*' - '*https://zjyozhki.jadoou.space/47db3ff9-a24b-4fcc-8a59-e2aff502acaf*' - '*https://gcyp.jadoou.monster/063f81aa-2266-4040-a7e0-a4272a0022cc*' - '*https://cacbvgql.jadoou.skin/11ef4ad0-d374-4c42-b3de-78edbed055bb*' - '*https://fahv2h6l.kimimaro-trance.com/?ublib=c8d50516-54c8-4b87-a3b1-0428854f1042*' - '*http://31.77.168.180:5000/ftr.bin*' - '*http://31.77.168.180:5000/babauster.exe*' - '*http://31.77.168.180:5000/wbozon.exe*' - '*http://31.77.168.180:5000/ntmyebewekca.exe*' - '*http://31.77.168.180:5000/soltwo.exe*' - '*http://31.77.168.180:5000/first.exe*' - '*http://31.77.168.180:5000/refac.exe*' - '*http://31.77.168.180:5000/umvbr.bin*' - '*http://31.77.168.180:5000/porlonert.bin*' - '*http://182.119.196.129:40076/i*' - '*https://tkhf.jadoou.mom/60a3f216-d234-4ead-9e65-8daadeb9cd58*' - '*https://frqljktr.jadoou.site/b8a7601f-d076-4287-b05f-0d4b7b21e27e*' - '*https://byagqv8a.fileboroo.com/?ublib=24901cc9-f3c6-4c2f-8e81-2458d20e816d*' - '*https://mlbn.jadoou.makeup/d9a04cde-d015-470b-a51f-75ab154a1462*' - '*http://77.79.160.210:51525/i*' - '*https://sth4xz5f.pacificcrestforaging.com/?ublib=24006556-f831-4f6e-ac02-922fcafa7d3f*' - '*https://knihrdel.jadoou.shop/1f9c07a6-6ceb-4e3b-a4c9-70e2cb0bfa38*' - '*https://pub-6bb84612f1aa422e987506bd70a6550c.r2.dev/HCUQAUTJ.msi*' - '*http://141.11.88.119/dg.x86_64*' - '*http://141.11.88.119/dg.aarch64*' - '*http://141.11.88.119/dg.mipsel*' - '*http://141.11.88.119/dg.powerpc*' - '*http://141.11.88.119/dg.armv4l*' - '*http://141.11.88.119/dg.sparc*' - '*http://141.11.88.119/dg.sh4*' - '*http://141.11.88.119/dg.mipsrouter*' - '*http://141.11.88.119/dg.armv5l*' - '*http://141.11.88.119/dg.armv7l*' - '*http://141.11.88.119/dg.i486*' - '*http://141.11.88.119/dg.m68k*' - '*http://141.11.88.119/dg.arc*' - '*http://141.11.88.119/dg.armv6l*' - '*https://xc1y2oam.jetbet.download/?ublib=2a0a4211-ae80-4d54-a77e-c5e04e044848*' - '*https://ahkx.jadoou.lol/5c479e97-397b-4074-a7e4-d80c37dd6be7*' - '*https://pqxhifiu.jadoou.sbs/3f80625e-0815-4bcf-aad9-fe261f52fc51*' - '*https://pbcx.jadoou.lat/e2a8eae8-9e7b-41af-87db-2de8fb118e0f*' - '*https://ajkcsyzc.jadoou.online/099a692e-342d-4532-8be1-56d7c828a812*' - '*http://61.53.93.69:53346/i*' - '*https://n85e216p.jadoou.yachts/?ublib=a0aba99a-0e36-4c7a-8c42-65707a9ae3e3*' - '*http://27.215.48.54:39132/i*' - '*https://viuc.jadoou.icu/2ea55e65-9381-448c-83ae-b586ecb21725*' - '*https://kclujyvd.jadoou.one/8a37023d-da5e-4cd1-afa2-30e4cf93a223*' - '*http://115.50.54.75:33198/i*' - '*https://klsv.betturkey.bet/4b942d50-0dbb-40cb-a21e-ea0da5fca9a2*' - '*https://vspzxyds.jadoobet.info/525bfad0-1f3b-42b4-80cd-9d82a22c5e41*' - '*https://ceayo90m.jadoou.xyz/?ublib=36675b49-9aef-464d-b4ef-fe27adb7c757*' - '*https://7c7ax36p.bahigo90bet.com/?ublib=384f03ab-b276-4128-84bb-e88b0579c723*' - '*https://ogedjbqx.jadoou.baby/44fa5a15-5232-4bb8-8177-1bd070c574da*' - '*https://exlt.behtarin-site-shartbandi.com/8fdf126b-4719-4113-924f-640e934e5c20*' - '*http://182.120.14.6:54946/i*' - '*http://42.224.254.82:54025/i*' - '*http://61.137.148.215:33410/i*' - '*https://yjrbnmoc.casinomhub.bet/e2dcdfd9-87b6-46ff-a2bc-dc36dd6051c6*' - '*http://182.120.14.6:54946/bin.sh*' - '*https://kcpj.bahigo.casino/b996488d-e070-4604-9951-a635e5f672f7*' - '*http://42.224.254.82:54025/bin.sh*' - '*http://61.137.148.215:33410/bin.sh*' - '*https://uwrt8xqz.jadoou.cfd/?ublib=a38dd917-aa94-464e-986a-94e82412ae1d*' - '*https://acthktpb.betropol.bet/3f0258fa-a6ca-4dd4-b331-36ff6971fdea*' - '*https://vwhp.betpublic.casino/66f5aef2-b751-4b93-84e0-d5dbbf4cc32b*' - '*https://sidnxgci.radioshartbandi.bet/34dfdaac-6e8b-4814-a595-c86d8008e464*' - '*https://cdba.bet90forward.win/7a0bd89b-fdf7-412b-9fe0-ec42423459ba*' - '*http://119.179.255.193:59772/i*' - '*http://110.36.70.189:34474/i*' - '*http://119.179.255.193:59772/bin.sh*' - '*https://mfej25tu.jadoou.cyou/?ublib=dff13a08-89b2-46d0-9868-46d6143f8fdd*' - '*https://eikgcqyt.onjabet1.com/0fa92f57-53da-4834-9435-39a98ef9ef36*' - '*https://fock.bekabet.casino/19add951-f89a-4789-a350-8843bd14acff*' - '*http://59.101.150.244:44968/i*' - '*http://27.206.196.156:47093/i*' - '*https://sjzcjaqs.jadoou.bond/92d61de1-5eb6-4a30-abe7-4c0e0cf9ce67*' - '*https://mypwk0n2.jadoou.click/?ublib=94d469f0-e55a-45f3-8716-0896b2ac9083*' - '*http://123.11.73.184:55553/i*' - '*https://jidm.jadoobet.pro/974e10ba-ff8a-43c1-afda-4e452b301c50*' - '*https://fdmyrhjq.jadoobet.vip/?ublib=71a1eb2c-6edf-4d1b-82e5-a776631dd5c5*' - '*https://ufdrepkt.jadoou.autos/909c070b-6316-4a87-b17a-a575e312f123*' - '*https://olptz5o4.jadoou.beauty/?ublib=b739174a-8241-4e3c-bf7a-937690ed81cd*' - '*https://jkvw.jadoobet.live/9d1c428c-ab64-43d8-b03c-6e8382f4b0a7*' - '*http://182.121.104.206:34529/bin.sh*' - '*https://dudqylyo.jadoou.art/24c6cab9-4624-495c-a44b-0bb256997486*' - '*https://snvd.jadoobet.ink/7421ad84-dfc8-4bc9-9f8d-31d9f7f318e8*' - '*https://lwqeujgc.jadoobet.xyz/3dd57329-b411-4742-8eaf-93767659c995*' - '*http://182.121.229.4:50017/i*' - '*https://azffnyvq.zaribbala.bet/?ublib=5b39e4a8-3f9f-4573-ae6d-2a16a20ca928*' - '*http://115.49.0.19:40211/i*' - '*http://182.121.229.4:50017/bin.sh*' - '*https://aujh.jadoobet.blog/cc93203e-61f0-4814-9fce-e39f20fde2d3*' - '*https://fggcvmnq.jadoobet.forum/a6845b16-9b85-4168-90c0-721574d0bf0e*' - '*http://115.49.0.19:40211/bin.sh*' - '*https://tcxc.behtarin-site-shartbandi.com/a0494149-c7d5-4e11-a7b2-1d56dc1549e3*' - '*http://42.231.90.113:57377/i*' - '*https://qcilezmw.jadoobet.club/5ad0d60b-ea82-4da0-99bf-e1c89210e9d1*' - '*https://ap9nqrjc.jadoou.christmas/?ublib=0f9ff334-d7c1-49e3-a9be-c06b500a2599*' - '*https://xuqbplvg.site-shartbandi-khareji.com/?ublib=eeef3ed8-c163-4b96-8a5d-1f947d2436a6*' - '*https://ljqk.bahigo.casino/d7bafbc9-ca48-4cf3-8490-5136d8a36f2f*' - '*https://qqjbcfkl.fileboroo.com/431ac1b3-f945-477e-943b-a7b331925541*' - '*https://tl9afxug.bahsegel90.com/?ublib=9671249b-ed7b-401a-aa0f-926aa0eb6db3*' - '*http://123.5.127.246:38895/bin.sh*' - '*http://119.117.87.164:59176/bin.sh*' - '*http://119.117.87.164:59176/i*' - '*https://kyqwfrjr.betturkey.bet/6c3d1924-bdc3-472b-b0bc-fd474fced06f*' - '*https://rddj.jadoou.boats/d0dfe87c-66d1-4a9b-be47-274db337adbd*' - '*https://nsuoqcej.betturkey.bet/1b96bba8-7963-4ee5-9145-46ed29dd741c*' - '*https://llar.jadoou.boats/c5892db4-a47c-4cc2-b55d-9c5ce1883687*' - '*http://119.179.239.23:37650/i*' - '*http://110.36.12.61:50211/i*' - '*https://cbsnews.date/tgv/RandApp*' - '*https://voltix-net.biz/Popka/Volti%D1%85.zip*' - '*https://arcanemods.top/ArcaneSetup.zip*' - '*http://115.55.144.131:44167/i*' - '*https://qfjwyksn.jadoobet.info/?ublib=45a7b450-cc43-4ba3-9f4b-8a91a5777ec5*' - '*https://zduyoblb.betropol.bet/2207261e-0ee9-4dcd-a0af-1585040d3e39*' - '*http://42.55.238.98:49506/i*' - '*http://110.36.12.61:50211/bin.sh*' - '*https://ltvz.jadoou.biz/8860b420-6636-47f5-9366-bc931f7e2d17*' - '*http://219.155.11.95:50263/i*' - '*https://peiry.casinomilyon.bet/746f1c39-d1a6-41f9-a6fa-e0602a2c4d76*' - '*https://wubbueiu.betpublic.casino/051cbb16-a150-4bbd-8cfd-3058f1884ecc*' - '*https://xxaz.jadoou.beauty/d631e478-2ef6-4f9c-95e2-42234a5a3d21*' - '*https://ringmycellphone.com/images/rotate/rotate.php*' - '*https://owhzzucu.jadoou.cyou/?ublib=22ff5e31-98ca-4762-9c5c-70c36de7fe56*' - '*https://zbplgmhe.bet90forward.win/5b259190-a06b-4b6a-a92c-2632aa5c1431*' - '*http://36.36.250.212:47035/bin.sh*' - '*https://elng.jadoou.baby/883cb613-5b0b-4410-8696-5ef2ba6535c9*' - '*https://mjbpgp3k.jadoou.cfd/?ublib=f4e25355-7f92-4829-9607-bf2c2b9d748e*' - '*https://fibvhxte.bekabet.casino/44830036-ce23-46ab-a71c-f2f19094f716*' - '*http://125.41.3.43:57288/i*' - '*http://42.231.66.147:33877/bin.sh*' - '*https://tgjg.jadoou.autos/a9c55ebf-3bc9-4e5b-87bf-59904e3bdb15*' - '*https://rgklgdmw.jadoobet.click/?ublib=39b6c84b-94e1-47a4-9b57-885788854487*' - '*https://acthwqwn.behtarin-site-shartbandi.com/21e8f421-57c5-470b-80e7-7191fece8290*' - '*https://9h5e0vbd.jadoou.club/?ublib=8c7d8c1b-d43a-4676-baac-132ed6648164*' - '*http://112.248.61.25:49352/i*' - '*https://omwf.jadoou.art/3fdbe0c1-4fe2-478f-ad6c-b1efed486439*' - '*https://xmgonqda.jadoobet.xyz/02fd6dad-2527-4251-b2c9-648e0dc3f04d*' - '*https://tetz.site-shartbandi-khareji.com/dca18a52-f5bc-4110-a48b-8f22b5049993*' - '*https://kokkpxut.jadoobet.vip/461abad7-ea0d-4211-a8b0-261fd4a5754f*' - '*https://qzl7oi7a.zaribbala.bet/?ublib=fac6fd45-51e6-4f1f-95c2-14321239f9db*' - '*https://85.239.149.40/lrcaoQ7xSYfFVno2S9*' - '*http://91.92.242.243:6600/ESPIxN5lducyZQW5we*' - '*http://85.239.149.16/wbpLpf9vg2EVbxmbfW*' - '*http://93.152.224.29/IpS9GN16MBsmhWBe*' - '*http://93.152.224.29/tBiNhjfyJ2VFClAx85*' - '*http://85.239.149.16/CloudFlare_Captcha_Code_839101*' - '*http://85.239.149.16/WOBVpWpXWLm37L9XF*' - '*http://85.239.149.16/f6ptObhnkvaYRgMEJ*' - '*https://dozco.com/public*' - '*http://85.239.149.16/BvCPpznZO6547X47*' - '*http://85.239.149.16/CloudFlare_Verification_Code_845270*' - '*http://85.239.149.16/gWowSyTRkvfEcGsIj*' - '*https://i-like-ele-phants-verification.live/iamchallenge/verification/UserID7383526*' - '*http://117.217.228.182:48400/i*' - '*https://plzm.onjabet1.com/1b937088-3406-407f-b849-182be3919797*' - '*http://117.217.228.182:48400/bin.sh*' - '*https://ruuupkia.jadoobet.pro/ecd888f6-b860-4225-b74b-6d5fa4c08c60*' - '*http://182.114.198.106:45907/i*' - '*https://xywz.betraca.bet/d7ae90f8-25dd-430d-97cf-5d22fe8bab5c*' - '*https://ichnwcqh.jadoobet.live/bf1c115f-812c-49cf-ba20-cd5a211c8b0f*' - '*https://vefzvud7.jadoou.bond/?ublib=109b42cb-4282-4663-9d51-b46d8f760cf6*' - '*https://81ro1qyb.radioshartbandi.bet/?ublib=a71c6a6f-e445-442e-93de-14b946531cb0*' - '*https://micfybfh.jadoobet.ink/4796c73a-7cd5-48db-a727-89871317445a*' - '*https://mdzt.behtarin-site-shartbandi-football.bet/95680789-5ed8-4768-bee1-00eea145d538*' - '*https://fnrok367.jadoobet.blog/?ublib=1715f9a7-fa59-4a8a-985e-36884a8b9dfa*' - '*http://59.96.136.212:58967/i*' - '*http://119.118.90.115:60669/bin.sh*' - '*http://123.5.127.246:38895/i*' - '*https://rnjaeyqy.jadoobet.info/e62bcb5f-634b-4c0f-894a-011e81233b0f*' - '*https://bjmd.bahsegel90.com/26439a7b-016e-4ba2-8cfd-cfa699b94f2a*' - '*http://59.96.136.212:58967/bin.sh*' - '*https://5r48e4d3.betturkey.bet/?ublib=19340331-dbd2-49d0-bbd3-eb9c1db40e24*' - '*http://175.165.70.97:43547/i*' - '*https://yfekdkqg.jadoobet.forum/50ec875e-53cc-4ca3-97f8-1fcd3c7015ed*' - '*http://115.52.21.30:38573/bin.sh*' - '*https://hksv.bahigo90bet.com/2006c26f-48a0-4547-acf3-eab01d3aed07*' - '*https://nisosznd.jadoobet.club/50c0143e-5692-4bb5-87b0-c58591c2abda*' - '*https://lmhk.bahigo.casino/c0fc735b-cac9-4a5c-9637-a7b6d071b954*' - '*https://zfs6aubs.betropol.bet/?ublib=f7479ddf-5ef0-4975-9498-c0a77eeed5d7*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 7 id: 637246d6-65a0-5912-b598-2253f087651e status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 7). logsource: category: proxy detection: selection: c-uri: - '*https://osgeorhf.bekabet.casino/5bf101ec-fd3d-44b1-9c8e-2457fc95fa5a*' - '*http://42.231.208.60:37800/i*' - '*http://42.231.208.60:37800/bin.sh*' - '*https://fhqc.backgammon.download/bc1e7cf3-4048-4863-84c9-d919352d799b*' - '*http://222.141.122.172:36476/i*' - '*https://nwhygnbt.behtarin-site-shartbandi.com/f96170d1-4630-461b-9fd4-06c40b906e2b*' - '*http://222.141.122.172:36476/bin.sh*' - '*http://110.37.86.67:39010/i*' - '*http://182.121.210.117:46841/i*' - '*https://vlfnosj4.bazisangkaqazgeychidancepoli.com/?ublib=bccb006c-9183-4bea-9ec3-673a9c4a6db3*' - '*https://sh6ze53a.bet90forward.win/?ublib=50b18fa6-c8a1-43e0-8add-f5304ffe4957*' - '*https://lskz.bettilt90.com/dc28a2fe-6f09-4bc7-8be3-d7b84ab50cd7*' - '*http://182.117.27.59:51437/i*' - '*http://110.37.86.67:39010/bin.sh*' - '*https://wntzwdju.betpublic.casino/?ublib=346122e0-8ee6-4fca-8b70-9cd10d0dfd8c*' - '*https://etoncwgd.behtarin-site-shartbandi-football.com/42df99ab-5aaf-42b0-b85d-a9516bbd73df*' - '*http://112.246.11.204:57516/i*' - '*http://112.246.11.204:57516/bin.sh*' - '*https://oxlg.betraca.bet/a7df4c19-4ad8-4b1c-b073-8871a3896d40*' - '*http://222.138.126.62:36254/bin.sh*' - '*http://119.116.131.31:54163/bin.sh*' - '*https://nxiyquas.behtarin-site-shartbandi-football.bet/69f0bdff-a617-45fb-827b-1688bb73c09d*' - '*http://110.37.31.182:55872/i*' - '*https://uonh.bahsegel90.com/52059b34-b927-46b8-b40e-818160331e5e*' - '*https://orjrdtyn.site-shartbandi-khareji.com/8ef1d571-e5c1-4dbc-8060-f828b2e0490c*' - '*https://s7rpvlti.bahigo.casino/?ublib=6ecf8471-34fc-4923-85f5-fddb674467c9*' - '*http://110.37.31.182:55872/bin.sh*' - '*http://123.188.79.78:45414/bin.sh*' - '*https://jnjv.bahigo90bet.com/fce62c5e-93d1-4895-be74-7d1464e80ed7*' - '*https://puqrhdze.onjabet1.com/6f897d0a-a686-47a1-bdf8-67d20e9fae19*' - '*http://42.229.221.175:54079/i*' - '*http://115.57.255.73:39772/i*' - '*https://iwyx.bekabet.casino/1dd6528f-c457-4847-8ad3-b379426ae55c*' - '*http://42.229.221.175:54079/bin.sh*' - '*https://tjsojdll.betropol.bet/11160c4a-784a-4d44-8b12-4620eb1fd56d*' - '*http://60.214.58.128:50647/i*' - '*https://5jsdebh3.backgammon.download/?ublib=5ef23ea6-ab91-463b-a597-89df868fa0ed*' - '*http://222.138.102.72:33000/i*' - '*https://eksq11dg.dancebet90.app/?ublib=d9cd1ebe-ef6d-4bdf-82e4-891466ecc3a6*' - '*https://lpzi.behtarin-site-shartbandi.com/a7da215d-6637-46e5-9dfd-90b7a6dc8132*' - '*https://llgdqtat.betpublic.casino/fcdc8d65-4cd2-47ce-91b7-77089fa7122f*' - '*http://182.116.10.155:54576/i*' - '*http://182.116.10.155:54576/bin.sh*' - '*http://219.157.179.136:44096/i*' - '*http://110.37.13.213:43668/bin.sh*' - '*https://bqvojtsj.betgar.bet/f62200ea-99ad-44de-8400-df1475a22df8*' - '*https://prre.behtarin-site-shartbandi-football.com/62f95eb8-2c24-4102-a293-430d83f58366*' - '*http://219.157.179.136:44096/bin.sh*' - '*http://42.178.60.31:34929/i*' - '*http://112.248.245.229:56711/i*' - '*https://qs268cl5.radioshartbandi.bet/?ublib=e05797da-89bf-4038-a35d-ace09e9f0989*' - '*http://42.178.60.31:34929/bin.sh*' - '*https://wrryvujx.zaribbala.bet/08b7f398-c406-4d05-bcf9-175ca871c62e*' - '*https://uyxg.behtarin-site-shartbandi-football.bet/5db8636a-c81c-434b-bfb6-f7bec049131f*' - '*http://103.101.102.121:54675/i*' - '*http://110.37.64.31:45088/bin.sh*' - '*http://103.101.102.121:54675/bin.sh*' - '*https://jxiluxhf.radioshartbandi.chat/d1ce0ccb-6cf1-491b-ac4d-9aad250d59b0*' - '*https://tglc.bahsegel90.com/550d27af-f70d-448f-8781-78ec5fc2e1e4*' - '*https://xb7ea3kq.betturkey.bet/?ublib=264b8747-abf1-43ac-b247-b213012b8388*' - '*https://gtcymxsv.onjabet1.com/6679a7fe-5909-4912-88d1-936fa987938c*' - '*http://42.85.7.216:41048/i*' - '*https://files-storage.su/core/1.zip*' - '*http://45.90.161.42/x86*' - '*http://185.220.101.47/bins/sora.x86*' - '*http://45.90.161.42/arm7*' - '*http://185.220.101.47/bins/mirai.arm7*' - '*https://xbvj.bahigo90bet.com/ea8ff24c-4a6f-40da-bea7-8a9cafe3400d*' - '*http://125.40.26.196:37453/bin.sh*' - '*http://42.85.7.216:41048/bin.sh*' - '*http://182.126.198.181:45458/i*' - '*https://ocglemkm.betraca.bet/32a24b4e-7719-43fb-b34f-c4e015f13b8e*' - '*https://h81b1ag4.code-hediye-1xbet.com/?ublib=7412f589-1353-497b-b7e7-e4403a9a1c70*' - '*http://182.126.198.181:45458/bin.sh*' - '*https://syqi.bahigo.casino/12ee4213-d017-420a-8a0c-35eca7876bcc*' - '*https://zs3z44wh.bettilt90.com/?ublib=9407a861-4b48-4043-9404-59d2103d7ee1*' - '*https://gglosnig.betewin.poker/2b802e51-acaa-4c80-974e-2413476adb4b*' - '*https://igjp.backgammon.download/118f1118-82bf-4ae6-899a-63b4fd4ecb19*' - '*https://hdqzc.casinomhub.bet/9ca4b790-8bde-4830-a0b3-a80cd739e1ce*' - '*https://ifpzjway.betebet.poker/4d614ce8-2519-4408-8d2b-84570d00d3c4*' - '*https://jbqh.betaverse.casino/2d723589-f1ce-4428-902f-7013737dc360*' - '*https://adewbrfg.bet90forward.win/3d02a915-32d5-417d-81de-799708fb01a8*' - '*http://98.252.87.232:54826/i*' - '*https://tniukh64.bitbet.download/?ublib=0a4db2cc-3de0-4503-8ebe-c8c5c4734e95*' - '*http://123.10.3.15:58246/i*' - '*http://123.14.82.250:33483/i*' - '*https://hlme.bet90forward.app/308b6622-28b1-4cc5-948d-b0d55ac36823*' - '*https://uzmapubv.behtarin-site-shartbandi-football.com/4439bf95-cee6-4e54-8dde-47a4bceb9fa3*' - '*http://123.14.82.250:33483/bin.sh*' - '*https://tuvu.bet404.game/bd90012a-c264-433d-9f81-1e39551873b9*' - '*https://stdcamtp.behtarin-site-shartbandi-football.bet/a912419b-60ac-4cce-82e4-50e17b2e6d4e*' - '*http://27.215.51.159:56999/i*' - '*https://a9lrz6z9.betturkey.bet/?ublib=6f56d518-70cf-430e-bdb6-2ff82794679b*' - '*http://110.36.72.57:57396/i*' - '*http://209.54.101.171/42/givemebest.hta*' - '*https://dawn-mud-d34f.phzinhoooo.workers.dev/FTM0-40PO-AO28-G98E/img_277ltf.png*' - '*https://drive.google.com/uc?export=download&id=1atl3cZJNCTsuxmHAymvb7_c873JOXC0x*' - '*http://siggroyu.store/f/sant.jpg*' - '*https://drive.google.com/uc?export=download&id=1Hcnvm-eOWSBevnrOdeeJUapIgZAsMB2G*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/yIPUi*' - '*https://crypter.howto.rocks/img_045836.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/xlmAS*' - '*https://pritinder.ifree.page/img_003525.png*' - '*https://drive.google.com/uc?export=download&id=1zedecXg9goMyD7PpvT-eiN6PCD_hNWWp*' - '*https://drive.google.com/uc?export=download&id=11hOeQVHs_lNe8MQPWWojonbdpWPo067g*' - '*https://o82lzdzb.networkatlas.top/?ublib=87aa7f4b-3b71-4d90-b2fc-1c313963a4dc*' - '*https://andrefelipedonascime1781099063284.0791718.meusitehostgator.com.br/uDROsggMPH_25_06_Meus_ArquivosDeTexto/03.txt*' - '*https://andrefelipedonascime1781099063284.0791718.meusitehostgator.com.br/uDROsggMPH_25_06_Meus_ArquivosDeTexto/01.txt*' - '*https://andrefelipedonascime1781099063284.0791718.meusitehostgator.com.br/uDROsggMPH_25_06_Meus_ArquivosDeTexto/02.txt*' - '*https://drive.google.com/uc?export=download&id=1JCwGIY3FJjWVB9TapEfUFCMnv-SF2-kY*' - '*https://drive.google.com/uc?export=download&id=1n8LUdSbC-n2L7oZyWFcNlXRA4ZLJWteM*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/fuMoe*' - '*https://pocopaco.co.za/img_090136.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/pfCLO*' - '*https://drive.google.com/uc?export=download&id=1Dmm3nDGqP_-N-KsiM0-zioCTJDQYonyt*' - '*https://drive.google.com/uc?export=download&id=1ObSjRfAxe5D8je8uZDmkgk9kUs-nsQXs*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/mNHLb*' - '*https://pub-5fd52250a6494c859025a3cd39713703.r2.dev/img_183102.png*' - '*https://crypter.howto.rocks/img_065540.png*' - '*https://crypter.howto.rocks/img_213011.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/MHoYj*' - '*https://qcarxtrl.betcool90.com/?ublib=f11d01ee-c8d4-4e33-920b-8274276fc15f*' - '*https://drive.google.com/uc?export=download&id=1PMY1L8vqsY1xDNu-FJshXgC8X3otXaFK*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/qOcxX*' - '*https://sunix-technology.com/admin/MSI_PRO.png*' - '*https://sunix-technology.com/admin/nice.png*' - '*https://crypter.howto.rocks/img_064844.png*' - '*https://drive.google.com/uc?export=download&id=17ivR2nQexwOGa4M4n2EC3jSNK6U1L3VP*' - '*https://rufrzzcs.betpublic.casino/4a66cc71-c779-4fb9-87b0-f93d98137453*' - '*https://pbdb.bet303.site/d24ab38e-e011-41ec-8de0-793410a35e69*' - '*https://ggnytlvj.betnef.bet/fa4f0eea-2d10-4b3a-bfbe-a74f2ecf713f*' - '*https://lokb.bekabet.casino/96fbe0d7-3a88-4ad5-935c-d277dd4bfb34*' - '*http://72.255.30.244:43882/i*' - '*https://py01df9v.bettilt90.com/?ublib=da466986-1bd2-45eb-a442-3ec86f3d66a9*' - '*https://crypter.howto.rocks/img_065141.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/viOfP*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/cvMxa*' - '*https://crypter.howto.rocks/img_213631.png*' - '*https://crypter.howto.rocks/img_100330.png*' - '*https://misty-cherry-cea3.uploadsimg.workers.dev/fZelY*' - '*https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/yagghasa.png*' - '*https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/lkk.png*' - '*https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/hss.png*' - '*https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/aasyaa.png*' - '*https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/hky.png*' - '*https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/nwwaaa.png*' - '*http://27.204.193.16:54561/bin.sh*' - '*https://tradeswheel.lovestoblog.com/MSI_125442.png*' - '*https://tradeswheel.lovestoblog.com/img_002205.png*' - '*http://209.99.187.113/img_094148.png*' - '*http://209.99.187.113/img_093953.png*' - '*http://209.99.187.113/img_104942.png*' - '*http://209.99.187.113/img_105103.png*' - '*http://209.99.187.113/img_105140.png*' - '*https://teoz.radioshartbandi.casino/2cdea2e3-604f-49ff-93ff-b11ed5bb60d5*' - '*https://jcttadgn.betlivo90.bet/64a25988-c464-4b9f-a8d7-112f385a08df*' - '*http://110.37.25.189:53387/i*' - '*https://cppqqgxg.betlivo90.bet/6e25354a-10d9-4ca7-a5af-3bfe80141fbd*' - '*http://amzo-s.s3.ap-southeast-1.amazonaws.com/A7126.dat*' - '*http://amzo-s.s3.ap-southeast-1.amazonaws.com/A1121.dat*' - '*http://182.116.55.195:45633/i*' - '*http://112.225.45.14:46428/i*' - '*https://pyrd.radioshartbandi.bet/e71972a3-5e05-4b0c-9959-0f53fd92a321*' - '*https://peniclean.com/nvd_driver_dll.exe*' - '*https://zh3l5x4j.betstrong.bet/?ublib=412cb1e4-c1df-4197-9578-f618d82555d1*' - '*http://182.116.55.195:45633/bin.sh*' - '*http://45.146.81.130/crypter/vbbbfff.png*' - '*http://45.146.81.130/crypter/imggem.png*' - '*http://45.146.81.130/crypter/freeet.png*' - '*http://45.146.81.130/crypter/popopo.png*' - '*http://45.146.81.130/crypter/imgsert.png*' - '*http://45.146.81.130/crypter/cvvv.png*' - '*http://45.146.81.130/crypter/rrrrr.png*' - '*http://45.146.81.130/crypter/munddd.png*' - '*http://45.146.81.130/crypter/img_113833.png*' - '*http://45.146.81.130/crypter/crryy.png*' - '*http://45.146.81.130/crypter/prorump.png*' - '*https://pqyajjta.betgar.bet/98fcfd17-eedf-4258-ab16-af36f8119059*' - '*http://202.163.107.168:33531/i*' - '*http://42.85.134.227:46174/i*' - '*https://pmhy.gorgbet.net/d0682716-1747-4a82-b607-5eab5cb757da*' - '*http://110.37.64.31:45088/i*' - '*http://42.85.134.227:46174/bin.sh*' - '*https://fphhkiyz.betforward.download/320487ba-5ac1-4355-be2e-c210718eaca1*' - '*https://q0oocq7q.basari90bet.com/?ublib=0bd5fe14-2916-46a2-9304-d5ad8359b0e4*' - '*https://1qvrznky.runtimebeacon.top/?ublib=52cb2ddd-245c-4551-8f80-7741bbd85c26*' - '*http://62.60.226.185/s0907.exe*' - '*https://akvz.behtarin-site-shartbandi.com/b0a88c94-48f1-442c-88f8-13c44b90c37a*' - '*https://zcnevugr.betewin.poker/d87ecd56-a6fc-4b2f-8bc4-3ac0c18902e0*' - '*https://fzneds6a.betropol.bet/?ublib=405b2a7f-1d97-4e35-85a2-4fbe89e9e0c6*' - '*http://117.205.165.30:48400/i*' - '*https://tvcp.behtarin-site-shartbandi-football.bet/cfce73ac-a271-4724-95f2-61e065641720*' - '*https://xcfumaos.betebet.poker/172147ad-cd13-406f-b389-bfd5614f5f7a*' - '*http://117.205.165.30:48400/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_899d2dee1a40dac8.exe*' - '*https://skgm.bahsegel90.com/062cc5a1-ada2-4ee3-a592-64e959922b68*' - '*https://hlhmjajy.onjabet1.com/1dbd4306-e631-41d6-8746-3117975f9edb*' - '*https://gpukjn7z.betraca.bet/?ublib=855d2f7e-46d6-4f06-a2fb-824bda0f2165*' - '*https://zbrz.bahigo90bet.com/b115a713-c55f-4557-8faf-ac81f20e14bb*' - '*https://qfgzzlba.bet90forward.win/ca4cca20-0ddd-4d82-82e8-d9037d2e73aa*' - '*https://jbiyqacd.bcgame.shop/5f6b087a-1dbe-4226-abca-d31fcece3081*' - '*https://tvbx.bahigo.casino/97ccca6a-0de6-420e-abd2-c48f7e2d9fbb*' - '*https://zf82e23p.behtarin-site-shartbandi-football.com/?ublib=101d2262-4e45-424b-b8cc-e804b56c6a5b*' - '*https://35quvguj.banko90bet.com/?ublib=3e43ba45-029f-4e75-a84e-dd189faa0898*' - '*https://y06e8hvi.proxyharbor.top/?ublib=1331863c-6b1e-4347-95c8-c531986d58ec*' - '*https://rvbpwiks.bazisangkaqazgeychidancepoli.com/ad8cbf4a-ec88-4052-b636-e46606982846*' - '*https://tvzo.backgammon.download/06e49b1d-1311-46bc-858e-cb29b76f5164*' - '*http://39.87.36.107:57053/bin.sh*' - '*https://ayehtlgp.systemcompass.top/768b92fd-8947-4051-a609-c97b1c206c0c*' - '*https://ggj2o3iw.zaribbala.bet/?ublib=3f836d5c-a13a-485a-a2cb-48fa84842d97*' - '*https://ovya.logiccascade.top/5446b5fe-985e-4ed5-b61e-12eb6ebadfba*' - '*https://tjdxsecd.stacknexus.top/2cd7056c-4997-4c0b-b88b-7beea915859f*' - '*http://182.116.84.11:46161/i*' - '*http://27.204.193.16:54561/i*' - '*https://ruxi.kernelbridge.top/1ec26b9d-045f-4267-96f8-f01d23727902*' - '*http://182.116.84.11:46161/bin.sh*' - '*https://dkkmrjmb.signalfrontier.top/c5d8fa07-c85e-46ce-877d-11e16e3166c1*' - '*http://42.228.238.42:57406/i*' - '*https://kmfnh0zd.behtarin-site-shartbandi-football.com/?ublib=7bb49f5f-dfd2-4f75-9973-1ba4d0ab760e*' - '*https://qfkvyjft.scriptfoundry.top/917292e9-c1da-4922-ac4f-192753d2073b*' - '*http://42.230.68.64:33017/i*' - '*http://42.228.238.42:57406/bin.sh*' - '*http://176.116.56.92:6283/i*' - '*https://vgjb.bahsegel90.com/cead6641-a2dc-4153-b82f-1276b71cc19d*' - '*https://grgsg.onexbet.best/08b88dd5-8e0a-4ada-bb96-47fe34b8ceef*' - '*http://42.230.68.64:33017/bin.sh*' - '*http://182.233.38.178:37575/Mozi.a*' - '*http://196.251.121.142/a3f8d2/adb.sh*' - '*http://196.251.121.142/a3f8d2/kaizen.x86_srv*' - '*http://196.251.121.142/a3f8d2/dlink.sh*' - '*https://jc5eb1c5.radioshartbandi.chat/?ublib=8bdf88e5-66f9-497b-9e67-94548701997b*' - '*http://176.116.56.92:6283/bin.sh*' - '*https://hyh08ykm.packetmeridian.top/?ublib=91087a5b-93c2-4691-b8d1-4cae60e5e455*' - '*https://mfrsnkup.radioshartbandi.bet/b68e5112-bbc5-405d-9f3e-0ad3d3878a29*' - '*https://vxfo.bahigo.casino/54524aab-8509-4eae-addf-a9256cb47944*' - '*http://42.235.149.26:59631/i*' - '*https://s8p4n4bz.behtarin-site-shartbandi-football.bet/?ublib=c9fcf2f5-44be-4166-bf17-f2149fcc3bbf*' - '*https://glwpjrqq.bcgame.shop/da04f9c7-e1e4-4196-a4a7-49510567dabe*' - '*https://jtkeavok.bcgame.shop/1b43e959-4d8d-4312-8e83-7e107607c398*' - '*http://182.126.245.101:40314/bin.sh*' - '*https://snmg.bahigo90bet.com/5150d462-6881-4c3f-953e-94895e7dff03*' - '*https://ertt.bahigo90bet.com/05354918-f162-4eeb-ba90-e8de5fb6c985*' - '*http://119.115.222.169:52901/i*' - '*http://110.36.12.61:52297/bin.sh*' - '*http://119.115.222.169:52901/bin.sh*' - '*http://42.87.152.70:41357/bin.sh*' - '*https://awvz.backgammon.download/dafd8919-d9f8-4b8a-a841-8b79f9f62e29*' - '*http://59.96.138.224:40577/bin.sh*' - '*https://u1n70yhl.behtarin-site-shartbandi.com/?ublib=37b2752a-c838-4363-a9c6-eca106488424*' - '*http://27.215.125.166:51311/bin.sh*' - '*https://q6972jc6.powershart.com/?ublib=5f819f55-95da-4d2a-9fad-ace0fc9f2e03*' - '*https://xz1aa7xc.royalshart.bet/?ublib=636ccea6-302b-4b84-8d90-8f1b14893cf9*' - '*https://oj7f87i3.radioshartbandi.casino/?ublib=9c525f8c-b37f-4761-9e2e-24341614a7fe*' - '*http://27.215.125.166:51311/i*' - '*https://nnxhoedm.onjabet1.com/94b36fe0-a706-4271-96c2-1768bf16a54f*' - '*https://adbjginw.bet90forward.win/9c46f044-4b7e-42e9-af1c-c35f5808ab58*' - '*http://91.92.242.236/files-129312398/files/file_8c074aa042a45b9e.exe*' - '*https://dzij.alevcasino.bet/f8d09ac4-e37d-4ec4-885b-78e0906ac400*' - '*https://ujniklzz.radioshartbandi.bet/f354d8d2-e027-4871-9f4b-6e3089d1530f*' - '*https://nfvh.1pishbini.com/e9663846-3613-4376-9a47-fc06bc0f82a7*' - '*https://bizec8bu.zaribbala.bet/?ublib=d55ff9a7-33b6-4853-8483-aac95334d90b*' - '*https://ohnymfxm.btyek.cloud/3e65b427-fe87-41a8-82dd-be0223028bf9*' - '*https://eosgdskc.btyek.site/b8deeedb-13e5-44fa-875a-ad24d72d16db*' - '*http://62.60.226.140/files/7044575709/brti8Vz.exe*' - '*http://103.31.103.204:46574/i*' - '*https://yyyvzlgy.irantop.bet/bc48269c-0aba-4ad6-b8c0-bbeccdf8d6a8*' - '*https://vblr.barcelona11.com/01ebc1bd-3f01-4b9c-8be4-f43133f90830*' - '*https://ggittwjb.irantop.bet/7dbe829f-08c8-41df-972c-dd2e4a9e97d1*' - '*http://112.248.255.206:40693/i*' - '*https://nkzajnx4.pablobet.bet/?ublib=5637b900-931b-44bf-b25e-47943c2785fa*' - '*https://4x9zxbge.ritzo1bet.com/?ublib=b48a14b5-9d78-462b-896e-b28288be4bab*' - '*http://125.41.7.156:54523/i*' - '*https://auai.bet90forward.win/c18b38dc-e123-4a1f-abd8-2d0903de7a78*' - '*https://knyjwxkg.fileboroo.com/ac648a26-b5a2-407d-892f-8797fbe98669*' - '*http://125.41.7.156:54523/bin.sh*' - '*http://175.148.152.255:48925/bin.sh*' - '*https://oksz.ozabet.casino/d0adcef9-17dd-4138-9a6e-85ad1f7ea521*' - '*https://sfzfzyeb.btyek.site/8ec55314-201a-4593-9304-a4fa20e0d6d5*' - '*https://gifqd3gd.mahbet.poker/?ublib=10aa7268-6b48-4f15-8a62-0b3075ed3033*' - '*https://odng6v0p.rewardbet.bet/?ublib=f93608e1-9b89-4b9f-b2d3-26cc21e58cbe*' - '*https://secure.jokesterblinked.in.net/LICENSES.chromium.dat*' - '*https://ppdp.oza.bet/38ead192-d353-45ff-a9e4-5861359fbbf1*' - '*https://khlko.gorgbet.net/54dba6b6-7238-4b4b-bc1e-afa8b6e2a74d*' - '*http://175.148.154.150:51716/i*' - '*https://kesyothd.irantop.bet/cfdcf039-68be-45b0-a254-55164b22d741*' - '*http://62.60.226.140/files/7559850987/c40Txww.exe*' - '*https://vbhm.one1winbet.com/423cd298-6007-4daf-bbdb-b3aea234afe6*' - '*http://125.47.238.167:35702/i*' - '*https://caewscad.fileboroo.com/d594c87b-519d-4f61-acb4-d5b6f782d055*' - '*https://p8rzf42g.radmanwear.ir/?ublib=cf6065f4-a18d-485c-ad71-b04797080b3a*' - '*https://lynxsecurity.ru:2022/shell.sh*' - '*http://141.11.88.120/o.xml*' - '*http://176.100.36.247/Andiod.apk*' - '*http://176.100.36.247/Iranbot2.apk*' - '*http://91.92.40.118/kworkerd-cgroup*' - '*http://125.47.238.167:35702/bin.sh*' - '*http://110.39.238.29:57124/bin.sh*' - '*http://123.12.165.33:57440/i*' - '*https://undh.ofoghchat.ir/a48c9c88-5484-4b84-8fa5-bf476b8f90ec*' - '*https://xaktywhe.btyek.site/2db0231a-ae79-489c-844d-574c663ca318*' - '*http://160.119.69.4/k.php*' - '*https://www.mediafire.com/file/0cjywwwjfpc9cyy/Minecraft+Dupe+Mod+1.21.11.jar/file*' - '*https://qowmn9c8.iranvibes.ir/?ublib=7d24a14e-4749-4da3-a25f-de818b498f0e*' - '*https://www.mediafire.com/file/eihtrow48a6w45p/Matrix_Dupe.jar/file*' - '*http://95.216.21.87/iop8-agent.exe*' - '*http://95.216.21.87/333.zip*' - '*http://95.216.21.87/scanfff.exe*' - '*http://95.216.21.87/buildop.exe*' - '*http://95.216.21.87/222.zip*' - '*http://95.216.21.87/size.exe*' - '*https://jgtl.novin-gps.ir/d44cc248-598a-48ac-9d5e-7c65b6236b62*' - '*https://iqtpiyvx.rabonabet.casino/4bff366a-847b-44b7-87ea-7c185c244717*' - '*https://5rtckgb9.powershart.com/?ublib=a95aa363-6a05-42dc-bde0-69edbfff7890*' - '*https://yxjzgcji.proje-negar.ir/1d615043-044f-44ef-abab-007ee0e4d252*' - '*https://rlio.catsandcarp.com/dde654cc-0c1b-4513-8ee3-4485b5760fd1*' - '*https://3b213f9c.lionsport.ir/?ublib=e285af04-2bb5-4c21-9ef7-8b9cdf68ea1c*' - '*http://110.36.1.200:59137/i*' - '*https://mejpiuio.pokerprado.poker/26a3b111-39c7-43a5-8b91-6a3d2b90577f*' - '*http://110.36.1.200:59137/bin.sh*' - '*https://todahkuy.podcastshop.ir/fac217bb-7247-4eea-bed8-04ea14b6d7aa*' - '*http://62.60.226.140/files/7559850987/QDeGTBR.exe*' - '*https://hpwj.betawarz.com/65720ac0-84a0-49fe-ab45-d738208f918e*' - '*https://hzcsq855.taaghcheirani.com/?ublib=ef9d9073-218d-4a49-8228-a4cf935c1c09*' - '*https://drive.google.com/uc?export=download&id=1jV9G-oYJ7DbIAYj30moK_iOzqOMTiiI8*' - '*https://lttazjwo.pishbini90bet.bet/59503b90-9a48-4a03-a04c-5e9efa53ec1b*' - '*https://pub-f93d8f3d09584450b14b92394267bcc2.r2.dev/ZA_Access_My_Department%20(1).msi*' - '*https://pub-7e20e5854b5e4214a724a4f226301ea9.r2.dev/New_Approved_statementsss.zip*' - '*https://xczy.barcelona11.com/aacf7c7b-f1ff-47e2-9e0f-81f096da2083*' - '*http://216.9.224.48/7/drmSjnm.txt*' - '*https://drive.google.com/uc?export=download&id=1Q3L8qtXUanbTgSrUklB2Hq5e9Lp75xop*' - '*https://vsdipcxs.persianeducation.ir/9e5cdafe-6ccf-4f92-bbb6-2222b72b1f9d*' - '*https://bmmp.ace90betyek.bet/fff24796-f2c8-40f2-a301-62bd7d7e714a*' - '*https://xfcv55u8.iraniporn.video/?ublib=6ecfa6fe-e170-4920-b8e4-d9e5399d8e0a*' - '*http://115.50.95.121:59995/bin.sh*' - '*https://kuqetgql.shartebartar.game/?ublib=34d8a9de-a8ab-4545-8d79-06a4d0d5d774*' - '*https://wfwwdsvv.irantop.bet/e6098dd5-2d3b-455c-9de8-0f2b4f545e50*' - '*http://222.141.122.76:43722/bin.sh*' - '*https://pcue.elitesport.ir/d0f05d0e-a