-
Notifications
You must be signed in to change notification settings - Fork 85
/
Copy path2021-09-15 Hancitor IOCs
321 lines (302 loc) · 21.8 KB
/
2021-09-15 Hancitor IOCs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
THREAT IDENTIFICATION: HANCITOR / COBALT STRIKE
HANCITOR BUILD NUMBER
BUILD=1509_rwpl
SUBJECTS OBSERVED
You got invoice from DocuSign Electronic Service
You got invoice from DocuSign Electronic Signature Service
You got invoice from DocuSign Service
You got invoice from DocuSign Signature Service
You got notification from DocuSign Electronic Service
You got notification from DocuSign Electronic Signature Service
You got notification from DocuSign Service
You got notification from DocuSign Signature Service
You received invoice from DocuSign Electronic Service
You received invoice from DocuSign Electronic Signature Service
You received invoice from DocuSign Service
You received invoice from DocuSign Signature Service
You received notification from DocuSign Electronic Service
You received notification from DocuSign Electronic Signature Service
You received notification from DocuSign Service
You received notification from DocuSign Signature Service
SENDERS OBSERVED
MALDOC FEEDPROXY DISTRIBUTION URLS
http://feedproxy.google.com/~r/aopdxhsk/~3/4uYs9v2o09k/adiposeness.php
http://feedproxy.google.com/~r/bahvw/~3/BRqI5AlGXAQ/alae.php
http://feedproxy.google.com/~r/bflkxcae/~3/xWqP54mHPjg/solicitously.php
http://feedproxy.google.com/~r/bfrdayyf/~3/_CGC2ubhmkQ/gloaming.php
http://feedproxy.google.com/~r/clokdbfpa/~3/hn6J4PCMea8/newcomer.php
http://feedproxy.google.com/~r/crwmr/~3/6PU3OBwfGW8/dinner.php
http://feedproxy.google.com/~r/czqhdxkiob/~3/LaVhK-7sKQ4/sectoring.php
http://feedproxy.google.com/~r/dmszwcs/~3/XveBel1Ewp8/frigidity.php
http://feedproxy.google.com/~r/ecnpio/~3/dL0b6jwqpCc/scotian.php
http://feedproxy.google.com/~r/ecvikch/~3/ucwppjh9si4/explain.php
http://feedproxy.google.com/~r/embfivgn/~3/zoPcUwEOdJQ/baseness.php
http://feedproxy.google.com/~r/gbaehvp/~3/j7XMNt7EgAU/steve.php
http://feedproxy.google.com/~r/hbikcthavzy/~3/4wF2uJEhg-k/misfortune.php
http://feedproxy.google.com/~r/hckjoo/~3/29Q8JL3RNcA/above.php
http://feedproxy.google.com/~r/hrbrzolujf/~3/d_apL324JxU/bluish.php
http://feedproxy.google.com/~r/hwbwcrzutx/~3/Mnd5whAYQm8/oversized.php
http://feedproxy.google.com/~r/iahamhikdsk/~3/o8I1x0lj5NY/prohibit.php
http://feedproxy.google.com/~r/iqfzjxilxjz/~3/NAgq49uKB70/attention.php
http://feedproxy.google.com/~r/jcrqrvgdtoe/~3/iepZREwBu4w/erased.php
http://feedproxy.google.com/~r/jwimop/~3/_69HHvQYmYU/antiquate.php
http://feedproxy.google.com/~r/kmryk/~3/7-B2qX91XTc/tinkering.php
http://feedproxy.google.com/~r/kszry/~3/5w-ogXHR3rc/defendant.php
http://feedproxy.google.com/~r/kxdomjtqu/~3/zoPcUwEOdJQ/baseness.php
http://feedproxy.google.com/~r/lhwmh/~3/QD3KFs7nlSE/blossom.php
http://feedproxy.google.com/~r/lkgwlervyv/~3/MdXEn0JBZic/cubism.php
http://feedproxy.google.com/~r/makwtkqnds/~3/3YQerz2XYGQ/apoplexy.php
http://feedproxy.google.com/~r/mbheiooyi/~3/IFwPa5gM-N8/prowler.php
http://feedproxy.google.com/~r/mcrnlxvclip/~3/mkBSFtZwSfU/flabbergasted.php
http://feedproxy.google.com/~r/nsdwns/~3/WrsHvRiyu30/misspend.php
http://feedproxy.google.com/~r/pamwrpgugil/~3/q6HqvQqpeaU/blasphemous.php
http://feedproxy.google.com/~r/petjgfhj/~3/d_apL324JxU/bluish.php