843-4f92-acc4-7e72d8746da0*' - '*https://wvew.elitesport.ir/ee986a47-f18b-44d5-8a52-64088210a19a*' - '*https://oulkepos.nikansefile.ir/885af22a-0a25-4950-b227-be5f70468d3d*' - '*https://jnfj.elitesport.ir/0171a959-5115-4358-b061-9328efdbe9f6*' - '*http://arena-router.com/davennn.png*' - '*http://110.39.226.207:38554/i*' - '*https://duqvs764.likesport.ir/?ublib=fec07f89-75b3-4a30-8891-d23d590f027c*' - '*https://drive.google.com/uc?export=download&id=194Tdr8JIZMjhUah53b9upptKKsJOS0es*' - '*https://unix-technology.com/admin/MSI_PRO.png*' - '*https://q8nw6zme.fileboroo.com/?ublib=0ede463b-b4e4-4cc1-b1c6-3a24053aa924*' - '*http://115.50.69.1:59335/bin.sh*' - '*https://crypter.howto.rocks/img_225526.png*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/pQDyy*' - '*https://fqsmqhyz.mosbatsms.ir/3043417a-b1d9-4c9b-8088-cf6938ac8506*' - '*http://basegrid.cfd/yufile/MSI_PRO77.png*' - '*https://ventaslll.com/admin/MSI_PRO.png*' - '*http://basegrid.cfd/yufile/YUoldrdp.png*' - '*https://pub-45a83f302a1943ed8d62418c2af947ef.r2.dev/xxx.png*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/mlTzN*' - '*https://aapt.betsher.casino/7459ddcd-6c5c-439e-b3b0-53a81af5c85d*' - '*https://res.cloudinary.com/dp1ymsqid/image/upload/v1783584059/img_005701_bsqk4y.jpg*' - '*http://170.39.215.70/Siames7.ocx*' - '*http://170.39.215.70/Phar.pcx*' - '*http://115.55.250.127:37744/i*' - '*http://filezox.xyz/common/axis/edu.png*' - '*http://filezox.xyz/common/axis/dbk.png*' - '*http://filezox.xyz/common/axis/richy.png*' - '*http://filezox.xyz/common/axis/chief.png*' - '*http://filezox.xyz/common/axis/bt.png*' - '*http://filezox.xyz/common/axis/msi.png*' - '*http://41.216.189.157/nerv.mpsl*' - '*http://115.52.243.121:35977/i*' - '*https://ncvhdwcq.medsalamat.ir/709b6649-cccd-45a6-997e-a15b53944778*' - '*https://trlcayaw.matalebeziba.ir/0cd962cd-60ab-477e-a8c5-f937b0fc7d86*' - '*https://akvy.20sport.ir/b558b7a4-044e-4334-8187-4a3d029831b7*' - '*http://110.36.2.23:39355/i*' - '*http://119.178.188.100:58317/i*' - '*https://mdazhynx.btyek.site/?ublib=fb6db7fc-d185-47f5-bfc7-83e6ce5e93df*' - '*https://cniqfzhe.riskybet.casino/4940fa3e-8808-4c43-907e-2937a9212512*' - '*http://110.36.2.23:39355/bin.sh*' - '*https://cztv.betfa.download/786b058c-3c35-45d1-bd4e-c418847abb32*' - '*http://62.60.226.140/files/7411337060/zz4Sj5M.exe*' - '*https://snbzg3fu.noscriptc11pills.com/?ublib=2af76072-aea3-4559-ad09-188afc2701f3*' - '*http://115.62.148.220:57253/i*' - '*https://xqbhmyyk.powershart.com/92288779-75be-4a6d-926a-60b720647e7f*' - '*https://zirq.bet24.casino/e84a1534-9d81-42e9-9885-87c9ec330dcc*' - '*http://123.5.173.7:58528/i*' - '*http://115.62.148.220:57253/bin.sh*' - '*https://078ia1jh.ace90betyek.bet/?ublib=d2a18dc6-1973-4194-9d66-88c43e684231*' - '*https://eznvrdxc.footbalpersian.ir/f2c098f5-f3e0-40ad-a000-78782cb85759*' - '*https://glmo.bcgame90.casino/8f76290e-6931-4de5-9ee8-9545ab324a50*' - '*https://i0wrocb4.bet90forward.win/?ublib=a40aa275-d00a-4425-932c-5fe320324758*' - '*https://eiuphpvo.fiorentini.ir/8477f959-ef4f-460e-a604-625a89e32902*' - '*https://ojvh.barcelona11.com/a79728b2-b069-4d3e-9f6d-885a7d31675e*' - '*https://fh6sil11.test-drive-iran.com/?ublib=98cb34c2-559b-42ea-878a-06415764ba79*' - '*http://119.178.188.100:58317/bin.sh*' - '*https://jxfszcuc.megaparifarsi.com/ec265e54-974c-4371-8588-0fc9c2583ad2*' - '*https://psqj.app888starz.download/dedb7c36-d013-4fcd-827b-56942ebaa585*' - '*http://113.228.151.189:48866/bin.sh*' - '*http://123.11.77.40:40335/i*' - '*https://omjsikzk.irantop.bet/9ce99d4e-dcbe-420f-9e17-84b4b69b8143*' - '*http://115.52.40.97:51546/i*' - '*https://ftoa.healthvarzesh.ir/2426b78e-96df-46cf-9f9e-671efde71f1b*' - '*http://115.52.40.97:51546/bin.sh*' - '*https://7j6ew89s.melbetir.casino/?ublib=d332c470-153d-4a80-b4f6-e2255fdf3c8f*' - '*http://222.141.39.86:41282/i*' - '*https://0mx8cbge.fa1xbet.vip/?ublib=c23e2bbb-32fe-42f7-9e2d-9f530971e04a*' - '*https://fhbd.golibet.page/82d7b13d-796c-4a21-91bb-f9e1135dfa1c*' - '*http://222.141.39.86:41282/bin.sh*' - '*http://115.52.176.31:38829/i*' - '*https://ujxjvdku.catsandcarp.com/0cc56791-942e-49a2-9b8b-c6b954e4db45*' - '*http://91.92.242.236/files-129312398/files/file_8b191269d0a8fd0c.exe*' - '*https://dumw.goaliran.ir/3ad266aa-a44b-4ef7-ad8d-befbd7e2f662*' - '*https://13d3c8zt.kick1bet.com/?ublib=7eb1968a-6eea-4e6f-92c6-7486b3aefec0*' - '*https://hwgi901o.cialispi.com/?ublib=02095bbc-f535-447a-9bcb-bfd6283a0bbd*' - '*https://hljr.gamesport.ir/22987b31-2701-4f2e-8ea0-d9dc9dc00290*' - '*https://uyixzgec.betawarz.com/f9ed3df2-2094-4cfe-8275-9e7ffa173ea3*' - '*https://ghccipia.fifa90bet.casino/a05dc409-14a5-4a77-bdc9-51c0f08059d2*' - '*https://gclz.futboliran.ir/77c4da64-1937-40b4-b2ed-870b021fd591*' - '*https://smfnctms.fifa90.bet/d59048b8-33bb-4088-b616-ae04f0a8e12f*' - '*https://4z0tdlyo.calvaryhospice.org/?ublib=f0a461af-70f7-4907-b701-98ef305590eb*' - '*https://ihnx.footbalpersian.ir/906ff932-3c62-4c96-8fd9-59ba0cec2529*' - '*https://jtemlhyz.enfej.casino/7a94b3d0-8fc5-4e83-b97c-6dbd7523c06c*' - '*https://dgl7533w.melbetir.bet/?ublib=bdca0d5f-c783-454c-9977-b1b1f243c1bf*' - '*http://39.87.30.92:47241/i*' - '*https://qakm.fiorentini.ir/5a5d55ff-f17c-4ebb-80f3-fabfe639e949*' - '*https://zvulhavn.elitesport.ir/dc406432-f59e-40cf-88ad-e9bca504fc83*' - '*http://5.167.229.94:27250/i*' - '*https://gtv6eszx.riskybet.casino/?ublib=c153430f-e97d-44f8-900b-5ae7b49d91be*' - '*https://ultimatebodyrecovery.com/*' - '*https://jrudq.ganj.bet/34a03c7c-ee45-4baa-8ba5-4c07ee06d1a5*' - '*https://blhs.20sport.ir/e4f17ac4-8903-4ec0-aa5f-85aa252a42bc*' - '*https://mbifcxdz.careeriran.ir/37bb9b34-9138-47ee-a6bc-bc4ba8156633*' - '*https://lddwegnb.ketabworld.ir/?ublib=f5a9f75c-5ba4-4f9f-a0f8-f2d044dc3b13*' - '*http://182.124.126.196:40819/i*' - '*http://91.92.242.236/files-129312398/files/file_b66749d846629102.exe*' - '*https://rcodtjdj.melbetiran.bet/89f5b321-1eca-4e6f-92d4-9b19eade73c1*' - '*http://123.12.240.37:49403/i*' - '*http://91.92.242.236/files-129312398/files/file_55c1b708fcd2591a.exe*' - '*http://42.232.228.31:53154/bin.sh*' - '*https://aafnojwq.megashart.blog/f49b548a-b94f-4b4e-8be9-466375601547*' - '*http://110.39.238.66:42378/i*' - '*http://123.12.240.37:49403/bin.sh*' - '*https://etorvugt.betsher.casino/a3b48ce8-7a40-45dd-b296-086371b090c1*' - '*https://wrov.betfa.download/b2d96a4f-c10a-4838-a7f2-e91073c177f7*' - '*https://4lbsgx9v.powershart.com/?ublib=f48b9f35-70d2-4336-ab34-093691f3d405*' - '*https://instnhvy.melbetiran.bet/2ef02074-58d8-41f3-849b-ce8880aeda06*' - '*http://42.231.91.217:53883/i*' - '*https://obds.betsher.casino/fc8af826-5165-4842-9400-18685b4bc3b8*' - '*https://xclparsl.megashart.blog/48de669f-81c9-457c-933e-825d43043cba*' - '*https://9c8joror.melbetir.app/?ublib=40129f89-d469-47dc-9ab4-41ea7f4cfd11*' - '*http://182.127.4.27:43671/bin.sh*' - '*https://rmwj.betfa.download/9f165916-880d-43aa-9cc5-c083f2f54619*' - '*http://d90s0lckjm3qn44hcum01m8hh5cnosj6q.oast.fun*' - '*http://d90s0lckjm3qn44hcum0sidr8j1jfutb5.oast.fun*' - '*https://8n2r77nt.app888starz.download/?ublib=5b7fca65-4845-4e7f-a9b2-52a0c57c478d*' - '*https://zqjjyamd.megaparifarsi.com/172da6e7-0589-48bb-a507-ea3381cfd8e3*' - '*https://cabv.bet24.casino/3dd522a2-da78-451c-800e-9cc1e5067d3d*' - '*http://182.123.245.187:35967/i*' - '*https://verify.hashtopoils.org/verify_amd*' - '*https://verify.hashtopoils.org/verify_arm*' - '*https://sjgejs29.itsport.ir/?ublib=8fa80e70-e96f-476f-a95c-1f8e55f3aca7*' - '*https://emtd.bcgame90.casino/c7c1897d-a4af-4f02-8b90-aeac3bcf3605*' - '*http://182.123.245.187:35967/bin.sh*' - '*http://123.7.226.252:39722/i*' - '*https://mpv5bjr9.yasbet.co/?ublib=f8d69c4c-7b1b-4c29-aa75-afdbd96d3564*' - '*http://62.60.226.140/files/7048186296/Gy41y7O.exe*' - '*https://dcaxdwoo.barcelona11.com/da80530e-3180-4285-baf9-881e2e039c83*' - '*https://ztop.hazzaratbet.com/506a48ad-9522-4a9d-b741-4d8aaf9e7a59*' - '*https://toonhymp.barcelona11.com/77f467b3-2f80-4605-98e9-c9a7ad320f85*' - '*https://eluk.hazzaratbet.com/66b34559-2dd8-472a-b900-17481638eb05*' - '*https://pub-b156ef7b8e9141738331d7cd7868c327.r2.dev/output.bat*' - '*https://i.ibb.co/3ynnQmxB/c1A.png*' - '*https://hvaujhmz.alhilal90.com/053c7321-7980-41f5-ae96-c0de156094da*' - '*https://qee052b3.irantop.bet/?ublib=387ccab7-95c0-4bd8-92e4-9265942c14d8*' - '*https://bwup.catsandcarp.com/2af7d0f8-d488-4646-9d1e-ad290a2df45a*' - '*http://182.127.4.27:43671/i*' - '*http://222.141.122.76:43722/i*' - '*https://2766iljo.melbetiran.poker/?ublib=105c4669-6188-45e1-9feb-ff87e61450e3*' - '*https://3w6k8hlt.pinbahis.bet/?ublib=2c82e7ff-387f-43fe-bcd1-51c1395115f4*' - '*https://phcwqqkr.1xgermany.com/d2b282f1-b951-4e49-8364-6d87897cc80f*' - '*https://ykgl.calvaryhospice.org/5468cbb5-9b09-40a6-8515-0bdcdd62b0cb*' - '*http://123.5.158.194:57168/bin.sh*' - '*https://errxxcnl.gamee.bet/70738f5e-4f31-4119-b124-a45974b35888*' - '*https://vj7eaayr.fa1xbet.vip/?ublib=7d3d7529-c27d-40be-b74a-3177bddd906d*' - '*https://kqbtsllu.1xgame.pro/7df7b7fe-ab25-4c20-b375-43f1e4c1eb41*' - '*https://obuf.betawarz.com/275fec36-f843-46b7-9adb-43ddeb837b10*' - '*https://fezk.polbaz.bet/48d045e7-7562-43ed-a88a-ea1e6d5a6f9d*' - '*https://tiduflxx.farsi1xbet.shop/8d25635e-11c6-43b3-9d66-4a95eb45e11c*' - '*https://srgq.icebet90.com/5c2f6eef-2d2d-4cc8-b668-0d8549e18eb9*' - '*https://pub-61124cd6b14a43ab85c051bf3b7bf33f.r2.dev/Semoklu.msi*' - '*http://d90s0lckjm3qn44hcum0r44ejdsrc3ke3.oast.fun*' - '*http://d90s0lckjm3qn44hcum0ejhp587m6s5xc.oast.fun*' - '*https://desentupidora.pro.br/assets/MSI_PRODJ5TH.png*' - '*http://42.86.113.243:40712/i*' - '*https://pastefy.app/2UAyY6A9/raw*' - '*http://115.61.51.91:46415/i*' - '*https://pastefy.app/lBTfY3Xg/raw*' - '*https://a1ukh8ol.cialispi.com/?ublib=24b3d06c-8ce8-4099-940e-1d8af649555a*' - '*https://rbthbhfo.backlinkbet.com/4f5e79ed-eafd-44ff-8f0d-09e1945855a9*' - '*http://115.55.177.183:36148/i*' - '*https://jrfl.hazzaratbet.com/c5a4f284-e088-4b11-8d91-48fedb48e0ea*' - '*http://91.92.242.236/files-129312398/files/file_02ab507d3ceeda2d.exe*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 8 id: 01c93c5f-26be-5b91-aace-96430c306e45 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 8). logsource: category: proxy detection: selection: c-uri: - '*http://91.92.242.236/files-129312398/files/file_cfd4bfe5de4a0388.exe*' - '*http://91.92.242.236/files-129312398/files/file_adc06bbfce57bc0f.exe*' - '*http://91.92.242.236/files-129312398/files/file_3dd5d9273b191b45.exe*' - '*http://91.92.242.236/files-129312398/files/file_3a1cc00092af29d0.exe*' - '*https://lams.catsandcarp.com/004c8c05-0cdb-4c38-967f-918bccad89e0*' - '*http://62.60.226.198/uploads/480e1d7b7c1f4f86893e91d7297ff652.exe*' - '*http://62.60.226.198/uploads/c48d8858c31d4439a5a58204effb3d85.exe*' - '*http://62.60.226.198/uploads/3bf4d96d7ba74ee7ad4ce7cdea8e7033.exe*' - '*http://62.60.226.198/uploads/e36ea4fdb2994fe9b58aaecc72c71f06.exe*' - '*http://62.60.226.198/uploads/ca089a46f61743cd83884b1577b489ef.exe*' - '*http://62.60.226.198/uploads/ac68a70ed1654d04b29a8985d5ab58e8.exe*' - '*http://62.60.226.198/uploads/3923ae729e2c4adf85dc26b2db55768a.exe*' - '*http://62.60.226.198/uploads/4b5b8620309f491789af03500ede5528.exe*' - '*http://62.60.226.198/uploads/37ca1ffeb4e14e6f9b4854013b1c4ca5.exe*' - '*http://62.60.226.198/uploads/3f319bcbb3744ae8a49dc54a1b02c02c.exe*' - '*http://62.60.226.198/uploads/f0f1d4b4522f4c9f897ac08a4e1d1623.exe*' - '*http://62.60.226.198/uploads/d63419ec10664d4384a260b3f7e614cc.exe*' - '*http://62.60.226.198/uploads/6b3b40e54b9c4c26a13d7a72a2eaab3c.exe*' - '*http://62.60.226.198/uploads/fe74b5ae594c4eda870ac2ec9dc214a0.exe*' - '*http://62.60.226.198/uploads/32daa1c9eac744b98d12ae18e00f9ad2.exe*' - '*http://62.60.226.198/uploads/a14d88353c6441d89205a760ac7a1c79.exe*' - '*http://62.60.226.198/uploads/6d4b5504e589459f8e11ad3d1838f3f5.exe*' - '*http://62.60.226.198/uploads/edfaeaf2bb634e3bb0f45339142bec7f.exe*' - '*http://62.60.226.198/uploads/25c935b940ea40cfba6db6c752400178.exe*' - '*http://62.60.226.198/uploads/d9e1709923ce40c49d6add23c7c95d0e.exe*' - '*http://62.60.226.198/uploads/f9a78169df37447aa3dfc6ad4d3593e7.exe*' - '*http://62.60.226.198/uploads/57c96d44ac93466f8cf814703a77fe4c.exe*' - '*http://62.60.226.198/uploads/7d3839dfd03646a282c79d407acc92e8.exe*' - '*https://wclaheuy.akhbarirani.com/f8429bd0-6a0d-477e-92b5-fc1f7d2b6bc3*' - '*http://90.153.217.151:59587/i*' - '*http://115.52.22.6:35725/i*' - '*https://qcfonhxm.1pishbini.com/32e1dbab-274d-4d8c-89d3-34b3a63d0990*' - '*https://7eo6l6dj.bet90forward.win/?ublib=3fa0c2f5-d3c9-496b-adeb-41529ccc0bdc*' - '*http://115.55.234.28:52773/i*' - '*https://jvjj.calvaryhospice.org/1a67207a-4403-451b-9383-adf105fa8c31*' - '*https://e1l3tn5m.bet1xyek.bet/?ublib=b09a5cff-37d4-43f3-9d39-3e1075dad749*' - '*https://dcyfiemg.betzopoda.com/?ublib=4dc7cc3d-60da-4224-b2f4-90aae6ebc7e2*' - '*http://42.238.64.12:58417/i*' - '*http://115.55.234.28:52773/bin.sh*' - '*https://indf.betawarz.com/1db7be2b-1c69-4302-b7df-8269658755b7*' - '*http://59.103.116.68:46941/bin.sh*' - '*http://59.103.116.68:46941/i*' - '*http://123.235.194.222:60042/bin.sh*' - '*http://182.126.121.9:52719/bin.sh*' - '*https://smildilt.1xjet.pro/1503cab1-110d-4354-90eb-0ae1ab838c91*' - '*http://120.84.214.35:43836/bin.sh*' - '*https://cpvt.bet120.games/f21bac70-6953-4cdf-9be0-7b54ca5c0e3b*' - '*http://115.55.10.88:38789/bin.sh*' - '*http://78.187.104.169:44308/i*' - '*https://ydanflbg.1xgermany.com/c1e82c66-9d7c-4087-a5a1-76952278a143*' - '*https://pzhj.barcelona11.com/45082e60-eb77-4ad0-a4ab-c73f8ddb76bb*' - '*https://eoy6mamg.bettrend.vip/?ublib=d8976c1a-b79c-4501-8555-d65e6c07d519*' - '*http://222.137.95.232:58447/i*' - '*https://hljajzy.arsenal11.com/731393f8-c825-45a1-a0a1-1d851f441ceb*' - '*https://wakvssup.1xgame.pro/593bc40b-788b-4929-a6a0-e5dfdee06a98*' - '*http://222.137.95.232:58447/bin.sh*' - '*https://vhkpyhz.alhilal90.com/4cc86bb8-a612-45dd-bbc2-a1ac74ea915d*' - '*http://59.96.136.162:35864/i*' - '*https://ascaf0yi.rollexbet.com/?ublib=114f0fac-eaa9-466e-8ce8-e479c58e0653*' - '*https://pzaiotb.akhbarirani.com/9d80dbd7-e049-4a07-b02f-787dd27a017f*' - '*https://clkdnxzu.bet1yekbet.bet/04e628fa-d1f4-4ece-9ca2-fd812d391004*' - '*https://h1b2r6fo.oris303.com/?ublib=959d7f47-e584-4378-b53c-a0b079d00dd4*' - '*https://75rw2mk7.1xvip.xyz/?ublib=6ff97af0-0973-4fa9-b29e-85af6e525bda*' - '*https://sgnfvyd.1pishbini.com/120f474e-cde2-4c2c-8da9-ad8480eec06b*' - '*https://exwrvqwl.bet1yek1.bet/c1fc358a-f0c6-4956-865c-00d763c883b1*' - '*https://pd9l19qk.milliardbet.com/?ublib=7978d189-3b6b-49f4-b52d-cefe50fd20f3*' - '*https://ookksol.zeebline.com/8aca6874-0746-4f80-9b51-63ca7d6af894*' - '*https://yeduwgyh.backlinkyek.com/0105e3bd-d897-489f-883f-56cbc66ba39f*' - '*http://115.50.95.121:59995/i*' - '*http://115.50.89.177:48625/i*' - '*https://ajdixpjp.1xforward.xyz/f4fe76ec-d460-4855-921c-21d57935696a*' - '*http://123.4.190.17:48149/i*' - '*https://npvnwrv.jetbet90iran.bet/3f59e222-db58-4089-9421-28b4d10984d8*' - '*http://115.55.10.88:38789/i*' - '*https://8djyx8g3.mellbet.net/?ublib=d65eefb1-fb9a-471c-9d5f-10be7e7779d5*' - '*http://42.224.27.77:34533/i*' - '*http://182.127.102.167:36777/i*' - '*http://182.127.102.167:36777/bin.sh*' - '*https://rmhtxvz.jet90betyek.bet/bf40d285-73f4-4d7a-b284-55d28b74a8c0*' - '*https://mqp8iw5d.jetshart.net/?ublib=71bee544-f485-455d-9c90-05a86166cd29*' - '*https://h9qlti2y.marjaevakil.ir/?ublib=ab06e5d9-c6fe-4c3a-b9a0-88ef4dcaecf2*' - '*https://oznubofc.backlinkbet.com/a445f56c-1a81-4a13-9ebc-78a4acb36cda*' - '*https://scawwaq.jet90betiran.bet/978510df-0f08-4df3-9613-8158e68b8dcf*' - '*http://27.207.230.65:33257/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_362cb5e2f5df49e2.exe*' - '*https://9qdbp5gv.bet90forward.win/?ublib=9492ee16-2ec3-48da-b29d-0c8aa0ecd312*' - '*http://123.8.55.58:53035/i*' - '*https://ffedpfb.jet90bet.bet/e2b950a5-d4d2-4303-8270-32b9af24c52b*' - '*http://123.235.194.222:60042/i*' - '*https://ywpwwxjc.ace90bet1.bet/6baa2cda-6177-4035-988f-a57fae77c8b8*' - '*http://39.65.212.175:50865/i*' - '*https://ezrqiew.jet90bet1.bet/ccb7c45c-0bf9-4eb1-863b-c975a1dc1839*' - '*https://iixryzos.1xyekbet.bet/81ee77dd-5cea-4a5a-a0b8-41711ec78f86*' - '*http://110.39.238.66:41966/i*' - '*https://3qian795.bet359.bet/?ublib=46636f45-643b-4d0e-97d3-b32635a603ec*' - '*https://hcqkjox.zeebline.com/42b35561-f4fd-471d-82b1-8fe53eae96e7*' - '*http://182.113.200.200:34920/i*' - '*https://vilhvypu.1xborobet.bet/1cf1cca3-e7a6-4585-bba1-f8b45fb5a901*' - '*https://xdkynlm.bethouse.bet/358c9f3f-eb60-45b4-8b54-a4f62e11c09d*' - '*https://jpauxzfd.1xforward.xyz/ae84f584-8ad5-43ac-aab4-6fd420929650*' - '*https://c50tvp96.bet1yekbet.bet/?ublib=bd27e5e2-20bf-4ba4-b07e-83227998d43a*' - '*https://qqtldjhf.1xforward.xyz/6bee5073-bc4f-4c4a-828d-0feb2d694c58*' - '*http://46.236.65.230:47543/i*' - '*http://46.236.65.230:47543/bin.sh*' - '*https://vkgfakco.yan303.com/665f2f98-1691-4e74-8fbd-4a11f50991a6*' - '*http://182.239.81.126:54635/i*' - '*https://opklh5i1.catsandcarp.com/?ublib=3520d4ec-bc22-40ef-ac7b-31024fc6ebba*' - '*https://az1cv6zs.calvaryhospice.org/?ublib=61a226d1-42be-442a-bff9-fb6cd9aa9412*' - '*http://182.239.81.126:54635/bin.sh*' - '*https://oavxdiz.bet1xboro.bet/e94c3771-5cea-4bbd-8155-aa7ea233b13c*' - '*http://125.45.57.40:45480/i*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/XTmXN*' - '*https://gulsen.kesug.com/img_225317.png*' - '*https://gulsen.kesug.com/img_225502.png*' - '*http://195.177.94.103/img_160700.png*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/nqzOd*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/pBzfv*' - '*https://aair.org.ro/Udfl140.mdp*' - '*https://aair.org.ro/Bryog.thn*' - '*https://sunix-technology.com/admin/MSI_PRODJ5TH.png*' - '*https://sunix-technology.com/admin/sdy.png*' - '*https://aair.org.ro/Deor.xsn*' - '*http://27.222.178.246:42909/i*' - '*http://119.186.232.222:41659/bin.sh*' - '*https://ventaslll.com/admin/lit.png*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/wCSMn*' - '*http://195.177.94.103/img_144346.png*' - '*https://tdyqptv.bet1betyek.bet/6ba35ae0-9784-42d6-b5cc-76a9f1a77828*' - '*http://175.146.227.235:55858/i*' - '*http://www.gridfile.cfd/yufile/MSI_PRO2ndJuly.png*' - '*http://www.gridfile.cfd/yufile/YUoldrdp.png*' - '*http://www.gridfile.cfd/yufile/MSI_PRO77.png*' - '*https://sizyrotiqnsa.com/*' - '*https://j0g2ia0g.bet1yek.bet/?ublib=37e6abe3-98ad-4ec7-845c-6c115d9c2304*' - '*https://web.opendrive.com/api/v1/download/file.json/NF8zMjU5MTMwNDFf?temp_key=%90Xdl%88m%C6&inline=1*' - '*https://od.lk/s/NF8zMjU5MTMwNDFf/kFhkbIh.txt*' - '*https://aair.org.ro/Zoroaster.dwp*' - '*https://aair.org.ro/Rema.psp*' - '*https://ventaslll.com/admin/ogfile.png*' - '*https://ventaslll.com/admin/MSI_PRODJ5TH.png*' - '*https://pub-993e6833644143bca786bdde76325190.r2.dev/img_164905.png*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/klZSD*' - '*http://202.1.26.13:34091/i*' - '*http://175.146.227.235:55858/bin.sh*' - '*http://151.241.154.141:8888/1/iemqg674fyehs.nwl*' - '*https://cfimotpa.site-enfejar-pooyan-mokhtari.com/12778495-3750-4533-8e28-9881ca79131e*' - '*http://151.241.154.141:8888/1/iemqgfyehs730.kbt*' - '*http://202.1.26.13:34091/bin.sh*' - '*http://116.139.183.228:43439/i*' - '*http://153.117.15.59:33746/Mozi.m*' - '*http://139.135.44.215:43974/Mozi.7*' - '*http://111.92.152.188:53622/Mozi.m*' - '*http://223.123.46.69:35063/Mozi.7*' - '*http://5.182.210.61/eb77a0*' - '*http://141.11.88.128/mips*' - '*http://116.108.215.143:48020/Mozi.m*' - '*http://93.115.101.140:13677/ipmiv2.xml*' - '*http://5.182.210.61/abf45c*' - '*http://5.182.210.61/f76580*' - '*http://83.142.209.46/a3f8d2/dlink.sh*' - '*http://5.182.210.61/cb3281*' - '*http://141.11.88.128/8UsA.sh*' - '*http://83.142.209.46/a3f8d2/kaizen.mpsl*' - '*http://5.182.210.61/d4f92f*' - '*http://103.186.77.82:59118/Mozi.m*' - '*https://res.cloudinary.com/dp1ymsqid/image/upload/v1783395994/img_204415_txnqyg.jpg*' - '*http://5.182.210.61/a8caff*' - '*http://165.22.248.57/giga.sh*' - '*http://160.30.142.211:41925/Mozi.m*' - '*http://41.216.189.157/nz/morte.mpsl*' - '*http://94.154.43.192/nz/mz.x86_64*' - '*http://41.216.189.157/nz/mz.x86_64*' - '*http://153.117.6.92:32895/Mozi.a*' - '*http://103.26.86.210:53056/Mozi.m*' - '*http://5.182.210.61/d97444*' - '*http://5.182.210.61/18b1a1*' - '*http://5.182.210.61/7f05c4*' - '*http://5.182.210.61/d54b5f*' - '*http://5.182.210.61/f169f9*' - '*http://5.182.210.61/f3986f*' - '*http://5.182.210.61/f62f42*' - '*http://5.182.210.61/f63f2c*' - '*http://5.182.210.61/46427d*' - '*http://5.182.210.61/d6682e*' - '*http://5.182.210.61/40d884*' - '*http://5.182.210.61/e4a021*' - '*http://5.182.210.61/2d73a8*' - '*http://5.182.210.61/596e39*' - '*http://5.182.210.61/89e2d3*' - '*http://5.182.210.61/51c737*' - '*http://5.182.210.61/223d92*' - '*http://5.182.210.61/9ef853*' - '*http://5.182.210.61/d04811*' - '*http://5.182.210.61/c1dfb0*' - '*http://5.182.210.61/cc4be4*' - '*http://5.182.210.61/a7fd05*' - '*http://5.182.210.61/7f6642*' - '*http://5.182.210.61/b207c4*' - '*http://5.182.210.61/4abd6d*' - '*http://5.182.210.61/391c2c*' - '*http://5.182.210.61/f65191*' - '*http://5.182.210.61/d6d59a*' - '*http://5.182.210.61/c8c871*' - '*http://5.182.210.61/a37216*' - '*http://5.182.210.61/836333*' - '*http://94.154.43.87//arm5*' - '*http://5.182.210.61/e0b3b9*' - '*http://5.182.210.61/947dba*' - '*http://5.182.210.61/9a9fd2*' - '*http://5.182.210.61/470af3*' - '*https://utuyuea.backlinkyek.com/7ee2081d-ea9c-4cf3-9c26-d6d5eb491a03*' - '*https://qowlvqc.backlinkbet.com/1c4c84fc-89f9-44f1-a5e3-2e2f33ff7688*' - '*https://uaat6cni.bet1yek1.bet/?ublib=24f89b77-c4b5-4343-87d9-2b2435e75fc0*' - '*http://dawn-bush-ddd1.yasminanthonyy.workers.dev/dnlrp*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/aJVea/*' - '*https://aboulokman.howto.rocks/img_042508.png*' - '*https://aboulokman.howto.rocks/img_041940.png*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/VPUqW/png*' - '*http://dawn-bush-ddd1.yasminanthonyy.workers.dev/arzdo*' - '*http://222.134.162.166:39839/i*' - '*https://mcb0187.gamer.gd/img_070947.png*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/MieOz*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/lVRdN*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/swbui*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/Pkjtb*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/GVIBf*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/xfAHa*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/STCNC/*' - '*https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/vzjBJ2C20https3A/pub-ce02802067934e0eb072f69bf6427bf6.r2.dev/camb.png*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/WVMpU*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/uWupr/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/FGuju*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/QgQLV*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/SIATH*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/uwupr*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/kuwxx*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/uWupr/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/XbOEk/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/ttQty*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/mTlAc/*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/NCxCO/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/MieOz*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/obcGB/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/vIgbf/*' - '*https://nameless-moon-f4b5.anthony-gomes-oliveira2020.workers.dev/oNKiQ/*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/qxijp/2c20https3a/*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/kUwxx/*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/VPUqWxU/*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/mtlac/*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/zvuia*' - '*https://nameless-moon-f4b5.anthony-gomes-oliveira2020.workers.dev/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/ZcIiY*' - '*http://dawn-bush-ddd1.yasminanthonyy.workers.dev/yqphr*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/cuUDg*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/xZFCj/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/mIggm*' - '*http://dawn-bush-ddd1.yasminanthonyy.workers.dev/ctwta*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/mtlac*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/JlyBc*' - '*http://nameless-moon-f4b5.anthony-gomes-oliveira2020.workers.dev/*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/phbeq*' - '*https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/LfleS*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/UQmSg*' - '*http://dawn-bush-ddd1.yasminanthonyy.workers.dev/okklk*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/xUOyo/*' - '*http://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/xUOyo/*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/sWbui/*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/SMMwc/*' - '*http://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/jxdpx2C20http3A/alstrive286-ToBeVPN-1.0.40-universal-5c4afdb.apk*' - '*https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/obcGB*' - '*http://dawn-bush-ddd1.yasminanthonyy.workers.dev/dnlrp/*' - '*https://nintvncm.rayegan.net/a1c028f4-684c-4094-bf0d-e5d812fe16b2*' - '*https://rtzixna.site-shartbandi.christmas/ce0180a8-fe46-4bb4-b3d0-bcc4d1a13645*' - '*https://vgip5uas.1xgame.casino/?ublib=3f7ce8ae-27b0-492a-9619-8e64f19df1d8*' - '*https://8omeu821.1xpin.casino/?ublib=09fa71a0-c9e6-4c28-a429-f5cb55da2af5*' - '*https://dbfzqcjz.site-enfejar-hazarat.com/ff583915-fed4-4930-b10c-0bf01860b611*' - '*https://qnjanmb.bet1forward.com/35689783-0d79-4a59-b682-b11289279659*' - '*https://bwvastni.bet1xyek.bet/?ublib=ad5a8333-6bec-401f-a231-b149edf6ef64*' - '*https://iemjjbmd.prozhe.net/2e8b8e3b-8b5d-4542-afd6-f45f0838ad9d*' - '*http://123.5.187.149:57633/i*' - '*http://182.121.251.220:47156/i*' - '*https://bezwhhi.ac90bet.net/c959eca2-2402-417e-96ed-1c201942f641*' - '*http://182.121.251.220:47156/bin.sh*' - '*http://221.14.37.212:50111/i*' - '*http://123.5.187.149:57633/bin.sh*' - '*https://morganstat.sbs/dl/file/8140e835-c8d0-466f-aaa4-7b544072129a?t=9a26ef15-4eb4-47b4-a6c3-0c4f76080616*' - '*https://xverikstat.us/dl/file/8140e835-c8d0-466f-aaa4-7b544072129a?t=5f7820a6-8229-4c38-9e27-88c58cc76ec3*' - '*https://boodystat.click/dl/file/89e178b6-246f-4ce3-9ce5-6117cb4cd716?t=25bcf8ca-b9f9-42fc-ac9a-18dc45df8ab4*' - '*https://belxgvc.thevallartasrestaurants.com/8b6c747b-5d3e-4504-9868-de799461fa57*' - '*https://fin-code.lol/p*' - '*https://blue-paper-f69f.acrypters.workers.dev/FTM0-40PO-AO28-G98E/img_lja7nf.png*' - '*https://blue-paper-f69f.acrypters.workers.dev/FTM0-40PO-AO28-G98E/img_zsykvq.png*' - '*https://morganstat.sbs/dl/7z*' - '*http://182.114.253.69:40055/i*' - '*http://198.12.110.140/img/img_201134.png*' - '*http://198.12.110.140/55/goodskillwithgreatdayscameinourlifeformebestking.hta*' - '*http://198.12.110.140/img/img_205826.png*' - '*http://198.12.110.140/19/godwillhelp.hta*' - '*http://182.114.253.69:40055/bin.sh*' - '*https://5k9iblva.ace90bet1.bet/?ublib=08cd29c9-3507-49ff-9cde-d435260e35e3*' - '*https://tdyyhcqa.hi-lo.bet/0ae9f0e6-5e22-4854-b597-e875470d0bbc*' - '*https://bhmsnwx.sargarminovin.ir/7a14aca3-6f71-48ce-a6a0-b24a68e993b4*' - '*https://kenwillzltd.com/kenwillzltd.zip*' - '*https://www.kenwillzltd.com/kenwillzltd.zip*' - '*http://otkxhon.1bet1yek.bet/fc46db51-3d94-440b-a2ec-9c07824f7225/gc.key*' - '*http://110.36.90.129:45359/i*' - '*https://mouvlws.oxiidbet.com/9f60ff9b-6fa3-495c-98db-a22ce2f128ab*' - '*http://27.215.4.112:34306/bin.sh*' - '*http://119.116.131.31:54163/i*' - '*https://aekwtnf.1xyekbet.bet/cccde670-3058-497e-b734-4c977f9a0b03*' - '*https://b58jef3z.22beet.com/?ublib=233ebe80-7a96-4603-a9c8-437ce0ac511e*' - '*http://115.56.157.238:53041/i*' - '*https://nmsqiavn.enfejar-site.bet/7dab1736-47ed-4f3c-bc23-41d590704781*' - '*https://tmm18nfa.1xpin.bet/?ublib=37db7841-c42b-4a93-9dd4-b4ffceb99c31*' - '*https://ll96bzym.salamatyari.ir/?ublib=f6cf618b-6ff6-46c3-8ff9-b935c25093c3*' - '*http://221.14.53.123:52908/i*' - '*http://221.14.53.123:52908/bin.sh*' - '*http://115.56.157.238:53041/bin.sh*' - '*https://ynteevb.1xvip.xyz/418b4ba4-3980-4990-8267-bac7abe1ef9f*' - '*http://130.12.180.190/corp/a*' - '*https://jhq8hqlo.1xforward.vip/?ublib=aa67ab88-4fc9-4d6f-b25f-63af261910b2*' - '*https://oybvqan.1xrussia.com/11b213cb-61da-4808-bd1c-3ed43e0df821*' - '*https://gexbskxk.beshnoinja.ir/cc28b0ff-9ccf-4af1-96f3-bdb120010091*' - '*http://39.87.12.58:57189/i*' - '*http://178.16.54.109/ph8.exe*' - '*http://178.16.54.109/ph7.exe*' - '*https://hybnjif.1xpin.pro/e2d4416d-b73d-4f8f-aa9d-04b1c8d90ea1*' - '*https://vqyjhmr.1xpin.live/1a28dceb-73a9-452a-8490-a8efc97218a3*' - '*https://rxt0h93a.1xforward.com/?ublib=48292505-5058-466d-abeb-91fabe918a26*' - '*https://rugcfdaz.marjaevakil.ir/28a56e04-4fe3-40d7-a2ce-de815924332f*' - '*https://eqwbbhd.1xborobet.bet/c11eee6a-10e1-4078-8ea4-7cb707f44ab9*' - '*https://ymy16goe.calvaryhospice.org/?ublib=34135967-aa3b-40c1-a658-e70818b5f6e4*' - '*https://3tloufwg.oris303.com/?ublib=37eb6e79-22ae-4de8-9133-1d922f4397ad*' - '*http://115.50.88.177:46689/i*' - '*https://pwsljqp.1xbeet.vip/601bef65-5be8-47a0-ae92-b38c9dfb9bbb*' - '*https://dwpxsmzy.1xforward.bet/?ublib=81f5e50b-62f9-456b-ba1c-f819222ea43f*' - '*https://ogiforjk.iranmotorplus.ir/02773a30-e94f-49f9-be60-9bc328ac0f94*' - '*https://ryovgcz.1xbeet.site/40f025f9-8c2c-4b8c-b5dd-9393a2e7c71c*' - '*https://sfdvbdy.1xbeet.app/12f40b9f-2830-4f41-9fe9-9213d6fa9ad1*' - '*http://175.17.228.41:45154/i*' - '*https://x6ho2kp5.1xcart.pro/?ublib=73754938-5b6d-4184-85a7-20028c652c21*' - '*https://efdnssea.honaribash.ir/b8a924ae-32de-4294-bc0f-31a926d14e9b*' - '*https://vykzqwol.gamefarma.com/7439b079-fd45-4749-87fa-9863e2245e4e*' - '*http://110.36.1.200:38574/i*' - '*https://ezqhmvl.1bonus.bet/e7d29f27-8c23-433d-933d-bb0919f92ea7*' - '*https://agkzvfg.1bet1yek.bet/75851c5b-6b52-4587-89a1-546f1e685a91*' - '*https://x41eexzh.1xcart.net/?ublib=8ef4e24b-01a5-4191-bb9b-703f9d7471d4*' - '*https://1xkf6w16.bet1forward.com/?ublib=7e6d377a-9b6c-408d-8609-c2097c8ca868*' - '*https://lfk25ohk.win1bahis.com/?ublib=b06ed3b7-8014-41e8-95cd-134e307f107e*' - '*https://rhgxzyok.fotoiran.ir/490d05b8-70a7-4d4f-bbc2-681951c23280*' - '*https://faqgkjb.testmobo.ir/fe88f376-699d-4523-91e6-6241f9000c27*' - '*http://178.16.54.109/ph6.exe*' - '*http://110.36.4.89:45153/i*' - '*https://qkwgkjx.seoprof.ir/2ea371dc-da64-4cc5-8a50-aa700440118c*' - '*http://178.16.54.109/ph2.exe*' - '*http://178.16.54.109/ph4.exe*' - '*http://178.16.54.109/ph.exe*' - '*http://178.16.54.109/ph3.exe*' - '*http://178.16.54.109/ph5.exe*' - '*https://baxubfe4.1xborobetyek.bet/?ublib=12cdac15-ce54-4e42-93f8-0245dd62d733*' - '*https://jwngvds.sargarminovin.ir/92abde59-26a6-40bd-a0a9-dce16a194029*' - '*https://evzkqyyd.turkeybahis.com/87e82e52-58d2-4d9e-96af-13b81103279b*' - '*http://182.121.84.137:49014/bin.sh*' - '*https://numvvvx.oxiidbet.com/52a1c417-2700-4268-870b-abdb818d597c*' - '*https://fpk81nyo.thevallartasrestaurants.com/?ublib=825c2bb6-03cc-4b42-a4aa-c1fb54ee40bf*' - '*https://ntvyplg.jetshart.net/78f88e53-8bc0-41d3-9e92-107f97832552*' - '*http://39.74.39.94:44453/i*' - '*http://39.74.39.94:44453/bin.sh*' - '*https://mvukddsz.turkeybahis.app/619d2265-806d-4374-95a2-cbc741429eb4*' - '*https://sjnszmy.hi-lo.bet/045c06f8-ecd4-49ce-a27b-bbead1b6a503*' - '*https://oh0vsizc.vipbahis.cash/?ublib=f2b3feb1-c74c-4ff8-9629-4927b454909a*' - '*https://56nyefeb.ac90bet.net/?ublib=6094d283-31cb-4bb6-bd14-4a4beb987aa1*' - '*http://125.46.199.204:41231/i*' - '*https://bguhecd.beshnoinja.ir/abca083e-abb8-4fa5-8ee1-62ba8fa56f6b*' - '*https://nzraw48i.rayegan.net/?ublib=6b9d0ced-9a24-4c9d-a642-495620154dd1*' - '*http://182.121.46.129:54713/i*' - '*https://kjftest.beshnoinja.ir/be341056-80de-41e7-96af-b32e0ed980ca*' - '*http://61.53.132.21:58512/i*' - '*http://202.163.107.168:52523/i*' - '*http://202.163.107.168:52523/bin.sh*' - '*https://nodtrbhz.poundbahis.com/1d220e67-d526-4a9b-a276-e49ce1835d64*' - '*https://jshreqm.arayeshkhas.ir/389aaf62-a0c7-4f04-8397-40b3def1ae80*' - '*http://42.229.160.104:58096/i*' - '*https://foxo8ujn.prozhe.net/?ublib=6df96a9e-7a49-4c7e-9ed7-907acd4d986a*' - '*https://dvjmeze.yan303.com/f80623bd-b464-4434-9cf5-957bb7cf218f*' - '*http://125.104.155.79:12844/i*' - '*https://wrccdbyk.90jet.win/4e607b7d-77fe-41ff-8387-970e5e58bb66*' - '*http://125.104.155.79:12844/bin.sh*' - '*https://cramjui.winx303.com/219a34cd-2744-4d3c-825e-aa94c17b9be2*' - '*http://62.60.226.243/public_files/sNQSAwz.txt*' - '*https://9nqbrnn7.farsibeenglish.ir/?ublib=a9895d4c-9f4a-4fab-868a-a356fc99e611*' - '*https://solar-sanat.net/00231.exe*' - '*https://pizzariatrattoria.com/00982.exe*' - '*https://mineiicancry25june2026.blogspot.com/nilapila.docx.psd.pdf.in.sys.nilapila.docx.psd.pdf.in.sys?*' - '*http://182.127.177.15:33397/i*' - '*https://09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.filesusr.com/ugd/09c1d5_e167390a12384599b0bf0dc76170aa11.txt*' - '*https://3snpseyu.enfejar-site.bet/?ublib=895ad8db-a93b-471a-847e-e2ad99faa4f7*' - '*https://5obrufj4.1bahis.bet/?ublib=1bc9a689-903a-49e3-bdd4-5d3f2a8f672e*' - '*https://ofwyjhh.prda303.vip/d7eedf98-b249-4968-b61a-b876f45a6aa0*' - '*https://ozcocard.melbahis.com/3e893971-6195-4ab1-b8c0-1f5deeefd9d5*' - '*https://gaeilmx.prozhe.pro/c09c52d1-0810-41ce-935b-1bc0561840eb*' - '*http://182.180.160.206:37795/i*' - '*http://163.142.95.243:33034/i*' - '*http://163.142.95.243:33034/bin.sh*' - '*https://22prf6xs.eduprof.ir/?ublib=b2c0b562-1ec4-4ff8-b29a-b4135a3375a0*' - '*https://yvutfxz.pabloobet.com/f20d09a7-02ec-4084-940c-d4bb9d22cda3*' - '*http://221.15.212.44:36077/bin.sh*' - '*http://61.53.148.123:39856/bin.sh*' - '*https://qyhgsea.jetshart.net/0028f4ae-7047-4747-832a-4f4d925b53d3*' - '*http://123.190.104.152:35517/i*' - '*http://123.190.104.152:35517/bin.sh*' - '*https://mnntzrbl.masterbahis.com/ebddfbe1-a67c-40eb-875d-895d4d41b2db*' - '*http://182.112.8.125:33032/i*' - '*https://pczlsqy.hi-lo.bet/4dec5906-2994-4664-bd66-8e7bbd664415*' - '*https://dhaafy3l.thevallartasrestaurants.com/?ublib=ae0d3402-5acb-42cb-8681-e52aaf6fab3c*' - '*http://123.14.92.181:48100/i*' - '*http://219.157.176.196:36063/i*' - '*https://ourynlg.calvaryhospice.org/5fa01c93-0912-4949-99fb-c3074d3d2c9b*' - '*http://123.14.92.181:48100/bin.sh*' - '*https://68v034mp.bet1xiraq.com/?ublib=c765d324-0a00-4b4c-9673-d8402180a568*' - '*https://o8w2orhn.1bahis.app/?ublib=9151c703-2c2b-4fb4-8896-bd50b499b198*' - '*http://219.157.176.196:36063/bin.sh*' - '*http://115.55.4.118:39524/i*' - '*http://222.137.6.57:51029/i*' - '*https://aipmmwm.bet1forward.com/3a3621a3-b2b8-4430-99bb-d87bca25413f*' - '*https://vh1oi5hz.rayegan.net/?ublib=fd1f8591-966e-4993-a0cc-38ee0bf39db4*' - '*http://222.137.6.57:51029/bin.sh*' - '*https://vqincjko.jetbahis.win/05d8a49b-5487-4fbd-ad61-70541e8ad7a4*' - '*http://182.123.245.51:60755/i*' - '*https://vfchqur.bahiscash.com/a086b290-ea2b-4fa5-9f7b-e4af8420b387*' - '*http://182.123.245.51:60755/bin.sh*' - '*http://62.60.226.140/files/8634320058/ENIOnn8.exe*' - '*https://ntqpkct.bahiscart.com/f29b444d-1c06-49a9-a69c-029904eaadd1*' - '*https://u9gcj5sd.oxiidbet.com/?ublib=55a4e6f9-1eba-4151-bd42-9c01fa2b2c8a*' - '*http://59.96.137.166:41050/i*' - '*https://nazemud.ac90bet.net/1a2dfa37-1efd-4b97-9945-7e195dd16099*' - '*https://azxhmev.prozhe.net/fa296535-349e-4380-8e53-b05fe29b5396*' - '*http://119.185.140.136:34637/bin.sh*' - '*http://110.36.28.45:52690/i*' - '*https://zshaimrg.forwardbahis.com/b16b28f5-d99c-4809-bfb4-78897dd50d51*' - '*http://110.36.28.45:52690/bin.sh*' - '*https://oemtklu.pabloobet.com/df769883-de99-4605-81da-08e182d5fa09*' - '*http://115.61.120.206:58192/i*' - '*https://6l2yvway.fidoubet.com/?ublib=51c06ffc-d56f-4c77-bd3e-befc23213cc8*' - '*https://ojst23x0.site-enfejar-hotbet.com/?ublib=804cda12-7364-4208-90d7-15392b48c617*' - '*https://8bmmubit.site-enfejar-ba-zarib-bala.com/?ublib=560f8e55-8bd2-470b-84be-e3010f1e4aab*' - '*http://115.61.120.206:58192/bin.sh*' - '*https://njgpeig.onjabet.casino/51513efa-204c-4f4b-af74-1949847e293d*' - '*http://42.239.147.11:40838/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_141c1ca0542fb688.exe*' - '*https://mospyqp.ninjafruiet.casino/0dd75653-621b-49c0-997f-adb738326cd7*' - '*http://27.215.4.112:34306/i*' - '*http://91.92.242.236/files-129312398/files/file_f590956d0d4448c4.exe*' - '*https://irf3md7c.casinobahis.app/?ublib=ed7de21b-ddc2-4b7f-8bb7-9426ad91080e*' - '*https://qvmobjz.nextbahis.org/315d124b-352d-4ee0-ad6f-5f33db621dcc*' - '*https://sfcrhzgd.btyek.shop/4cc045e2-8f3b-495b-a423-b7c54c56f7ba*' - '*https://cldppqm.jetshart.net/2e4a62c3-c4d3-41bb-b7c0-70bac110cc8a*' - '*http://110.36.19.101:34815/i*' - '*http://61.52.3.100:56319/bin.sh*' - '*https://jpdgawf.enfejar-site.bet/93236947-d382-49ca-a477-f3fff71fb8ee*' - '*http://61.53.135.159:45858/i*' - '*http://112.246.16.106:42448/i*' - '*https://fbkhheg.bahisforward.com/ae82047f-19c2-4dad-9f87-c24acd731bda*' - '*https://69gqzj0b.cartbahis.com/?ublib=4b8c809b-60ea-4854-b047-0282294be527*' - '*http://61.53.135.159:45858/bin.sh*' - '*https://xcgifut.bahisdolar.com/d0ea5931-feda-4c1b-a635-b801b97acbac*' - '*https://rbso1spv.hi-lo.bet/?ublib=e975a273-1662-420c-88c1-c148a8df7034*' - '*https://ibsovb64.bet1xiraq.com/?ublib=2c119b2d-279e-4756-ab26-50d4c6b67b64*' - '*https://ufdopmc.bahiscash.com/5cd6c481-2149-490d-b048-950c14d15d23*' - '*https://omani-disputes.com/txt/adkbjdd.txt*' - '*https://lcsywbam.btyek.christmas/adc2ab6a-88ab-4cf5-9095-1395059a67ad*' - '*https://nfpljmg.bahiscart.com/cd15335c-4143-4cba-a880-3d4babbcccd5*' - '*https://0681dt20.bahisgame.com/?ublib=e9fbc6e5-2ba7-4559-8049-bbac13f8ab3d*' - '*http://46.151.182.131/minern.tgz*' - '*http://182.126.125.182:53937/bin.sh*' - '*https://sarafinance.in/js/phantomlog/fjnmhfg.txt*' - '*https://sxedaqg.1bahis.bet/d4f61545-1441-46fc-a471-b0d3b0c7de03*' - '*https://ztlfqqk.1bahis.app/ee7bf068-5865-478d-bc37-37089a8b3fea*' - '*https://kwb3h55h.thevallartasrestaurants.com/?ublib=0ef49ee5-d773-4411-9f0a-c195df305709*' - '*http://141.11.88.108:81/pxxe313.sh*' - '*http://83.168.110.191/bins/pm68k*' - '*http://83.168.110.191/bins/pmpsl*' - '*http://83.168.110.191/bins/parm5*' - '*http://83.168.110.191/bins/parm7*' - '*http://83.168.110.191/bins/parm6*' - '*http://83.168.110.191/bins/pmips*' - '*http://83.168.110.191/bins/psh4*' - '*http://83.168.110.191/bins/px86*' - '*http://83.168.110.191/bins/parm*' - '*https://joujfre.1bahis1.com/48fb51d6-f49a-4d81-8a84-f8dfc228b3de*' - '*https://ugbobgyo.btyek.christmas/8bd2d064-29ca-4ce6-86e3-d8ecf31a4256*' - '*https://nawkvml.oxiidbet.com/0af83d91-6570-46d2-bef5-cbcac3adf8b9*' - '*http://182.121.75.3:57932/i*' - '*http://125.43.253.40:45300/i*' - '*https://kwqienen.btyek.christmas/6cef7d64-4afa-49bf-9231-f4a8b3254007*' - '*https://mehpuqa.ac90bet.org/d1ca05b8-f2e8-405c-9c91-b7ee280df43a*' - '*http://31.77.189.52/tr*' - '*http://125.43.253.40:45300/bin.sh*' - '*https://jffl6ogj.bet1forward.com/?ublib=53191b6a-654e-4fe9-a4ce-e856a4a124d7*' - '*https://tthbmmcd.fidoubet.com/?ublib=29d6cffd-b98d-45e3-9365-7be8af9d18a5*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 9 id: 4c37c8c6-e6f5-5c09-a6f4-8629e36b463a status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 9). logsource: category: proxy detection: selection: c-uri: - '*https://39cif89o.rayegan.net/?ublib=f97e22e5-2f9e-4e05-9bf0-9ee71550ec44*' - '*http://125.44.18.162:45932/i*' - '*https://uvjkxyc.ac90bet.net/a59519be-e419-4965-bfa4-4a8ddf1e2959*' - '*https://wagxbxx.ac90bet.net/8adead89-6ee9-4e55-b200-1534d938eeb6*' - '*https://xmevvdl.ac90bet.com/2b0daa5b-fd00-4799-83a8-c1c440226b6a*' - '*http://182.116.222.48:47276/i*' - '*https://ae97yns1.betiran.vip/?ublib=67a241dd-b481-4e0d-a8c3-d6e5bac7ae38*' - '*http://182.116.222.48:47276/bin.sh*' - '*https://cyvvepo.90pishbini.com/639212e7-1d33-4add-9c28-76a36d28fe84*' - '*https://vcrjfnwa.ketab.blog/499acc6c-f432-4ef7-bca4-cde01a6ec12d*' - '*https://pzioeui.bet303.poker/3da9c1b6-9fae-4018-ba95-efa3be2e0873*' - '*https://cho4uj96.bet303iran.org/?ublib=ffa25ef5-2961-4bc9-8ddc-088ca42438c4*' - '*https://czpcvew.bet1xiraq.com/11cc34b2-ae8e-416b-b6c5-14f8fd3ad045*' - '*https://ifdj62v9.thevallartasrestaurants.com/?ublib=fc64f8ff-eaea-4ca0-acc1-644d8bc7c56b*' - '*https://us5fm2lg.ace90bet.bet/?ublib=fbdcd952-147c-4ec2-b81a-40fe6019ce13*' - '*http://219.155.85.137:38740/bin.sh*' - '*http://115.61.16.89:60412/i*' - '*http://110.36.75.16:34612/i*' - '*https://yylcnvu.90jet.pro/d78f3929-f360-4e1e-8e33-f145cb7db75d*' - '*http://182.113.33.173:48386/i*' - '*https://tzpfztp.90bet.org/411450bc-4cb1-4d45-8459-9aa20b46be4e*' - '*http://182.113.33.173:48386/bin.sh*' - '*http://42.226.220.245:43493/i*' - '*http://42.238.128.35:34567/bin.sh*' - '*https://9sltd81l.ace90.games/?ublib=2a504a01-7233-49b4-8168-a04274668e0d*' - '*https://bzmkmgt.rayegan.net/281dc1ed-6344-49b3-9b80-bac1f28cb31c*' - '*http://81.213.214.180:45494/i*' - '*https://zjfzifr.psd.markets/4eebd2fb-5997-4e37-844c-449889e2c8ae*' - '*https://edvdafc.prozhe.vip/cd18ebe8-8e1c-4cb1-b73b-20830d64bec3*' - '*http://27.215.126.241:41234/i*' - '*http://27.215.126.241:41234/bin.sh*' - '*https://6pyrumd5.ace90.casino/?ublib=e40838e9-5c60-4244-8abf-af4f60368c0c*' - '*https://qsnvmsy.jetbet90.ai/53421f3e-f890-42db-bc1d-1004578c5a9e*' - '*https://wgzgqfep.bingobet.pro/?ublib=b5c7d065-8854-431e-a445-905054925dea*' - '*https://man745va.takbetkade.com/?ublib=ac8fc556-fce9-4c44-b52f-f80d2e5ceceb*' - '*http://123.8.19.106:33545/i*' - '*https://flpquwu.enfejar-site.bet/3dc077db-8acc-47da-af5b-6a6ffd21b031*' - '*http://60.211.30.95:42089/i*' - '*http://182.119.182.78:59445/i*' - '*https://zxvzlnh.ketab.computer/33f12eb0-b093-42d3-8b3a-324c5f3b9184*' - '*https://jyrighxw.prozhedownload.net/?ublib=c9bf5279-8894-4462-ac5c-b4a4539a4a4e*' - '*http://42.226.223.156:56020/i*' - '*http://42.226.223.156:56020/bin.sh*' - '*https://hmwrabs.btyek.cfd/63420efc-61ab-4cc4-9b35-f562c4139aa6*' - '*https://jthevya.22beet.vip/d91da79c-cb37-473f-b1b5-b70c7bc757a6*' - '*http://91.92.242.236/files-129312398/files/file_d515a6c45f469215.exe*' - '*https://hrjjo6as.prozhe.shopping/?ublib=03a32740-356d-44be-ba98-69d634d5836b*' - '*https://hgdiucl.iranwp.ai/e77f6909-46da-44e6-a345-de434a78692a*' - '*http://42.235.96.8:33141/i*' - '*http://42.229.158.248:49877/i*' - '*http://110.36.12.61:52411/i*' - '*http://110.36.12.61:52411/bin.sh*' - '*https://dazayse.hi-lo.bet/c56eee16-4a70-4ab0-bf2a-ea9e969eafa3*' - '*https://2wij971l.betbazi.net/?ublib=60224767-65eb-431e-abde-413816594735*' - '*https://vzqodjb.fidoubet.com/717fba20-4fee-4f7a-81a4-e67847fa8286*' - '*https://1xhk4hau.bet1forward.com/?ublib=eac50af1-1c02-412f-8998-ed565b0ba0cf*' - '*https://8gqtj29a.jetshart.net/?ublib=6bc51cd5-7c68-4e38-bb15-666590cf0e1e*' - '*http://62.60.226.140/files/946381547/6SnNrNw.exe*' - '*https://czcymhx.enfejar-site.bet/c134f757-6fbf-46f2-8fde-8e2ef55324d0*' - '*http://178.173.138.137:3302/i*' - '*http://115.42.71.239:33856/i*' - '*https://urqvdqc.dreambet.casino/fbf70d99-bbbd-46ff-a08b-0468c6fadccb*' - '*http://5.167.229.63:27250/i*' - '*http://42.224.120.236:46898/i*' - '*http://115.42.71.239:33856/bin.sh*' - '*https://gobfmmh.casino888.promo/637714a3-4913-48bf-8771-60db8202144e*' - '*http://5.167.229.63:27250/bin.sh*' - '*https://hvid2q0h.bet24bet.bet/?ublib=47b2b8c8-4265-49a1-b2cb-75ce6e988a53*' - '*http://42.224.120.236:46898/bin.sh*' - '*https://otlqkiy.betmiz.bet/549e8e07-9390-4b05-971f-b7184cfb76eb*' - '*https://zqtjqik.betiran.vip/8141189f-692a-400e-a1de-d6ce42d2d723*' - '*https://agnbpfw.arbetwinner.com/d7447165-4902-4e0c-8e8b-1e431986f361*' - '*https://mpfmdjf.ace90.games/812f9093-7a27-4cd0-93c8-f62abd0f7a69*' - '*https://9vxg256z.bazikeno.com/?ublib=385b8b23-905a-4e86-9c14-a5408f5418e5*' - '*https://vhnp4ovl.1xcart.xyz/?ublib=95a8d175-054f-4b3b-96c2-9c5ff9ee9b53*' - '*http://125.40.32.43:46829/i*' - '*http://123.188.72.73:40312/i*' - '*https://mz2qs1j6.1xforward.live/?ublib=ca2f0a8c-187f-4811-a053-cf4596f8d984*' - '*https://ovrrdtl.ace90.casino/a3c2b451-fb6a-4a07-9a9e-9906c86705bc*' - '*http://123.188.72.73:40312/bin.sh*' - '*http://125.40.32.43:46829/bin.sh*' - '*http://125.43.36.196:46025/i*' - '*http://182.119.252.40:43837/i*' - '*http://125.43.36.196:46025/bin.sh*' - '*http://182.119.252.40:43837/bin.sh*' - '*http://42.238.128.35:34567/i*' - '*https://qnfqfmh.ace90bet.bet/b5853890-c93a-46f6-afba-7dc5d327b4df*' - '*http://203.101.181.9:36927/i*' - '*http://221.1.246.201:57771/i*' - '*https://2i2joe5h.aviatorfly.casino/?ublib=6dc8b49e-ad6c-4668-b85c-a131147e0771*' - '*http://221.1.246.201:57771/bin.sh*' - '*http://203.101.181.9:36927/bin.sh*' - '*https://cswnawh.accbartar.com/381c8534-c928-4416-9185-170f733e0673*' - '*http://182.113.210.246:51745/bin.sh*' - '*https://rucuxpv.acbet.poker/d5720ce0-ef9f-4414-bfcd-309b46da69ac*' - '*https://ayoddsw.acbet.casino/0b606039-d872-4ae5-9277-02eeb46c9c1f*' - '*https://0pkit2tt.prozhedownload.net/?ublib=1446773f-978d-46e5-a765-c473126fe732*' - '*http://110.36.20.227:40827/i*' - '*https://pzczhnl.yek.autos/60d9be23-03ef-4988-9dbf-40b7bbe8644e*' - '*http://219.156.20.121:55286/bin.sh*' - '*http://108.168.0.60:38944/i*' - '*http://123.190.235.107:45926/bin.sh*' - '*http://108.168.0.60:38944/bin.sh*' - '*https://evypenr.winnerbahis-tr.com/7cc69da8-80c4-4d91-8222-5f10a071cbd3*' - '*https://zozhhgic.btyek.buzz/a0dc5a15-c981-4524-bcae-8060d6e8c621*' - '*https://ms9amh2h.1xcart.vip/?ublib=b9d37dd8-b34f-4005-b46f-0d27b2855d57*' - '*https://rxyvhv1x.1xforward.cash/?ublib=c8beee18-2b72-4b50-aa5e-1bd88df24a04*' - '*https://gakvmew.tinybet.bio/110199ac-bb25-4b3f-9fa3-7afcce070331*' - '*https://1v2w5ogt.prozhe.shopping/?ublib=5f1fff4c-6764-465a-a4f3-a7adfc147dea*' - '*http://203.99.178.253:39378/i*' - '*http://103.141.5.137:48514/i*' - '*https://cgoucbv.thevallartasrestaurants.com/6c47b75e-9545-4d27-bb3c-888ef49d98b4*' - '*https://xxjbypq.takbetkade.com/55a59c50-9ca6-44ff-846d-2ed877048166*' - '*https://wji9u2ff.fileecell.com/?ublib=982fe4ee-80f5-468c-8ce4-c0b033e389b1*' - '*http://175.166.11.195:60468/bin.sh*' - '*http://110.36.93.217:58047/bin.sh*' - '*https://oxepqya.btyek.autos/7b9bea4c-8444-4fbb-9c21-de57fceb9ba1*' - '*https://sevffjdu.jozveyek.com/e550d6b4-585f-452f-be3f-7c6d13b6a97b*' - '*http://27.44.147.143:57621/bin.sh*' - '*http://115.52.244.235:58014/i*' - '*https://frfjuzh.btyek.cloud/f9e0585c-7b70-40f0-903f-679661adc58d*' - '*http://61.220.155.123:60006/bin.sh*' - '*http://125.44.43.163:40143/bin.sh*' - '*https://ms9datqz.953.games/?ublib=3622cfb0-bf5d-4a68-8b42-e715a92b90fb*' - '*http://115.55.8.92:55376/i*' - '*https://kwsgmru.btyek.click/ee58f8f3-3920-4673-aa28-5a026b0c9226*' - '*http://123.14.93.165:39598/i*' - '*http://115.55.8.92:55376/bin.sh*' - '*https://91qdl1ty.1xcart.cash/?ublib=a62a9e72-29df-456c-9d06-0372722d5501*' - '*http://62.60.226.185/ven9392.exe*' - '*http://62.60.226.185/qrj3292.exe*' - '*http://62.60.226.185/x93923.exe*' - '*http://192.162.199.186/upload/wrm.exe*' - '*https://clearlogic.digital/index_files/css(1)*' - '*http://id89652.cfd/uploads/V2BIqXDFGxz4.exe*' - '*http://62.60.226.243/file/novaPDF.exe*' - '*http://id89652.cfd/uploads/RIuBqY6b3GgC.exe*' - '*http://62.60.226.159/uploads/ufi6SIWRqItb.exe*' - '*http://62.60.226.200/file/LightPDF.exe*' - '*http://62.60.226.159/Remus.exe*' - '*https://test-domain-126f83.shop/_content-api/uploads/changenow_2_0_3_354_google_release_55797c6141.apk*' - '*http://196.251.107.217/file/AdobeAcrobat.exe*' - '*http://62.60.226.200/file/ArchivoConfidencial.exe*' - '*http://196.251.107.217/file/fontdrvhost.EXE*' - '*http://192.162.199.186/upload/build.exe*' - '*http://196.251.107.186/uploads/522028f3854b99ef_232.php*' - '*http://62.60.226.159/uploads/6158e824f422100c_380.php*' - '*http://62.60.226.159/uploads/4282b64340621d54_324.php*' - '*http://62.60.226.159/uploads/K4NRh51sETRs.exe*' - '*http://196.251.107.104/rkx4.exe*' - '*https://changenow.com-bloom-hub.pro/_content-api/uploads/changenow_2_0_4_355_google_release_bcc61a7c08.apk*' - '*http://62.60.226.159/uploads/98067e0809c96190_355.php*' - '*http://62.60.226.200/file/MasterPDFEditor.exe*' - '*http://62.60.226.159/uploads/62PiZ6SCm64c.exe*' - '*http://62.60.226.159/uploads/gVoiqOkIP3fj.exe*' - '*http://62.60.226.159/Remus_crypted.exe*' - '*http://62.60.226.159/clpd.dll*' - '*http://62.60.226.159/RUN_x64.exe*' - '*http://62.60.226.159/uploads/Y5plLLj6B3TV.exe*' - '*http://62.60.226.159/uploads/XeHIsAv3cFps.exe*' - '*http://62.60.226.198/uploads/0c2284a48210472e896f96c9ed851c6c.exe*' - '*http://62.60.226.159/uploads/qxNJj2MK2WvZ.exe*' - '*http://62.60.226.159/uploads/AOIWM1BZ4UyB.exe*' - '*http://62.60.226.200/file/WondersharePDFelement.exe*' - '*http://62.60.226.200/file/AdobeAcrobatReader.exe*' - '*http://62.60.226.159/uploads/b0fe083f6a9aae7b_380.php*' - '*http://62.60.226.159/uploads/zQAXJLrhOrPH.exe*' - '*http://192.162.199.186/upload/klr.exe*' - '*http://62.60.226.159/ntk.exe*' - '*http://62.60.226.159/uploads/ZFDi7FbNvDJF.exe*' - '*http://id89565.cfd/stealc.exe*' - '*http://62.60.226.159/uploads/lcqhOJFva6G3.exe*' - '*http://62.60.226.159/uploads/ZCGmh01NyNBv.exe*' - '*http://62.60.226.159/uploads/2sxGhWj2XgrB.exe*' - '*http://62.60.226.159/uploads/rV5YzJqY0uHK.exe*' - '*http://62.60.226.200/file/CopiaExpedienteParcialPDF.exe*' - '*http://196.251.107.186/uploads/7ea7ffe564b654a0_254.php*' - '*http://62.60.226.159/uploads/EaehVyPuQOdr.exe*' - '*http://62.60.226.159/uploads/xBMaNg5sOHAk.exe*' - '*https://changenow.com-free-pro.cyou/_content-api/uploads/changenow_2_0_4_355_google_release_bcc61a7c08.apk*' - '*http://62.60.226.159/uploads/6096686a6f915cab_347.php*' - '*http://62.60.226.159/uploads/mQGu8qFmddJB.exe*' - '*http://62.60.226.200/file/NotificacionProceso.exe*' - '*http://196.251.107.104/middleware_5.9.3210_INSTALL.exe*' - '*http://62.60.226.159/uir.exe*' - '*http://62.60.226.159/uploads/0d7c515480786e0c_394.php*' - '*http://196.251.107.170/access/JWrapper-Remote%20Access_os_jwwin-00052861074-archive.p2.l2*' - '*http://62.60.226.159/uploads/73f454b5b8b3c70e_380.php*' - '*http://62.60.226.159/uploads/rRJ32hXLuypG.exe*' - '*http://62.60.226.159/uploads/Polarised_6.7897.2734.4933_INSTALL.exe*' - '*http://196.251.107.186/uploads/f63a4fafa644638b_232.php*' - '*http://62.60.226.159/uploads/dee0cbbbdeaf544a_355.php*' - '*http://62.60.226.159/uploads/nPoy8jDlXnl3.exe*' - '*http://62.60.226.159/uploads/H3H3IIBOpXr.exe*' - '*http://62.60.226.185/ngufre.exe*' - '*http://62.60.226.159/uploads/FHkPLmcxLVzB.exe*' - '*http://62.60.226.159/uploads/c2bc06c79ec29e7f_324.php*' - '*http://62.60.226.200/file/aLosoisjajn.exe*' - '*http://62.60.226.159/Clipper.exe*' - '*http://192.162.199.186/uploads/6927d216ea469e77_225.php*' - '*https://nomadtrade.app/*' - '*http://62.60.226.159/uploads/b39abbfeef70a557_347.php*' - '*http://62.60.226.159/clprz.exe*' - '*http://62.60.226.159/uploads/6203f24963cfd919_275.php*' - '*http://62.60.226.185/universalbrowser.exe*' - '*http://62.60.226.200/file/FoxitPDFEditor.exe*' - '*http://196.251.107.217/file/MuPDF.exe*' - '*http://62.60.226.159/uploads/22bd747db995a3af_437.php*' - '*http://62.60.226.159/uploads/980cabcef3021569_289.php*' - '*http://62.60.226.159/uploads/KDGIuXrfiF0c.exe*' - '*http://196.251.107.186/uploads/9fe73e83c7b381e1_224.php*' - '*http://196.251.107.217/file/DocHub.exe*' - '*http://62.60.226.159/rnkk.exe*' - '*http://62.60.226.159/uploads/1e8289a8285e5794_324.php*' - '*http://62.60.226.159/uploads/Cyec7H3H3IIB.exe*' - '*http://62.60.226.159/uploads/4a2fbc6ca49f558b_355.php*' - '*http://62.60.226.159/uploads/nIXANrysnjbX.exe*' - '*http://62.60.226.200/file/media221.exe*' - '*http://62.60.226.200/file/PDF24Creator.exe*' - '*http://62.60.226.159/wrpr.exe*' - '*http://62.60.226.159/uploads/1GqH6FjdxlxZ.exe*' - '*http://62.60.226.159/uploads/4axvcHu4dT8N.exe*' - '*http://62.60.226.200/file/ABBYYFineReaderPDF.exe*' - '*http://192.162.199.186/upload/build.exe?4*' - '*http://196.251.107.217/file/CentroDocumentalLegal.EXE*' - '*http://62.60.226.200/file/LectorDeDocumentos.exe*' - '*http://62.60.226.159/LdJRZ4sl.exe*' - '*http://62.60.226.159/content-based_20.7_INSTALL.exe*' - '*http://62.60.226.159/uploads/33pAY8SMaVfA.exe*' - '*http://62.60.226.159/uploads/oRYRbsc3HMV0.exe*' - '*http://62.60.226.159/uploads/7LgCJBejtGFn.exe*' - '*https://changenow.com-direct-hub.pro/_content-api/uploads/changenow_2_0_4_355_google_release_bcc61a7c08.apk*' - '*http://62.60.226.159/uploads/GFFtRGMNxJIO.exe*' - '*http://62.60.226.159/uploads/d2L7ttCvPPkJ.exe*' - '*http://changenow.com-free-pro.cyou/_content-api/uploads/changenow_2_0_3_354_google_release_55797c6141.apk*' - '*http://62.60.226.159/uploads/b4PbyGkvWkWT.exe*' - '*http://62.60.226.159/telegram.exe*' - '*http://62.60.226.159/uploads/kf98CyDpY8AD.exe*' - '*http://62.60.226.159/uploads/ZOuFctrxEC2.exe*' - '*http://62.60.226.159/uploads/02ae14cb11255bb7_340.php*' - '*http://62.60.226.159/uploads/OXaBlSZnTcE9.exe*' - '*http://62.60.226.159/uploads/rGJmtquOpsb.exe*' - '*http://196.251.107.104/11x06x2026_x64.exe*' - '*http://62.60.226.159/uploads/265904de95419466_324.php*' - '*http://62.60.226.159/uploads/d74af26f416d996a_275.php*' - '*http://62.60.226.200/zw734/notice.exe*' - '*http://62.60.226.159/uploads/wLHA4pz2eYQr.exe*' - '*http://62.60.226.159/uploads/lpcHvgTXKAoR.exe*' - '*http://62.60.226.159/uploads/wqMrLteEqdo2.exe*' - '*http://62.60.226.159/jkr.exe*' - '*http://62.60.226.159/uploads/sdfsdf.exe*' - '*http://62.60.226.159/uploads/JjF7c6J5PNOG.exe*' - '*http://62.60.226.159/uploads/zaz89oWTN7s6.exe*' - '*http://62.60.226.159/uploads/b5c9cae19bef201e_380.php*' - '*http://62.60.226.159/uploads/BEwLuTkFW565.exe*' - '*http://196.251.107.186/uploads/f46571d254e4b94f_225.php*' - '*http://62.60.226.159/uploads/f917e794154f3233_340.php*' - '*http://196.251.107.217/file/PDFgear.exe*' - '*http://62.60.226.159/uploads/enOrCqIuJnkW.exe*' - '*http://62.60.226.159/uploads/3bCp7gSCIQmv.exe*' - '*http://62.60.226.159/uploads/9b0cRP5nFpm8.exe*' - '*http://62.60.226.159/uploads/WKDTwODi6YIV.exe*' - '*http://62.60.226.159/uploads/76aecf2121a0c02e_437.php*' - '*http://62.60.226.159/uploads/hYXgtKySiMdF.exe*' - '*http://196.251.107.170/access/JWrapper-Remote%20Access-00052861074-archive.p2.l2*' - '*http://196.251.107.170/access/JWrapper-Windows64JRE-00052234686-archive.p2.l2*' - '*http://196.251.107.170/access/JWrapper-Remote%20Access_winutils64-00052861074-archive.p2.l2*' - '*http://62.60.226.200/file/Exp11001Consulta.exe*' - '*http://62.60.226.159/30x04x2026_x64.exe*' - '*https://chargenow.com-eco-io.pro/_content-api/uploads/changenow_2_0_4_355_google_release_bcc61a7c08.apk*' - '*http://62.60.226.159/uploads/i1pQPqZCAMwL.exe*' - '*http://62.60.226.200/file/Online2PDF.exe*' - '*https://www.nomadtrade.app/*' - '*http://62.60.226.159/uploads/pWUaIBHjo36e.exe*' - '*http://62.60.226.159/uploads/cLXqfjCbXy3q.exe*' - '*http://62.60.226.159/uploads/06cfc39eed5de509_380.php*' - '*http://62.60.226.159/uploads/M1G3hmpqGWP9.exe*' - '*http://62.60.226.159/uploads/ElH1IUcZBhgk.exe*' - '*http://62.60.226.159/uploads/kavAksJMTVB6.exe*' - '*http://62.60.226.159/uploads/38e72a798b454def_289.php*' - '*http://62.60.226.159/uploads/MKVo99Iest2k.exe*' - '*http://62.60.226.159/ll_wrapper.exe*' - '*http://62.60.226.159/uploads/PgcK9HLhjqdA.exe*' - '*http://62.60.226.159/uploads/FXSl7GSecFip.exe*' - '*http://62.60.226.159/uploads/rPIP8p6r7tGr.exe*' - '*http://62.60.226.159/uploads/9BOpLRHCTaIX.exe*' - '*http://62.60.226.159/uploads/ltokHKSkAlMt.exe*' - '*http://62.60.226.200/file/FoxitPDFReader.exe*' - '*http://62.60.226.159/uploads/A5ko39j7TjCC.exe*' - '*http://62.60.226.159/uploads/fe8695a65e32a648_275.php*' - '*http://62.60.226.159/wldclp.exe*' - '*http://62.60.226.159/uploads/150987805cc14582_289.php*' - '*http://196.251.107.217/file/aLksndwnsm.exe*' - '*http://62.60.226.159/uploads/3Ux7Y1YtziiK.exe*' - '*http://62.60.226.159/uploads/d5372b253974cd08_275.php*' - '*http://62.60.226.159/uploads/54334cb5d3fb3f20_372.php*' - '*http://62.60.226.159/uploads/e9KsjS4PYvql.exe*' - '*http://62.60.226.159/01x06x2026_x64.exe*' - '*http://62.60.226.159/uploads/23c4ec5b6e052f27_414.php*' - '*http://62.60.226.159/uploads/7504a2847cdaae25_289.php*' - '*http://196.251.107.217/file/WUDFHostFiscalia.EXE*' - '*http://62.60.226.159/uploads/CDv1xOGa1K8D.exe*' - '*http://62.60.226.159/uploads/RyVgxhvoSTFo.exe*' - '*https://changenow.com-free-pro.cyou/_content-api/uploads/changenow_2_0_3_354_google_release_55797c6141.apk*' - '*http://62.60.226.159/tar.exe*' - '*http://62.60.226.159/uploads/Zt1Vf3gZ67uK.exe*' - '*http://196.251.107.217/file/STDUViewer.exe*' - '*http://62.60.226.159/uploads/UnIpbTkERx.exe*' - '*http://62.60.226.159/uploads/2bCvwNx30rYB.exe*' - '*http://196.251.107.217/lt138/New-Build.exe*' - '*http://196.251.107.217/file/Procesador_Datos.exe*' - '*http://62.60.226.159/uploads/c0ba00456c939e36_372.php*' - '*http://62.60.226.198/uploads/ce46f0e45cb74bf7ae3dab623a5f30d8.exe*' - '*http://62.60.226.198/uploads/a7704d4be43748eebfbb80817390991d.exe*' - '*http://62.60.226.198/uploads/e62643e895b944b1bf901d95beae1d0b.exe*' - '*http://62.60.226.198/uploads/07c95b4d9ec04817aa653865ebecdc50.exe*' - '*http://62.60.226.198/uploads/b00e7cf466d641a8835184b68147b363.exe*' - '*http://62.60.226.198/uploads/c5dc3455448f4d268d249da21b5a3ee7.exe*' - '*http://62.60.226.198/uploads/ed8eba3fc553427884a61b901ee4024b.exe*' - '*http://62.60.226.198/uploads/649c0ea5d3cc4eba9f43ced494d5bd8e.exe*' - '*http://62.60.226.198/uploads/cf344bb7ec234382bce2eaec283e9b9b.exe*' - '*http://62.60.226.198/uploads/343371bd6e224c848d6a093c20a977ce.exe*' - '*http://62.60.226.198/uploads/0df3de25a5ee46fb82e2167823e617b6.exe*' - '*http://62.60.226.198/uploads/2bd507f4b3184682bb68d3cd05bb16c2.exe*' - '*http://62.60.226.198/uploads/c8da181b60c14ff9adf91489fe35169d.exe*' - '*http://62.60.226.198/uploads/0e27e281bf7f4a9eb802b0f9955b6ae2.exe*' - '*http://62.60.226.198/uploads/a1fd56780c0c4bdb9e94201323092b6c.exe*' - '*http://62.60.226.198/uploads/d8c4701c49804c59b65e265c8ad7dfe2.exe*' - '*http://62.60.226.198/uploads/9471420a112741e6bff8e62a1578083a.exe*' - '*http://62.60.226.198/uploads/61144ef43afa4011b9ddd73a0c774791.exe*' - '*http://62.60.226.198/uploads/60c71da0f5af46c49f2e50e991e5a0c7.exe*' - '*http://62.60.226.198/uploads/13f51d65ad2b4f41b462b41622de090d.exe*' - '*http://62.60.226.198/uploads/64f50ed6b76c41af804ce2615fd26c13.exe*' - '*http://62.60.226.198/uploads/02228c6eb6024acaa4d655f3e3956ac9.exe*' - '*http://62.60.226.198/uploads/9a7f060f3825475eb7efb1bc0a6aeef3.exe*' - '*http://62.60.226.198/uploads/921373a8b958471d8ebeadc2a154f07c.exe*' - '*http://62.60.226.198/uploads/ecd0846ff4094811bd11482014c3cbc3.exe*' - '*http://62.60.226.198/uploads/dab45eb82abb45af9c01f2bc13b52bab.exe*' - '*http://62.60.226.198/uploads/89d10ff72841414992a66999aaf5e6b1.exe*' - '*http://62.60.226.198/uploads/2588b44882f94ec1a8684db2868ed046.exe*' - '*http://62.60.226.198/uploads/d4f3669fead548f7bdc33041f67fc918.exe*' - '*http://62.60.226.198/uploads/b4cf6e7ffc494436b68056fc75e0f19e.exe*' - '*http://62.60.226.198/uploads/fc0572ee150a466a99bde5748044ab16.exe*' - '*http://62.60.226.198/uploads/327c2ee5c73843fdbd81fddcc1004d3e.exe*' - '*http://62.60.226.198/uploads/748d04b04fea43adb36ed6c43ee65dc9.exe*' - '*http://62.60.226.198/uploads/96be920ae9ad435c8315dad7c8bc9349.exe*' - '*http://62.60.226.198/uploads/a8a7747933e24fa9bfc305336683c1f1.exe*' - '*http://62.60.226.198/uploads/60c71da0f5af46c49f2e50e991e5*' - '*http://107.172.235.213/134/img_103613.png*' - '*http://107.172.235.213/134/goodthingswithmebestfeelingforbestforme.hta*' - '*http://107.172.235.200/ww.adyen.comknowledge-hubpayment-gatewaymsclkid=0dcc9c9da58815369da2f6a715a7654d&utm_source=bing&utm_medium=cpc&utm_camiii.php?&*' - '*http://107.173.143.45/128/img_211435.png*' - '*http://104.168.5.47/90/kk/goodforbetfeelingscomingfromtheheart.hta*' - '*http://107.172.172.205/83/givenmemuchbetterthingsfroeverybodyforme.hta*' - '*http://107.172.172.205/www.skydo.comfeaturesget-international-accountsutm_source=bing&utm_campaign=GA_Search_Core1_Nov25&utm_medium=ad&utm.php?&VVV*' - '*http://104.168.5.47/httpswww.pcmag.compicksthe-best-cloud-storage-and-file-sharing-servicestest_uuid=05ZUPUtSJIjL9ET37tWfQcl&test_variant=AKS.php*' - '*http://107.172.172.205/83/img_190348.png*' - '*http://147.124.213.158/46/goodforbestpeoplesaroundonmybestthigns.hta*' - '*http://202.155.8.56/HSRP*' - '*http://129.121.114.124/jvFP*' - '*http://147.124.213.158/46/goodforbestpeoplesaroundonmybestthigns.hta?&%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC/*' - '*http://216.107.139.197/SBSI*' - '*http://216.107.139.197/SREV*' - '*http://129.121.114.124/r81*' - '*http://129.121.114.124/Qq5*' - '*http://202.155.8.56/CEMY*' - '*http://216.107.139.197/TASE*' - '*http://129.121.114.124/CJT*' - '*http://129.121.114.124/0Qm*' - '*http://216.107.139.197/FNZQ*' - '*http://216.107.139.197/XNQX*' - '*http://129.121.114.124/k8z*' - '*http://129.121.114.124/nFtK*' - '*http://129.121.114.124/MQY*' - '*http://202.155.8.56/OGLO*' - '*http://202.155.8.56/UGHR*' - '*http://202.155.8.56/IWAK*' - '*http://202.155.8.56/ZSAM*' - '*http://202.155.8.56/CRHT*' - '*http://202.155.8.56/MPJD*' - '*http://216.107.139.197/FCWI*' - '*http://216.107.139.197/NCQD*' - '*http://129.121.114.124/cPq5*' - '*http://147.124.213.158/?&*' - '*http://202.155.8.56/WAEC*' - '*http://216.107.139.197/PGAL*' - '*http://202.155.8.56/XNHF*' - '*http://216.107.139.197/ETGC*' - '*http://202.155.8.56/BVNS*' - '*http://202.155.8.56/MRLM*' - '*http://202.155.8.56/ZEFS*' - '*http://202.155.8.56/XRKQ*' - '*http://202.155.8.56/JRIG*' - '*http://216.107.139.197/DJMM*' - '*http://216.107.139.197/KQWJ*' - '*http://216.107.139.197/GULL*' - '*http://216.107.139.197/MJDG*' - '*http://216.107.139.197/QTJA*' - '*http://202.155.8.56/FKEU*' - '*http://216.107.139.197/TWDS*' - '*http://216.107.139.197/JEXR*' - '*https://thisisafalsepositive.st/cdn/e/42a522313d92*' - '*https://thisisafalsepositive.st/cdn/e/36f2c0035ef9*' - '*https://iu41zeaj.1xgame.vip/?ublib=9bdc1972-12a5-4bf1-8233-66d043cd88a2*' - '*https://thisisafalsepositive.st/cdn/5ef451455923*' - '*https://softmix.online/ps/setup.zip*' - '*https://softmix.online/ps/7za.exe*' - '*https://softmix.online/ps/setup.ps1*' - '*https://rdt.li/E848Pt*' - '*http://62.60.226.198/uploads/5df66d1d1d5343828aea45cea2b76c5c.exe*' - '*http://107.173.143.45/128/givemebesttimeforbetterplacescomingforme.hta?&%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B/*' - '*https://147.124.213.158/46/goodforbestpeoplesaroundonmybestthigns.hta?&%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC/*' - '*https://zov.ismak.icu/bins/nova.x86_64*' - '*https://107.173.143.45/128/givemebesttimeforbetterplacescomingforme.hta?