http://feedproxy.google.com/~r/plpkrmfier/~3/w0FARLyDWIk/oxheart.php
http://feedproxy.google.com/~r/qhqoyfavqi/~3/pIwk3O82q9g/daemon.php
http://feedproxy.google.com/~r/rfkkr/~3/irEaNrGbC0c/paternity.php
http://feedproxy.google.com/~r/toqaetnm/~3/XgMGLJXx9ZE/studs.php
http://feedproxy.google.com/~r/weezyq/~3/sL3Hbh_5l8k/eventful.php
http://feedproxy.google.com/~r/wxbddix/~3/ZrUaSe1oAq4/unclasp.php
http://feedproxy.google.com/~r/ykdxxgdwics/~3/MUTz25aAf4w/extortionist.php
http://feedproxy.google.com/~r/zlacuieid/~3/NNanbVgPYqg/beret.php
MALDOC REDIRECT URLS
http://15minutespizza.hu/adiposeness.php
http://15minutespizza.hu/oxheart.php
http://covid-19.mgkanyasangliedu.in/dinner.php
http://covid-19.mgkanyasangliedu.in/solicitously.php
http://sample3.khushiyonkazariya.in/sectoring.php
http://www.krishnafarm.org/antiquate.php
http://www.krishnafarm.org/paternity.php
http://www.krishnafarm.org/unclasp.php
https://15minutespizza.hu/adiposeness.php
https://15minutespizza.hu/oxheart.php
https://azerbaijan-tourism.com/flabbergasted.php
https://azerbaijan-tourism.com/tinkering.php
https://bank.zanderscloud.com.ng/blossom.php
https://block-b-1.titan2-1.site/misfortune.php
https://covid-19.mgkanyasangliedu.in/dinner.php
https://covid-19.mgkanyasangliedu.in/solicitously.php
https://dellhummock.com/extortionist.php
https://dellhummock.com/oversized.php
https://ecms.qubit-software.com.my/baseness.php
https://ecms.qubit-software.com.my/daemon.php
https://ecms.qubit-software.com.my/newcomer.php
https://galabau-life.de/above.php
https://groupebambandiaye.com/blasphemous.php
https://groupebambandiaye.com/frigidity.php
https://groupebambandiaye.com/prohibit.php
https://iamjitenpatel.com/prowler.php
https://jumabar.co.uk/misspend.php
https://metastudies.gr/defendant.php
https://metastudies.gr/erased.php
https://plive.today/explain.php
https://refrigeracioncastilla.com/bluish.php
https://shopilyv.com/alae.php
https://shopilyv.com/cubism.php
https://start360up.com/scotian.php
https://start360up.com/steve.php
https://unifashion.app.krazyit.com.au/apoplexy.php
https://unifashion.app.krazyit.com.au/attention.php
https://unifashion.app.krazyit.com.au/studs.php
https://worldeducationtranscript.com/gloaming.php
15minutespizza.hu
azerbaijan-tourism.com
dellhummock.com
galabau-life.de
groupebambandiaye.com
iamjitenpatel.com
jumabar.co.uk
khushiyonkazariya.in
krazyit.com.au
krishnafarm.org
metastudies.gr
mgkanyasangliedu.in
plive.today
qubit-software.com.my
refrigeracioncastilla.com
shopilyv.com
start360up.com
titan2-1.site
worldeducationtranscript.com
zanderscloud.com.ng
MALDOC SECONDARY REDIRECT URLS
https://onedrive.live.com/download?cid=3CEC2FE9F059497E&resid=3CEC2FE9F059497E%21127&authkey=AAiYyHZNrS-xDL8&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21128&authkey=AI3FNsoewVetlNc&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21106&authkey=AN8enKResN1jac4&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21131&authkey=AFaYYRpY-WSgevw&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21127&authkey=AIasZfwmpT3qGvI&em=2
https://onedrive.live.com/download?cid=68B1DD8E43F92671&resid=68B1DD8E43F92671%21119&authkey=AEpb7BgaNsJdyUs&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21136&authkey=AAaYziBJmidGLZM&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21118&authkey=AAkt4IUm2u9ryXM&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21120&authkey=AG2CQgiLzCHp4OI&em=2