&%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B/*' - '*https://e703cad0-1b37-4cd4-b3d6.tapscalafilepro.net/d586a839-c071-set-4012-95c4-ab-3474f21afc61*' - '*http://147.124.213.158/ewoocuconomictimes.indiatimes.com.php*' - '*https://107.173.143.45/sso.esic.gov.inESICSSOAppLiferaylogin.jspbmctx=7CAD769BFA3451BE21DE1F73E125D2C4FA94907F3FE40A1DCE0DB069C1A208E4&password=secure_string&contextTypeop.php*' - '*https://elvaruno.com/Zoom_Meeting_Notes_docx.zip*' - '*http://104.168.5.47/90/wegivenbestnetworkingskillwithbestcreation.js*' - '*http://110.36.68.198:59056/i*' - '*https://ceohdvj.bonos.promo/07c568e7-e51d-4d15-b60a-725fc9cc4001*' - '*http://123.133.220.150:58690/i*' - '*http://123.133.220.150:58690/bin.sh*' - '*http://222.139.41.63:38230/i*' - '*https://vchbhqa.betbazi.net/0f783cb6-1e72-412f-9aa8-e296829c1ae4*' - '*http://222.139.41.63:38230/bin.sh*' - '*https://q3g84ost.22beet.pro/?ublib=da047756-5a36-4f69-b6c7-0933dd42be2a*' - '*https://gefpeqd.bet1xiraq.com/6b2ad2c9-239c-4eb6-9e98-8fa51c409803*' - '*https://feeykse.betbacklink.com/68218a9b-f9c4-427f-85ad-5c3a7a3e3560*' - '*http://110.36.25.33:50344/i*' - '*http://27.194.253.28:49514/i*' - '*http://61.52.73.171:59471/bin.sh*' - '*https://fituwzg.yek.autos/2184dcb9-2bf6-4158-8689-eef70a2c9ede*' - '*http://220.201.156.155:43300/bin.sh*' - '*https://www.y8uo8qn.top/view%20details%20(3).zip*' - '*https://yunczfkm.cyou/test.vhd*' - '*https://yunczfkm.cyou/fuetyshfgjufhgj.zip*' - '*https://taxassessment.cyou/Tax_Assessment.vhdx*' - '*https://taxassessment.cyou/tax_assessment_0609.zip*' - '*https://taxassessment.cyou/tax_assessment_sg.zip*' - '*https://balconyresidences.com.br/A64ybzU6h2ndxvVzRdE0wrhclick/download.php*' - '*https://cxs9e097.vip1xbet.org/?ublib=ce4d6c4e-f359-442b-a5fc-1e2bd4bdad79*' - '*https://jenkinsmoving.com/ssan*' - '*https://pub-b81078cffc6d471e9d2d977de133536e.r2.dev/ZA_Access_My_Department.msi*' - '*https://kmkyfcu.winnerbahis-tr.com/a13d94db-73ca-48bf-a8da-a8344868e17d*' - '*https://github.com/dcm1-6626/T-1million/raw/refs/heads/main/t2.zip*' - '*https://github.com/dcm1-6626/T-1million/raw/refs/heads/main/t3.zip*' - '*https://github.com/dcm1-6626/T-1million/raw/refs/heads/main/t1.zip*' - '*https://github.com/up-6626/udm/raw/refs/heads/main/udm.bat*' - '*https://github.com/up-6626/udt/raw/refs/heads/main/udt.bat*' - '*https://github.com/up-6626/udm/blob/main/udm.bat*' - '*https://github.com/up-6626/udt/blob/main/udt.bat*' - '*https://github.com/dcm1-6626/T-1million/blob/main/t3.zip*' - '*https://github.com/dcm1-6626/T-1million/blob/main/t2.zip*' - '*https://github.com/dcm1-6626/T-1million/blob/main/t1.zip*' - '*http://125.46.247.200:56409/i*' - '*https://lcizmbo.tinybet.bio/111eac38-5324-40d4-b7f6-7e1a2f13834c*' - '*http://123.7.220.33:51773/bin.sh*' - '*https://7v8ver7f.1xgame.pro/?ublib=d1ca7c74-7c4d-4c2c-887a-87470e95ccd3*' - '*https://ob0fix15.1xgame.org/?ublib=929141f1-f133-4ad0-adaf-a56e2179f356*' - '*http://115.52.244.235:58014/bin.sh*' - '*https://erngvel.takbetkade.com/def0e59f-d16d-4633-9fb2-5ddb8cbfdbc8*' - '*https://dqr7yibh.thevallartasrestaurants.com/?ublib=622239d9-c6ac-4d06-8e25-37ff6868e811*' - '*https://jwyclcz.shartbandi.xyz/0030f548-9a87-4907-b81c-a916cb069e43*' - '*https://zgfnygu.prozhe.download/9dc48e18-42a9-4b75-9185-50683516558e*' - '*http://182.114.195.35:54379/i*' - '*http://115.42.71.239:36376/i*' - '*http://182.127.43.134:58246/i*' - '*http://182.114.195.35:54379/bin.sh*' - '*http://115.42.71.239:36376/bin.sh*' - '*https://tfxeoexc.betfakade.com/?ublib=c54290d2-9e9b-406d-a97a-50070b8565c1*' - '*https://vzwkcrp.megashart.org/3e22bb3d-fdb8-452b-8933-57806f5d8901*' - '*http://62.60.226.140/files/7559850987/rTSWKfd.exe*' - '*https://kdoyvze.megaparii.pro/e1e2ab52-6d71-4a04-b9e3-195d0da9e36b*' - '*https://vwvlxxx.megaparii.pro/e8eec2e7-5687-47a7-8324-243d680257b5*' - '*https://lqqpunt.megaparii.pro/eb79550f-2286-41cd-adb9-88609d5d306b*' - '*https://lofybdv.megaparii.pro/556ffabb-6029-4fd5-9860-2bb1dd443051*' - '*http://59.103.121.32:41365/i*' - '*https://5732ru8p.1x303.casino/?ublib=b62f6aaf-4d3a-48d7-87c4-b022b0f902c6*' - '*https://pg1mu94o.yek.baby/?ublib=d537fd3e-47bc-489c-9101-b6400051a0c3*' - '*https://j29oqmyl.1xgame.net/?ublib=4381cd10-cd88-4dd6-8d00-b53074b8ffde*' - '*http://220.201.156.155:43300/i*' - '*https://sfsgldq.1xx.games/1f64cf21-2062-460f-8877-2a610ba412dc*' - '*http://83.219.1.198:58786/i*' - '*http://83.219.1.198:58786/bin.sh*' - '*http://42.58.167.28:50302/i*' - '*http://42.238.241.117:47417/bin.sh*' - '*https://kztxtnj.pastiadajalan.pro/6412b97f-613a-48fd-89c5-11619f833705*' - '*http://42.58.167.28:50302/bin.sh*' - '*http://123.8.43.219:58002/i*' - '*http://182.119.179.36:59445/bin.sh*' - '*http://62.60.226.140/files/7559850987/SQuh7Vh.exe*' - '*https://dwyxchu.megashart.org/52ff60df-f27e-4d8d-ba89-c728a52f71fd*' - '*https://lwunxeob.1xjet.casino/?ublib=b12f2f14-e5c8-49e2-a2c0-cbe61c7a34ae*' - '*http://62.60.226.140/files/7690878206/n49HvmP.exe*' - '*https://etddhyf.takbetkade.com/e63cb3b4-8484-4c9a-97fd-bf286ac0c378*' - '*https://sscibrc.pinprobet.com/d71c6b0e-b808-49df-96e5-e659e8b78889*' - '*https://c557zanx.1xhot.xyz/?ublib=6f52e110-50f4-44f1-bc13-ebb0855b1d5e*' - '*https://jrfuwpw.megaparii.pro/9d230f40-c126-4529-a64e-4b8af5386fa8*' - '*http://182.123.225.3:53384/i*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 10 id: 9be1fdd1-7adf-5871-9e7e-5914b7d12996 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 10). logsource: category: proxy detection: selection: c-uri: - '*http://62.60.226.140/files/7782139129/GpgQSTP.exe*' - '*http://110.36.0.157:52113/i*' - '*https://lyjbjin.1xforward.pro/66bbde02-458d-4a76-a193-63fcd44bcaa8*' - '*http://110.36.15.130:54326/i*' - '*http://115.55.115.215:46705/bin.sh*' - '*http://182.123.225.3:53384/bin.sh*' - '*https://vps2v21x.1xgame.live/?ublib=bde8f12b-6572-4102-8c0d-d725f29e5d41*' - '*https://8oes4jec.betfakade.com/?ublib=aee8a7a4-7c61-40e3-abb3-887ed69c4448*' - '*http://123.9.104.168:50199/i*' - '*http://110.36.15.130:54326/bin.sh*' - '*https://wadbrnz.1xx.games/4b999f63-2a7b-4c00-b637-bc72a071ec93*' - '*https://1cqslawq.1xhot.org/?ublib=9d4ac2c0-49ff-47f1-8ea7-b20bf3b6ed15*' - '*https://yhcawcq.1xx.bio/b37e3396-022d-4f87-bcb8-102840db8c16*' - '*http://123.11.235.113:45689/i*' - '*https://aawzmuz.1xvip.live/a4df3f76-9f2f-4a28-89c6-a09632b10d9c*' - '*http://112.248.115.148:45179/i*' - '*https://zrdxgajy.thevallartasrestaurants.com/?ublib=3e52cb85-ba55-4963-b557-375d2ca8a431*' - '*https://cayif.hellokism.click/Lfic11e.zip*' - '*https://havgbelc.bingobet.pro/b6127657-ed61-4344-9f40-3a1d594bc948*' - '*https://frhphph.1xsomalia.com/f9d47e9f-1e00-48ba-870a-16342d35da74*' - '*http://110.36.30.112:38106/i*' - '*http://110.36.30.112:38106/bin.sh*' - '*https://oxqniwv.1xpin.vip/edcc3c22-d58e-4305-b72b-69493006207f*' - '*https://qxguiws.1xpin.org/28b5e66a-f135-4665-b0ee-04dac7a9b654*' - '*http://61.52.159.219:49548/bin.sh*' - '*https://w9x1nvom.sizzleasianfood.com/?ublib=c3d185d4-8bb1-4ee7-9118-3a5f3dc55199*' - '*https://jds4p0yc.betbacklink.com/?ublib=14de31c2-1df3-413d-8515-65ac9a31f290*' - '*https://dhur9q3h.1x303.casino/?ublib=00b08813-0c36-46f8-b24d-e0024332ea57*' - '*http://182.116.12.154:55908/i*' - '*https://ao046xe5.1xbeet.xyz/?ublib=0550d70c-6683-4bf7-825d-d12f153c2d7e*' - '*https://vlmtl3yv.jozvedownload.com/?ublib=fe77ff2e-5b89-43f9-876a-60bd8fa92a25*' - '*https://fnd9555t.ligabfa.com/?ublib=a5761cd7-be72-4803-b8d7-9bc0ec15b75b*' - '*http://182.116.12.154:55908/bin.sh*' - '*https://evhg599x.lemongrassasiangrill.com/?ublib=7310e1df-da6b-4277-934f-16f541d56837*' - '*https://adoswjr.calvaryhospice.org/42978f33-ddfe-49ee-a0dd-941c38341157*' - '*http://125.41.8.75:54629/i*' - '*https://manovingenieria.com/manovingenieria.zip*' - '*https://barlucianocassino.com/g21hg1298h12j90gh129jhkg0.php?*' - '*http://125.41.8.75:54629/bin.sh*' - '*https://jkltnrm.alohawatersports.com/2bf47fdd-54c6-49c8-a4ba-84e1bf175bc4*' - '*http://115.61.120.210:60517/bin.sh*' - '*http://175.146.229.121:55858/bin.sh*' - '*https://edvekzo.alohawatersports.com/b1efa50a-abe9-43a9-b31c-056eb1444520*' - '*https://xwlctmz.yek90bet.com/9edbbed0-fbd6-439c-b0d5-7399ef20c850*' - '*http://222.138.180.248:57746/i*' - '*http://27.44.145.185:41522/i*' - '*https://tfd2ceqg.bet365persian.com/?ublib=0d587752-4fe9-4340-8e98-76285279d677*' - '*https://7lm2xwqz.1x1bet.xyz/?ublib=d7785ba6-3af2-483c-9405-21a369fe8ba7*' - '*http://125.45.63.235:53847/i*' - '*https://07vh2ie1.jozve.download/?ublib=fcaa3645-db91-4ca2-ad42-9b39e783bfda*' - '*http://125.45.63.235:53847/bin.sh*' - '*https://oymbwsa.yek90bet.com/7e4025ac-d750-470f-8398-79e3893cb367*' - '*https://vasecle.pinprobet.com/4a76bb2f-5aaf-4801-a888-52267870be2a*' - '*https://5z9j5y93.akhlagvaahkam.xyz/?ublib=68c9447a-ccab-41b4-860d-b5514bc7c071*' - '*http://182.116.113.116:51117/i*' - '*https://lakjctx.megaparii.pro/43691b4f-c3a7-46e7-92f0-373ac7422cf2*' - '*https://vgqntzu.betmilliard.com/712d3c6a-53fd-4fa1-9def-ecdc434f2795*' - '*https://qv3dp7rx.ahkam.xyz/?ublib=56ffd8ae-fc41-437f-b04e-e3617d9e2b07*' - '*https://sctawfw.1xgame.games/88df07b9-a605-4349-ae61-554c6ccfc01e*' - '*http://42.234.155.30:46244/i*' - '*https://hlhfm0v8.1x1bet.co/?ublib=aa2b25d6-15ef-46fe-a87f-a9196d97c58a*' - '*https://12xb1qlu.jet-theme.com/?ublib=e3596cfc-d215-40d0-8a74-5583debef91c*' - '*https://gbbzsnq.1xgame.cash/d09b204d-8b30-4257-9e9c-2c856e5f85da*' - '*https://ejjfjm2l.vip1xbet.net/?ublib=f3b87ac2-ad32-4c47-83ab-18e5589ba93c*' - '*http://123.8.46.94:58002/i*' - '*http://123.8.46.94:58002/bin.sh*' - '*https://pmaumei.1xgame.bet/62f4ef88-a697-4c29-8316-650185e22d7e*' - '*https://tearmbdo.bet1forward.com/fc8630e4-2287-427f-b0ab-ad8aebeb9ab6*' - '*https://qlrjloxh.jozve.one/e9817e4f-3b65-40a0-9bdd-e58c6afd9f3a*' - '*http://62.60.226.140/files/5780918464/lPZYdDr.ps1*' - '*http://119.179.250.183:42201/i*' - '*http://61.53.196.243:55492/i*' - '*http://91.92.242.236/files-129312398/files/file_7abbb1cadc4625ad.ps1*' - '*https://flhrpdn.yekbetkade.com/45a59c2a-1b46-4cfd-8a4f-92259d7ea516*' - '*https://rfedpuuc.falsafekonkour.site/?ublib=01057b20-0c1b-47e6-a963-324be77d9013*' - '*http://119.179.250.183:42201/bin.sh*' - '*https://lbftpzh.takbetkade.com/7733e39b-8ac6-4a0f-b3aa-13c7e4edabb1*' - '*https://mlvgwjn.1xforward.pro/e955fa4f-bca8-46ed-8cbe-d4bf666037df*' - '*https://926ikjry.euroyek.bio/?ublib=798fd62a-d1ea-48f1-a303-1060b86ce722*' - '*https://id10ixg6.1x1bet.cash/?ublib=b9979bce-aeed-45ef-a406-94093d9d91ef*' - '*https://aqjyrpm.1xforward.org/308cad30-c637-483c-8c7d-421fa7e6e3df*' - '*https://fsaxdfy0.hit4.bet/?ublib=aa91b418-f8e1-4647-9350-eaebbfa2785b*' - '*http://182.119.198.230:39634/bin.sh*' - '*http://42.225.228.117:44168/bin.sh*' - '*http://125.46.130.156:50524/i*' - '*https://uusqctu.eurojet.pro/fce75b82-81b3-4da8-b1b2-32e1dd7decdd*' - '*http://144.172.97.69/50/godgivengiftbiggerthananyonegivenbestfdfit.hta*' - '*http://144.172.97.69/ww.adyen.comknowledge-hubpayment-gatewaymsclkid=0dcc9c9da58815369da2f6a715a7654d&utm_source=bing&utm_medium=cpc&utm_campaig-w293498ew9r8rer98r77.php?&???????????????*' - '*http://144.172.97.69/img/img_190855.png*' - '*https://rdt.li/xUaZWS*' - '*http://192.210.186.199/133/img_181645.png*' - '*http://192.210.186.199/httpswww.hipaavault.comresourceshipaa-compliant-cloud-storage-secure-your-healthcare-databackup.php*' - '*http://192.210.186.199/127/nicepersonwithbettertiming.hta*' - '*http://192.210.186.199/img/kb/brazilgoodformebettersmooth.hta*' - '*http://192.210.186.199/129/buttersmoothpussykinggirlonhereforme.hta*' - '*http://192.210.186.199/131/wellgoingonbestfeelingsforme.hta*' - '*http://192.210.186.199/131/img_174443.png*' - '*http://192.210.186.199/httpsdevelopers.cloudflare.comapiresourcesaccountsmethodsupdate.php*' - '*https://192.210.186.199/www.cdwg.comcontentcdwgenarticlessecurityprotecting-ot-and-critical-infrastructure-in-an-evolving-threat-landscapes.php*' - '*http://192.210.186.199/117/greendaysgoinginmylife.hta*' - '*http://192.210.186.199/47/img_220250.png*' - '*http://192.210.186.199/132/img_210822.png*' - '*https://192.210.186.199/132/wegladtoseethebestforbestpeoples.hTA*' - '*https://192.210.186.199/133/wegreatthingswithbettermeansgood.hta*' - '*http://192.210.186.199/httpswww.veeam.comfree-hybrid-cloud-trial.htmlst=bingpaidsearch&utm_campaign_id=604987702&utm_adgroup=trial-hybrid-cloud-nb-backup&utm_adgrouss.php*' - '*http://192.210.186.199/httpsdevelopers.cloudflare.comapiresourcesaccountssubresourcesaccount_organizations.php*' - '*http://192.210.186.199/130/servicegoodforusebestthings.hta*' - '*http://115.61.120.210:60517/i*' - '*http://125.41.230.212:42327/i*' - '*https://v1rsowak.xbetone.com/?ublib=9e298db3-ac25-45ba-aac5-2afe413043ba*' - '*https://dedzwcx.enfejarbahis.com/67eb2033-603b-48e4-a20a-e944b8f06672*' - '*https://lsyhgfl.enfejarbahis.com/307dc2d6-9df8-4374-8e1d-9ea472c6ad7f*' - '*https://fmpdxnv.enfejar.poker/4dfaa57d-12f2-4dd8-a71f-2ca6e555e8ee*' - '*https://lseczri.enfejar.poker/16e1bc58-1537-4537-a5c7-51350fac2e1a*' - '*https://gejrdcu.enfejar.poker/56722ccb-692f-4e3c-9033-3b507e3fa7b1*' - '*http://62.60.226.140/files/7512462936/dG0gJBZ.exe*' - '*http://182.126.180.243:58590/i*' - '*https://pnz8cbiq.vip1xbet.org/?ublib=47dc6504-1768-409c-ad0a-6ee1695f778d*' - '*https://kqlnrvh.enfejar.poker/9388fa4f-5f02-484c-bd18-2d165628e916*' - '*http://141.11.88.103/bins.sh*' - '*https://klqxthu.enfejar.poker/1e70be9f-6442-432f-b0b8-cdd49eed1d86*' - '*http://182.124.212.108:50577/i*' - '*http://112.246.80.75:39781/i*' - '*https://86uweryp.zarib.bet/?ublib=4931a3ba-3b66-4af8-a60b-292cae98b63f*' - '*https://s6adoo5q.filetak.com/?ublib=fdc2061d-e9e9-418c-b89c-5ca07809ddb2*' - '*http://42.238.70.195:51198/i*' - '*https://prestigeclient.lovable.app/__l5e/assets-v1/d47c82f6-6d9e-446c-abc6-9d6e95abb501/Prestige-1.21.x.jar*' - '*https://wihernc9.vip1xbet.net/?ublib=a16a6233-a927-49e1-a0fd-db96cb17b4e4*' - '*http://42.238.70.195:51198/bin.sh*' - '*https://tvdmydv.yek.christmas/e80e6dc0-3c34-45fa-9061-3a151a51a254*' - '*http://44.223.110.247:1337/mods/jre.zip*' - '*https://irahook.org/mods/jre.zip*' - '*http://27.44.146.20:41423/i*' - '*https://irahook.org/mods/smp.jar*' - '*http://44.223.110.247:1337/mods/smp.jar*' - '*http://91.92.242.236/files-129312398/files/file_5dbe792bb15db267.exe*' - '*http://115.57.167.206:57531/i*' - '*http://115.57.167.206:57531/bin.sh*' - '*https://99iud2c2.falsafekonkour.site/?ublib=0ff46764-be66-4168-b64e-ef59fd8ce743*' - '*https://iak4jg2m.gembet.live/?ublib=96202963-050f-4dc1-8abb-d31ad59e3b7d*' - '*http://112.248.163.173:35273/i*' - '*http://125.41.104.120:56409/i*' - '*http://125.41.104.120:56409/bin.sh*' - '*http://125.47.119.146:55675/i*' - '*https://heifdda.yek.buzz/734bd965-ed43-46cf-ac3a-5f0206c8a7ca*' - '*http://125.47.119.146:55675/bin.sh*' - '*https://ke9j9z10.interwettenbet.com/?ublib=f85752d6-893f-4adb-b5d3-9a7f38cd59ca*' - '*https://fuotcd3b.futshart.pro/?ublib=e3125e1b-3b16-435a-b248-9251f527da2a*' - '*https://fzkx5dg3.estekhdam.online/?ublib=21b76d5c-fd5a-4d37-b920-ca63a234606b*' - '*http://212.164.115.235:55869/i*' - '*http://110.37.53.25:58088/bin.sh*' - '*http://115.55.51.220:54353/i*' - '*http://212.164.115.235:55869/bin.sh*' - '*http://112.248.100.184:47063/i*' - '*http://112.248.100.184:47063/bin.sh*' - '*http://42.55.31.104:40005/bin.sh*' - '*http://77.236.74.65:57977/i*' - '*https://5werloog.funxbet.live/?ublib=aa822f15-e605-4e31-817a-98f3b29523e4*' - '*https://rfdatuh.yek.boats/274c6c72-a290-48d6-9444-eeb61f2d3356*' - '*http://98.252.87.232:50861/bin.sh*' - '*http://112.242.185.188:45010/i*' - '*http://112.242.185.188:45010/bin.sh*' - '*http://d90s0lckjm3qn44hcum0b9nzeotuz8g35.oast.fun*' - '*http://d90s0lckjm3qn44hcum04th5mqx3go15x.oast.fun*' - '*http://d90s0lckjm3qn44hcum0zyhonc1p7zw4o.oast.fun*' - '*http://d90s0lckjm3qn44hcum0znqd1uar4nsqm.oast.fun*' - '*https://p5tnetyi.footb.xyz/?ublib=a804bfd2-489c-46da-94cd-cd21170212c9*' - '*http://91.92.242.236/files-129312398/files/file_0cfc26d9c73098bf.exe*' - '*https://mrjeehw.yek.beauty/6d687597-5334-407f-98a5-f6f227123c0f*' - '*http://110.36.80.162:38021/i*' - '*https://eayuhgu.xbetone.com/935684f8-8b5a-486c-9d27-61f6d78f46ba*' - '*https://jjtsc3t1.homabet.com/?ublib=972d5e06-09a9-4110-9d4d-23e157d5644f*' - '*http://110.36.80.162:38021/bin.sh*' - '*https://egzbf2a5.estekhdam.one/?ublib=bc8e56a0-196d-430a-9826-9026508319c1*' - '*https://pkdac095.euroyek.bio/?ublib=03412876-1989-4553-bcc4-e2728aa9d660*' - '*http://115.55.55.238:59748/i*' - '*http://222.142.226.106:52151/i*' - '*http://115.55.55.238:59748/bin.sh*' - '*https://sowmwvh.vip1xbet.org/5ad23ad5-5405-4250-aee8-cc4cd7fa8dfd*' - '*https://clysselw.betkaka.bet/?ublib=d62de2ab-95e7-40cc-bc7a-d5579dc62847*' - '*http://62.60.226.140/files/724846695/vpcJH2O.exe*' - '*http://115.55.223.146:43386/i*' - '*http://123.14.93.231:50448/i*' - '*http://42.238.170.65:54036/i*' - '*https://8pxyyjso.doobix.pro/?ublib=2a59e2df-fdea-4f99-844f-e4b4a244d394*' - '*https://zthayuyp.1x303.casino/?ublib=b9b94899-24e9-44bb-aa25-a842760bd4a5*' - '*https://i0gxyl9q.betaffiliate.marketing/?ublib=84186b88-51bf-4d6c-9eee-ad796fb31ecd*' - '*http://182.113.40.220:47427/i*' - '*http://62.60.226.140/files/724846695/MGvlOIG.exe*' - '*https://phcbmap.vip1xbet.net/3ba097aa-2c3d-423f-b757-ac32580b80b2*' - '*https://uamhqvjx.abresanishahri.store/10129262-2452-481f-bb8f-392907e90f17*' - '*https://lwflkiar.betsoor.live/460da77f-1d92-4cf2-b5d3-fe7fcca31370*' - '*https://jpopdwg.vip1xbet.net/887e4755-f7b8-4f69-9917-73976e7e3ea5*' - '*http://116.140.173.225:55136/i*' - '*https://7ipg23zj.bet808.poker/?ublib=76959cda-9e5e-497a-9f75-e1b8f95ded46*' - '*http://182.113.31.70:50018/bin.sh*' - '*http://116.140.173.225:55136/bin.sh*' - '*http://27.206.189.240:58978/i*' - '*https://blue-paper-f69f.acrypters.workers.dev/FTM0-40PO-AO28-G98E/img_m9agri.png*' - '*http://107.173.143.45/sso.esic.gov.inESICSSOAppLiferaylogin.jspbmctx=7CAD769BFA3451BE21DE1F73E125D2C4FA94907F3FE40A1DCE0DB069C1A208E4&password=secure_string&contextTypeop.php*' - '*https://sh.classera.com/enT3ac*' - '*http://107.173.143.45/128/givemebesttimeforbetterplacescomingforme.hta?&%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B%D0%9B*' - '*http://147.124.213.158/ewoocuconomictimes.indiatimes.com.php?id=newsnew-updatesindia-set-to-get-first-private-gold-mine-today-all-about-andhra-pradeshs-swarnagiri-project-that-can-produces*' - '*https://acessaurl.com/SWiHSeG*' - '*http://147.124.213.158/46/goodforbestpeoplesaroundonmybestthigns.hta?&%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC%F0%9F%9D%AC*' - '*https://github.com/VideoPad-Free-for-PC/.github/archive/refs/heads/main.zip*' - '*https://69x4o4j5.bet808.casino/?ublib=56156c61-4a81-460f-8ef6-b2a8da140228*' - '*http://115.57.243.240:39118/i*' - '*http://115.57.243.240:39118/bin.sh*' - '*http://91.92.242.236/files-129312398/files/file_4c436927d72aed3f.msi*' - '*https://xwnfpj7t.betrein.pro/?ublib=b3d51f5c-b226-4a07-b9a6-43a851fd6025*' - '*https://esjvtzn6.aloo.bet/?ublib=a571ff30-9c75-45c3-a2d3-babc9f0d9c52*' - '*http://115.48.11.72:56497/i*' - '*http://115.55.217.5:52830/i*' - '*http://125.40.115.195:49809/i*' - '*http://115.48.11.72:56497/bin.sh*' - '*https://91vkuxv1.enf90.net/?ublib=79226b16-10a2-475f-84d9-cb02e3f4a875*' - '*http://115.55.217.5:52830/bin.sh*' - '*https://j2rfzlmu.enf90.net/?ublib=dfcf517a-cdd3-417a-bb05-575ff97ef085*' - '*https://setup-code.com/install.ps1*' - '*https://3gk1o3xg.betoshart.live/?ublib=d029f24c-bc86-44fd-91d6-e187d4d947b8*' - '*https://4l988hfr.1fabet.live/?ublib=59c45c23-9aaf-4772-90c1-f447436f6c4e*' - '*https://bfhxci6n.dancebet.net/?ublib=b535fd63-8659-44eb-a078-c9c9178f11ed*' - '*https://chhtni23.dancebet.app/?ublib=60e78355-38ee-40dc-b0c6-a0f8bc4af806*' - '*http://42.232.238.189:41000/i*' - '*http://27.44.146.12:36056/i*' - '*http://42.235.168.146:46008/bin.sh*' - '*http://42.233.88.99:46031/i*' - '*https://voltix-net.top/BIBA/V%D0%BElti%D1%85.zip*' - '*http://42.233.88.99:46031/bin.sh*' - '*https://jrfrggyb.crash.promo/?ublib=47f46462-82ff-49aa-975b-98b4c223451a*' - '*https://royalcare-sy.com/1212.exe*' - '*https://royalcare-sy.com/cross.exe*' - '*https://royalcare-sy.com/respamming.exe*' - '*https://royalcare-sy.com/shockerzz.exe*' - '*https://royalcare-sy.com/6565.exe*' - '*http://royalcare-sy.com/cross.exe*' - '*http://115.50.220.128:59661/i*' - '*https://mdftw8lo.btyek.website/?ublib=bf723810-216b-4253-949d-cd83a30499d4*' - '*https://easyfiles.cc/2026/6/ce0a3ffe-dc52-470b-8686-99cd20029255/NS2H.zip*' - '*https://djaczx9h.btyek.online/?ublib=c4993d64-c456-4f4f-aca9-b1e039bcffb1*' - '*http://222.141.47.94:48327/i*' - '*http://125.41.133.47:43078/i*' - '*https://squvbf6p.btyek.one/?ublib=3ad123de-3852-4784-9864-dc443665a2e0*' - '*http://222.141.47.94:48327/bin.sh*' - '*https://cdn.jsdelivr.net/gh/recavrylog/roandatech@1cc983d/rp_4*' - '*https://lvt.vip1xbet.net/4e0d84da-c118-4423-83c4-2b0b4883f3ec*' - '*http://112.239.101.142:35487/bin.sh*' - '*http://219.155.225.142:45884/i*' - '*https://x4ii4c50.btyek.store/?ublib=81f18dad-afb8-4fb1-abc7-9381f68fb08e*' - '*http://175.149.67.175:47768/bin.sh*' - '*http://219.155.225.142:45884/bin.sh*' - '*http://27.44.144.179:43421/i*' - '*http://27.44.147.89:53751/i*' - '*http://115.55.119.242:36608/i*' - '*http://42.235.168.146:46008/i*' - '*http://115.55.119.242:36608/bin.sh*' - '*https://njb2hl8n.betobord.live/?ublib=0a20a0d5-4331-49e3-aff0-2fc0f9827e5f*' - '*https://cxsbf6om.betmajickade.com/?ublib=23ae640f-d58b-4c81-a403-2608361c9b8f*' - '*https://q08rvd2u.btyek.bond/?ublib=20a30d54-bb7c-4821-ba05-7a5b7ce3b8e2*' - '*http://115.48.132.221:52310/i*' - '*http://123.14.187.7:43837/i*' - '*http://62.60.226.140/files/8606001881/01ZDJLI.exe*' - '*http://123.14.187.7:43837/bin.sh*' - '*https://x089w0f5.btyek.boats/?ublib=70c1a1c4-b1af-4d09-9b8f-13323c0520ea*' - '*http://123.129.131.196:36697/i*' condition: selection level: high tags: - attack.t1071 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: b8d9795d-9da2-596c-972c-02d93befbc0a status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://221.14.42.82:39615/i*' - '*http://129.121.114.124/fR9v*' - '*http://129.121.114.124/tAGc*' - '*http://129.121.114.124/cXiP*' - '*http://129.121.114.124/kiA*' - '*http://112.109.219.55:35136/bin.sh*' - '*http://190.109.227.219:37896/i*' - '*http://115.49.106.146:58197/i*' - '*http://75.1.240.64:39075/i*' - '*http://105.225.100.14:54855/bin.sh*' - '*http://27.8.128.30:37740/bin.sh*' - '*http://105.224.57.155:52243/bin.sh*' - '*http://27.153.144.57:34302/i*' - '*http://110.37.7.53:49904/i*' - '*http://122.159.34.131:39014/bin.sh*' - '*http://124.234.219.192:60575/i*' - '*http://190.111.98.238:37258/i*' - '*http://182.124.174.196:42413/i*' - '*http://221.15.174.93:47197/i*' - '*http://119.119.187.178:48407/bin.sh*' - '*http://223.151.74.217:38285/i*' - '*http://105.225.100.14:54855/i*' - '*http://221.15.174.93:47197/bin.sh*' - '*http://222.209.122.135:57774/bin.sh*' - '*http://124.234.219.192:60575/bin.sh*' - '*http://45.165.172.92:58242/bin.sh*' - '*http://45.165.172.92:58242/i*' - '*http://101.109.81.93:59129/i*' - '*http://218.91.67.4:40286/i*' - '*http://190.109.228.199:53843/i*' - '*http://138.252.69.9:54615/i*' - '*http://27.153.144.57:34302/bin.sh*' - '*http://222.209.122.135:57774/i*' - '*http://45.170.224.217:44446/bin.sh*' - '*http://220.161.160.164:43968/i*' - '*http://119.119.187.178:48407/i*' - '*http://183.159.190.99:51266/i*' - '*http://120.37.212.172:59859/i*' - '*http://106.41.44.56:55712/bin.sh*' - '*http://110.37.90.59:50937/i*' - '*http://110.37.90.59:50937/bin.sh*' - '*http://221.14.42.82:39615/bin.sh*' - '*http://36.26.212.201:36975/i*' - '*http://36.26.212.201:36975/bin.sh*' - '*http://105.184.105.72:40719/bin.sh*' - '*http://222.220.145.169:51630/i*' - '*http://222.220.145.169:51630/bin.sh*' - '*http://42.224.156.3:55917/bin.sh*' - '*http://42.224.156.3:55917/i*' - '*http://200.115.102.246:52428/i*' - '*http://27.189.31.239:40785/i*' - '*http://59.58.42.3:40746/bin.sh*' - '*http://42.229.90.24:34545/i*' - '*http://45.177.33.164:52673/i*' - '*http://220.161.160.164:43968/bin.sh*' - '*http://45.177.33.164:52673/bin.sh*' - '*http://94.154.43.88/ohshit.sh*' - '*http://60.176.252.170:42159/bin.sh*' - '*http://222.245.0.182:59607/bin.sh*' - '*http://42.229.90.24:34545/bin.sh*' - '*http://200.115.102.246:52428/bin.sh*' - '*http://106.41.44.56:55712/i*' - '*http://185.244.84.159:46779/.i*' - '*http://77.247.88.81:49544/bin.sh*' - '*http://105.225.123.172:50893/i*' - '*http://111.126.223.219:44915/i*' - '*http://123.130.133.208:53097/bin.sh*' - '*http://27.189.31.239:40785/bin.sh*' - '*http://105.186.211.136:43135/i*' - '*http://111.126.223.219:44915/bin.sh*' - '*http://124.162.49.231:51581/i*' - '*http://123.185.91.180:52353/i*' - '*http://60.215.23.95:55729/bin.sh*' - '*http://125.46.234.158:35953/i*' - '*http://105.184.74.158:60163/bin.sh*' - '*http://83.168.69.141/armv7l*' - '*http://83.168.69.141/armv6l*' - '*http://185.9.139.117:41869/bin.sh*' - '*http://103.195.239.172/main_x86_64*' - '*http://187.45.95.254:51076/bin.sh*' - '*http://112.198.193.5:52054/i*' - '*http://cdnorigin.net/api/agent/loader?k=n4d-2ff16c75b1d2*' - '*http://180.245.56.160:52208/i*' - '*http://183.23.129.109:35951/i*' - '*http://103.195.239.172/main_mips*' - '*http://105.186.237.184:47419/i*' - '*http://83.168.69.141/armv4l*' - '*http://105.224.110.80:47391/i*' - '*http://51.75.118.165:20130/dl/BlahajNet.x86_64*' - '*http://112.198.193.5:52054/bin.sh*' - '*http://103.195.239.172/main_arm*' - '*http://122.193.195.215:57630/i*' - '*http://110.37.56.122:41290/i*' - '*http://120.82.201.135:45647/i*' - '*http://110.85.108.218:41787/i*' - '*http://105.224.57.155:52243/i*' - '*http://154.219.116.177/Mddos/Mddos.arm5*' - '*http://219.157.39.0:34723/bin.sh*' - '*http://116.248.82.191:34039/i*' - '*http://14.189.118.121:58826/i*' - '*http://83.168.69.141/mips*' - '*http://83.168.69.141/p2.sh*' - '*http://46.236.65.41:56440/i*' - '*http://194.110.87.216:18080/bins/x86_64.bin*' - '*http://175.43.93.121:57143/bin.sh*' - '*http://14.189.118.121:58826/bin.sh*' - '*http://110.37.56.122:41290/bin.sh*' - '*http://175.43.93.121:57143/i*' - '*http://83.168.69.141/mipsel*' - '*http://105.225.123.172:50893/bin.sh*' - '*http://27.21.26.73:59239/i*' - '*http://83.168.69.141/i486*' - '*http://83.168.69.141/aarch64*' - '*http://45.170.224.217:44446/i*' - '*http://105.186.237.184:47419/bin.sh*' - '*http://105.224.38.160:37417/bin.sh*' - '*http://101.66.20.151:34135/Mozi.m*' - '*http://95.43.75.2:19117/.i*' - '*http://79.165.88.118:43615/i*' - '*http://209.99.186.235/api/agent/full?arch=amd64*' - '*http://83.168.69.141/armv5l*' - '*http://113.233.236.144:43521/i*' - '*http://183.63.8.194:44654/bin.sh*' - '*http://61.53.94.200:46286/bin.sh*' - '*http://111.185.147.232:46236/i*' - '*http://110.37.106.148:35674/i*' - '*http://182.46.196.157:35089/i*' - '*http://185.9.139.117:41869/i*' - '*http://105.184.7.22:52755/i*' - '*http://113.233.236.144:43521/bin.sh*' - '*http://209.99.186.235/api/agent/loader?k=n4d-2ff16c75b1d2*' - '*http://105.224.228.156:55561/i*' - '*http://105.224.38.160:37417/i*' - '*http://124.162.49.231:51581/bin.sh*' - '*http://123.14.208.6:40785/bin.sh*' - '*http://171.213.200.200:54131/i*' - '*http://187.45.95.254:51076/i*' - '*http://105.186.211.136:43135/bin.sh*' - '*http://83.168.69.141/x86_64*' - '*http://171.213.200.200:54131/bin.sh*' - '*http://47.212.193.38:44155/bin.sh*' - '*http://122.193.195.215:57630/bin.sh*' - '*http://105.184.105.72:40719/i*' - '*http://180.245.56.160:52208/bin.sh*' - '*http://47.212.193.38:44155/i*' - '*http://182.46.196.157:35089/bin.sh*' - '*http://221.198.118.73:57439/bin.sh*' - '*http://79.0.5.138:42273/.i*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64*' - '*http://94.154.43.148/wget.sh*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips*' - '*http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4*' - '*http://94.154.43.148/c.sh*' - '*http://94.154.43.148/w.sh*' - '*http://36.89.62.19:63814/.i*' - '*http://222.243.95.50:41564/i*' - '*http://222.243.95.50:41564/bin.sh*' - '*http://125.46.234.158:35953/bin.sh*' - '*http://110.93.243.19:40765/i*' - '*http://196.189.35.172:33721/bin.sh*' - '*http://110.37.116.78:40685/bin.sh*' - '*http://36.24.85.12:52016/bin.sh*' - '*http://113.221.74.28:33643/i*' - '*http://182.120.41.220:55248/i*' - '*http://45.231.145.15:41344/i*' - '*http://45.231.145.15:41344/bin.sh*' - '*http://36.72.30.243:49303/bin.sh*' - '*http://36.72.30.243:49303/i*' - '*http://116.248.82.191:34039/bin.sh*' - '*http://118.125.24.88:59343/bin.sh*' - '*http://36.24.85.12:52016/i*' - '*http://217.60.195.127/a.sh*' - '*http://129.121.110.105/14d*' - '*http://129.121.110.105/Qva*' - '*http://129.121.110.105/EMu*' - '*http://129.121.110.105/djr*' - '*http://129.121.110.105/FtoP*' - '*http://129.121.110.105/c2lv*' - '*http://129.121.110.105/aKmh*' - '*http://129.121.110.105/0f9*' - '*http://129.121.110.105/Xvg*' - '*http://129.121.110.105/jST0*' - '*http://105.184.156.91:60979/bin.sh*' - '*http://27.204.233.111:34879/i*' - '*http://27.204.233.111:34879/bin.sh*' - '*http://27.21.26.73:59239/bin.sh*' - '*http://27.23.67.50:57590/i*' - '*http://118.125.24.88:59343/i*' - '*http://27.23.67.50:57590/bin.sh*' - '*http://129.121.110.105/LSD*' - '*http://129.121.110.105/BHRm*' - '*http://129.121.110.105/dmff*' - '*http://129.121.110.105/rWH*' - '*http://129.121.110.105/uOa*' - '*http://177.86.229.115:54758/i*' - '*http://221.198.118.73:57439/i*' - '*http://110.93.243.19:40765/bin.sh*' - '*http://177.86.229.115:54758/bin.sh*' - '*http://47.22.166.163:56510/bin.sh*' - '*http://162.255.251.91:56761/i*' - '*http://103.80.57.126:40459/i*' - '*http://105.224.251.74:39145/bin.sh*' - '*http://105.184.94.186:33579/i*' - '*http://182.119.63.53:45610/i*' - '*http://189.127.169.20:49051/bin.sh*' - '*http://183.23.130.74:53767/bin.sh*' - '*http://222.219.74.179:52755/i*' - '*http://77.239.124.139/nz.sh*' - '*http://31.56.209.153/c.sh*' - '*http://105.224.42.87:38595/i*' - '*http://120.28.220.18:49132/i*' - '*http://120.28.220.18:49132/bin.sh*' - '*http://123.12.168.110:50097/i*' - '*http://31.56.209.153/nz.sh*' - '*http://129.121.110.105/mIa*' - '*http://129.121.110.105/xCzb*' - '*http://129.121.110.105/ph7*' - '*http://129.121.110.105/pu0*' - '*http://129.121.110.105/sAD*' - '*http://105.184.18.189:43225/i*' - '*http://2.26.136.128/twget.sh*' - '*http://205.237.110.232/giga.sh*' - '*http://94.154.43.61/cache*' - '*http://94.154.43.61/cometome*' - '*http://196.190.1.39:34527/i*' - '*http://45.165.172.91:45949/i*' - '*http://196.190.1.39:34527/bin.sh*' - '*http://45.165.172.91:45949/bin.sh*' - '*http://106.40.240.66:47640/i*' - '*http://106.40.240.66:47640/bin.sh*' - '*http://196.189.101.82:60459/bin.sh*' - '*http://222.173.239.186:38683/i*' - '*http://105.187.42.210:52419/bin.sh*' - '*http://196.190.105.170:55224/i*' - '*http://105.186.248.15:48079/i*' - '*http://105.184.183.213:58987/i*' - '*http://77.247.88.82:40510/bin.sh*' - '*http://31.56.209.70/nz.sh*' - '*http://129.121.110.105/UlX*' - '*http://129.121.110.105/ANmR*' - '*http://129.121.110.105/PMw*' - '*http://129.121.110.105/WAu*' - '*http://129.121.110.105/0aYd*' - '*http://46.159.123.188:46944/bin.sh*' - '*http://125.24.166.160:48604/i*' - '*http://180.125.200.33:44678/i*' - '*http://180.125.200.33:44678/bin.sh*' - '*http://221.207.225.97:36850/i*' - '*http://221.207.225.97:36850/bin.sh*' - '*http://45.172.218.181:40632/bin.sh*' - '*http://46.159.123.188:46944/i*' - '*http://58.242.23.224:33747/i*' - '*http://116.68.162.210:40108/i*' - '*http://116.68.162.210:40108/bin.sh*' - '*http://103.172.186.156:55095/i*' - '*http://103.172.186.156:55095/bin.sh*' - '*http://105.184.108.47:44705/i*' - '*http://105.184.108.47:44705/bin.sh*' - '*http://196.189.35.172:36765/i*' - '*http://105.224.82.249:42805/i*' - '*http://129.121.110.105/5zOK*' - '*http://129.121.110.105/y2k*' - '*http://129.121.110.105/w1kw*' - '*http://129.121.110.105/vUID*' - '*http://129.121.110.105/UM7*' - '*http://182.126.194.44:33480/i*' - '*http://122.159.243.224:41653/i*' - '*http://95.56.232.109:36126/i*' - '*http://95.56.232.109:36126/bin.sh*' - '*http://122.159.243.224:41653/bin.sh*' - '*http://183.151.4.238:48247/bin.sh*' - '*http://183.151.4.238:48247/i*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnloongarch64xnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxni386xnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnm68kxnxn*' - '*http://41.216.189.236/bins/xnxnxnxnxnxnxnxnaarch64xnxn*' - '*http://196.189.35.172:38422/i*' - '*http://196.189.35.172:38422/bin.sh*' - '*http://59.42.89.228:56735/i*' - '*http://105.224.253.142:53571/i*' - '*http://105.224.253.142:53571/bin.sh*' - '*http://110.36.89.246:52906/i*' - '*http://110.36.89.246:52906/bin.sh*' - '*http://113.205.175.109:40459/i*' - '*http://113.205.175.109:40459/bin.sh*' - '*http://160.22.106.17/bins.sh*' - '*http://117.131.92.150:50108/i*' - '*http://117.131.92.150:50108/bin.sh*' - '*http://38.21.70.189:51850/i*' - '*http://38.21.70.189:51850/bin.sh*' - '*http://195.201.123.9/iran.aarch64*' - '*http://195.201.123.9/iran.mipsel*' - '*http://195.201.123.9/iran.m68k*' - '*http://195.201.123.9/iran.x86_64*' - '*http://195.201.123.9/iran.mips*' - '*http://195.201.123.9/telnet.sh*' - '*http://112.198.130.140:58398/bin.sh*' - '*http://114.227.50.186:47510/bin.sh*' - '*http://45.74.3.37:5001/bins.sh*' - '*http://182.122.194.186:41991/i*' - '*http://182.122.194.186:41991/bin.sh*' - '*http://94.154.43.115/bins/cat.sh*' - '*http://110.85.91.113:33841/i*' - '*http://110.85.91.113:33841/bin.sh*' - '*http://120.28.215.129:50122/i*' - '*http://94.154.43.164/peak.sh*' - '*http://162.249.125.141/release/goahead.sh*' - '*http://110.137.156.38:60980/i*' - '*http://110.137.156.38:60980/bin.sh*' - '*http://125.161.249.227:48043/bin.sh*' - '*http://91.92.42.213/phantom.sh*' - '*http://196.190.1.39:45413/i*' - '*http://196.190.1.39:45413/bin.sh*' - '*http://45.177.33.164:54535/bin.sh*' - '*http://105.186.67.127:42127/i*' - '*http://105.186.67.127:42127/bin.sh*' - '*http://91.92.42.213/bins/phantom.mpsl*' - '*http://91.92.42.213/bins/phantom.mips*' - '*http://91.92.42.213/bins/phantom.x86*' - '*http://160.22.106.17/release/x86_64*' - '*http://160.22.106.17/release/x86_32*' - '*http://79.106.74.167:36061/i*' - '*http://105.225.189.37:52601/i*' - '*http://105.184.28.228:59307/i*' - '*http://105.184.28.228:59307/bin.sh*' - '*http://175.43.138.10:47103/bin.sh*' - '*http://27.23.67.50:34071/i*' - '*http://27.23.67.50:34071/bin.sh*' - '*http://110.37.83.214:43234/bin.sh*' - '*http://45.177.33.169:47045/i*' - '*http://45.177.33.169:47045/bin.sh*' - '*http://217.60.195.187/cams.sh*' - '*http://27.219.119.11:49565/i*' - '*http://94.154.43.164/meow.sh*' - '*http://27.219.119.11:49565/bin.sh*' - '*http://94.154.43.164/mipsel*' - '*http://94.154.43.164/armv4l*' - '*http://94.154.43.164/armv5l*' - '*http://94.154.43.164/mips*' - '*http://94.154.43.164/i686*' - '*http://117.26.226.163:59859/i*' - '*http://167.250.158.32:37233/i*' - '*http://196.189.9.27:55826/i*' - '*http://110.83.135.231:40746/i*' - '*http://110.83.135.231:40746/bin.sh*' - '*http://129.121.110.105/eOF1*' - '*http://129.121.110.105/YQN*' - '*http://129.121.110.105/TGb*' - '*http://31.77.227.10/bins/nullnet_bash.sh*' - '*http://115.46.136.48:38896/i*' - '*http://45.150.195.235/twget.sh*' - '*http://115.46.136.48:38896/bin.sh*' - '*http://45.90.163.37/Mugen.sh*' - '*http://217.60.195.143/payload.sh*' - '*http://77.247.88.88:46996/i*' - '*http://175.154.116.98:44265/i*' - '*http://175.23.91.202:54273/i*' - '*http://213.242.30.74:53676/i*' - '*http://31.77.227.104/w.sh*' - '*http://31.77.227.104/wget.sh*' - '*http://31.77.227.104/c.sh*' - '*http://175.23.91.202:54273/bin.sh*' - '*http://213.242.30.74:53676/bin.sh*' - '*http://66.212.173.225:39265/bin.sh*' - '*http://36.69.82.140:58226/i*' - '*http://159.255.7.152:55266/i*' - '*http://159.255.7.152:55266/bin.sh*' - '*http://36.69.83.116:45851/i*' - '*http://36.69.83.116:45851/bin.sh*' - '*http://77.247.88.88:46996/bin.sh*' - '*http://183.92.205.45:55257/i*' - '*http://183.92.205.45:55257/bin.sh*' - '*http://112.252.222.187:37837/i*' - '*http://112.252.222.187:37837/bin.sh*' - '*http://82.86.65.140:45484/bin.sh*' - '*http://105.186.224.110:60709/i*' - '*http://105.186.224.110:60709/bin.sh*' - '*http://117.255.4.7:48645/i*' - '*http://117.255.4.7:48645/bin.sh*' - '*http://196.190.133.180:47622/i*' - '*http://196.190.133.180:47622/bin.sh*' - '*http://45.150.195.235/mload.sh*' - '*http://skript.club/nz.sh*' - '*http://122.241.36.130:42051/i*' - '*http://122.241.36.130:42051/bin.sh*' - '*http://157.173.119.111/nz/nz.arm7*' - '*http://157.173.119.111/nz/nz.arm*' - '*http://157.173.119.111/nz/nz.arm5*' - '*http://157.173.119.111/nz/nz.i686*' - '*http://157.173.119.111/nz/nz.x86*' - '*http://157.173.119.111/nz/nz.ppc*' - '*http://157.173.119.111/nz/nz.arm6*' - '*http://157.173.119.111/nz/nz.m68k*' - '*http://157.173.119.111/nz/nz.i468*' - '*http://157.173.119.111/nz/nz.mips*' - '*http://157.173.119.111/nz/nz.arc*' - '*http://157.173.119.111/nz.sh*' - '*http://157.173.119.111/nz/nz.x86_64*' - '*http://157.173.119.111/nz/nz.mpsl*' - '*http://157.173.119.111/nz/nz.sh4*' - '*http://157.173.119.111/nz/nz.spc*' - '*http://125.40.94.207:47197/bin.sh*' - '*http://206.62.120.34:37766/bin.sh*' - '*http://79.116.79.132:58647/.i*' - '*http://45.177.33.164:54535/i*' - '*http://220.201.230.29:36850/i*' - '*http://220.201.230.29:36850/bin.sh*' - '*http://66.212.173.225:39265/i*' - '*http://175.9.166.203:50484/i*' - '*http://94.154.43.123:8080/payload/ce8wkx7wrurx/ymvyvf.sh*' - '*http://77.247.88.90:60854/i*' - '*http://60.160.170.234:50103/i*' - '*http://105.225.111.196:49659/i*' - '*http://177.86.229.12:35799/i*' - '*http://105.225.111.196:49659/bin.sh*' - '*http://codeinspector.ddns.net/nz.sh*' - '*http://27.28.98.143:54370/i*' - '*http://105.186.198.55:41311/i*' - '*http://105.224.50.234:45151/i*' - '*http://101.21.20.154:59328/i*' - '*http://105.186.198.55:41311/bin.sh*' - '*http://105.224.50.234:45151/bin.sh*' - '*http://101.21.20.154:59328/bin.sh*' - '*http://113.233.224.20:44021/i*' - '*http://105.186.117.196:52929/i*' - '*http://180.245.46.51:34600/i*' - '*http://180.245.46.51:34600/bin.sh*' - '*http://175.43.138.10:47103/i*' - '*http://180.115.69.190:51906/i*' - '*http://36.70.238.164:33041/i*' - '*http://41.216.189.236/run.sh*' - '*http://129.121.110.105/sgAx*' - '*http://129.121.110.105/WJ97*' - '*http://129.121.110.105/gIP*' - '*http://175.31.207.211:36948/i*' - '*http://175.31.207.211:36948/bin.sh*' - '*http://180.252.217.48:36167/bin.sh*' - '*http://124.135.10.58:51825/bin.sh*' - '*http://217.60.195.187/kla.sh*' - '*http://105.186.160.136:33521/i*' - '*http://205.237.110.232/tplink.sh*' - '*http://41.216.189.236/g.sh*' - '*http://41.216.189.236/nz/c.sh*' - '*http://41.216.189.236/c.sh*' - '*http://85.11.167.178/ohshit.sh*' - '*http://85.11.167.178/Services.apk*' - '*http://91.92.42.50/top.sh*' - '*http://60.182.121.161:36943/bin.sh*' - '*http://182.52.76.61:53226/bin.sh*' - '*http://115.197.138.73:36085/i*' - '*http://110.37.17.117:34094/i*' - '*http://110.37.17.117:34094/bin.sh*' - '*http://5.175.174.231/Sakura.sh*' - '*http://27.201.110.150:33452/bin.sh*' - '*http://205.237.110.232/mipsel*' - '*http://105.186.125.68:56001/i*' - '*http://124.234.207.132:46552/i*' - '*http://124.234.207.132:46552/bin.sh*' - '*http://8.213.214.55/all.sh*' - '*http://129.121.110.105/lil*' - '*http://129.121.110.105/p*' - '*http://41.216.189.236/nz.sh*' - '*http://222.182.123.150:50511/i*' - '*http://112.31.189.32:50387/bin.sh*' - '*http://122.243.148.233:35817/i*' - '*http://103.217.215.238:17645/.i*' - '*http://193.93.228.160:38677/bin.sh*' - '*http://110.138.10.48:48865/i*' - '*http://110.138.10.48:48865/bin.sh*' - '*http://182.126.116.115:46286/i*' - '*http://182.126.116.115:46286/bin.sh*' - '*http://123.11.176.76:58197/i*' - '*http://94.154.43.87/wget_gpon.sh*' - '*http://115.63.113.248:50097/i*' - '*http://115.63.113.248:50097/bin.sh*' - '*http://105.224.109.82:60337/i*' - '*http://119.178.242.230:38056/i*' - '*http://119.178.242.230:38056/bin.sh*' - '*http://36.70.238.164:53141/bin.sh*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnm68kxnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnloongarch64xnxn*' - '*http://218.91.141.176:45041/i*' - '*http://105.186.143.197:48129/i*' - '*http://41.216.189.157/run.sh*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxnaarch64xnxn*' - '*http://41.216.189.157/bins/xnxnxnxnxnxnxnxni386xnxn*' - '*http://105.224.228.207:43461/i*' - '*http://1.70.76.151:38428/bin.sh*' - '*http://125.44.155.10:60685/i*' - '*http://205.237.110.232/wget.sh*' - '*http://205.237.110.232/curl.sh*' condition: selection level: high tags: - attack.t1583 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 2 id: aa890aa2-39d1-5806-a079-5354cafd9ada status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 2). logsource: category: proxy detection: selection: c-uri: - '*http://125.44.155.10:60685/bin.sh*' - '*http://39.75.7.179:39437/i*' - '*http://39.75.7.179:39437/bin.sh*' - '*http://196.190.11.194:47788/i*' - '*http://171.116.111.62:43207/bin.sh*' - '*http://105.224.66.14:53221/i*' - '*http://105.224.66.14:53221/bin.sh*' - '*http://110.178.52.170:46321/bin.sh*' - '*http://60.215.23.95:55729/i*' - '*http://45.207.196.86/all.sh*' - '*http://123.148.225.193:43983/i*' - '*http://112.109.211.19:58395/i*' - '*http://112.109.211.19:58395/bin.sh*' - '*http://196.190.133.180:56776/i*' - '*http://179.49.213.85:33501/i*' - '*http://36.80.229.52:38724/i*' - '*http://39.70.183.42:40654/i*' - '*http://220.135.42.30:54689/bin.sh*' - '*http://211.73.163.154:36543/.i*' - '*http://120.28.200.193:51670/bin.sh*' - '*http://105.184.236.22:51533/bin.sh*' - '*http://104.168.4.206/ar15.sh*' - '*http://120.28.197.118:47227/i*' - '*http://196.189.198.193:44465/bin.sh*' - '*http://220.184.3.184:37223/bin.sh*' - '*http://64.89.163.215/bins/busywget.sh*' - '*http://64.89.163.215/bins/wget.sh*' - '*http://64.89.163.215/bins/callaputa.sh*' - '*http://110.37.3.251:46046/i*' - '*http://110.37.3.251:46046/bin.sh*' - '*http://110.37.127.135:36933/bin.sh*' - '*http://112.254.156.154:45877/bin.sh*' - '*http://41.216.189.92/3.sh*' - '*http://41.216.189.92/nz/c.sh*' - '*http://41.216.189.92/2.sh*' - '*http://41.216.189.92/c.sh*' - '*http://45.90.163.37/HMugenXrevamped.sh*' - '*http://94.154.43.192/titanjr.sh*' - '*http://219.68.168.193:42212/bin.sh*' - '*http://105.184.15.207:33315/i*' - '*http://219.68.168.193:42212/i*' - '*http://220.135.42.30:54689/i*' - '*http://217.60.195.214/tplink.sh*' - '*http://217.60.195.214/massload*' - '*http://112.31.189.32:50387/i*' - '*http://41.216.189.92/nz.sh*' - '*http://217.60.195.214/wget.sh*' - '*http://217.60.195.214/curl.sh*' - '*http://27.223.204.195:43479/i*' - '*http://110.178.52.170:46321/i*' - '*http://94.156.166.84:53500/i*' - '*http://171.38.26.9:47753/bin.sh*' - '*http://113.218.241.42:43649/i*' - '*http://38.56.21.66:45423/i*' - '*http://38.56.21.66:45423/bin.sh*' - '*http://79.106.74.167:42214/i*' - '*http://79.106.74.167:42214/bin.sh*' - '*http://120.28.200.110:32910/i*' - '*http://120.28.200.110:32910/bin.sh*' - '*http://125.160.131.186:42169/i*' - '*http://103.172.186.195:45747/i*' - '*http://45.90.163.37/goahead*' - '*http://110.37.74.11:51802/i*' - '*http://110.37.74.11:51802/bin.sh*' - '*http://171.114.228.34:48473/i*' - '*http://95.9.35.137:60865/i*' - '*http://95.9.35.137:60865/bin.sh*' - '*http://196.190.11.194:48898/i*' - '*http://115.49.9.4:48207/i*' - '*http://115.49.9.4:48207/bin.sh*' - '*http://42.232.87.186:35730/i*' - '*http://180.244.8.111:48519/i*' - '*http://203.177.251.31:46755/i*' - '*http://94.154.43.42/bins/zxcrAretard.x86*' - '*http://94.154.43.42/bins/zxcrAretard.x86_64*' - '*http://94.154.43.42/bin/zxcrAretard.x86_64*' - '*http://94.154.43.42/bins/services.apk*' - '*http://94.154.43.42/hiddenbin/zxcrAretard.x86*' - '*http://94.154.43.42/bin/services.apk*' - '*http://94.154.43.42/hiddenbin/sora.x86_64*' - '*http://94.154.43.42/bin/zxcrAretard.x86*' - '*http://94.154.43.42/hiddenbin/services.apk*' - '*http://94.154.43.42/hiddenbin/zxcrAretard.x86_64*' - '*http://94.154.43.42/hiddenbin/kokyru.x86_64*' - '*http://94.154.43.42/bin/juanRetard.x86*' - '*http://94.154.43.42/bins/juanRetard.x86_64*' - '*http://94.154.43.42/hiddenbin/juanRetard.x86_64*' - '*http://94.154.43.42/bins/kokyru.x86*' - '*http://94.154.43.42/bin/kokyru.x86*' - '*http://94.154.43.42/hiddenbin/kokyru.x86*' - '*http://94.154.43.42/bin/kokyru.x86_64*' - '*http://94.154.43.42/bin/juanRetard.x86_64*' - '*http://94.154.43.42/bins/juanRetard.x86*' - '*http://94.154.43.42/bins/kokyru.x86_64*' - '*http://94.154.43.42/hiddenbin/juanRetard.x86*' - '*http://110.37.39.234:40735/i*' - '*http://115.203.19.155:49446/i*' - '*http://110.85.109.44:41787/i*' - '*http://110.85.109.44:41787/bin.sh*' - '*http://203.177.251.31:46755/bin.sh*' - '*http://60.176.4.229:58811/i*' - '*http://60.176.4.229:58811/bin.sh*' - '*http://109.236.44.113:54968/i*' - '*http://110.37.65.212:34828/i*' - '*http://110.37.65.212:34828/bin.sh*' - '*http://182.126.194.87:46521/i*' - '*http://182.126.194.87:46521/bin.sh*' - '*http://91.92.40.118/init.sh*' - '*http://46.217.141.171:6457/.i*' - '*http://110.37.118.66:51233/i*' - '*http://110.37.118.66:51233/bin.sh*' - '*http://110.37.39.32:39109/i*' - '*http://91.92.40.118/wget.sh*' - '*http://36.77.231.47:44683/i*' - '*http://36.77.231.47:44683/bin.sh*' - '*http://183.214.149.164:48126/i*' - '*http://45.90.163.37/GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh*' - '*http://125.161.140.79:43591/i*' - '*http://125.161.140.79:43591/bin.sh*' - '*http://94.154.43.230/nz/nz.x86*' - '*http://94.154.43.230/nz/nz.x86_64*' - '*http://222.220.238.211:40579/i*' - '*http://171.213.144.239:51077/i*' - '*http://180.116.55.223:47238/i*' - '*http://196.190.10.252:44170/i*' - '*http://82.144.86.37:40653/i*' - '*http://82.144.86.37:40653/bin.sh*' - '*http://125.120.88.71:57971/bin.sh*' - '*http://110.37.80.218:49898/i*' - '*http://196.189.98.77:60631/i*' - '*http://111.127.234.134:58633/i*' - '*http://152.70.4.175:5555/bot_arm6*' - '*http://105.224.71.15:43381/i*' - '*http://105.186.68.15:57107/i*' - '*http://105.186.68.15:57107/bin.sh*' - '*http://196.190.1.39:39487/i*' - '*http://196.190.1.39:39487/bin.sh*' - '*http://123.9.95.33:45775/i*' - '*http://113.9.187.252:58571/i*' - '*http://105.224.71.15:43381/bin.sh*' - '*http://119.163.181.201:40921/bin.sh*' - '*http://119.163.181.201:40921/i*' - '*http://110.37.109.18:34868/bin.sh*' - '*http://115.49.93.222:36105/i*' - '*http://190.109.228.122:55441/bin.sh*' - '*http://112.251.248.241:39251/i*' - '*http://112.251.248.241:39251/bin.sh*' - '*http://45.186.37.201:43806/i*' - '*http://119.119.168.238:48407/bin.sh*' - '*http://223.167.60.30:40918/bin.sh*' - '*http://42.224.254.133:54137/i*' - '*http://zov.ismak.icu/nova.sh*' - '*http://120.82.202.248:45647/i*' - '*http://95.56.232.109:35220/i*' - '*http://95.56.232.109:35220/bin.sh*' - '*http://213.66.68.29:49834/bin.sh*' - '*http://113.9.11.71:60099/bin.sh*' - '*http://182.117.173.30:51129/i*' - '*http://182.117.173.30:51129/bin.sh*' - '*http://200.115.102.2:40618/i*' - '*http://220.184.94.118:57971/i*' - '*http://220.184.94.118:57971/bin.sh*' - '*http://85.121.177.73:8080/arm7*' - '*http://85.121.177.73:8080/arm5*' - '*http://105.184.147.227:38141/i*' - '*http://110.186.230.73:49929/i*' - '*http://105.184.30.75:49789/bin.sh*' - '*http://36.72.49.89:51095/i*' - '*http://141.11.88.129/w.sh*' - '*http://141.11.88.129/c.sh*' - '*http://110.186.230.73:49929/bin.sh*' - '*http://105.184.30.75:49789/i*' - '*http://141.11.88.103/bin.armv4eb*' - '*http://141.11.88.103/bin.armv5l*' - '*http://141.11.88.103/bin.armv4l*' - '*http://141.11.88.103/bin.i486*' - '*http://141.11.88.103/bin.armv4tl*' - '*http://27.206.183.209:45419/i*' - '*http://123.148.191.5:43457/i*' - '*http://5.175.217.137/ohshit.sh*' - '*http://141.11.88.128/wget.sh*' - '*http://141.11.88.128/w.sh*' - '*http://141.11.88.128/c.sh*' - '*http://217.60.195.160/f*' - '*http://221.15.189.7:49763/i*' - '*http://221.15.189.7:49763/bin.sh*' - '*http://138.252.69.11:51869/i*' - '*http://138.252.69.11:51869/bin.sh*' - '*http://85.204.125.67:8080/m-i.p-s.SativaC2*' condition: selection level: high tags: - attack.t1583 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 63202b95-a0d7-5dae-94f6-6ce4853dc84c status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://172.245.12.92:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest*' - '*http://198.37.105.19:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest*' - '*https://94.154.32.173/Bin/ScreenConnect.ClientSetup.exe*' - '*https://94.154.32.173/bin/support.client.exe*' - '*https://2.58.56.111/Bin/ScreenConnect.ClientSetup.exe*' - '*https://2.58.56.111/bin/support.client.exe*' - '*https://203.159.90.46/Bin/ScreenConnect.ClientSetup.exe*' - '*https://203.159.90.46/bin/support.client.exe*' - '*https://45.154.98.140/bin/support.client.exe*' - '*https://45.154.98.140/Bin/ScreenConnect.ClientSetup.exe*' - '*https://104.249.10.66/malw5500.msi*' - '*https://193.26.115.6/Bin/ScreenConnect.ClientSetup.exe*' - '*https://193.26.115.6/bin/support.client.exe*' - '*http://203.159.90.61/Bin/ScreenConnect.ClientSetup.exe*' - '*http://203.159.90.61/bin/support.client.exe*' - '*http://2.58.56.147/Bin/ScreenConnect.ClientSetup.exe*' - '*http://2.58.56.147/bin/support.client.exe*' - '*http://45.83.28.52/Bin/ScreenConnect.ClientSetup.exe*' - '*http://45.83.28.52/bin/support.client.exe*' - '*https://85.120.81.76/Bin/ScreenConnect.ClientSetup.exe*' - '*https://91.92.34.123/Bin/ScreenConnect.ClientSetup.exe*' - '*https://91.92.34.123/bin/support.client.exe*' - '*https://198.211.109.187/Bin/ScreenConnect.ClientSetup.exe*' - '*https://198.211.109.187/bin/support.client.exe*' - '*https://217.60.241.27/Bin/ScreenConnect.ClientSetup.exe*' - '*https://217.60.241.9/Bin/ScreenConnect.ClientSetup.exe*' - '*https://217.60.241.27/bin/support.client.exe*' - '*https://217.60.241.9/bin/support.client.exe*' - '*https://158.94.209.221/Bin/ScreenConnect.ClientSetup.exe*' - '*https://158.94.209.221/bin/support.client.exe*' - '*https://185.241.208.218/bin/support.client.exe*' - '*https://158.94.211.110/bin/support.client.exe*' - '*https://158.94.211.110/Bin/ScreenConnect.ClientSetup.exe*' - '*http://91.92.240.17/bin/support.client.exe*' - '*https://91.92.243.254/Bin/ScreenConnect.ClientSetup.exe*' - '*https://124.198.131.99/Bin/ScreenConnect.ClientSetup.exe*' - '*https://124.198.132.189/Bin/ScreenConnect.ClientSetup.exe*' - '*https://124.198.131.217/Bin/ScreenConnect.ClientSetup.exe*' - '*https://178.16.55.95/Bin/ScreenConnect.ClientSetup.exe*' - '*http://91.92.240.17/Bin/ScreenConnect.ClientSetup.exe*' - '*https://178.16.52.160/Bin/ScreenConnect.ClientSetup.exe*' - '*https://185.241.208.218/Bin/ScreenConnect.ClientSetup.exe*' - '*https://124.198.132.189/bin/support.client.exe*' - '*https://124.198.131.99/bin/support.client.exe*' - '*https://185.241.208.33/Bin/ScreenConnect.ClientSetup.exe*' - '*https://178.16.55.95/bin/support.client.exe*' - '*https://84.54.33.167/bin/support.client.exe*' - '*https://84.54.33.167/Bin/ScreenConnect.ClientSetup.exe*' - '*http://84.54.33.128/bin/support.client.exe*' - '*http://84.54.33.128/Bin/ScreenConnect.ClientSetup.exe*' - '*https://ijexgroup.com.br//wp-admin/images/ScreenConnect.ClientSetup.msi*' - '*https://raw.githubusercontent.com/sean100496/bnb/refs/heads/main/ScreenConnect.ClientSetup.exe*' - '*https://aidlifempowerment.com/r/irstranscripviewer/ScreenConnect.ClientSetup.msi*' - '*https://gooseberry.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi*' - '*https://store5.gofile.io/download/direct/38c5a60f-2017-4ede-ae11-cbb79b2022a9/ScreenConnect.ClientSetup.msi*' - '*https://panel.munchyyyyyscpann.live/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest*' - '*http://167.99.234.133/ScreenConnect.ClientSetup.exe*' - '*https://rtsinternationals.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest*' - '*https://pub-4b56b0bd24274a89bb1d367d0cec866f.r2.dev/ScreenConnect.ClientSetup.msi*' - '*https://185.69.123.172/Bin/ScreenConnect.ClientSetup.exe*' - '*https://185.69.123.172/bin/support.client.exe*' - '*https://77.91.123.220/bin/support.client.exe*' - '*https://77.91.123.220/Bin/ScreenConnect.ClientSetup.exe*' - '*https://104.131.86.222/Bin/ScreenConnect.ClientSetup.exe*' - '*https://104.131.86.222/bin/support.client.exe*' - '*https://137.184.133.198/Bin/ScreenConnect.ClientSetup.exe*' - '*https://137.184.133.198/bin/support.client.exe*' - '*http://137.184.35.2/Bin/ScreenConnect.ClientSetup.exe*' - '*http://137.184.35.2/bin/support.client.exe*' - '*https://nexrogcapital.xyz/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest*' - '*https://80.96.58.112/Bin/ScreenConnect.ClientSetup.exe*' - '*http://192.159.99.171/Bin/ScreenConnect.ClientSetup.exe*' - '*http://192.159.99.171/bin/support.client.exe*' - '*https://roland.uscourt.online/Bin/ScreenConnect.ClientSetup.exe*' - '*https://roland.uscourt.online/bin/support.client.exe*' - '*https://193.26.115.211/Bin/ScreenConnect.ClientSetup.exe*' - '*https://193.26.115.211/bin/support.client.exe*' - '*https://194.26.192.70/bin/support.client.exe*' - '*https://178.16.54.12/bin/support.client.exe*' - '*https://178.16.54.12/Bin/ScreenConnect.ClientSetup.exe*' - '*https://anglingforimages.com/puggh/doc/ScreenConnect.ClientSetup.msi*' - '*https://join-google-meet.com/download.php*' - '*http://130.12.181.111/Bin/ScreenConnect.ClientSetup.exe*' - '*https://crestmarkhq.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest*' - '*https://rentadefrio.com/src/ScreenConnect.ClientSetup.exe*' - '*https://178.16.54.212/Bin/ScreenConnect.ClientSetup.exe*' - '*https://178.16.54.212/bin/support.client.exe*' - '*https://njointmeetinponts.highfivedecore.com/hjs/jojo.tmp*' - '*https://github.com/officedesknote-star/bodakuwa/raw/refs/heads/main/ScreenConnect.ClientSetup%20(18)%20(1).msi*' - '*https://github.com/officedesknote-star/bzeet/raw/refs/heads/main/ScreenConnect.ClientSetup%20(25).msi*' - '*https://github.com/officedesknote-star/DESKFRO/raw/refs/heads/main/ScreenConnect.ClientSetup%20(17)%20(1).msi*' - '*https://github.com/officedesknote-star/bzeett/raw/refs/heads/main/ScreenConnect.ClientSetup%20(20)%20(1).msi*' - '*https://github.com/officedesknote-star/sww/raw/refs/heads/main/ScreenConnect.ClientSetup%20(19)%20(2).msi*' - '*https://193.142.146.203/bin/support.client.exe*' - '*https://193.142.146.203/Bin/ScreenConnect.ClientSetup.exe*' - '*https://f005.backblazeb2.com/file/latestzoombucket/Zoom.msi*' condition: selection level: high tags: - attack.t1219 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 93d3c255-4375-5c38-b856-d0eb0a80972a status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://158.94.211.214/installer.exe*' - '*http://94.26.90.90/client.exe*' - '*http://91.199.133.59/client.exe*' - '*http://91.92.43.200/client.exe*' - '*https://aethersyncmatrix5.lol/noncrypt/21-32/crazy.exe*' - '*https://aethersyncmatrix5.lol/noncrypt/obsh/acr.exe*' - '*https://aethersyncmatrix5.lol/noncrypt/21-32/acr.exe*' - '*https://aethersyncmatrix5.lol/noncrypt/21-32/R2.exe*' - '*https://aethersyncmatrix5.lol/noncrypt/21-32/R5.exe*' - '*https://aethersyncmatrix5.lol/noncrypt/21-32/beb.exe*' - '*https://aethersyncmatrix5.lol/noncrypt/21-32/mixnew.exe*' - '*https://aethersyncmatrix5.lol/crypt/obsh/crazy.exe*' - '*https://aethersyncmatrix5.lol/crypt/21-32/ojujn.exe*' - '*https://aethersyncmatrix5.lol/crypt/21-32/bjbh.exe*' - '*http://209.99.188.158:8888/n.exe*' - '*https://158.94.209.17/lc/1.exe*' - '*https://158.94.209.17/lc/3.exe*' - '*https://158.94.209.17/lc/2.exe*' - '*http://178.128.151.248/update.exe*' - '*https://185.69.121.139/bin/support.client.exe*' - '*https://185.69.121.139/Bin/ScreenConnect.ClientSetup.exe*' - '*http://94.154.35.240/svc.exe*' - '*https://178.16.52.160/bin/support.client.exe*' - '*https://124.198.131.217/bin/support.client.exe*' - '*https://185.241.208.33/bin/support.client.exe*' - '*http://45.141.215.47/svchost.exe*' - '*https://customcreationsmaine.com/db22/bin.exe*' - '*https://customcreationsmaine.com/fed/remcosraw.exe*' - '*http://158.94.211.92/s_enterprise*' - '*https://konterlink.hippamsas.com/assets/js/extensions/Komodo.exe*' - '*https://allendaltonproduction.com/quas/Client-built.exe*' - '*https://tue-orange-01.cfd/JblSound.exe*' - '*http://85.120.255.252:8000/csharp.exe*' - '*https://kgbhost.digital/kingboss/uploads/bin.exe*' - '*http://45.74.3.37:5001/bot.exe*' - '*https://qvxzaetnb.vip/*' - '*https://woorimart.vip/*' - '*http://152.42.130.4/s.exe*' - '*http://167.99.234.133/svc.exe*' - '*http://167.99.234.133/main.exe*' - '*http://167.172.253.41/test.exe*' - '*https://jb.mywwjj.xyz/C/2/elevate.exe*' - '*https://jb.mywwjj.xyz/A/2/_extracted/dcremagentinstaller.exe*' - '*https://jb.mywwjj.xyz/A/2/_extracted/elevate_from_server.exe*' - '*https://jb.mywwjj.xyz/D/2/elevate.exe*' - '*https://jb.mywwjj.xyz/A/test.exe*' - '*https://jb.mywwjj.xyz/A/34534.exe*' - '*https://31.76.252.47/cdn/v1/assets*' - '*https://firebasestorage.googleapis.com/v0/b/june-july-dd5c8/o/Cytophil.exe?alt=media&token=cb9fe647-a483-4d59-93e6-c044948eb453*' - '*http://94.26.90.210/acc-1421/data_cache.exe*' - '*https://lodging-dictionaries-jill-ministry.trycloudflare.com/Dokumente/Rechnung_2026_07_46220671079901.pdf.lnk*' - '*http://164.90.210.228/app.exe*' - '*http://159.223.98.10/svchost.exe*' - '*http://159.223.98.10/Launcher.exe*' - '*https://185.69.122.37/Bin/ScreenConnect.ClientSetup.exe*' - '*https://185.69.122.37/bin/support.client.exe*' - '*https://www.mediafire.com/file_premium/i4dwrxh5hvqe54w/client.exe/file*' - '*http://64.89.161.16/1/products.exe*' - '*http://185.132.53.171:8888/railcomsvc.exe*' - '*http://185.132.53.171:8888/SEMANTIC_ASTROLOGY.exe*' - '*http://185.132.53.171:8888/session.exe*' - '*https://thepullmanfolkestone.com/ppisondeers.exe*' - '*https://marjdl.pro/f45ccce7.exe*' - '*https://marjdl.pro/a9170b87.exe*' - '*https://marjdl.pro/d9792a72.exe*' - '*https://marjdl.pro/38a18a19.exe*' - '*https://marjdl.pro/27908639.exe*' - '*http://107.172.247.123/227/vmc.exe*' - '*http://107.173.227.77/240/bcc.exe*' - '*https://microsoftupdater.info/dl/79649bc7-c772-48ea-830f-9bdccb5b951c/client.exe*' - '*https://kaleda.pro/69733be4.exe*' - '*https://gogolfonline.com/zira-miszsn.exe*' - '*http://62.60.226.198/uploads/69fae640e8174bdfa0056b685ae7e460.exe*' - '*https://kaleda.pro/d7b5970c.exe*' - '*http://185.199.197.10/load/kythy.exe*' - '*http://91.208.197.30/client.exe*' - '*https://80.97.124.66/Bin/ScreenConnect.ClientSetup.exe*' - '*http://85.120.252.216/Bin/ScreenConnect.ClientSetup.exe*' - '*http://62.60.226.198/uploads/0c086e9dec2646afaae25a4d6d279141.exe*' - '*http://185.103.166.138/download*' - '*https://microlsireqjn.com/nvd_driver_dll.exe*' - '*http://45.83.28.19/a.exe*' - '*https://getsolara.live/Launcher.exe*' - '*https://partytimedjsohio.com/fed/rawfile.exe*' - '*https://donutcash.lol/Prestige-Client.exe*' - '*https://intelligence-bloomberg-tonsol.cfd/analytics/*' - '*http://107.174.146.3/Bryllupsmarchens.ex*' - '*http://132.243.212.233/load/kythy.exe*' - '*http://202.95.13.184/2.exe*' - '*http://46.151.182.239/update.exe*' - '*http://103.149.90.4/123.exe*' - '*http://192.252.181.68/setup.exe*' - '*http://154.222.29.103/1.exe*' condition: selection level: high tags: - attack.t1204.002 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: f7dcb19a-6fd4-5ac4-beb3-41b954bb4563 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://95.155.151.113/sensi.sh*' - '*http://91.199.133.133:8080/vivotek.py*' - '*http://91.199.133.133:8080/payload.sql*' - '*http://192.255.195.150/img/1.jpg*' - '*http://31.56.209.153/wget.sh*' - '*http://31.56.209.153/w.sh*' - '*http://31.56.209.153/nz/o.xml*' - '*http://31.56.209.70/nz/o.xml*' - '*http://41.216.189.236/bins/o.xml*' - '*https://5.253.59.16/k/bplplatatenera.dat*' - '*http://94.154.43.37/bins/ipmiv2.xml*' - '*https://orienttaxtile.com/monday/secured_stub.ps1*' - '*https://jb.mywwjj.xyz/A/2/C_1.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_24.1.vbs*' - '*https://jb.mywwjj.xyz/A/2/B_6.vbs*' - '*https://jb.mywwjj.xyz/A/2/f3a1.vbs*' - '*https://jb.mywwjj.xyz/A/2/C_1_verify.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_29.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_29.2.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_29.1.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_24.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_24.2.vbs*' - '*https://jb.mywwjj.xyz/C/2/c2b8.zip*' - '*https://jb.mywwjj.xyz/A/2/A2_19.rar*' - '*https://jb.mywwjj.xyz/A/2/B_10.rar*' - '*https://jb.mywwjj.xyz/A/2/A2_15.rar*' - '*https://jb.mywwjj.xyz/A/2/A2_15_obf.rar*' - '*https://jb.mywwjj.xyz/A/2/A_11.rar*' - '*https://jb.mywwjj.xyz/A/2/B_7.rar*' - '*https://jb.mywwjj.xyz/A/2/B_8.rar*' - '*https://jb.mywwjj.xyz/A/2/A2.18.rar*' - '*https://jb.mywwjj.xyz/A/2/A2_11.rar*' - '*https://jb.mywwjj.xyz/C/2/C_6.25.rar*' - '*https://jb.mywwjj.xyz/A/2/A2_17.rar*' - '*https://jb.mywwjj.xyz/A/2/A2.6.24.rar*' - '*https://jb.mywwjj.xyz/A/2/A2_17.1.rar*' - '*https://jb.mywwjj.xyz/A/2/B_6.rar*' - '*https://jb.mywwjj.xyz/A/2/B_9.rar*' - '*https://jb.mywwjj.xyz/A/2/A2_11.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_18.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_0.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_18.1.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_17.2.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_15_obf.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_15.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_16.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_19.vbs*' - '*https://jb.mywwjj.xyz/A/2/A2_19.2.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_28.1.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_27.3.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_24.1.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_28.2.vbs*' - '*https://jb.mywwjj.xyz/C/2/A2_erte_obf.vbs*' - '*https://jb.mywwjj.xyz/C/2/A2_15.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_24.3.vbs*' - '*https://jb.mywwjj.xyz/C/2/A2_0.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_27.6.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_27.5.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_28.3.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_27.4.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_25.3.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_28.4.vbs*' - '*https://jb.mywwjj.xyz/C/2/f3a1.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_27.2.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_25.1.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_25.2.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_28.5.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_27.1.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_24.2.vbs*' - '*https://jb.mywwjj.xyz/C/2/C2_27.7.vbs*' - '*https://jb.mywwjj.xyz/C/2/C_1.vbs*' - '*https://jb.mywwjj.xyz/A/2/A_11/B_11.vbs*' - '*https://jb.mywwjj.xyz/A/2/_extracted/setup1.vbs*' - '*https://jb.mywwjj.xyz/D/2/C2.6.24.rar*' - '*https://jb.mywwjj.xyz/D/2/A2_15.vbs*' - '*https://jb.mywwjj.xyz/D/2/A2_0.vbs*' - '*https://jb.mywwjj.xyz/D/2/A2_erte_obf.vbs*' - '*https://jb.mywwjj.xyz/D/2/C2_24.3.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2.28.rar*' - '*https://jb.mywwjj.xyz/D/2/f3a1.vbs*' - '*https://jb.mywwjj.xyz/D/2/C2_24.1.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2_29_5.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2_28_1.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2_29_3.vbs*' - '*https://jb.mywwjj.xyz/D/2/C2_24.2.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2_29_4.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2_28_2.vbs*' - '*https://jb.mywwjj.xyz/D/2/C_1.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2_29_2.vbs*' - '*https://jb.mywwjj.xyz/D/2/D2_29_1.vbs*' - '*https://jb.mywwjj.xyz/A/1/c2b8_test.zip*' - '*https://jb.mywwjj.xyz/A/1/c2b8.zip*' - '*https://jb.mywwjj.xyz/A/EC_puller.vbs*' - '*https://jb.mywwjj.xyz/A/1/A-1.vbs*' - '*https://jb.mywwjj.xyz/A/white_notepad_rcdata.vbs*' - '*https://jb.mywwjj.xyz/D/1/c2b8.zip*' - '*https://jb.mywwjj.xyz/D/1/d-1.vbs*' - '*https://jb.mywwjj.xyz/D/setup1.vbs*' - '*https://jb.mywwjj.xyz/E/c2b8.zip*' - '*https://jb.mywwjj.xyz/E/1/test_com.vbs*' - '*https://jb.mywwjj.xyz/E/1/E.1.vbs*' - '*https://jb.mywwjj.xyz/F/1/c2b8.zip*' - '*https://jb.mywwjj.xyz/F/c2b8.zip*' - '*https://jb.mywwjj.xyz/F/F.1.vbs*' - '*https://jb.mywwjj.xyz/E/setup1.vbs*' - '*https://jb.mywwjj.xyz/E/EC_puller.vbs*' - '*https://jb.mywwjj.xyz/G/G.rar*' - '*https://jb.mywwjj.xyz/H/1/c2b8.zip*' - '*https://jb.mywwjj.xyz/H/c2b8.zip*' - '*https://jb.mywwjj.xyz/H/H1.vbs*' - '*https://jb.mywwjj.xyz/G/G-1.vbs*' - '*https://jb.mywwjj.xyz/C/1/C-1.vbs*' - '*https://jb.mywwjj.xyz/C/1/c2b8.zip*' - '*https://jb.mywwjj.xyz/C/1/dfjieyisa.vbs*' - '*https://jb.mywwjj.xyz/C/1/fix_1625.vbs*' - '*https://jb.mywwjj.xyz/sys/A/1/c2b8.zip*' - '*http://skript.club/loader.sh*' - '*http://pvphood.cc/loader.sh*' - '*http://lcd88.cfd/loader.sh*' - '*http://ths.lat/loader.sh*' - '*http://41.216.189.236/nz/wget.sh*' - '*http://41.216.189.236/w.sh*' - '*http://41.216.189.236/nz/w.sh*' - '*http://41.216.189.236/wget.sh*' - '*http://ecl80.cfd:8080/loader.sh*' - '*http://41.216.189.236/o.xml*' - '*http://41.216.189.236/nz/o.xml*' - '*http://109.122.18.73/2026/pure.exe*' - '*http://109.122.18.73/2026/oke.js*' - '*http://109.122.18.73/2026/wz.exe*' - '*http://109.122.18.73/2026/wpa.vbs*' - '*https://redhiban.cfd/css/css/enter/stego_payload.png*' - '*http://104.168.70.168/img/img_102209.png*' - '*http://203.202.232.187/img/img_052226.png*' - '*http://107.175.202.168/shell/secured_stub.ps1*' - '*http://204.44.69.210/40/img_044544.png*' - '*http://198.23.144.23/130/goodthingsarecomingformylifenotyoursitscomig.vbe*' - '*http://144.172.109.153/60/amazingthingsarenextlevelthingsaregoingtobe.vbe*' - '*http://107.173.227.99/225/img_171115.png*' - '*http://107.175.202.168/44/givenbestnetworkingskillforbetterofrme.vbe*' - '*http://198.23.144.23/shell/secured_stub.ps1*' - '*http://198.23.144.23/129/goodthingsforgreatnessgoodfor.vbe*' - '*http://94.154.43.116/run.sh*' - '*http://64.89.163.215/bins/curl.sh*' - '*http://64.89.163.215/bins/busycurl.sh*' - '*http://41.216.189.92/w.sh*' - '*http://41.216.189.92/nz/w.sh*' - '*http://41.216.189.92/nz/wget.sh*' - '*http://41.216.189.92/wget.sh*' - '*http://41.216.189.92/nz/o.xml*' - '*http://41.216.189.92/o.xml*' - '*http://141.11.88.120/run.sh*' - '*http://160.119.69.4/z/wr.php*' - '*http://45.95.147.178/z/wr.php*' - '*http://41.216.189.157/nz/v.xml*' - '*http://41.216.189.157/v.xml*' - '*https://dragonsurcing.com/BUYING%20ORDER/stub.ps1*' - '*https://dragonsurcing.com/BUYING%20ORDER/BO_x_07-07-26.rar*' - '*http://41.216.189.157/atomic/o.xml*' - '*http://93.115.101.140:13677/c*' - '*http://93.115.101.140:13677/w*' - '*http://93.115.101.140:13677/narz*' - '*http://94.154.43.192/b.xml*' - '*http://94.154.43.192/nz/b.xml*' - '*http://94.154.43.192/nz/c.sh*' - '*http://94.154.43.192/c.sh*' - '*http://94.154.43.192/nz/w.sh*' - '*http://94.154.43.192/w.sh*' - '*http://94.154.43.192/wget.sh*' - '*http://94.154.43.192/nz/wget.sh*' - '*http://94.154.43.192/nz/o.xml*' - '*http://94.154.43.192/o.xml*' - '*http://41.216.189.157/c.sh*' - '*http://41.216.189.157/nz/c.sh*' - '*http://41.216.189.157/w.sh*' - '*http://41.216.189.157/nz/wget.sh*' - '*http://41.216.189.157/nz/w.sh*' - '*http://41.216.189.157/wget.sh*' - '*http://93.115.101.146:13734/w*' - '*http://93.115.101.146:13734/c*' - '*http://93.115.101.146:13734/narz*' condition: selection level: high tags: - attack.t1596 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 199948e4-3b99-55c5-9e01-84af19f235e8 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev/b/bd570760274eb2b44d484b0a6ec56d82*' - '*https://bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev/d/inner/691cbe2e-d6bb-484d-8259-5c101c3909c0*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2016.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2011.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2023.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2010.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2020.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2025.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2015.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2018.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2021.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2024.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2019.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2012.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%209.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2013.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2022.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2014.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%2017.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%203.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%208.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%205.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%207.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%204.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%202.vbs*' - '*https://jim-s.com/ab/Zoom_meeting/Meeting%20Invite%20HTML/downloads/windows/aboki/Zoom%206.vbs*' condition: selection level: high tags: - attack.t1059.005 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 7f7fdf26-91a1-560d-a0d0-d3ca4f241833 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://cnc.strikec2.wtf/update.sh*' - '*http://159.223.110.159:50821/all.sh*' - '*http://91.199.133.133:8080/deploy.sh*' - '*http://91.92.40.5/bins.sh*' - '*http://94.154.43.123/ldr.sh*' - '*http://151.247.22.48:8080/bins/payload.sh*' - '*http://94.154.43.51/payload.sh*' - '*http://156.226.174.98/bins.sh*' - '*http://94.154.43.192/fmkyq9.sh*' - '*http://154.217.249.247:9004/bot.sh*' - '*http://208.85.17.8/api/payload.sh*' - '*http://sanfranciscoinsulation.com/curl/720e1e04c2690ac14874d54823354d6bd06336b23e8458debaffeb2b18f5be6a*' - '*http://85.204.125.67:8080/payload.sh*' condition: selection level: high tags: - attack.t1059 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: d82517a8-5895-54b2-a86e-9fc38e70885b status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://orienttaxtile.com/tues/crypted.ps1*' - '*https://malaysianpastrybakery.org/teamm.ps1*' - '*http://auth-clo-id.cc/bc66ca0f4630d09d?_=1*' - '*https://auth-clo-id.cc/bc66ca0f4630d09d*' - '*https://babydiapersinturkey.com/l.dat*' - '*http://209.99.188.158:8888/a.ps1*' - '*http://158.94.211.92/enterprise/student_s.bin*' - '*http://158.94.211.92/std/?sid=1784977968557-5ah4z503*' - '*http://185.95.156.75/wiss1g4/footATM.ps1*' - '*http://89.106.83.40/MayData/coursehope.ps1*' - '*https://lucciodontologiaintegrada.com.br/16/zong.ps1*' - '*https://pdlaw.com.ph/wp-admin/maint/seccured_stub.ps1*' - '*https://xevzora.cfd/offc/secured_stub.ps1*' - '*https://xevzora.cfd/graced/secured_stub.ps1*' - '*https://xevzora.cfd/blessed/secured_stub.ps1*' - '*https://xevzora.cfd/asyn/secured_stub.ps1*' - '*https://lucciodontologiaintegrada.com.br/15/dbs.ps1*' - '*http://161.35.41.209/mmsndm899938/secured_stub.ps1*' - '*https://cdn.defenders.workers.dev/p/1*' - '*http://2.59.133.148/dab.ps1*' - '*http://193.41.226.161/dab.ps1*' - '*https://echkdia.com/wp-includes/html-api/blfoaqs/wqyax1k/smnzybp/bnm/secured_stub.ps1*' - '*https://xevzora.cfd/2day/secured_stub.ps1*' - '*http://144.172.109.153/1234/secured_stub.ps1*' - '*https://tdhviatnam.com/secured_stub.ps1*' - '*http://85.239.149.167/nLZQ1kMfpqUTJofiP*' - '*https://genesis-softs.com/powershell/Genesis.ps1*' - '*https://ticladevin.ro/robott.ps1*' - '*https://pdlaw.com.ph/wp-admin/BALL/stub2.ps1*' - '*https://qv.co.ke/pass.ps1*' - '*https://sticladevin.ro/pop/grace.ps1*' - '*https://pdlaw.com.ph/wp-admin/BAND/stub.ps1*' - '*https://pdlaw.com.ph/wp-admin/LOVE/stub.ps1*' - '*http://authorization-code.info/89dd882b7944d6d2*' condition: selection level: high tags: - attack.t1059.001 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 2e0c5f11-4d98-5166-9db3-a4978204d40d status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://nfeletronica.sevendocumentos.vip/fjp/zvjspngr.bat*' - '*https://pstbn.dev/01KYJ2ZEKMT0TFTABKG9FNRT8W*' - '*https://pstbn.dev/01KYJ3FWRGV7GTXPH4VQ7071TJ*' - '*https://pstbn.dev/01KYHNYXVDRE60BM6QDQ95GJRV*' - '*https://pstbn.dev/01KYHB8K9RVQQWAJXVNRTQTJPB*' - '*https://pstbn.dev/01KYCR02EJ7DTA93SWY6H8PAAW*' - '*https://pstbn.dev/01KYHHJYFHH685H8TXNXRQG20A*' - '*https://pstbn.dev/01KYHVWWTV8Z93Y6G3A7QWKQ1S*' - '*https://pstbn.dev/01KYHN9KV0VHPQG19FK26F7WF1*' - '*https://pstbn.dev/01KYCN26DZSM0SAQ83JKV6V9BS*' - '*https://pstbn.dev/01KYHGVGCYVWKD5GG3S7G9WRSS*' - '*https://pstbn.dev/01KYFEYVHFF8BW6RQGKMR0SZPF*' - '*https://pstbn.dev/01KYEY32STBHHRJEHQFQNN4MQS*' - '*http://blabhunk-copy.xyz/avast_update*' - '*http://seendone-clef.xyz/avast_update*' - '*http://willbile-gyms.xyz/avast_update*' - '*http://richoverfold.xyz/avast_update*' - '*http://dovepact-gist.xyz/avast_update*' - '*http://getrichcurl.xyz/avast_update*' - '*http://weak-obeylore.xyz/avast_update*' - '*http://pollsort-tick.xyz/avast_update*' - '*http://ternlaiddram.xyz/avast_update*' - '*http://babyglee-all.xyz/avast_update*' - '*http://give-pore-upon.xyz/avast_update*' - '*http://root-slot-quit.xyz/avast_update*' - '*http://her-vein-pool.xyz/avast_update*' - '*http://duel-gulp-luck.xyz/avast_update*' - '*http://markherdbark.xyz/avast_update*' - '*http://bold-blab-cold.xyz/avast_update*' - '*http://nice-aunt-milk.xyz/avast_update*' - '*http://nearzero-drug.xyz/avast_update*' - '*http://oryx-foryell.xyz/avast_update*' - '*http://drug-arereef.xyz/avast_update*' - '*http://dumb-heel-boy.xyz/avast_update*' - '*http://this-maimreef.xyz/avast_update*' - '*http://shaggulf-sold.xyz/avast_update*' - '*http://wind-cragblur.xyz/avast_update*' - '*http://gain-daze-kept.xyz/avast_update*' - '*http://tang-sail-and.xyz/avast_update*' - '*http://rideloreomit.xyz/avast_update*' - '*http://kiltwent-our.xyz/avast_update*' - '*http://and-last-lock.xyz/avast_update*' - '*http://tire-moat-shin.xyz/avast_update*' - '*http://bandsway-arch.xyz/avast_update*' - '*http://skewsage-loft.xyz/avast_update*' - '*http://etchspinhas.xyz/avast_update*' - '*http://armsmead-bell.xyz/avast_update*' - '*http://bell-geneclan.xyz/avast_update*' - '*http://fourhomethen.xyz/avast_update*' - '*http://rosecodeknew.xyz/avast_update*' - '*http://part-tape-into.xyz/avast_update*' - '*http://obeyyellwool.xyz/avast_update*' - '*http://riftfacetill.xyz/avast_update*' - '*http://folk-gleeglee.xyz/avast_update*' - '*http://nine-edge-was.xyz/avast_update*' - '*http://burp-flung-pilot.xyz/avast_update*' - '*http://mothwellkeep.xyz/avast_update*' - '*http://your-duty-cube.xyz/avast_update*' - '*http://pestrear-lamp.xyz/avast_update*' - '*http://lickinchmail.xyz/avast_update*' - '*http://rank-idea-mass.xyz/avast_update*' - '*http://wisemateboth.xyz/avast_update*' - '*http://true-gategrin.xyz/avast_update*' - '*http://samecobmill.xyz/avast_update*' - '*http://anus-staylard.xyz/avast_update*' - '*http://goal-soil-see.xyz/avast_update*' - '*http://tern-beck-chop.xyz/avast_update*' - '*http://diet-graymost.xyz/avast_update*' - '*http://gravezerosold.xyz/avast_update*' - '*http://leafcash-even.xyz/avast_update*' - '*http://give-lawncalm.xyz/avast_update*' - '*http://deft-army-glad.xyz/avast_update*' - '*http://termgruffpost.xyz/avast_update*' - '*http://dice-grate-plan.xyz/avast_update*' - '*http://word-notcolt.xyz/avast_update*' - '*http://bandrice-pity.xyz/avast_update*' - '*http://hewsseen-tear.xyz/avast_update*' - '*http://hullmall-cool.xyz/avast_update*' - '*http://seemeet-vine.xyz/avast_update*' - '*http://torn-midgegrim.xyz/avast_update*' - '*http://page-vest-lost.xyz/avast_update*' - '*http://absshop-ping.xyz/avast_update*' - '*http://obeylandchap.xyz/avast_update*' - '*http://verb-fowl-old.xyz/avast_update*' - '*http://hackburppace.xyz/avast_update*' - '*http://pantfontmalt.xyz/avast_update*' - '*http://ends-pare-stow.xyz/avast_update*' - '*http://lathvetoiris.xyz/avast_update*' - '*http://haste-flop-smug.xyz/avast_update*' - '*http://glue-more-cork.xyz/avast_update*' - '*http://glow-died-fail.xyz/avast_update*' - '*http://vent-live-crab.xyz/avast_update*' - '*http://juststep-rent.xyz/avast_update*' - '*http://cropriftmore.xyz/avast_update*' - '*http://hoopramplawn.xyz/avast_update*' - '*http://torn-beatduct.xyz/avast_update*' - '*http://milkgang-yell.xyz/avast_update*' - '*http://palm-cartfind.xyz/avast_update*' - '*http://uglyshop-mare.xyz/avast_update*' - '*http://stop-lathtrap.xyz/avast_update*' - '*http://workmane-seem.xyz/avast_update*' - '*http://dusk-omit-epic.xyz/avast_update*' - '*http://mode-poll-grew.xyz/avast_update*' - '*http://brat-malllake.xyz/avast_update*' - '*http://let-dyed-crow.xyz/avast_update*' - '*http://formnote-from.xyz/avast_update*' - '*http://sole-cederole.xyz/avast_update*' - '*http://pogo-hunt-brisk.xyz/avast_update*' - '*http://male-martloss.xyz/avast_update*' - '*http://iconropeknob.xyz/avast_update*' - '*http://podlossrota.xyz/avast_update*' - '*http://slot-maul-card.xyz/avast_update*' - '*http://tendnone-heel.xyz/avast_update*' - '*http://brisk-with-easy.xyz/avast_update*' - '*http://bathgram-rare.xyz/avast_update*' - '*http://tame-damp-nail.xyz/avast_update*' - '*http://mate-limegive.xyz/avast_update*' - '*http://knotgymstwo.xyz/avast_update*' - '*http://lookbergseal.xyz/avast_update*' - '*http://freeknot-norm.xyz/avast_update*' - '*http://moan-prod-did.xyz/avast_update*' - '*http://nickodds-none.xyz/avast_update*' - '*http://beenfatenext.xyz/avast_update*' - '*http://down-loanleap.xyz/avast_update*' - '*http://jiltparkhint.xyz/avast_update*' - '*http://food-rulegrate.xyz/avast_update*' - '*http://grit-briskbath.xyz/avast_update*' - '*http://fund-fool-stub.xyz/avast_update*' - '*http://verbsireblew.xyz/avast_update*' - '*http://rollgropeamid.xyz/avast_update*' - '*http://biketype-not.xyz/avast_update*' - '*http://fishwallhand.xyz/avast_update*' - '*http://beensale-lion.xyz/avast_update*' - '*http://fold-hide-deft.xyz/avast_update*' - '*http://such-sitejoke.xyz/avast_update*' - '*http://zone-pour-too.xyz/avast_update*' - '*http://tile-mythwake.xyz/avast_update*' - '*http://wean-bredfact.xyz/avast_update*' - '*http://ropestem-math.xyz/avast_update*' - '*http://turniron-mound.xyz/avast_update*' - '*http://infocrabcob.xyz/avast_update*' - '*http://stopplay-rich.xyz/avast_update*' - '*http://over-clapmolt.xyz/avast_update*' - '*http://swaycladstop.xyz/avast_update*' - '*http://hatchfoe-flung.xyz/avast_update*' - '*http://seenlamegnat.xyz/avast_update*' - '*http://card-slip-pier.xyz/avast_update*' - '*http://dove-void-pave.xyz/avast_update*' - '*http://out-duct-till.xyz/avast_update*' - '*http://idea-nickdoor.xyz/avast_update*' - '*http://next-jazz-iron.xyz/avast_update*' - '*http://soonmuff-cob.xyz/avast_update*' - '*http://heal-jazz-shop.xyz/avast_update*' - '*http://wolfbill-rope.xyz/avast_update*' - '*http://sellnotlife.xyz/avast_update*' - '*http://mazeduskloud.xyz/avast_update*' - '*http://tuck-hoaxwade.xyz/avast_update*' - '*http://keptpilekeep.xyz/avast_update*' - '*http://slimsidehero.xyz/avast_update*' - '*http://open-teem-test.xyz/avast_update*' - '*http://sand-lure-noon.xyz/avast_update*' - '*http://swayoralnear.xyz/avast_update*' - '*http://holdpogohaul.xyz/avast_update*' - '*http://ugly-arcs-lyre.xyz/avast_update*' - '*http://gladloanwhat.xyz/avast_update*' - '*http://ends-fork-ores.xyz/avast_update*' - '*http://rugsrudeculm.xyz/avast_update*' - '*http://sill-flog-aunt.xyz/avast_update*' - '*http://slimnice-brow.xyz/avast_update*' - '*http://harmlick-mode.xyz/avast_update*' - '*http://earlnotgray.xyz/avast_update*' - '*http://luckfort-grim.xyz/avast_update*' - '*http://grid-brisk-lard.xyz/avast_update*' - '*http://tilt-wear-weak.xyz/avast_update*' - '*http://losspreyshot.xyz/avast_update*' - '*http://rant-heel-perk.xyz/avast_update*' - '*http://push-seeksash.xyz/avast_update*' - '*http://cozysigh-nick.xyz/avast_update*' - '*http://said-site-luck.xyz/avast_update*' - '*http://bind-mice-glow.xyz/avast_update*' - '*http://suitgive-jerk.xyz/avast_update*' - '*http://mere-tosspush.xyz/avast_update*' - '*http://hoop-chad-gust.xyz/avast_update*' - '*http://surf-life-sank.xyz/avast_update*' - '*http://lordcozytrap.xyz/avast_update*' - '*http://lull-islebrew.xyz/avast_update*' - '*http://lace-wise-crop.xyz/avast_update*' - '*http://nice-poolback.xyz/avast_update*' - '*http://slamlacetube.xyz/avast_update*' - '*http://glow-once-four.xyz/avast_update*' - '*http://manyhaste-seat.xyz/avast_update*' - '*http://sail-sham-step.xyz/avast_update*' - '*http://bred-mornidea.xyz/avast_update*' - '*http://examclaparmy.xyz/avast_update*' - '*http://move-dram-film.xyz/avast_update*' - '*http://dramdare-shop.xyz/avast_update*' - '*http://open-pact-fore.xyz/avast_update*' - '*http://pile-thinuse.xyz/avast_update*' - '*http://ugly-oursold.xyz/avast_update*' - '*http://earltoll-snap.xyz/avast_update*' - '*http://rout-draw-roll.xyz/avast_update*' - '*http://disk-bask-rusk.xyz/avast_update*' - '*http://part-doselawn.xyz/avast_update*' - '*http://pine-bathbear.xyz/avast_update*' - '*http://briskpair-rode.xyz/avast_update*' - '*http://smug-lend-gray.xyz/avast_update*' - '*http://gridgrimmorn.xyz/avast_update*' - '*http://char-avid-verb.xyz/avast_update*' - '*http://duck-fondmoan.xyz/avast_update*' - '*http://claylikepilot.xyz/avast_update*' - '*http://soilleafmain.xyz/avast_update*' - '*http://mottl-dirtnine.xyz/avast_update*' - '*http://peer-tend-urge.xyz/avast_update*' - '*http://king-culmdown.xyz/avast_update*' - '*http://plug-halo-flip.xyz/avast_update*' - '*http://prey-body-word.xyz/avast_update*' - '*http://flux-heldsham.xyz/avast_update*' - '*http://math-buoy-seen.xyz/avast_update*' - '*http://foe-flawmire.xyz/avast_update*' - '*http://alsofillsoar.xyz/avast_update*' - '*http://fordsoupward.xyz/avast_update*' - '*http://live-fled-slam.xyz/avast_update*' - '*http://harm-mint-veto.xyz/avast_update*' - '*http://past-reefprin.xyz/avast_update*' - '*http://coalfact-tear.xyz/avast_update*' - '*http://ores-font-form.xyz/avast_update*' - '*http://propgrab-bird.xyz/avast_update*' - '*http://last-hull-brig.xyz/avast_update*' - '*http://live-helpinfo.xyz/avast_update*' - '*http://loansome-rare.xyz/avast_update*' - '*http://groan-brim-peak.xyz/avast_update*' - '*http://songsunk-view.xyz/avast_update*' - '*http://jerkloss-flux.xyz/avast_update*' - '*http://festgrape-bog.xyz/avast_update*' - '*http://papa-graze-wart.xyz/avast_update*' - '*http://moandownsave.xyz/avast_update*' - '*http://same-theeaft.xyz/avast_update*' - '*http://ballweldleer.xyz/avast_update*' - '*http://poemtendriot.xyz/avast_update*' - '*http://like-hold-fray.xyz/avast_update*' - '*http://part-lame-door.xyz/avast_update*' - '*http://died-halo-tang.xyz/avast_update*' - '*http://gangteem-beam.xyz/avast_update*' - '*http://half-mufflurk.xyz/avast_update*' - '*http://shepalemess.xyz/avast_update*' - '*http://plan-druggrape.xyz/avast_update*' - '*http://stem-doseleft.xyz/avast_update*' - '*http://brig-skipdeep.xyz/avast_update*' - '*http://hire-just-deep.xyz/avast_update*' - '*http://rose-wallidea.xyz/avast_update*' - '*http://rope-goalalso.xyz/avast_update*' - '*http://jilt-elsebeam.xyz/avast_update*' - '*http://rule-bead-dust.xyz/avast_update*' - '*http://scan-coolhock.xyz/avast_update*' - '*http://stubclue-hold.xyz/avast_update*' - '*http://will-side-weed.xyz/avast_update*' - '*http://curename-gust.xyz/avast_update*' - '*http://podhelp-peat.xyz/avast_update*' - '*http://adodebtsole.xyz/avast_update*' - '*http://dealflung-four.xyz/avast_update*' - '*http://amid-darnsoul.xyz/avast_update*' - '*http://tenscub-goat.xyz/avast_update*' - '*http://card-votecrew.xyz/avast_update*' - '*http://smug-graze-omit.xyz/avast_update*' - '*http://robe-denyharm.xyz/avast_update*' - '*http://slabride-herd.xyz/avast_update*' - '*http://217.60.195.214/x86*' condition: selection level: high tags: - attack.t1587.001 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 1238ec65-3c02-564d-bb4a-e2b53d898099 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://120.46.15.254/pty10*' - '*http://34.88.165.144:8080/pty3*' - '*http://159.112.183.71:8080/pty10*' - '*http://113.45.17.8/pty3*' - '*http://116.205.168.247/pty4*' - '*http://1.95.51.146/pty4*' - '*http://114.132.77.127:8080/pty3*' - '*http://113.45.17.8/pty4*' - '*http://1.94.221.183/pty4*' - '*http://1.94.221.183/pty3*' - '*http://120.46.12.14/pty3*' - '*http://1.92.136.152/pty10*' - '*http://123.249.20.250/pty4*' - '*http://1.92.136.152/pty4*' - '*http://120.46.12.14/pty10*' - '*http://1.94.221.183/pty10*' - '*http://113.45.17.8/pty10*' - '*http://82.156.56.214:8080/pty10*' - '*http://34.88.165.144:8080/pty10*' - '*http://116.205.168.247/pty10*' - '*http://120.46.15.254/pty3*' - '*http://116.205.168.247/pty3*' - '*http://1.95.51.146/pty3*' - '*http://114.132.77.127:8080/pty4*' - '*http://123.249.20.250/pty10*' - '*http://1.92.101.221/pty10*' - '*http://139.159.233.200/pty4*' - '*http://82.156.56.214:8080/pty3*' - '*http://1.92.101.221/pty4*' - '*http://82.156.56.214:8080/pty4*' - '*http://159.112.183.71:8080/pty4*' - '*http://159.112.183.71:8080/pty3*' - '*http://120.46.15.254/pty4*' - '*http://123.249.20.250/pty3*' - '*http://114.132.77.127:8080/pty10*' - '*http://139.159.233.200/pty10*' - '*http://120.46.12.14/pty4*' - '*http://1.95.51.146/pty10*' - '*http://1.92.101.221/pty3*' - '*http://1.92.136.152/pty3*' - '*http://139.159.233.200/pty3*' - '*http://34.88.165.144:8080/pty4*' - '*http://43.201.225.240/pty4*' - '*http://95.179.224.131:8080/pty4*' - '*http://133.130.120.21/pty3*' - '*http://107.175.91.154/pty4*' - '*http://153.121.64.189/pty4*' - '*http://133.130.120.21/pty4*' - '*http://153.121.64.189/pty3*' - '*http://158.101.170.110:8080/pty4*' - '*http://128.140.127.91:8080/pty3*' - '*http://103.149.46.223/pty4*' - '*http://44.251.73.166/pty4*' - '*http://3.150.67.206/pty4*' - '*http://185.76.78.13:8080/pty3*' - '*http://54.241.21.243/pty4*' - '*http://43.201.225.240/pty3*' - '*http://54.204.84.214/pty4*' - '*http://128.140.127.91:8080/pty4*' - '*http://103.149.46.223/pty3*' - '*http://185.76.78.13:8080/pty4*' - '*http://95.179.224.131:8080/pty3*' - '*http://185.209.49.62/pty3*' - '*http://67.230.186.41:8080/pty3*' - '*http://146.190.220.33/pty3*' - '*http://41.87.80.123/pty3*' - '*http://67.230.186.41:8080/pty4*' - '*http://24.199.124.218/pty3*' - '*http://45.93.201.74/pty3*' - '*http://152.42.178.130/pty3*' - '*http://146.190.220.33/pty4*' - '*http://140.238.229.80:8080/pty3*' - '*http://208.87.131.195:8080/pty3*' - '*http://140.238.229.80:8080/pty4*' - '*http://158.101.170.110:8080/pty3*' - '*http://54.204.84.214/pty3*' - '*http://185.209.49.62/pty4*' - '*http://208.87.131.195:8080/pty4*' - '*http://152.42.178.130/pty4*' - '*http://45.93.201.74/pty4*' - '*http://44.251.73.166/pty3*' - '*http://54.241.21.243/pty3*' - '*http://3.150.67.206/pty3*' - '*http://144.91.89.153:8080/pty4*' - '*http://144.91.89.153:8080/pty3*' - '*http://107.175.91.154/pty3*' - '*http://41.87.80.123/pty4*' - '*http://24.199.124.218/pty4*' - '*http://45.93.201.74/pty10*' - '*http://208.87.131.195:8080/pty10*' - '*http://63.142.250.72/pty10*' - '*http://153.121.64.189/pty10*' - '*http://158.101.170.110:8080/pty10*' - '*http://185.76.78.13:8080/pty10*' - '*http://146.190.220.33/pty10*' - '*http://54.204.84.214/pty10*' - '*http://24.199.124.218/pty10*' - '*http://3.150.67.206/pty10*' - '*http://140.238.229.80:8080/pty10*' - '*http://107.175.91.154/pty10*' - '*http://54.241.21.243/pty10*' - '*http://152.42.178.130/pty10*' - '*http://41.87.80.123/pty10*' - '*http://128.140.127.91:8080/pty10*' - '*http://95.179.224.131:8080/pty10*' - '*http://103.149.46.223/pty10*' - '*http://185.209.49.62/pty10*' - '*http://43.201.225.240/pty10*' - '*http://67.230.186.41:8080/pty10*' - '*http://133.130.120.21/pty10*' - '*http://44.251.73.166/pty10*' - '*http://144.91.89.153:8080/pty10*' - '*http://162.249.125.141/f*' - '*http://205.237.110.232/dlr.mips*' - '*http://217.60.195.160/magic*' - '*http://162.249.125.141/r*' - '*http://205.237.110.232/m*' - '*http://205.237.110.232/no_killer/arm*' - '*http://217.60.195.214/no_killer/arm*' - '*http://205.237.110.232/no_killer/mpsl*' - '*http://217.60.195.160/g3*' - '*http://217.60.195.214/m*' - '*http://205.237.110.232/no_killer/x86*' - '*http://205.237.110.232/ftpget.sh*' - '*http://204.168.239.181/huhu/titanjr.ppc440*' - '*http://204.168.239.181/huhu/titanjr.i486*' - '*http://205.237.110.232/dlr.mpsl*' - '*http://204.168.239.181/huhu/titanjr.x86_32*' - '*http://217.60.195.160/amips*' - '*http://162.249.125.141/umips*' - '*http://217.60.195.160/rmips*' - '*http://204.168.239.181/huhu/titanjr.arm5*' - '*http://204.168.239.181/huhu/titanjr.i686*' - '*http://204.168.239.181/huhu/titanjr.arm6*' - '*http://204.168.239.181/huhu/titanjr.sh4*' - '*http://196.251.121.142/a6*' - '*http://162.249.125.141/mips*' - '*http://204.168.239.181/huhu/titanjr.ppc*' - '*http://196.251.121.142/mp*' - '*http://204.168.239.181/huhu/titanjr.spc*' - '*http://196.251.121.142/m*' - '*http://196.251.121.142/aa*' - '*http://162.249.125.141/umpsl*' - '*http://162.249.125.141/garm5*' - '*http://162.249.125.141/rmpsl*' - '*http://204.168.239.181/huhu/titanjr.m68k*' - '*http://204.168.239.181/huhu/titanjr.arc*' - '*http://204.168.239.181/huhu/titanjr.mipsl*' - '*http://204.168.239.181/huhu/titanjr.arm*' - '*http://205.237.110.232/no_killer/arm7*' - '*http://205.237.110.232/no_killer/arm5*' - '*http://162.249.125.141/amips*' - '*http://205.237.110.232/dlr.arm5*' - '*http://162.249.125.141/garm*' - '*http://204.168.239.181/huhu/titanjr.mips*' - '*http://45.207.196.86/huhu/titanjr.mipsl*' - '*http://45.207.196.86/huhu/titanjr.i486*' - '*http://45.207.196.86/huhu/titanjr.sh4*' - '*http://45.207.196.86/huhu/titanjr.arc*' - '*http://45.207.196.86/huhu/titanjr.i686*' - '*http://162.249.125.141/rmips*' - '*http://205.237.110.232/no_killer/mips*' - '*http://196.251.121.142/a7*' - '*http://162.249.125.141/mipsel*' - '*http://205.237.110.232/dlr.arm4*' - '*http://162.249.125.141/gmips*' - '*http://196.251.121.142/a3f8d2*' - '*http://204.168.239.181/huhu/titanjr*' - '*http://217.60.195.214/arm4*' - '*http://45.207.196.86/huhu/titanjr*' - '*http://205.237.110.232/arm4*' - '*http://162.249.125.141/o*' - '*http://217.60.195.160/sh*' - '*http://205.237.110.232/t*' - '*http://205.237.110.232/massload*' - '*http://103.83.87.122/telnet.sh*' - '*http://217.60.195.214/t*' - '*http://217.60.195.214/dvr.sh*' - '*http://162.249.125.141/gmpsl*' - '*http://205.237.110.232/dvr.sh*' - '*http://217.60.195.160/shell*' - '*http://205.237.110.232/o*' - '*http://205.237.110.232/dlr.arm7*' - '*http://205.237.110.232/dlr.x86*' - '*http://205.237.110.232/tftp.sh*' - '*http://196.251.121.142/wget.sh*' - '*http://162.249.125.141/garm7*' - '*http://204.168.239.181/huhu/titanjr.arm7*' - '*http://204.168.239.181/all.sh*' - '*http://162.249.125.141/shell*' - '*http://162.249.125.141/t*' - '*http://204.168.239.181/huhu/titanjr.x86_64*' - '*http://175.100.126.159/all.sh*' - '*http://162.249.125.140/arm7*' - '*http://217.60.195.214/o*' - '*http://167.99.95.139/pelerberjembud/peler.i686*' - '*http://167.99.95.139/pelerberjembud/peler.x86_64*' - '*http://167.99.95.139/pelerberjembud/peler.mpsl*' - '*http://167.99.95.139/pelerberjembud/peler.x86*' - '*http://167.99.95.139/pelerberjembud/peler.arm*' - '*http://167.99.95.139/pelerberjembud/peler.m68k*' - '*http://167.99.95.139/pelerberjembud/peler.ppc*' - '*http://167.99.95.139/pelerberjembud/peler.sh4*' - '*http://167.99.95.139/pelerberjembud/peler.arm7*' - '*http://167.99.95.139/pelerberjembud/peler.arc*' - '*http://167.99.95.139/pelerberjembud/peler.arm5*' - '*http://76.164.203.171/t/wget.sh*' - '*http://167.99.95.139/pelerberjembud/peler.mips*' - '*http://167.99.95.139/pelerberjembud/peler.arm6*' - '*http://167.99.95.139/pelerberjembud/peler.i468*' - '*http://167.99.95.139/pelerberjembud/peler.spc*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnsh2xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnmicroblazexnxn*' - '*http://76.164.203.171/t/mipsel*' - '*http://76.164.203.171/t/arm5*' - '*http://76.164.203.171/t/mips*' - '*http://76.164.203.171/t/mpsl*' - '*http://76.164.203.171/t/curl.sh*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnmipsxnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnx86_64xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnpowerpcxnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnriscv32xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnm68kxnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnaarch64xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnriscv64xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnloongarch64xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnsh4xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxni386xnxn*' - '*http://51.81.135.241/bins/xnxnxnxnxnxnxnxnor1kxnxn*' - '*http://76.164.203.171/t/arm*' - '*http://76.164.203.171/t/ftpget.sh*' - '*http://76.164.203.171/t/tftp.sh*' - '*http://45.198.224.151/main_x86*' - '*http://45.198.224.151/main_arm7*' - '*http://167.99.95.139/x86_64*' - '*http://76.164.203.171/t/arm7*' - '*http://167.99.95.139/x86*' - '*http://167.99.95.139/arm7*' - '*http://167.99.95.139/arm*' - '*http://76.164.203.171/arm7*' - '*http://217.60.195.160/t*' - '*http://217.60.195.160/massload*' - '*http://167.99.95.139/1.sh*' - '*http://217.60.195.160/o*' - '*http://45.198.224.155/main_arm7*' - '*http://167.99.95.139/massload*' - '*http://178.16.54.93:81/armv7l*' - '*http://179.43.182.70/fuck*' - '*http://76.164.203.171/arm*' - '*http://45.198.224.155/main_x86*' - '*http://178.16.54.93:8080/armv7l*' condition: selection level: high tags: - attack.t1595 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: b9458004-89fc-5cd9-a702-f3fb7f8dc1b8 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://geo.estimator-undermostshelving.in.net/jquery.min.js*' - '*https://airtickts.com/*' - '*https://kiabillc.online/dndjonse/jqqc3S9hjjnxxzKjqmTMtgt9S4mMqMoKGsHEjw2jjce4gv.js*' - '*https://leconto.lol/file.js*' - '*https://hdbkell.com/code/tmhfjm426347*' - '*https://hdbkell.com/rtbqi.js*' - '*https://hdbkell.com/frofg.js*' - '*https://hdbkell.com/y9nzz.js*' condition: selection level: high tags: - attack.t1059.007 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: f3f72688-3e33-5974-97c1-6e19803f13c8 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://drive.google.com/uc?export=download&id=1EznN9ZSMbkarOKxIJQJNw-P_JNXqHJQz*' - '*https://drive.google.com/uc?export=download&id=1OUs4s8axg1VrXLEGkjjz9EB-4mCpnM0F*' - '*https://drive.google.com/uc?export=download&id=1A_G80DzjmvUicajtNsLlEzIaP0jSPEtV*' - '*https://drive.google.com/uc?export=download&id=1rG8PN8efU6NPnWc2RyoyuL9wtjMo4Uz_*' - '*https://drive.google.com/uc?export=download&id=1ktEK2pYyjK7s5o5F0jS0mhBXziiDeG0c*' - '*https://drive.google.com/uc?export=download&id=1Y3_BFb3tptXY0kprpPvWYV5CiKKZ9Cx2*' - '*https://drive.google.com/uc?export=download&id=1_IQQEY7HAIOzTbbxSukTX35LyUH1i5xR*' - '*https://drive.google.com/uc?export=download&id=1UIgT0r3Q4SsKy23W67BvT20b4xNocMsf*' - '*https://drive.google.com/uc?export=download&id=1yjjfYWhS4OcahaAgVzA7CS2LqkeLTGnu*' - '*https://svganchordev.net/icons/108*' - '*https://drive.google.com/uc?export=download&id=1WWfERNA9Y8IM-7DO4x6dAA7r1VlFNoTc*' - '*https://drive.google.com/uc?export=download&id=1TMZqDplNRrNoGk2xvGsSEWrreA9pmFn7*' - '*https://drive.google.com/uc?export=download&id=1m9ysKrEB1M54w1KAMA3IZrtzo5a-HtK0*' - '*https://drive.google.com/uc?export=download&id=1ysD5Ynm5FVGZbicmpYWBvh6rgaJXDp2z*' - '*https://drive.google.com/uc?export=download&id=1QZfOUz7Dr64aBopA7Jw6JYLmLjEx0twJ*' - '*https://drive.google.com/uc?export=download&id=1hXA5stqaTkbz9JtLLh1NjEJIC5OvWIEv*' - '*https://drive.google.com/uc?export=download&id=1Z-Ckd2w5vC18hs-mdwj5l31r2zHZBl4k*' - '*https://drive.google.com/uc?export=download&id=1veAFwKnNqQiY6aIgBD3Y6K35-U2Rdmxj*' - '*http://170.39.215.70/jwnYx38.bin*' - '*https://aair.org.ro/CityhJdWumJsAbpTjJzbL76.bin*' - '*https://aair.org.ro/bbUsQZjjwh110.bin*' - '*https://aair.org.ro/pGsWdCez63.bin*' condition: selection level: high tags: - attack.t1027 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: bc865f35-fb9c-5301-9cc6-72a5b4510a43 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*http://193.142.58.29/60/imahereforbesthtingstocomehereformebestcomebackgfor.hta*' - '*http://192.255.195.158/133/winthematchwithbestfeelingformebest.hta*' - '*http://192.236.217.81/160/southwestbestthinkingforcinggood.hta*' - '*http://107.172.247.123/227/ecs/givemesomethingsgood.hta*' - '*http://107.173.227.77/240/ecw/weneedbestthingsfromthegreatpeoplesaroundtheglobalcoing.hta*' - '*http://107.173.227.83/225/ecv/wegivingsomethingbiggerthingswithmebetterforme.hta*' - '*http://194.116.236.163/38/goodthinkgsforbetterwayscoming.hta*' - '*http://107.173.227.99/400/kissedbyprincesssheisbeatufifyl.hta*' - '*http://203.202.232.187/44/weneedbestcreativeideasforbetterplacestocomeback.hta*' - '*http://172.245.195.209/90/wegivenbestwishesinsideforme.hta*' - '*http://204.44.69.210/40/globalnetworkingkingsonhereforbetter.hta*' - '*http://192.255.195.146/25/goodperfromacenforbestthignsforme.hta*' - '*http://144.172.109.153/60/cbb/weneedsuchakingdomofnicepersonentirelinkingforebst.hta*' - '*http://107.172.247.123/226/weneedbestthingswithbestversionsneed.hta*' - '*http://209.54.101.152/50/greatdaycomingformylifetogetmegood.hta*' - '*http://192.210.186.206/40/wellmaintinaedthingsarebestofroprofessional.hta*' - '*http://192.236.217.81/124/givingbestthingswithbetterplaceonhere.hta*' - '*http://107.173.143.36/33/wehavingbestsolutionsforbetterplacescomingfor.hta*' - '*http://104.168.70.168/60/goodthingsareavailableforhtebsestbthignsforneway.hta*' - '*http://46.183.223.88/57/nimiddlemaninthisindutrytogetbackgoodforme.hta*' - '*http://204.44.93.68/20/gooddressingskillgoofforme.hta*' - '*http://107.173.227.99/225/wegivenbestthingsforeverybodytogive.hta*' - '*http://107.175.202.168/44/unv/givemebestthingswithbestprocssionthigns.hta*' - '*http://198.23.144.23/129/oo/bissbetnetorkingmarketthingscomingfor.hta*' - '*http://107.173.143.52/30/goodthingsarecoming.hta*' - '*http://107.173.143.52/20/givinggoodchancestogivebetterplacesforme.hta*' - '*http://107.173.143.52/145/givingbestthingsbeterformegood.hta*' - '*http://194.116.236.163/35/weneedbestthingsforeverywheretounderstand.hta*' - '*http://172.245.195.209/80/weneedtogivebestthings.hta*' - '*http://107.173.143.45/18/weneedgoodthingsforbetterplacescomiginthebestnetworking.hta*' - '*http://192.3.45.6/16/breathefailandsuccess.hta*' - '*http://107.175.88.103/44/nicegoodoneforme.hta*' condition: selection level: high tags: - attack.t1218.005 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 1a723501-158b-594f-ba66-5b321b7ee5de status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://moment-dtp1654.vercel.app/?download=1*' - '*https://documentz.vercel.app/?download=1*' - '*https://police1107workzlo.vercel.app/?download=1*' - '*https://poiskrunsvo.vercel.app/?download=1*' - '*https://chekingmax.vercel.app/?download=1*' - '*https://porno-videophotos.vercel.app/?download=1*' - '*https://gossuvpn.vercel.app/?download=1*' - '*https://police1107rat.vercel.app/?download=1*' - '*https://mvd-2026.ru/Video.apk*' - '*https://police0807work.vercel.app/?download=1*' - '*https://krdtpvieod.vercel.app/?download=1*' condition: selection level: high tags: - attack.t1566 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 0c605e4f-15a3-52be-9a7a-87ef57b8618a status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://api.recapcha.space/task/windows?token=912*' - '*https://jb.mywwjj.xyz/A/2/_extracted/setup.bat*' - '*https://excited-wagner-demonstrates-showing.trycloudflare.com/rec.bat*' condition: selection level: high tags: - attack.t1059.003 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: 26625d53-1cae-5021-b167-27bf9a3e03f0 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://pub-e17adc2984a64a2f8f2a3f402fd92e53.r2.dev/ikzwhpl.png*' - '*https://kzaa.co.za/1.jpg*' condition: selection level: high tags: - attack.t1027.003 - source.URLhaus --- title: Detect Activity to Known Malicious Other - URLhaus urls - Chunk 1 id: d2424ac8-fbbf-597c-babb-3d28d56ae376 status: experimental description: Detects traffic or activity related to known malicious urls associated with Other from URLhaus (Chunk 1). logsource: category: proxy detection: selection: c-uri: - '*https://raw.githubusercontent.com/jennyloops/fakepay/main/Fakepay.jar*' - '*https://raw.githubusercontent.com/jennyloops/radium/main/Radiumclient.jar*' - '*https://raw.githubusercontent.com/jennyloops/xenon/main/Xenonclient.jar*' - '*https://raw.githubusercontent.com/jennyloops/krypton/main/kryptonclient.jar*' - '*https://raw.githubusercontent.com/jennyloops/4e/main/4eclient.jar*' - '*https://raw.githubusercontent.com/jennyloops/gamblerig/main/Gamblerig.jar*' condition: selection level: high tags: - attack.t1102 - source.URLhaus --- title: Detect Activity to Known Malicious Other - AbuseIPDB ips - Chunk 1 id: e0f358e2-7f6c-5889-a284-5fdc255bd8c7 status: experimental description: Detects traffic or activity related to known malicious ips associated with Other from AbuseIPDB (Chunk 1). logsource: category: firewall detection: selection: dst_ip: - '1.2.3.4' condition: selection level: high tags: - attack.t1110 - source.AbuseIPDB --- title: Detect Activity to Known Malicious Other - MalwareBazaar hashs - Chunk 1 id: 7c6f2a2d-2462-5aae-96a3-56a2ed66bf72 status: experimental description: Detects traffic or activity related to known malicious hashs associated with Other from MalwareBazaar (Chunk 1). logsource: category: process_creation detection: selection: hashes: - ' "93f1112efb938edee0b52aa69c28303d99b489ec0d785af553250478546ec647"' - ' "589e46d07f1239dd6b8b07a00d5739279648863d9cc78ced1a05fb034fc16122"' - ' "b2388fb3fedb1d62f7a6cd1719613b5f298c56e677de981f339550a6b7a3daf3"' - ' "c076437d6a30f394ea3f97331987884228703b350026da16337e7c1b4d740b66"' - ' "c50a08b67bbe92e4afae7bb28b33af820001aa384ee82ad1a88e16d623c14e6d"' - ' "847daefabc7cf5e466c8540fc331a2ee340fe286aaa7127b20527beaf8b8fce2"' - ' "223f03fcc04e7c0f0fdc1b5ffaa30ce817269ad1903d25036887bea299cdf187"' - ' "8cd988e1f749a5e008128df6f2b7da55c2760fbcdf414f26260331db723e6a15"' - ' "8489605870dd2735a8298cbb05db98cc6dc1d49e30caf3aa7d3260cc8fecdead"' - ' "3f9f8dd458b0a1f82c47dfdde874f609ae5f451644fb96c85c95403d2f4816a4"' - ' "c2ae41bff71b9d5dd6d5845f1cda894729f406db9501c3afca402420b91515c0"' - ' "58b16700b8a3b8f0db2fb2e14b8c3e835270111518e67239b373a81ffd265b9a"' - ' "9117cbbaf4a200b534763f9c129d0f1a7bfca9d73d9a1fbfe97564790405e902"' - ' "79cab94e4ca816acbb4068254adaac761f16f8a6e4796408c77840235e5890ee"' - ' "2aab00defb69f62ea24fcf2d2afc85750e1e24bc67a6e2fed6166438dfc1172d"' - ' "0262c43ca22a7fb751f38117641a206220b0ab116cd79864c7336207dffa7358"' - ' "a0f85de525c9f1126dd701b4b9a50237ef6dd1605836da64e983e49a2c50d268"' - ' "e98f72882d520f1a1d17036847154b84db0b44a463f75d2d12af1bb9c48fff95"' - ' "b9679a478bea2fb3eb238e75139e20fff5652b1b2495e6cc66e9f7110e3f4339"' - ' "431f2f7b389128c829dcd139f4f1c3bf95411ea14b87e271c0b04ad6469ba896"' - ' "f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987"' - ' "3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39"' - ' "8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70"' - ' "d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e"' - ' "d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141"' - ' "c7ba7ec8cb6953a25ab30fd3d9ec6c9422da9a9c9db8dad664667c5d4baa9a55"' - ' "76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226"' - ' "e71b7fd8a38ace53045a576a8498f11a81c2d8f66b93086317c250dff5430429"' - ' "ae0c7cf73a0572469bd43b4f44bbe38b67ca35a45728c3f2a3cbb37662b44a8f"' - ' "1362adc3a121da862b252c1e9d7beb81fc9d19aa18335555a6771a3685d46cca"' - ' "4178cf0bd11cd9977008647ebb6bb12a7ad34c384faab31da66c8dfbf64f72a4"' - ' "33adb2cf048181b5de75d5dd5c837565a738ebd1350b7953e0dc47a3fb7040fe"' - ' "38027ca6afc21bd734d86e96b8d3c6016e5afff6d8139b777cb55825a92f8f15"' - ' "a477f89d63408f5ada9698388e4348c65611c81efe19681772e7354d64c2d3ed"' - ' "c65f05b9f92b5d1cc2d19cf9f8d12fad263403d54952be88f93cd65a54239a5b"' - ' "b7330cf42457ba3a1cb515d260f2fb3f4dd90e4de9cf26fd6b070cf53109df6d"' - ' "93a180ec5678568b9d071861338cc3572ac8c95cba3f7887ab597565c722602f"' - ' "de6f4352d29b306317a03c96a39d8d9df21c70435676311573f70b7e73acf567"' - ' "5d19c6cd2687c25287f30d6de13a2e0ec95f909576f5d29b018be095062d3437"' - ' "468e406f1b699984ba66833482de4f1e4586e8f80bfbb8fd46056260ed19b0e4"' - ' "b253c73d2cac9ee27a3ebe89896b08bd455ed9f552ff7af20154d925822379ed"' - ' "eaebbaf4e6affb72d0979fb50e61538cfb2f24f61b9c8157862f124f761465d9"' - ' "6e6513b872fcd852b76ac8927cc6126c63bd4b31badb2cb451d383c058f7fcb1"' - ' "a90c1e26e58a9744f4b647fbb6707e18df24b38a4769982a50a004ab909f9c66"' - ' "928ea1b44130b207af4151cc988bb6beab1b94f29abcd6d58d469f6876f4f7ee"' - ' "9a81a09982169309d5d1c81b4563ba7d37ffe4cae58d3de3c2f5935f4809dc42"' - ' "cec9d22bdac621193a5ca25471be565cc88141bb163777b4f9b9c19b25bff42f"' - ' "7dcf4a36579a8f730a0a624eae103f3726f7a6230e92fa16010cee45a494bb9d"' - ' "0a072ac7e5af0b6af24550a46755dddfc6582e575112a9794ff6ada7e283ac6c"' - ' "a5450557a47e6bf770bcfa02c8731baf3600725eba203926631c0202a926798f"' - ' "cdc3b1b449c8196d3025cf953f12c3eba5c6e3371b402e5ddd945170f831b546"' - ' "e202969e703aa1cffa4932c7dfba8b667e99f8c9cc556497223f5bc08e0756ea"' - ' "ad21776ed177bd75e1771cf39efbf97f0d1c4d809f7bf5c93e2d14f6317b0999"' - ' "bea4c166b9ad9a936911b052601f480ca4f2de0d3f7494fe35562805bf491491"' - ' "a685603be47c7c2290ed7682ec863cfbf363db84ca1f6a7f46a1e1cf5ac98d19"' - ' "3b520f138b30704f7a94682b10912ccbed47e33a8fe9445ab6c8ca681d3e8bb2"' - ' "f77fcbfc80694ae1f1e3cdebf52131f6bdfdb9a5cb93e9d38c86b8cb0974c6fe"' - ' "d44edce44672d1c036650973eb16ae1398e7ae936c3000e8a1342e49d97cec6d"' - ' "a164e78d311b37432803d6f2df5fa87b4bbff648a88a7749280b013f22fb689a"' - ' "aa506ee75e077c11866d92c36bf716f75ae3c91a69332b11cd1646c0e9fcb4ef"' - ' "f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847"' - ' "8ee96f025af10aefab7cd52033cd171b1150ab40509ea1df41065c3f9c8a5bbb"' - ' "c93719e9387ecf198f4cf4d008313617c4b3769960434f3b4baf557dd613166f"' - ' "425205c25f1f131145d4ea88d05c390adacdaf6cb9a33a6f0f4f4f8963348b4c"' - ' "b465b7c8ab145c07492fb823264844ffb756d35fdb98421556772263a0960c30"' - ' "f64699cfd4a393749820a7cc2ec9c0dc5be5bc4515bfd2c0c3303d083390ef52"' - ' "8d3ec44d1d9e8b5e0ce534c639d071b41356d0b153dcc399d03d34284fd4e555"' - ' "afae69b53881fed76460f309197b222e6766562c01089e5007b5aece9dc8a4ea"' - ' "cd8fa68c43ef0630666fd871671012d32cf68a9a72a773a3bbc7dbf44bbd67cc"' - ' "05024d8d63805d12ae713bfe1c7b12624cfb466f3cfa39ac0d202f7052a2825f"' - ' "54ec6f6ae01bac05e426f43ae669d15c459cc5beebc329f93948e7a4feace334"' - ' "2da00e28e0905831325a952cdb2de6c3d270da7d718395d6301f8c34f528e4c3"' - ' "fdfee70d879c9ae74ccb8e35c59aebb21ef9e304c7d0f26b0c8dab696c7f5c93"' - ' "1a590fb5de5c8a36a0442db1b271ebd51c7de575227865ed159ebc7b3ae4b56e"' - ' "79080253351f0b5ddbfafa337e5164fc203f81e77f490da71d281716d27d7a13"' - ' "3f33b5d2fd1b3284bb9f5184a0b612dbb4cbfde351d960c7f63260baf84e3fe4"' - ' "7517f74335b9d5617ed6187508e141ca1d525891bfc8661965ac9882c3af98e1"' - ' "ee96d7615a0d0340c2e087da81d7d59c86540f0501a671985d5346948f6d509b"' - ' "7bc8f969a69bb646211e6550544bdbf2b80b8b12f1872543f18e52f57ea50da4"' - ' "4726119df522ae2ddd955748482f9c5bad480c80436628f51a85171eb364a1fd"' - ' "f62657234e8de3f09fc7fbbbabc49890aaaf73e9bbabd298710a9e0de7d24dff"' - ' "28fd7d231a920dc53176cfe738a55854f5836a104ea9b0bb020ad161ad93f606"' - ' "e6dddb4d8bec39ce63809d5d0507c99388464521529a852b1eaabffb28d5ab5b"' - ' "0d9fa68a6280045d08a96bb834c69b408dee80cae651dfdd3c29d7a78f8e95f2"' - ' "b76b2e67f36e85e2c7a2e6904ed92550991fd14743c3a004d8cf2a797d9c72f5"' - ' "f6343ec28a56575486792998c0cad6e7d86747e93a97c93867af0cc4c780156c"' - ' "6830ed28846ce2537d7d31da6f9400dfaf3e2af69846eb9ace281534e9ae0265"' - ' "c6ac61665e6e17533ff27fa1b5d3f003a5fad335b1c21363fbe42b4a9a841eca"' - ' "80dff5a01116b8ca2a66d241d2d60fa07fdc992e5c4aade563098b497e5849de"' - ' "033d230ab2196494a387319c7ca69943b7df39b83b552ee9328d0cff3c9eec3f"' - ' "eced21d4f306a565789462eebfdeb45be1f71b93bc0d00ec0e78e935f488b406"' - ' "77f1fd9dbfe931fed67f0d7365293ad6ff8e1a3a02976b528d879c39e7d02fb9"' - ' "c25329116a57d51912ec241ca8b581a5c7cc01b729e40492abe5fc48720586a1"' - ' "5dcf2e377ceb21ebd8abc1597f9ba926ab9428ef77db7dd6c9dc5382d685e1ec"' - ' "02461de930a8c049d1616a7dd2cac2faf1b245d39874f8658a7f80a9a2e6ed0b"' - ' "e934350af93b76a02d18e700599aaefb94bd447499a60a3de98065ad124b1b05"' - ' "09b02692523576627b14e7510125bb99732891efed079439218a69396482e72b"' - ' "3e1b1fe0edaa2aa1cd743646f41354eaaf7eaf54d47a416f141ba9f9320024fd"' - ' "6dbec719cbb48336123cc4e6665ff69f55d6d182f3db285136cab794888b1ff2"' - ' "84e0669351cdf4ce4006082749c8810219134c1d332f2b226697c5ed00f3c04c"' - ' "dda624c840fa96b71a6624d281fc84bc6bc70a7a550d96072bada7419a9a86ee"' - ' "937e4f8133d72d80f8cb9977c05a744bf7ef70823cd3dde7a4a6e376a0946c6c"' - ' "b78cdf3ff3def0a9800ff193bb0d4928072e1296c7801fc095fc9e69442a333c"' - ' "9d0690fac5168a38b4dfc77289e53ffbb1b87219b27390a5d4a11e303c307823"' - ' "8a46d5ea2d20041fc3f1f2f9ab60e46247f96acac0677e66255cd563eda1c4b3"' - ' "0db05388d762bff931351ac2d599ca1d2bb216198754cda6d275b07709c50766"' - ' "da0db01417df6ccfe6df054b08663ed59d377c065740a7a83921c033dbebb29e"' - ' "6065cb819a2f8192c7a0ab5979f4aa581bb694b1e0642703428960efcab80273"' - ' "52e89502b66794eb4148aed84011a23352deb7bd9188987e69ba7f567dff923c"' - ' "1b6dab8bc06f91bb0c2331a714ff5b79d3e4ff0a490f3d6af8c68c6ebf52450d"' - ' "fd9dec7ac8b45ddebec3fa88dfa1758afedcbe530d1a824c3857fc77fe3ffd69"' - ' "7f695d411b96f912511855ebeb01449d6d03018cd694acc6c21ebe126c84c0f1"' - ' "ebbf02159468c817ad92312f2dc0018c3a22c6842f71b52d25d3516dab9bc640"' - ' "86e3239163b19b87d9c5d3f0dccaad5779633fa3c8ca3b6aa485eedf7d32a1bb"' - ' "0cacceb763d3e00197e2c0fc6635df4e31a3882cca109e398801e5c92713096b"' - ' "3383eb3b2432c941b970d677a508b424c0748cce78467c4e947c90fb616e9f59"' - ' "cb77279bf1008421c06ed137b8c4988b4950406acba4c31d218ebe1aaa979565"' - ' "3c8c1d7684efd4edf61207179a7893ecea46dc49a26eed378f5197a5340182c3"' - ' "6a0d3236416e6d737b411c1226637f8d7e31e17cc1b6848398b8c46a56024350"' - ' "17fc68689d29cb90f9a5c406b2bbea052fa6edb8883d95843e4f5732915a29a1"' - ' "819f91ff225f10500e94576a6473487162ffb5e50ec92dab9950b0b143418a21"' - ' "da92fef44bc35bd1da5e8d6390ebd4619a2fec5986ca1e80f353923a41ad60df"' - ' "691e9671bfc6405f1ce7c273d9736d3e5a4d50cfb2c000a08e0bebecc111d2f5"' - ' "56d44489e8a4d17f59608730e90c2b24149c9cd9a6dd6bad1c709d938d9d8d77"' - ' "18e87a07ebb1995e1822e0609f221b13d3d86588b5575509fc085f0d385a905b"' - ' "eda777c80eb6d7ff2a1540dbdeb1b3c6f52e8122ae429c732227c460997b5896"' - ' "bd3e7b1d36d45079f4787aec93557d247a24906b01cd3cb26f0536179644aaf6"' - ' "5dc45286ff0904add55a4c2b286f0e79c7b880dfa21c6badbb5f814fefd7476e"' - ' "181df1e408b4ab730be34936f8ab455ebefef2e56d969953227d16c123557d8d"' - ' "f4170e716e7d62ff98fe2d1adc8c7d1794b2f61db550ba8dd5ba94c9e9600fb8"' - ' "c7022836a3f92a6589df7cce99ee3db69ce0a98a7c266ba90a8ec5e37227329e"' - ' "01193b3f2299b6fa849824e6b3e7276d1b9d23c62dc06b9cefc31ade1bab5201"' - ' "a60040a22cbb9db1a20dc2814249a7088f82fcb4fbc0fb1535c37700ee11c271"' - ' "99e69fe905fef0d4f0bac72ab55e6427163552c4972f1640e52ac9fccea66623"' - ' "ccf20313c97946ac9b20a95486811b801113d7828d66b90a149813d79d5d8aca"' - ' "f859666226f0413513bd2e0782b18376824a94ef57730189cf268307934e9407"' - ' "aa223638cd0363efd4195a0081ff36b953c45b36b2bc1dca0aba27ded47259bd"' - ' "e075080e6309777e1fe0281b4e449a2acda99a51294f4b6bbf90fa9dfdcc577a"' - ' "29da4c0a6c0b913084810fcf7fc29d88f0f2038e460b4bb128a1d5d7884f707a"' - ' "418a30d149de64318e6323c91b86c856875a26eeee24b1383b38e57a0e3f0d7f"' - ' "5b769a715939762d66fdefbed016abfe5e3d63412b53ea17ec79d1731f728fd0"' - ' "c15bfdbad15854228e9276959f899592b265204e00dbe1aea6fbc7976c972469"' - ' "ec0078d806fcb7b0ef538a51ae03217888ce1bd3e96a73beceecc2c12675d77d"' - ' "e8bcf00b705d9e65c10137acd798f401b19880f6d2957420ab55e49e01d99d4f"' - ' "b8e46b0ece6c02f2b6069a9cbe9686ce595d7ca59494214cc6d6ebaa9b5d072a"' - ' "6248dc18ac86b280a8a608f150567ed88e1df1dd845d3ab78bdd051a0c9cf560"' - ' "d8c68be694f53af4a3aa091f398d6f1d410a045b1f4359ec14107d78f2fd6846"' - ' "30c1bcf495b5e45c38c3e522debca17c16f21e8967f3a9558709315de1c7f727"' - ' "c4b3ea21fa4980afdeb052b4903f07439b12cbe93b9770f49e1d6fb874fa35ff"' - ' "205ae4ddb3ac9093e68c3106ab93385f82ff88a68df10503751254ee923a1474"' - ' "0524372ecfcbc9258d6311dc3bf7b9084a9c7b14bf942f010331210c0e124873"' - ' "04d788870638c10c73140fc9a00cefb7217e1ed6e9ff25468e87e5e3a2cf9c75"' - ' "3f5cb4f42afb4b77f5734d143e352b134f5825f4022eaeb5bdaf4b6e243d8fc3"' - ' "7e4420e487e1398f3b554fc20c069433df24c3883caae35125be1802e25849b3"' - ' "91dd7cec4367461b5c459d4c6823836ff65772051f4c5e14e6761b60a53efd8f"' - ' "2ec961162dd43e87b68abf63977c983d5c4a8dcd77caa399faa72914734d022b"' - ' "65f22339ca6da33a0c38475b1aaeb4b59140aebe7e30d84d05fe95ebcfb55cd8"' - ' "728a2f85c9ff8bbb463e93253ec05e8f3933271887457c5a0f5d4933ec8712c7"' - ' "2da611af6f3cad9f6829a476cfd47b8c4fd54e814024517da3aab2e4a81643b0"' - ' "440aad0e03785281f8a05f00cb76ec9c78767bd3c0be1c654afb96acc7c83461"' - ' "5ee4286084f21bbeb8cc03e124d1e148535cb3a9c375157d749ace607e5f7414"' - ' "b638c8dfb4e4b00b91f21b22b295ab6f3d156e8ba7f78cb48a3c3f052acb272c"' - ' "2db30be542d9f8729e23947c0565174bc1132600e5a9ab02c13214406b02ac14"' - ' "74eb42416b47c082fc867764b577ceac6f1bd68e192695d79a9e48a7bd3fdd69"' - ' "76ddda4f6fddef5b3f5cbd41e60aed14a881465db1142b09b0ca7faf2b89a77e"' - ' "ef3f82ab769f9fc17877df59566e5349bf4b1e30ca25960d38330d6752797ba3"' - ' "5f1146ec4c1130cd64af934de2687d6dc78330b3bc6c8486deb39b9305b10d72"' - ' "b2c63c65d8d46ca1dbb5f610886f3ff8aa4502f11099c250f7178e4df839f760"' - ' "dea359cc74cb74dd82cd1ddc32b74f6652b58ab24d4508c74012945add5b35ea"' - ' "08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4"' - ' "8e3aaccdcfec00f697fd658758bea1bf41ce5f09ecebea1788161c29a9f9f9bb"' - ' "5074b37a866644a70785e11a49187fe99017d17377539fbd2f5cd2b7db01feaa"' - ' "a05e47692520185c1d3b5b0bb72b6a4b954064d2e28af22c5dad24fb2b924743"' - ' "f71d0a1e35de73055df98576e0891c2ff8ae22001c2aaa483eecf28891c1e719"' - ' "243de5e93436d84b56e6a629552483b5cc0c2e95823fe465f546a443a55a60f0"' - ' "46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4"' - ' "dea0649857c76ceabba2ac3ecb1aa5960e92f1a5ef80b385a75903aa7edd2c3d"' - ' "c8f5154d2662341069adbac8a2447b7e409300a7683ec93a9ee3312f16ec2b26"' - ' "d96ab58f07cd94c3381f9be5e45c9a9f7ce8b8cf8b28aa3d35e45b650e8565fd"' - ' "4c3084e6f337e867f335f4b04937350f150e82888f391ca63427f8eafa76c978"' - ' "69e8a73e215114989a0d9c5c9c666587057e2bcf1c29b1fb7d45e1cb38a715de"' - ' "ab4d75510a9385c878db258079a4b81d2e27998e7d5c97dc081b49dc84eb1219"' - ' "8f78a2bc79b2af9f852684eef9ebbeaf7858b6de808f9a19d18d9eb3987229ed"' - ' "245f0ee939fa4068c7ac66b51a51f845e1cc8070ee76e21aedf57be7b087ef9c"' - ' "8970de128df9ca7689eb008b88932516c55ac84783d08faa55d925a3188504fd"' - ' "fa4b30b7cc5b13ed11c7658dd3ce4f2f2e7d3488c95f0a728d11a3186d6a4671"' - ' "273c96eb5d64f3a07e8e741ac70c64dfb375f73e478bdf751508f033a9a36f3b"' - ' "ea550290a1b2f65be7eaac6f0d2d34bddd943bc63e41d864d2f3dd1523cfb94a"' - ' "87f2552baff86893a70431dbb9c88f28c6b9abe5fb4a9408518f3bac58e76a41"' - ' "ffe43428798b71d61022bb16ccdc58d9e2ed2a87675002e77cccf21356d91eb3"' - ' "10aa22f1c88b690399fa6cfe6f6f7bc1ed49d153313585fc5520621f160b64ce"' - ' "02a04456bb5725fffb1afc5a47231a6362f04802a076c6230ed2bcde95c583d4"' - ' "452f40131b10db314303d499da82c8174b4296fa902d9dad5f0744bac0fbc1c4"' - ' "be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a"' - ' "e3144c24d2eefa8b88c9723c91217f57fb29114a9dbc1ff5f2b0fb4a0183a520"' - ' "5bffb0a31973b0ff6b4a86ce9f14dd4c72f180378e9750dc7419e0587502ad49"' - ' "f3b19f4e2436cdbe96ca1c1c888a077d6a7f558e44e7611e672f052b1082a2f5"' - ' "c3eebcc3151c36d88866d401e7e05fd1bd19e18d203bcc485f3decafabb39bd1"' - ' "7c3aecf4e8b6efb08ac5be198fbbe7b45b609aef704ee4a1518842a0babf1670"' - ' "439a03653b8f93d80b15335d49f0937d0f395b803bbf60d6ed31b968816dad39"' - ' "d43e16731b6390dd5a246f16961942a347c4234596a66716aa1f343df9209687"' - ' "fac28f3d0ed1da9effabd03e90ade9cad8fabf25455e29f085fd5cc6633a3bc7"' - ' "becbaeb0599ae2599db7a0537befa082ed55c92ed2432031263cb07839504677"' - ' "6c62012b703248a9be54cb3ad066506637d365bcacd44111fe484116f9058043"' - ' "74ca82a10e5e8697db96b8cb28280ff9fd0371eaafa32eb1d785320b962e19f4"' - ' "37edd2381325114990174f341e9de27a1fbf77eeb579904460b991ebfb5418bf"' - ' "3ce0504ba65f8d56f83d7fef45faeaeb31e4e5aa9b872b56610b5f2558231caa"' - ' "18545d002ca40ad6dfb7982a390035cf291a047a09dda45744f35887d66a2a4d"' - ' "9916a3a0da9b0953b1ba80a1f094ed4aa9e177804566fd3b4fd59b6166684c80"' - ' "404ea0022b777c6f39863df08b3de450efabf36abd9cc92c5bf300e72651861a"' - ' "f0a831235612f19e5b22e7dd4ce96580435d951151bc437aa5bee4a9b5d738f6"' - ' "025ede6dc13255b7b6ba7e597bfe9c41e0218a4450fb45c2dde92240728b307a"' - ' "35485ba20999dea4e577ff71a03b2895facdd0c04422f12d3fab3cc0cb1a2b5b"' - ' "bb6662d5d7bfb2b9d0dde6d3f9446a1e022e1948f40fbe58ac3ef981fbba8c80"' - ' "a91f8ea006fb7ffa3c8b7646e356ebc4fb297609e3b693b161cdd12598fe51e6"' - ' "8b7da40aa4f663b15ea8b3f710a9fc9860ccfd6f7abce72d5326d14cc77ff2f9"' - ' "8c6c9763aa586346c2a5a29401d319ef45b737cd4d87c8f786ebc0086ba0ad1f"' - ' "2baf29bfe608d86ebe253729c380fcc533b18fee19db778c63179340289979e5"' - ' "9e8425815626d2ce26bdc913dea0d5fc1f400fa3312efb997d905505dbd5aea1"' - ' "205b5212fb0a8492c880e8d390934b4d906de783f4392969f5be7860555397bb"' - ' "8f312413d911af37f7636c63f33fb48b5f6d15c68a04a3db42a3189e24690d3f"' - ' "512191a429f16b01a16d73ee97ef57f7699dfbdf4ea77ec445288fb33d3663a6"' - ' "741fa61fcdb50dc300afc1b626d9414bc573005f541a6eec38d60782cf444055"' - ' "b782f4ba0e8d5339a53fc9493497d87a8231574afafbf96e85385ebe891a4270"' - ' "97d632037760b0b33cf3342ed948d24ea6ae4461214bd3b7c9c385885588b399"' - ' "fbe8582b193be1657f0576d7435763d426cf4bff6661b081a3bf75462d7477dc"' - ' "ec4c52d0ffb9815766f6a9b51973f48c060dc379163869e69bae3055052c2794"' - ' "dbc20ff01e841465144f36ba30522a4ea19f2d25f7b1d0b7bb87f5e0ca149048"' - ' "87ba031182065ab2d7781c08e0b7a829ca5f34e9781f43a1fcb8fafa53076713"' - ' "995387f072de1050d90012748cb5e3008294fccb057b7d9f43723a44d2754c64"' - ' "7cb6ba27ef3f28f7fcc2e5b3fd89643821f22f93e78cf31058a241ae95b9815c"' - ' "1be2c82d51733eac4e6b7b19476406e57db15576c33beee0eb4adca5f87737b0"' - ' "a9daf5cf583904d5c7782f8edb24cdf04fc9853933dbe1de14b40739e6bf3325"' - ' "6e31820a404105ff219231b7abd672bdabbef024214341ac7974167f907ba785"' - ' "46d6a21ae04d601b440ff13cff0caa2dbb3b7b6dbe2a378ea92266425dda5061"' - ' "8dee7af57738b476c15c004218847d01803871a954010774d620620766150fa6"' - ' "ccc79f60e5c8ca5982764e27b3f538de096793e929219a9984d33b78e1c7557d"' - ' "8d47da6cde6e7802746be81adf3b4111c28f1632ac62e39376607ce68f11102c"' - ' "8bb234210f823bf749a87114923a3f50fefe831dc30e9641899f65d75b40325a"' - ' "54b6b4406838a478bb1d3ed396be56ae8a3279932ab09181e47bb578417d47d1"' - ' "aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6"' - ' "4144773688d4758678ed18fec3743d0759d3f42fbbe766f54acc7c5adfde96d5"' - ' "aaa252d9ddcd8c962f90bffe584c722fa38834e5b8051a4b7ac6ce043392cf4e"' - ' "80c2a49dcd62c93f667ace6549494b569ee2d574b03ef7fdee48080b0d9a432e"' - ' "2210b14d4791b4edfdb8cedb71482bfb0ecc21cf9d42793f9d06e522eba50430"' - ' "62c0947a8d1b8559d980307a432b26d713f221aed3eb3688c61128f98f1c5e4b"' - ' "1382fbfcc7691d404b2202838270efd4137d4a4964047b94f2ed1dfabb407741"' - ' "5478d1fe4f979f6a9a456d50dd84d18b04294701c9128eabcef412f6779a39b4"' - ' "44bed371f56abd518f34edcf6e12d198964b53d169ba12ee637821335158aa95"' - ' "f5373262a219ab4dd54a901c063c6455633536d7a1f320d2e5f21f1785a48669"' - ' "95f86972335363beff97375fdcc22b0d31728b6f021d905a00011b83c16405e0"' - ' "ee0d33ea8449b17859fa05e62d79cd67aa5e19e443c9c180db1613504176ebb4"' - ' "62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0"' - ' "9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582"' - ' "1c9542a59998ebee5568c152d930b3eda2dd13943f8ea44e3e490e4dd846e5ca"' - ' "81c1d54c2c531da88a39f037c10f343f6e2578891d300fc647fe6c027344805b"' - ' "5eb83ec1cb48a810bd667ea8fb51f878122b62698d10a5ba506675608b691646"' - ' "9b18ee5589a9975dac07e07e163fc326333418ff8c57d6c91aff247797329053"' - ' "72155fab13fa7e994ef8a964108e4f5f214435b57a98fead3ed070adc0072644"' - ' "118e07b4e4c4dd181db7c257495788b5f6a85fff0044d569e6f4fc19077c871c"' - ' "54acf03d875d277569538dc4afab8214275c455d8a04d8a04c004fa3b72bb411"' - ' "3dbd88569004d2e27354f3a166c434679a0769058e0b123e22c2c6c86cb4605a"' - ' "bee3eeb0509f0af7acfec816e30ea568b8fb98cb5a576acffbde4058574a988f"' - ' "d6a11018040b6242e82c4fe326f3deb2ece71c0e105bee57b53471677799dd42"' - ' "45d47c8069f6a26f25ff02c972117d0abf6edd8ebe38a34514e388d0bbc44bba"' - ' "d688bd08f76ebea82a1944ccd0213a8cacfc91377fcde9dcf17df8b9b6311129"' - ' "a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562"' - ' "31e86a063a1bdb8f77d70a05c0b67ea7f962ccdd527a40311fe0debefb724375"' - ' "a2da49f221ea054d054ad6864fa443ffafd25a21ffc643a30257980963f36c7a"' - ' "537079272b0ccda68ba39a657e83549c91ba45d9eecefd29db322a200d08f354"' - ' "439b2f72b37b28a9114dec1bdc27e68b7b261f73a77d5408eab726e5ba096ecc"' - ' "c18b493bdf0403f015b58745c3ef3b18a7253437fcb567a1e5f63a2887eeaad1"' - ' "44803559c71a805c0400f3647ff6384dcdfe7a79254910b7fe514ee1e258c12d"' - ' "9fb440b26b054059cc167bdaacbb46e7821447d3b89359a40f6b9dd60163eaf8"' - ' "5f88be80111356aa32af22b72157c314dc65efd1cb36a41c25b00ee4b410f8fc"' - ' "bbbab27acb546f3f3aa632bb5e084316f4af2fef4490262dfc33d4df624f96cc"' - ' "bab2dee1fc862cd6915bd9d70222c6be76103111d78c67dc498842a6c681ffed"' - ' "e54459c6e71f048bcba8c3103982e2b9f4b5f9cd9b00d0b71a2d03a24ab84d12"' - ' "55f0132ba99eaf397afb997f26900c6ae6c9c797f2dd99da5423c33f549b5afe"' - ' "edd25cef88fe2c1bd562e33f9403c1644f09f80ce10690f1337e7b295357d751"' - ' "22eec70bf4412de64eb3ac2aaf1991a7e1ca197f8ec37339fa549e0037908e85"' - ' "1bef2e01e1f4aad8becdec1dc5f525dedd83567f9fecfe51f6c8ac9efdfc0b8e"' - ' "2a01a22a5d823b5705dad1f7de5d15ebf9068347099726b95878aeaf9de9b625"' - ' "4bc1bc072949437c41adf9203ba98595ebaeb1ee47d231fc9e59a16e697e336c"' - ' "aa585df9ce9d53ee758526dea601e4718bfd333ac594448574b7f6ac711f0fe8"' - ' "a80f608476a3faacca1ef34361cc418a68661db2d87ccf0d9b14d307453e59f4"' - ' "b67373fd6b4806d799d94fb1391e7e3c01354b1787fd2f879b6cff2f154f0c60"' - ' "243be638007185cdfd1b24a5d30f78c55bbb9e6fff241685e12a8a175728b9c1"' - ' "a364fcd5ab8c0b3167f28db0e9729b552d29fbffa7a382561839fc4831c542c1"' - ' "6d67be88230d11f5751ab86094ccf4f704013e40c3172efee3bd08e772258f83"' - ' "679a5148066f3355ed6f66f53a388f5b7c3a301d734311acda9804dd747385de"' - ' "fd7cdb47ad462dc080a987b66612784a1955d2b80d4bfec9031517fc0626a0eb"' - ' "fafdcf2aa1011e57905046c5e9d178f8c3812f311ee6c16c65a3f436511864b4"' - ' "b8fea3cc9b18b4b09c94ed6645ad12d04274ddefa6ffd043576f00d2dea33d9b"' - ' "38d883132265520493ca6b111191fb18ad691f13de2ada0c6598a92e880b2c7f"' - ' "bcf7bd7b46d57c055e8cde4588dae1aee094cc225074e0b5430640e90a8468ff"' - ' "26cba7929124eb13801a4e32c7071a2b3ab10896048bb25ca900e04edfa34795"' - ' "4b2bfcdbd2235a917786405381129da36922bbbb3f0342fbe44eaad3760afaa5"' - ' "64d7a96e4307457cf9c2efdd4990bcf4b5a215cb60fb8c36ebb46d1ac01f12d6"' - ' "c0523063abe84c4064e3fad4f5503f9a7ea500420ddf909ef4ae1979da45cc15"' - ' "a12938970191659c4b45d3aee886c6ef9b95f1e02e78eb85c71343f4a1e8cdd6"' - ' "86dac88668ac7f20317d657ee7e95aea8a9df3530ff2713f8d62557e381bbec9"' - ' "0ed2bdca1aba5f0aa9b460314668ee74511d57e54adecb06a5595aa227db6a30"' - ' "76bc2cfa58c82672d1cbe9112bcec4e8e7935a53b1db21b0f5731cf96fadcde6"' - ' "13bd0b75039576c6b5f249e507cb5de04300c83b2971edd94686659848c504c7"' - ' "6f65ac067cd914ac0d3a04d801e0363cf615f867c0fe683340656387e48f9337"' - ' "5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e"' - ' "04a7afdf922df7e62e68cdcdec70597bcb86d2831fb50665b6989ebe850a2a6f"' - ' "dc923b4f2165fe6f326f26f8739ceb3d3aea3e5b78bc8b091047fc677d0214ad"' - ' "ed2457fc9931b8af83ff1428339fd6acb8619b73cf0e82c2658180f8e718626d"' - ' "a1416a250bf7219f95961f484421dda844b5013b5561c4a40591489dcfcdd384"' - ' "63898fa3645e69a333f8ea158d0c4e7bb20a4265f0d4597f50ee2ffffc9df820"' - ' "5d060c6fbf2dc9bcb1131452aec575fc921e64c88828dc0faa78a9a09770e551"' - ' "b24e5a844ab93fe8567b9f5937280cad8f3fdd4db0eeddd69079af1e8d7f31b2"' - ' "a58cdd282196a800054eabccafbecbbf5a4eeb6a5a7a925353d7901dae0db9da"' - ' "d7676d0f24364b278a6dd2b1c5fd34f688881cf3ff9e53e1e40f1b4048b7ce28"' - ' "66116ac63292be96cc8a20fb991844fa378c19051a156f1c4dffb7db01b43dc2"' - ' "bd744729e85f0084857466fe1d3df9d5caacb8b1f7cb0ac2bac6067361907da9"' - ' "36b19a238e94508cb66ee491f6c0f7c36ec07a938fd8cdf1ca292a864fba7f14"' - ' "88536cf7df49585be4aa97e938b5ef5b5ccc46abbd2919010646a9a17281e3b5"' - ' "0c3424f930bd6ac00091ef6a6f96cf4f88f830c85b8937dd1776154202048434"' - ' "6a4d371a7e82215799f79944204cf1ae4586a5a1cb6bdd5f6fb55e811e2154f2"' - ' "d1b8110868977a697f191498c1bd2ff1ea7ca469d1a7632b07411236dd75002d"' - ' "eb8426a2c384270297500f7ee836f38c6ba86eb981f8729304f0dc022e8e2754"' - ' "2fcaa054ede7ae263d4479c83e122bc124b2c78b768ad653eb4511a95360fd3f"' - ' "d0c0dc10447e81afa7b17ececeb7ad616a8a7b58fa9dbe70f03165fcea0a9f71"' - ' "3f661a590790cb90966dd89803bfa662abd8aa67bbf4d90e44888a48399597f9"' - ' "03cba07268c420c1e208547cbb7162fa0f34176c8949fc5cb279cef06e94e90d"' - ' "97c77f02acfa0a62992da06101c5e07e713b68f58e59098a209030a06ff2aa2e"' - ' "6bdedd8343999e8e0fce00858ee8fe47c1e42e27db2a217d4cdb689e048b5522"' - ' "f051f14146e69ffd2f22c48c5126f53e8a94e2ce86b9adb46de0fb5230d46538"' - ' "bf38ae8c1b495b2a547337759969967a8bf632f5adbbd9a9bb7c724007d684b8"' - ' "bc9c4e81bc9acd2a93de62ba696009084594161da3db5eddc4774a006d8bd07e"' - ' "af5a2f1b7e388d4fb49d72e8f453fda673472ad603bf72aee4869a34b37f535a"' - ' "78906623ce30eba7174e99d7f9d1df5fe69d1fdd7d5eb36329963e29b65bef2e"' - ' "a01634a49545e05dcb1624aec62184f1f45c9224e4d356d191971914a4668a5a"' - ' "f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a"' - ' "8d0c4a2565d38c923a50bb5daf512a7b80633643c65b5464d665e5f71b8fbd55"' - ' "816f1f4df1f3964c807ea3606a6319a7872b6de54dd9286c1fed4982d6982af6"' - ' "a2a67bc564e7dae8ebb3bf87368df309c1a5cb80b007872adc294e5da76106e4"' - ' "d6a3c1e20b5ee7b111614d914b286bc1d0d4bfd5f6663893a4478ab28c6c2e58"' - ' "77580df28349934bc9b326713207109426c53962fa030405668004c2175d519b"' - ' "2ad53cce04d81baa4eb732c88d465743c45a5ef4349d71d18759f715848c8f9e"' - ' "ddfc434ed42759bb027f8aa7ba857e1955a462000d7f128b8f2987995864e4eb"' - ' "9378b08d1f873cc78b3eae058a3f5533590d932a53a0f8ca1a9d7a3533398773"' - ' "b14e42aa75e85d5e0d14e831bf7988f0e235cb5e1d48255a637dac7548e4a4e6"' - ' "67f3574076af6c924ace8cd5352e99b7d9c756e7ef72ee356acdae0250f22307"' - ' "5a6a5d0a5fa64dd08476f2e9ed9dfacd92b4a142777fee5d37b5c05fbb972c2c"' - ' "ebd140217102e211a74b341198292a392a0e25ecf5ec1a53fb411c14c3b7b6f8"' - ' "bfc864e08da7597e73bc116169c20acab325ac0ed4efcfde5cbe751f7334416f"' - ' "c51cd6ef8dda0858ddcc67d4742b2ec0f9a3889d1ac3a3c7627f443e4ca68a79"' - ' "adec57e91d17360a84d443ec280165e6c00aa95e7664e70d7332bf7a4b4e0e70"' - ' "05937148071e4dd0a4f0dfa9f37b0dc587fc0b16041e446673affdfe0109c98d"' - ' "08983ed95707cb36e6282d4eaa5146525d8878e9ddff22b984c8a4298607bdc8"' - ' "6f65c49d2057a600e59c26b8ca003a17c2f312e3ecc269b8c69a6c0ad24dae19"' - ' "d614e03ba9ec3b8bc6b942b8e2f4743eab4d43b6620267a73896a11f5387c315"' - ' "ee951324005c874fc6b65d8c0028d206a32c4d3efe1f719fca2e64f0542331ba"' - ' "870f422bb0b9dbcf78765cd258372dc44268ee64d46e074f466c064ffe88f3b8"' - ' "6ea50710c93686f003af4b988504499a27ecd8355b47642c9737dce630950865"' - ' "aac8a487f9297ee2fe85b2a96d70ca018c597df314657eaeb9701b730bc8c956"' - ' "c297678aeeca8dc51d1c9ba9b70505210dd8f43199daa00d4995e0a923336762"' - ' "0f46b89689bf2d3cbcebff2f1f6986d0591f91f2e06b710a2b2aba771d50f21d"' - ' "5601862241d0a31a19c5b9a9fb3e9a7749aad3c6c0b481e4b8ccf0734d96c4be"' - ' "a1ffe4eda93f409d5a9182986247dcfea399341b2c5ff4960a2f976be64b9ac3"' - ' "8017ed65956d25fddc8834a24605bcaa6ec0c3070a61bad86ee57e5e4a2d04cc"' - ' "e4f89d9cc40ae3383da6c90a404b7403dd9e4d974ba98f483625fd7827758c7e"' - ' "b0866e9dec2d8ad9d4de1ab717dee5e2a575126ca8a8e1e565c38c61b44f48a6"' - ' "617d527bf91956db918dc80c769b79d0d9c6dd980b9c9419773575e2c166256e"' - ' "cc5415249cfa840db5c5fad2c439851d84276966ba7206864232119482786ca0"' - ' "03fd7be9f0167cfa5ed7aff44c310e66e20141134f4c4b51b60f7cc706a47f64"' - ' "fad48e2d29e539c4beb96e8e1d7367b53f14f73613ff97628152de8f910a74d8"' - ' "cce828a00157a6752738f4d54974b7c85ead80685553f856015cd2625088049e"' - ' "e8e0c818a9b4fc92cdc651f4054325da6b3e1f1754710704c2e3c1f6694138f2"' - ' "f972397ca82b604efdbc6041bbb1a435500cf37206de9973b21f8632433ad243"' - ' "d664021eff6b92368479a4b9401272f9f869bddb0a22da5434747bb0433fff45"' - ' "87a4e8e1c1056ee839eeb03f5108c87ea9bc4b9bce220ab5002f2853b26044b6"' - ' "fe315afcc80b75d67aa937c4234c5a54ea15b27652f6b3607b0289ac52228051"' - ' "a698fd443f31acb8747f8f8a33460eb04952bf3437ff0e07236207acace850e8"' - ' "7b09c0ac5c43fe1e0482d991c2c3c6ce01dbdd6b61392391df41510ac0114a35"' - ' "71a38bb78c3aeac3135d4f55aa1f4c4d54fa130fdef0a1a360d33d0f608a8f05"' - ' "fd6334c555b02f64adf35c06f120a6c650f7059cdbbba991123d76da29c31466"' - ' "1cdd76bb77fbcd5061671c61c6176ddfa6ec10c0761f727cd73c60e6e93f9e1b"' - ' "1a62ab32f8f5e760e6b4c1cca8a8001ba031e6a00a6440de4cf6e2d37eae7283"' - ' "8778196f7d3c9c18eb0d50236e52c814f735549c5aa00de3bf70bf1c1398db75"' - ' "0c6c43f41201dbce3472988c9c16232f1540de43e336f73d3db4cae9242c7568"' - ' "a579f41e732ca4cf5205595cf9a6844d9508e39e5f2b23d7d65f41ce7ccf81a5"' - ' "8925eb6a43dd4cc79cbfc572cea2ef4359c6d19e90429b1f0ecacdf483c8b2e6"' - ' "00d148fd3572eb11cdc5dc7c39369ce0a8d5184549c0a8a80c0562c1c9e8b50d"' - ' "7e3b9c7b7f848252a548877f6bde45d9c1b7e4d293e95ac87f5d3907f6dcb4bd"' - ' "51682f0b692662c08b4db3a62a4c223b98c1621a443d175ce0987d869a36ca5c"' - ' "571e00f38e991099c5544fac98d45e5e3a89bebc610beb5512cdca01d56d13d5"' - ' "e84b8cad66bc7602107b7ef59178595b3dcc4843f8846b835f3316e1a4182185"' - ' "42bc3ec5de505d5d3fa1fe147ee88418848186373be7a3479954cf57a4ccb4e0"' - ' "4f91389a0c0f5451d064d0f31cf90aa77b60b1cf937d0b4ed7f1ec5a358179c2"' - ' "6473eb6ce8a8bffb6599c9a71820e66b55a71ab58e203036ed1e47c205e7278e"' - ' "cf44153b92da38b641a45988f6bdc1024c8c9482305ca024897a51636ce59d77"' - ' "5a38ada8c168bf7f2e88f353ea58a64033f89b3170dcd016ccfba708e64ac0fc"' - ' "0ba5c04325f7af25a2f6bf4c588dff798d481b0a799b10faac9d4daed7c09c5e"' - ' "6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891"' - ' "0a924a5f0ab09c5a8a07807685a4637cb54cfa9185da8a18204930727571ed5c"' - ' "0cd19bbf6f9d4c7957914232797342030258b008554e7f88d03d55d71086ab05"' - ' "e87b87e7cca0f235c07ad91bd09b8df76155ab6dd172d4ea324e06a6477acafd"' - ' "a0b1d4c8d3356aae2caaf6030c7eed821794f7b32bcdc538f7960865856cbec3"' - ' "c02d13068650616ee7d93748d98a79e942dada09016ec5a18c725921dbbecf3c"' - ' "1916cfab459307852b4d845e05b4961ffddf742988d22d63531beffc7ec30e7c"' - ' "3652b0a2453858df736e1ff16e04120b296641b22f98643a7eca6f4f981c0c3c"' - ' "5b1a4ff601b9a7eb49bce8aa570a31cec226313842628ecc204f24ff7ad280ac"' - ' "de009520d1e656a090b96736712653fd174d629f0dbe7bbe0d240dfd18004d4c"' - ' "27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093"' - ' "43b37c505bf661804a0b9a117a8875c47ae74bfec8b9d61d74dbc636716923d1"' - ' "e1abefa9c4682f8f429121b5b54b5443dc36a561abd5f0506f3d5f5ed5932627"' - ' "838a421db4e9ae25ebf41b3c3bfe50c08f89f76a654ee51dbbb617fe54e9f145"' - ' "e0968fdd46a966fd96963e0c082c826f0f4f68c6ae7c47db740e375b838a5166"' - ' "bb5a7c836e9a37aece882f9b04a3c20b2bfa338fdd29e41ed836a56f51f6a854"' - ' "4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd"' - ' "c11fd6a7eb8c9c12b53c1f073101ac691d56b40188a60daf44eed58b70b31cb8"' - ' "4ae8ca363d5dabce54deb29394ba21ca5b5a6d1646d1063c42c453567f40cdde"' - ' "24d35d5da1d2f76292de0c6bc406fcc1108055eaaa0b54952cf8d9a49d0aea3e"' - ' "40717c6dd9e3d28afd7937b8651efa2096c77478633ca1039f23c624ea322045"' - ' "43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a"' - ' "eb42d41b5d7fee9a040b863110ff675b6e907a4e570a3d2489728fe61ff8feac"' - ' "e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd"' - ' "b91d0d56c1d7ed94962d0f6501761db3573b1090fac15d9424e8b3c8b1914c9a"' - ' "de5b161afabe16c6de6a329454fb6bc2503a016431881e1a152b1ab755afc447"' - ' "91426a0ecbec54c757f946939bcfa983a365c12c4b4350d0565ecb46039ee353"' - ' "08becf1a0bd0a2ea01aab31d9678cf2b2e72372fe10aa01777c18acc9b9ffb30"' - ' "25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319"' - ' "d536a74a0d4e7beb230e9f36db8c302a3dd7d18dc2b50322680aa497b45cc1fa"' - ' "55e5e366d83ecefc831cac6499bc4f3c1f81fca0ad3c14db484eb59d53360d7a"' - ' "4d9d9274a5f607b4a04d6241b17b0bf447111f0c965c07f624a4deed906403c3"' - ' "0425863c35329613c911915f93eb006b2c4146d8d49b540844a6c2002ffccd02"' - ' "d05b01e00340c5c566b5866d86146d22adffb56d94af14a658b91cb0dfb2026b"' - ' "02ab21651a7d73e8622bda72a558b3e2937a2325425feda9d97b859b9a6825a0"' - ' "e0b1b9f88a12afaacf82cc053719ad44a176a6799a76b9b96109677ca52e0e50"' - ' "b4215570e813bb63397f602d9243504a272af92dac0e5dad0ab62ef5958f0805"' - ' "96508589d281460eab4eb1819c80e89bdffdb5fe86b8fe1400bb9268deb09e74"' - ' "03d2e8ef968a70c032ffb01c98b29ab612ae48043b44e63d15c2504f7f85de13"' - ' "b9b09102f0be935f39d742fe72bb0b98815d2a21b3f9b96c403ed1fb143a816c"' - ' "d8a5b845155fb8b7c1e6f584c1632049071ea72a8b64748e54d9e7a9802af31f"' - ' "2f7ffce5d02499ed4f3801aa1433ce0dad003a1ab818659a1994da2059c942ea"' - ' "2135da1fbfb04479247c4268d2002059ca335b5384929093644e4896c44a37bb"' - ' "1650509e245d62930fcd56d8f8aafe5e8ed9a57c746f027d7565fc732b77d7dd"' - ' "f40c9170ce158fb797deb5bd41f4110b51439d9fd9217944a01c325a6ca5c1c8"' - ' "d380f9a174bfd62bc70b845fdcd4e6043dd0d74d140326354caf1a5342fb7f77"' - ' "4f55629fddb7c272fe500b6a132fb15341d2f58ca29fb597be19ebdb77e1994d"' - ' "eba88b2d0eaa3aee3ed5065d902ae7445adf6f5874e3b47691637112168dca30"' - ' "03c5743f47a1fda44c176239e5db1fce92956512abeff90104c89fff4762acbd"' - ' "a4c8e913b89b45b64ee0a252b106388f28606cc5ac29779bcbad4b8dbb156646"' - ' "b6a5fad8301562cadab74015ece5957ea782810530997f051b498083b085a2cd"' - ' "ac08f4de2a47aa64d78f1844d326d6822f1fc17dfc040ef36ee5a1028f326a18"' - ' "2bcb88f4c13902767dba8f908dbfce453d2ba230b1712585909fe2a945a8e438"' - ' "ed443150ff389c2303606469b6339e9b96bec72ca695fcf82adc0f5f0130688f"' - ' "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"' - ' "c74a767e706428aa09fd7374d35f6b813cf35dbf1f0e8cc8defd80c85f97485b"' - ' "559e5ff2b8afb25bbc62275355ba2ceb668e8707de6b221315afb6c2390ba68e"' - ' "8539bb178bd466a933d77d27f895cd6d958b7bbf132b0484c4dfc46dfd485337"' - ' "9aff77873a7ed7bdc8681fb33ff0add725eb8f3bbe03a71cd3dc0f48d25f6634"' - ' "8d3c34527d9463895ead1c96e6fe2718adc3e84a4a18d121f8fe298d0950ebca"' - ' "b253914705ee609fca35a9bb69f318b7e871e14844f2dfcdc1ed7287d7bf6771"' - ' "5d137489edcdbc4b20793c71cd8a189db91fc960e8aaecad3c32178c6b403fa7"' - ' "fd3147e1b9394e7c063eb8086f82e2ddade915c4b5030d17865ff1a0e670488f"' - ' "f6b23cd237e6eff4720e9bb1835113b04735092d556dbe89f93a4099229ef77e"' - ' "b93eb36eb489daae00b021456b4f67b8841d4e61de387e6518bcd4a9b43661db"' - ' "d2e0923affdd8ca0f40ab962dad3358df6380c319869f09d27bc8b8a8ad22101"' - ' "fba96428f3abad42d2d2d3fc732d5a7e0f0bae85cb818bc2db86c9c6cc8177ca"' - ' "0f8a77a1bfb5cbe0d877aa0db048cd0dbb9892b50110930d4d13e738c8953bed"' - ' "2536b2fabd1afcbdc51e307ed0a43928973d9bca5bb87c849b80b77370ea2ab4"' - ' "88a809fd0fbcfe06987d6c3ec704c78f0c5a1d83aee1ce8b54954d6a6a9d6f87"' - ' "9f917f01cffa35d3a539039367d68c82b06b15ef5a46f6ea1740dfc8aa7cb009"' - ' "7145715cdc4352efd192a1d0441180f25cb274f2602845f0ddcb60a1c5337437"' - ' "344009fa95d9e38fa95a7f915bacdb9e744ac7cb23d63a9d2cd3f97173273673"' - ' "00ede09948ea4288d12db39d0ba935e9c5221b2b38d2fa67c5db0a6dbe66eeba"' - ' "155f0ec763ff3db0f48796e55d1401620dd739d66ab88a8dd78d8fae18cfc79f"' - ' "00b737ebaf75e5059a7bfecc8f67d8269c82f9782bae8367f79740bbc1f23d97"' - ' "e0bd961a9996be6496dc694f0f21576ff7cb50e53ba69f15bf21350451473c4b"' - ' "f4bbdfa60e288f6a8e0f132afaa86cf7b5ac3ce2594788ec7a101c2aaf8dd66e"' - ' "8d2b9ef75ecdcca8d51a9fdcf442526910d0d50cb692d40084831900d6266e1c"' - ' "0f1d3f611d0b45b0e413159f8dd3f11fb4c45b0030a937302efdcc10fa762a0f"' - ' "1f18ea1bfe695b966354c922138ab79b4347f50fb7f35461ca298d9c0aea1527"' - ' "ab89c48a4024030bbd3b73edd83f50dc8c4db63ed9d1193247ccf791feb7b19a"' - ' "0fb42b068534eb011b661f5a8628e7bef6be8716748f0214585dda90032e389d"' - ' "5d80e16b1d2a1a82afe8ab89c2d31bf51cd0965f5fdc658ca155167b4c30ae3f"' - ' "fabece475f5a63d9c58ce5f7fb1f8d4e9c7171ac5d603b7b1ec31b0932008cd3"' - ' "31e517377c8a025ddd0adfb0558707464875187624981204e00f62a34353bc76"' - ' "4460e3c8bd2d7843008ac46c66654f7525f6464cc156b8caa50b0bc072844878"' - ' "096943093f385ac0cd7af53dd2bb5afa5ec20159cb0a550060e5a1c06eaa25e4"' - ' "88a267bf0eb21b2dfec2e7320af2b34f110a90979b1481a0ace0a2ee9dd4c68f"' - ' "2d8b09556b0e45a68e466079e1b3e9446c94d3e671d84aeef4ea5c200d8f6255"' - ' "5206388541dc7e4059a638d94972ae6f16e4afe8ad7309d2a1d89dbd9323e53e"' - ' "0876e2e14dacb3bc960635fafdb65f2461c1c53f818c50b88ed74e601cdbc555"' - ' "b3acea557bea869639f7849419f3e4c7d1a58e09a13faee4adcddd954d692c32"' - ' "bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd"' - ' "3bbbe5434a963c477170bbcddcee3fc49c11288f9e195affb37db4872d3ac62d"' - ' "29816ba7d2b19508e688c572c98297150af0c4e62cb41cb78e6cf33578525989"' - ' "1af779d2b6f4f2c3801bb4e85d872a4fe4ee2168baea1092da9841dba211ba1c"' - ' "ed97fdb82c3dbfc55cf1203cbe82eb3ca983c084efd86c4b173916ae682f5a77"' - ' "696329a31289fd29b81a5fcaeedec83bea3cd21aa9a721ae50650a6a1ac6c00e"' - ' "89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975"' - ' "993a91711f05462dd1b5ebed9bc75892812d1029d0f40db02ff2145e11fe7d12"' - ' "dc9d9cbe82984f1c897f5d7c185fe75d35c63e44615bf9db9e0a53c7786a43d0"' condition: selection level: high tags: - attack.t1071 - source.MalwareBazaar --- title: Detect Activity to Known Malicious Other - MalwareBazaar hashs - Chunk 2 id: 007e370d-f684-5fad-a64c-39071a154e4b status: experimental description: Detects traffic or activity related to known malicious hashs associated with Other from MalwareBazaar (Chunk 2). logsource: category: process_creation detection: selection: hashes: - ' "1c7a1cba990b09786a6f27ca39ca8779ac0f4702ea62402b87aeb0bafc64680f"' - ' "b4f3acd50d0947aded733854216516d46990d57ce5e2cdcfdec432f0e498472a"' - ' "cded0a69f7e9884f965e83c9c7ee3523c92b676abb38905ba0cdf88d92825638"' - ' "7a0e34e5f3787471c5dc473771594ddcc57eed50bc89dfba8c27f049770e4cdb"' - ' "d60b04ecea3adb58b4369d4e52121377a9bc28fa1a29b69ceee60144c47492a2"' - ' "7e4549de761b5bdb361bf22e3f3069539400448094c45d2e84175d76b6553853"' - ' "fbc2b2bc5365528b68b60a150e85407c0f51952b95c272ac7d85714fd1e0e8bd"' - ' "5c33e3dfa983e99e0dc1618fdf7893c43182d6ef079f34fe3c94887b63ab274c"' - ' "c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef"' - ' "fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa"' - ' "beed089163efdba28ff4e0792272c79708c3b471be85f39bc1b5b8be2ff479cd"' - ' "90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c"' - ' "f68b0ab0aa45a9119c1a097c4d64dd3250733f771b34cec0699e3f9a7c88d79e"' - ' "c598ae0dd7ac49781d2068dfee9832ec0f577514d733877c6006a2e30b1943c1"' - ' "f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f"' - ' "946243289414d475c5fba55850ae2e7e9bb56717ea1bd8ee765da36455df9b2b"' - ' "76f31ade7064e808784e930b6d19ab13c44d016843ca3e4ea240dbc021aaa802"' - ' "03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d"' - ' "d780f1e6c3778505ef4f160043014e1aa9ecf994c9cfc78d87a3e588b08fbb32"' - ' "dae0629751f92261c4f365b4fc7fddbb86635adb89a6db7726cf7b6f62f991dd"' - ' "955e528e5783ef01dd38beaf307301791235123867743a7a62424b3fd4646278"' - ' "691b0e2f9555f229e921b0679f72452fe66c0d2432156efa4ff18c3f3724066a"' - ' "6c95b2b11729bd3b9076a0e5f08b578f1b07f3015a8dd99ae3a0dbb8a02b5b69"' - ' "85931578b4999670172dcd89d38fcf789e2327d9e6fbc7ebf47957d543e546dc"' - ' "3c2227bf19e1c955aa405ea712263567aa4b8398a04d299c0f1ac72a68d8b078"' - ' "4eac4154ff880410fa6ef526c82edeef040ba804d8d9906b6d876cf696ab2af6"' - ' "762db662ed65d34830b16e15767c05fbb1ccf19255e9b7d691549aa6cb60fd14"' - ' "244f99aee7d8cc63cca05e29ad19f03043165a8bde6ad4f21ec88cc6bafa858a"' - ' "57a855d9f0af4f98e71bfeeafe729631b13be2b8fea657b5e38341a980efdb9f"' - ' "dcc58cc3d0ab2f4c441e84c10e5fab7a65b4a679281aba18681fbd312b32f1b0"' - ' "e996cfdad8da2c623d24005b615276179f74b64a0cc3ff1e0de40f73e6ff8ce0"' - ' "71597d1d3fd474edc6cd032cef4453784b0f9e0952ec5a086006e391922f59a9"' - ' "d9d1e5ea108414535c5c8d6c7ecc30589fee71ff48cd19f1049d60b52b0a26ce"' - ' "895f80a5fa6b4a2f4f4446f4ec6ce464dc14b45883a2b41878c777a56adeb21b"' - ' "680c8f5840e1711d77a5b13cd2f0901e4866f770ce2778110c48e39ad93c4cf4"' - ' "a33bddb753434ac6021a2c32ad9a2e050addf6cc150da04769a3be64081d5e51"' - ' "7772db3f5485066f41830ec76a1b1452566f79a42659f3cdf445eab0593d9518"' - ' "cf4542d34db7c9156ae66d879818783058d3bb5bd6c4b004c6f7d4cbcec8e707"' - ' "eeeeccfefa06df87ef0bfee361639661e1dc5002e5ffea3836ba01976a67a9b3"' - ' "dfc8cd0674a378ded4d6de7feaed43f81d880b8ba6e13b3f9114ad4a052f56ed"' - ' "70834d14952834148288f1cf93edbac7eeb8a62cb90fb312c8e3091b1e14cb89"' - ' "7ab8371dc44a606e6ae0f5d4311569fc0f2238ad9f9e812b484398a03785c08c"' - ' "fea5db3aff1f2fd2b8788e0606c0d6343c4619d53fe112437bae0ac2f6e648f6"' - ' "05960451cd9f8bf4923f125aff729b16050a0c0a251b6792292126a5037a64a1"' - ' "65a8f831e009188555486aae3544cdc71bb4669d132d9a3314dbc7b31b8d8932"' - ' "79f402d7d3ec9e53e03aa1b4fcfc39be316a224f00f0730d863ca70ee74e2a1f"' - ' "994ce8657997d283ab752bf0d48818df0b703b92fbc445923c2088dc422f8dc1"' - ' "6a075178d97e5a5d954a4371c4411b5b869e9693f3b1885e99ccec118ff97f51"' - ' "ea867c92a10c8bb4d0121b06aa4bcfe05fa0e82f91077ad97b32141743523a87"' - ' "db692efe262d1cff65404d339854a925aa7e0ab2a8f2d4ada56ca6956278362b"' - ' "5e361fed77e942027e81e3e3f06d7cfb3757600103ae754d21e0b6266cd885d8"' - ' "9d652945421add47e3f0dcc5d873854376e1739ed45260237094c3f48a5a3982"' - ' "1c27866a299479060701f024dc15f17701616f786a06baa3c81a032932653eaa"' - ' "20095f8b7368bb158850894fe6af6af04cb725ffe3a233a5ffba3c6c34732737"' - ' "78afd6d38e77223e91428bcc55bc697419673f0793e93e284bd4f57fbf37178e"' - ' "234e8b3e181511af0ba6034688269aa9862f06d6898784e446d68375df10650a"' - ' "4b89913b90dd9499d8a462849f849b1f69cb84bf5b4ee0a8410a88ab1407ad2f"' - ' "49a8507e58f1ffbfc025d406a6fc9fa3ccc9f70e14ba46d40e5240529eca9e2d"' - ' "a9b91ac8c8162ad96cec334b084c787fc490bd35b2490f6762fd52cd8083b9d9"' - ' "d6317db9baeb51e7c4e67db12190502c301747a63fa0aa734243ee4bb811233e"' - ' "9708f2b3225eccec088a0a5cdcd6adcb195a7df82ea3742744d97fc19ba79cae"' - ' "734a3c39773ae8dab54e21d2d3d5d14e57601f0f97e69601d2e2782cd2c1ec3b"' - ' "8aabfc48f8ed6b2a05ba183660e44587a7ed71b4f5dbfc9438a3d177c70ee63b"' - ' "4298199643f6b5f7ca53e19cad60d3e210ccd0d809e3c2878b1ecb8afa1d2984"' - ' "f022acb351605a921076735b3e9338232ba4afbec4509e0d1ef2974953496f30"' - ' "1cc86e48d10d2f9a4d986ade1189cdaa773312db3be38f2031ad6404e843533b"' - ' "0e0528d4d1c7d1d8377a708f56f3aee3946d136512d152207e343344001c8365"' - ' "f4b3816a777574f642113def076a0dd356e668af8e3354185759f682172a2fd4"' - ' "fb627d67b5a9b670871c45703f6ccf7a0514cb0027e6f8a67039a6ed9cb3adc1"' - ' "5641d81e246be2bf92a7e039c5df2048e3e718758be982254b19101b6edd2c72"' - ' "d7c3b3e9ee4cfc3cac71ee8cd92309e4115360af5f7e155aa0d67e13a367713a"' - ' "bfba0f68e3d05e85c69a1522a0dac24b9e5e1369675e7ef93ed840f97120ac1a"' - ' "db224ca8fdb353dd9914ff91283b022e30adb75c33a750ed7bde0468f7991fcb"' - ' "8b411ac80e787590b787d87f1e96814eff9c27a0284ef76f0d95ad9367171be7"' - ' "142b78add17ae70fd5e5d3d5d3d66bec9fd2ac2ea1b4a11ef2e95538de829446"' - ' "0e50f54b54e3e179fb5530db13375a7a6bc297438511d374c680f32834934aa3"' - ' "5ac2f143982ab47b9f97f33498bdb76a2305e7f71f9592ba7250df5f861e8663"' - ' "faf3988b8f6dc690efb46aae98efcbe47e489958759e0dc60cb697019fe69e81"' - ' "c7efbd6038b27b51b39b30fcddfb91bbab0418997b9d05f639d0e053f23fb621"' - ' "197c435bd667bc44ae26a92898c34c36f8a093228409fdf5340fcae9ccabd642"' - ' "608c40e5ff9b0dd4d601d0a81751e1dc5cfa0f28dc526c1cb53d5d0898579199"' - ' "a5e14c19f1f736aa74a7fea4cf60dfbc22761b71cb24b64bbd77c0bf3fb1d0c1"' - ' "dc26c4aa0b5dd2cb74609168a68c818be6b9c3821fa56a5a9f659a5ff319a628"' - ' "d58dfeb75e2341d975e48d9553767909c176df178844215bc2bdf1660f5d3969"' - ' "1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46"' - ' "2d98b44c0532415ce47394f90b47da593c0619b21b486dbb80727d05498eafbb"' - ' "fb5c18b832e23448d78e7b2542579d1c79362636ab96b5299052614166d4e3fa"' - ' "497a067b6a911e187d21bb71e03c38892c5227700b35809e4526f583a4df007a"' - ' "710326f27c8dbd58d83c386dbbdc5c807cbc7f31ef07ad74d08d785419dc5c9a"' - ' "914c6ac38868363a37e12bd2b6088a3de87ea62a1765948c4faf31ca8bfde88d"' - ' "d1226435633f94e588dd20b6d15540dc18f30dcc3df1111795f24ef5d60cff06"' - ' "3aefeb77d9d51f85a2637c01e6bcfc74e9469a7bdf36fb908a5504e9cbdda7d8"' - ' "af71b2c0fa2345a5e46ce52b14f9e3ec658b4e195105c73f4443c79da7e286e8"' - ' "6042e01e3670bad16131f4f2d932cfdb9c9d01a9838447ff2a006a09d409adfa"' - ' "475e69baae47f29ca6e4689e5953926b5a1357d69ed8e0022b85804cff62d51e"' - ' "1a020229e3b01d58230ab2512fdb373b22d91676b441a792240a01f72b27affb"' - ' "1f49316f60cee5fd365ecda4b1c43fcfe10ec5a52fd0721b4eeb811afeab77ba"' - ' "d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835"' - ' "4dadfe0d60ca295ca0a3865cccf3d47c09ffbd05f2e2d76a578e8d645ab72f6b"' - ' "8802527c317068b4b824d7bc1843dee0e52e047c7fae4997d577c11349c1ef01"' - ' "5ee86cbcd296e0998ca20ee65a7506fb3baecfb7ce98eede29bff1a6a6e0fc95"' - ' "b6bc55d2b6e281b5bbf84f589a2847544233ad4b7abd05f942f27cba26703b8b"' - ' "5a5c24218a370368835995078715b51163521fb06d17922876968d0f2ec2b9ae"' - ' "ff1c3a2866f389f8ec2e4d57600446da4d131bad8ded341aa6619c0a0d35f752"' - ' "ee2169a39bff9da6e3152e80a13b0bd9dc1e55c3ab191ca387bf8ede1ebdcd8d"' - ' "f901e1a138129e819f4759f30102e94a9987409f0978c9505c2d679d1a0880e2"' - ' "798b6a521d6763f1b684f6d2a6c91e3eab92425dbd9265372a132aba1e213c5f"' - ' "72ba37f28406579b8556ca03137e7c2c4bed79e5fc875e560c017f161840fa65"' - ' "16efe20ecbe454a3390e05e1641c91bbbf436a2ab1c830b76dc6c8a8b4843f14"' - ' "7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413"' - ' "cea15fe7edd6b1b26f4326901781c16034ebe195cdb89ede2338e91c1d7ce6ac"' - ' "9d81c29ec25c73da97aeac0b1070a01e4eb9e7c310597ce70c54221eecf9ee17"' - ' "39e07fb60fbf206b06d1b5b2b74848d9d393c6bd66fd11e003436cd7ee6b5788"' - ' "99cd8530772b5bb986883ebfd09410bfd5328581a3e993472826eda78d6e3405"' - ' "61ab1d22949eac0582e989ae065ec4caee9ac99998276317edda96735cd311fb"' - ' "375f8a4ff4eafe485b210a9ffb6a84bdbdb9c52ae602293ddae53717935e8daa"' - ' "cb8d68041200958ef7c8b1c5d5cb82c2545f2d89b67dd49c564242f2f009362c"' - ' "c200f2497e8169897a1f0569e720331faf5f2fbc50530614641d612b4488797c"' - ' "0c16963f43604246e81f006d1f7df0a7258b36b929252c1502d92fea573d86aa"' - ' "398f5afa66a223371927ab84bd7c142d510de07887ff24e038edda78e2be5be6"' - ' "ab9476466cfead369f859a5336e557ccb5b22bdea09d3c245a91e9c305623427"' - ' "6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4"' - ' "92a466dfe16c32bfda121f36c95774dd26d84bd34258199f6e4cf9995e515268"' - ' "1bfb41a19de49c9c0dc63f434ff46f51ccba78e25629031bfda16e56b0f09df9"' - ' "9cb003eef21a9bc4b40536c667f65ece28f9d77665409908c81c3d64995f828b"' - ' "504d3db673cea7561272630dcdbcb132c470cdb6b4735af762f541f3adf19942"' - ' "4ce994747eb5fb4113f23d42f22a089e099c6690980dac9c92d26a28762e25ef"' - ' "324126d263910469357915525f2637ec1b0a2a6b875399b96c979687fed86e40"' - ' "af9675e75f65e5b6e422306955c8b2b93c2ee0dfd53fbe72cc81e9eab11b701a"' - ' "7b80dec3ee801e2d7d11373961448a7217078cb2721aef71fa2fd19534be3794"' - ' "6a4d4cf66e35ceda60fbec8568fd9a56f879c7a89b81286f3d0c33be50da89b8"' - ' "3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4"' - ' "6a2ba34451531f67b1fda9e5f46fc827a9af9944c348da0d81bc2e3a2b1195b1"' - ' "e03576ef95910013498efcba8de6509fb5f90398463f070667573e72b24d8607"' - ' "f0947de60d236365f6e8500361a61ddd76cc80c80d1e6647554a6a9f7a2c14a5"' - ' "8f51da6e72b00cb4c261c86ed00fd384c59cb6bce92f3f2ab9afa8a6902f9c78"' - ' "fce803738319874f83444c378945937195738bc12498d3e8a848fa3c6593dc39"' - ' "a3d28aca0da85ac7673ecf637a9b5ec87609e1abadf3b92c07730cdd2ba3fbea"' - ' "3ce8f79aeafb2664e8dbb3b08d06ac0d853531ca3c81e40888575b622cfaab07"' - ' "1bf1340c4954246861b4901b6a06e1aaa79ef186d1950dbc7f1c22a023f3f406"' - ' "49db1bcec605b3ec136d27cdc4f5ec6856fb5ef2c8f8f788688769ddd0929e2e"' - ' "120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab"' - ' "7c11e9050747ab4e1b350fbfd4d3b2c31dc663508cda277a223d1f55600735ee"' - ' "879617884d18a22bbd36afdcd7bce133f1e1cf92471fea46c7632ce40ca3fa56"' - ' "775a1891fbbc3b77a87b57715e24fd3fa43fa21b2f676d5e0c1b4af57b80abef"' - ' "b9ddd7f8aaeb1247eaa881caf75f8749d4b7c4442408c37d9bb57ad9927ee19a"' - ' "0d925c5400e17a96f4137f8cfc31fbd3890e96dddf178ce96d16388fe5b867a7"' - ' "6284528c4a3bd859b83fb286f7a65e06ee5bb77e970e933c2671c23eda636017"' - ' "395c9fe4498c5bfc2718a994ee82d3059702bcb965a8acd0770946b112c0060b"' - ' "64634ceeffb1d01ff9ac39164700fcfc535e08209d289b58b66582c5801ce24b"' - ' "3bfce4dc88b073a8ae6c85129578b376aebd83ca2b5adbb609cb8935f5b83dd0"' - ' "316a011169a7b30844d28b1e1afd0add0343f8310464ef9410569c8b12929068"' - ' "88de646b346b25c8bb1ad21ce2884499e9281597122d91162248e10bd7c935dd"' - ' "4d0c60de311727221932fb0d9c639b98a677aa99e1af4055fb4f2f6124be5ae7"' - ' "1dbc8fcb10b9fc3b08e0fc7c537918cfe6ed72cc0825aa1ba36262a55e0efba5"' - ' "e4fb9fa9a3d8167997133b6da09766b2113af3eebd1bc036d000648514610412"' - ' "e5b05cd22ea137f29351c6995e43eea0c5ec082e70ee3b6012e9c06c31068586"' - ' "7c421556d7798939bfdd5cf2cc5bd7b441224cfcd85b8f06858587a0f3e22871"' - ' "dd04bef1fb8fc82681dd90e39b6593c6a7d7afe8a6ce7739bc6f2bbefd763bd9"' - ' "376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88"' - ' "6d2790be771ec07b236ea618dc29e1b1364618521d6806483f0e515d99fde7d2"' - ' "663606a57b1f38da90136e9a8c2808c860e12a86d06e65231c104d7d44727a46"' - ' "8b77fb002e30e9cb667858d0f08e2c5c12ed450aca0d7293ecc092d639bdd1b9"' - ' "1945428f1a5bcac0595556d7acba0802c96ef9d9552a91c77d71f7bfd89c22f4"' - ' "05f93f2b503afa4ab697ae597cfe20e698b403a19516565f7d2277542f755e37"' - ' "594683e84aee02d2b6e0866bb55f8c665909cd96501a581d86be52126e63495f"' - ' "30788d7f420b84cf1f32fc63704e7fd0bbf044135b9f19d139a669c669d3ff59"' - ' "933f5b863d31390bd0ece05b5161a9e4c7dd440f2bc5c519f3ccb3f59a9f2437"' - ' "5211f23b3a96318bfdc662d65b0e3214bfd6fe39fc380180d25c91cfaccf91a6"' - ' "4f010dff7246390a67baa640a60408b15eed0110b318d6fc27d2866ec2f46347"' - ' "e2075682a3b7d3aa51ab2864e35feca4d3331ee59430cbae634a443983ab64f8"' - ' "20df2cf7270385a42b4a82122f5fd5dffb450f3f52bb483342722d0683635de0"' - ' "0ecc8ca00c5f331e2bb732b2295c8e019592d333c2ae0270653bc2900384a700"' - ' "adfa87d9c55472a7f671068681da6afe3d8d1019e70a397ddfcb3785d5870d42"' - ' "625e851b03c82ce9cfccddee99e8cf781de81afcdb1a89904511e99ccb960ca8"' - ' "559f371c949ff379c0f442fa7e3e35a3fc05ee03890eff90700f44db8a0b7348"' - ' "719ebb65c1ddac3e2e0537b60f0ea69107916dd7c6ac086d627363bbe7778537"' - ' "bce37988e485df1ec7b6407528793c9e72e4a42122120c880113cba5b9fd6b70"' - ' "d28f8996e7950f461242a43a37f6b9caa37a82f44d64e47d8570041b09aba6f9"' - ' "f0ae11ad6563377387972d1edca069529307efdfd6a83eb2da1dab900a7f46ed"' - ' "b192845b5838888510d7f50a2639f035c5229f6795faefcac84cb5c3202df9f0"' - ' "3d126d71cbf749f967a86a66af45d58e5a28ddafce98a8296c488ef1eccd8b4d"' - ' "08a7e7d2ca735e2e9142b50b0874cd801efa9058a6d1288b47a1f2aaff4f17cb"' - ' "2bd862a47885cbf30f4b9b454a8fb7f768dde815c3c347b9bb7958e72df4d48f"' - ' "c048a593b64283dcded4ad7b0ca69e8510c2f969576c40e04058dc949089ce9b"' - ' "3c249a9959969177ed3cef5952f04fb169439768f7993832723be6d13f96cd65"' - ' "6eaf3db89f368d36700e9de77a53968169f441f42e14bda9ef8ae2ee40a5590c"' - ' "cb2dd0ca49f2b01b684d38f85e710781d8bfcb87b995ab2482ada5b7275c311b"' - ' "b0ef763f0470f6000d3a7897368df0a32d2d056f3876b65f063da3477becc6d2"' - ' "a91762f2e84a425e9f71c13c658b508e15fafb82493902479e2cf3c53e4e3dab"' - ' "eabb7c5b0361963ad550fa2bdf7b60b64430cba2e1a89c4b3429d373f015af4f"' - ' "abb6b0f913a1f0d591ec92e302fa32ad717622255c1f511be2fe14253c95648c"' - ' "26d86f12a92a23f45deefabb67d252d562313f75c1a82f0b499bf751d8ae37bf"' - ' "2b7bf07e2fe98d16055d48bdd662aad581de186ad345d690bbb73145cd1b20d9"' - ' "3a066ff264cf26ddb814cfd79ce068febbf8b513c28fb99b45774b67aa82e202"' - ' "bc589a05f21e9e407e856ae4306dae71699620844512694d89fded2d31ca2a20"' - ' "64e2aa64848826b96ce1034752ff390df63eac2f88c2dbb9c0d7082e94475450"' - ' "f5fe841a98f372eab1db20a33a15527a637faecd8ee6b3da8c5bc488a1f2e7bf"' - ' "5702aada0b5f22642cc53816d5a4062dc77f4f10cfe66ad433b13eb0cc21a22e"' - ' "c04e55ba5d5634452600a9c7efe9a9c239d2f1cc162a22b543a0f64c10e36739"' - ' "0d6d32b2faf12c2c089c5d4a6f6b26e44e914e4f34b6f1efeedeab89310aba6b"' - ' "527230f4e689f9db53c27f649c2ea2bb5e43b0e338150c535d9ce897f6b3724a"' - ' "d63f9471f0a4a38b64686cba7d3040e0930cdc9e5ce5e6f1f9d77739e0777acb"' - ' "acf3ad112e18553196d10908e936199550cbc511fd820b7ddc721766057597eb"' - ' "a038be9d71c6972cb69e672a271a80ac8bf2866e65f862574b908cc078859b7e"' - ' "668f13b711898600912e5e2e7cb8a076eac2b6ea526386c70c1de5a50f9f705c"' - ' "81badb260741342daf5686ef603ca20bd28ac968588df0f482630200ec627f90"' - ' "f55843bdd22319bce1d57b5a11d25b2da4e37b0db1896bd8409a0ad5cb1c2d30"' - ' "3691a01eda529f77eac71a04cddc8d33ad651c14c7390deda49f0d965ffb02f0"' - ' "4a7406fa7cd9d1223b927292671eaa4767008ebb1c3ab0fec77a0e8ea9c27240"' - ' "e9579f5f3ea9b3190bb6d58af9a26fbd15cdbf525f403717ed246bfcefdfa65f"' - ' "135e978d6a6b1d079f669ac7514b85232ad2b3a9eae7dd5571453f3ea1b266e8"' - ' "c4b5e27653d3183f4c335f17aba89b1daf6cd18ef498cc70b2ce8e8b5c29c1ff"' - ' "59454824c45375a02f81004a05bb5bd3b174ca3e9c3b6076e321782afa615d8f"' - ' "20284424d188d855b0d544a01d48b7c2e56063b03d3a3f54cef382169480174a"' - ' "9a8027c753293ca805f61ea6238c81f29a7414a2733b1d0e23be0a9513a41094"' - ' "1d444ca2efa23b7cfa48d5c01b7ea660f1b524d27372be5288a1d5af647f7e73"' - ' "38ce4bb882a9cfbfac947bf01f3cea063dc04286a17c4efea9a0cb3569d86dde"' - ' "c846a22aeea3b8f5d7108ab005bdc2131c517937f41d9567262d586b31570558"' - ' "3519edb22a6fe2053db5e186f338392e92be0c46ccbd388ea42975a342f82872"' - ' "11c44a5af0e4d97f157d39e9a893263ef2758435aec9d7cbf3d2d64ae8dc4ea8"' - ' "c6524b7458b2235c221890f696846d82b82dd3f42f7bd5139f60eb7c708be0d1"' - ' "9ecde5a4dbb09cbb4e06205fc560a5fb667b66bba5e318f5805e4b5c638d0613"' - ' "dd72a0c3cc63e92ecd8b7c06da9fd3decfec0eed569266bb843b9b728b45ab18"' - ' "444c17dec37e72ad5998e3347e8749ab8af0236c2aad7db29f44ddc4bb3b1bde"' - ' "409d8d82e1cb03d73772291185ddd52d24cd9686284d743636472e1ddc3106c4"' - ' "6029c8f5566feada8ae7037f35c70640428553e04e8035487d7b98c1f5c26f9c"' - ' "667857e8cc7eb4db2280f1ad08066284a6f18c017aee3f039c8b7e811ed95aeb"' - ' "ed7240c8b599b5b5bbdafb145c1aa22547c7843b7c979fd82f1cee45a4ff580b"' - ' "c493897441710535756b48ee71c1a485df44182fd65bf09455f7fff0d8bbdeba"' - ' "8e86294bb3504f34708f1c4ea4ebaea738b0220ec1cc4c2fa13a1f061d9b2ccd"' - ' "5bd481c8418054abd52caa72de1ee3f8d68db5894405819858271991e5efa0e5"' - ' "451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97"' - ' "188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666"' - ' "f7f22ac70966c2205281f63c80e603952a23d1e41bbe98baf0d378e64ed0c3ae"' - ' "464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a"' - ' "7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412"' - ' "db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c"' - ' "25e6a6bac0859c785063eed88c04cfbb1c30613c9b549d846d43d1920db172e9"' - ' "cba19f8eedf90c332224bcd8f0df9be0e1dbd4324c67c79eef19d547c33ef331"' - ' "424d16cdbae8c830a8ad03a5eb1e95aaa3f4d6aba56748fcc2c7c79da83f79c1"' - ' "36ef3a11514f39f0143155711a4ca40ec546031a675a94c3b65dbae2c6d86e52"' - ' "54f14272fc6bad75f0b83984f701fce73fa73f0d9de209c161094f27836cea9b"' - ' "0619a40ade8d48b9123f0904215d520755ddf9db4f084c2e7403d550b065cb3e"' - ' "353481fd5fd4c3aaa1f8c356b0e79f9c02d727a7a46b110c1f937ba933d83699"' - ' "0210080da6e4cf7cfee029ad1f8aaf846910fe6249bac810cd84127f3c058d19"' - ' "19c0c5a7358609e8fa7274147b7637b038a5510846eb5eae2b2e64cfbdf078c9"' - ' "53e12f606763831de67a2bcf6b6b7fb239b21c526917e4d0e234975c86be4564"' - ' "21192e45f60c14b69939dddc002a9574044107db53f2896e1967bfe4b85d3881"' - ' "afb5c92086b2f08afd2d1b89843474439bba739e4ad1831908a3d2f15f4edaac"' - ' "d51f7074611b7384b6405179826b559f0b0682d6034750eae21f81085007e3ee"' - ' "cc21168e7a28352288ff3daea0adaa3c7a4ace0b7c07a1411039c5dd6d47c66f"' - ' "95d43193f2c25ae63f5e110243bd4eaa62b930e5a959393eb731a74953a9432b"' - ' "b8d4428680a8b386e1fd9623e7a8d7e1b582534468226bb80d7a3335e0185698"' - ' "6197de9fe8fd531ba4c5a5fe54718b01294cff013bbf56ecbbe680ac5ccd4eca"' - ' "255ef1d6f1da0b68446f349349d966c43ecbc96dca378836b9cc37abc013d671"' - ' "f6cf17d3a2fe9d4e4091aba37430ceb55bd43a7c741453b50fae7bc868f32994"' - ' "7a3515a3a1718614dcff61ddcf0b9984b7bf105ecd75fe2ff6f832589a93fdb9"' - ' "8ae5d15c1784e3462020a6784a729a8f2540e7433dd1b18d5d8c589da3358e43"' - ' "d13e4f45c26c3df8489825dc8b2ffa89ba85f9ea6bd13b76a8b4c8ff061d35ea"' - ' "f6f96693b00e3afd241efb078650781eee05c0e38b0f41e75e04f4672dd4fc48"' - ' "9454ca8bf4989d4088b8c80f430d852d13e85c09252275113d7132c0041dd1a9"' - ' "e479462010c2514b9fa8513bbd3d515fe665d58d6514f7e78411131ff3090ed9"' - ' "95ac4f25ca24aab7a5a443b813a3f92f0bbbc0a431e5e75764609f9214c114b3"' - ' "0eb86f9973e6be36c1a192201bae9afa2ac94c576082310701c70784fae4481b"' - ' "6defc35bfc6f3e62dbe357f0f9b2063fbfadaf80574382a9c141d4897140a1a2"' - ' "8a5cd46a4e91474deaeea3fb1277bc993524a547bd09138a15fefa456155d4b6"' - ' "9a5f306198f54047e7be608395869dc6d6dfc30757a04035c3c422f8c1a3495d"' - ' "3f09145757282e6a59cd69319ac3b9da3265022a1d4f92a1646f8ddbaad89333"' - ' "4a6450f5a3676568e1d3d993d1c6f908af7ca07c41887bf48d1ae9672fc58512"' - ' "44df3b2362cac083812b2069678032b4b2dd91589023f9bae4fbd3746a23b1f9"' - ' "cf8b604d9e3f1dc4470ad1e5cdf8922a3a84021b08ee8b0700b76ea63e0781fb"' - ' "6d785f191a10799f38e08cfc5563bd559729ec74efe2aa242c4542fd853f90d1"' - ' "336ff5d2c361e594327c54a8a5398bc0255f152d175f99bf3a9efd621c51a3b0"' - ' "eae10853be098476c31a1cb7d37c3b2dbc7ef80d73ce9d64306962eca8be8cc2"' - ' "c74820349ce06caf983178ef5ad7c8748afb1078caa98d66d1bb325a6f99d414"' - ' "7d6f5eb4bc8cdea4b40f7a3f659c50b35020602abdd8e8a2e2fc31732330a92a"' - ' "96aa9b5fcc9f02bf0879ae9b1e088b3f8dc978ec323da003b194fb660acd0713"' - ' "9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7"' - ' "441cb0179c91c4c36cbd05b75c6b9b8bd4a668518bceb7ba028a0b077d2a14eb"' - ' "f47db0bc0f9accb6cf4c033d81ceb1f79065c54616f90df4647ec0cb2d6f2ac0"' - ' "a046184ae4efc3f09a283a3c24d1533a191d05dc843c78534c3f129ceaa9946e"' - ' "79df12fb0a083f52bf77cffe998c9be6e9f588b7f918af11435fc5629c1d82b6"' - ' "af03598bef65613ab2c8a64fed066b9fd384d92da2fda23893b80ad5887812dc"' - ' "f2b628567c9194272993484fc7b706d0ebf036e30fddab42cf0ef95310782b17"' - ' "3788186a5d8e95fdcd9f6386bf85939b865cdd50c2ea28708e673af164aa61ee"' - ' "b8ba5580699a6e79742e679b4f8bc293fa903e31410a4a2bad0271731bb3c887"' - ' "46eb8bc5b1f257520507bb81b2d010ea9d5a56b1843c0168953f3662b53d7a15"' - ' "403cf85efeba8cc0e48dcb4fb7b22fa830426d4ac26d613d1e637ef64009581c"' - ' "e2f44b25a44109cea9ed49bb14fd4038da41912a75ccd2496194359af0eb1b41"' - ' "92d27e98374b36575b4c12c8ab050c55befef8a27401a97dd2493d40469981fd"' - ' "777e17fa8a709873f33cdbf7793948ae2f1c84dd7524c2f1fd911d4c14c372cd"' - ' "9b5a9954e031bf017324e3cbe578cb7f0148d428ee0172003846bc9486543aa4"' - ' "543dcff189a5f2fa7beeb6863e78edd31d74226196687185ad3e655c3ea034de"' - ' "41c0e8e47dfa4844066f4b76f2fe979694320bce1c4f7a9bb5e20a07b618b98c"' - ' "c4e659790c6a66c5ffc8a091edc4ea823258a6c684d8e50d147371e88d8b5775"' - ' "ea1da54f1c5b56aeed6fb6d138027f295c54713205b24d10371e8f0f42326ff1"' - ' "6c37739ac0fa9f67869f6c1ecdc939d5b05ad783b85d12f661c432f528ba7389"' condition: selection level: high tags: - attack.t1071 - source.MalwareBazaar