https://onedrive.live.com/download?cid=3CEC2FE9F059497E&resid=3CEC2FE9F059497E%21140&authkey=AEu4trsOp6q0Q64&em=2
https://onedrive.live.com/download?cid=7D261C857A768A52&resid=7D261C857A768A52%21106&authkey=AJqkMJ-DJ4HsTD0&em=2
https://onedrive.live.com/download?cid=68B1DD8E43F92671&resid=68B1DD8E43F92671%21142&authkey=ACmSiJGZorafZGg&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21110&authkey=ACwG7GLFkrsy6ns&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21122&authkey=ACd-FxSp-IlIfg0&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21118&authkey=AAkt4IUm2u9ryXM&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21139&authkey=AEra8JeJgzcXIYk&em=2
https://onedrive.live.com/download?cid=68B1DD8E43F92671&resid=68B1DD8E43F92671%21114&authkey=AC7n_7Nv_lDqvPY&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21107&authkey=AO0bJ5jeS37ci-0&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21121&authkey=AJjpR-Tijj5TFO0&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21142&authkey=AF0Z23qJ-fJQAA8&em=2
https://onedrive.live.com/download?cid=3CEC2FE9F059497E&resid=3CEC2FE9F059497E%21141&authkey=AMrlyXnTpwcSQkE&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21141&authkey=AOyp7ycBKiCuiBo&em=2
https://onedrive.live.com/download?cid=7C55C8C77E1CC578&resid=7C55C8C77E1CC578%21131&authkey=AMv9ks1YH9DIOkk&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21140&authkey=AApTvfYHmPCdAFQ&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21135&authkey=AI7yRcpRZCBPPBQ&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21127&authkey=AL6NAuVTH82xp9M&em=2
https://onedrive.live.com/download?cid=3CEC2FE9F059497E&resid=3CEC2FE9F059497E%21146&authkey=AHFqFexUXTwOMSU&em=2
https://onedrive.live.com/download?cid=3CEC2FE9F059497E&resid=3CEC2FE9F059497E%21133&authkey=AKCQlWyFMk5rnb8&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21138&authkey=ACBoVw9fDaeGTNU&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21140&authkey=AApTvfYHmPCdAFQ&em=2
https://onedrive.live.com/download?cid=48B9B5CC6BA130F2&resid=48B9B5CC6BA130F2%21140&authkey=AApTvfYHmPCdAFQ&em=2
MALDOC REDIRECT DOWNLOAD URLS
https://irycmw.dm.files.1drv.com/y4mXQCyhWzH5EsyNPewz6dDDKbH-lSzJvRFiL7CDhMLA32Y7FvZaaEKs4sFx4u7s9vW5Vn5yALvP1lMWyuRrYlmw3W01MCjcLkdP_gFDq0dJ3013dolTXD_OzvwrddhBvqI6zLS9Rvsk20jKJHj0MuRWETfNLXlPynkJ2Avbw1mbINrULK0PANVrOu_8Yce-3IGvUU1Ca_EsDmujazyLb2xTA/0915_2371983845302.doc?download&psid=1
https://vjchgg.dm.files.1drv.com/y4mZFqwRWbY1lnUER3Fn4ijZKKtvIBlXVvd9ZEGvkZ3xGH2Py0yXWhpwGkMx_vseJTOeQYtH1vw2KMtT6hY_ZtQ7_kQNlLg1S4Y3MrzHkwVU6bZzvZ3rrGECvS20SdYudP3dNab5dVf5xCNCa2RgeOLqY1yFAD7_rcVfAaQbRBf32PGu0Q_YmXLRClA6Nm8SZXMY5BwgRajnDu9Bhe2BqQ4bQ/0915_1432928135629.doc?download&psid=1
https://ctw9hw.bn.files.1drv.com/y4myVtlGl9HfLGWGGpvGmks0Jv_Ep5tainCoryFNtV2LF4mEzpvFd32gDwMwTC7z3vCL-wXL48Ud7WvpVJeluJhvnkYEcHPw1V738xXtlDrIPuNwETQ-oHQmx0gwokAWpIxYWp6DPsKnrhlr48OBghJ0BN_gKqw01yb2Mx0D6sXJF0sngJy5sWk56KVsW9rCbK24mfcwUpS2Wfnlm2rQFuQ5g/0915_2371983845302.doc?download&psid=1
https://hqfaka.dm.files.1drv.com/y4mZ-BoUxg_1Ej0_yKett_xh4y906SxGKsxCe_07aW_TG-F3B7_xzEqghhHK18aetsq8YL9sN9mDaFikgPObF1dScJ9ijavCte9wKeh0ZgtW2W_JWlYdJgiIVBT4X7wGRcTQrYFVyW1_e2mLOUjBjqIsXN8E-3FWWkaaBspapwP1EX21xIOpENZrkaqlhYXcXH81pFz9u1piM55DetvHYMCPg/0915_612534247465.doc?download&psid=1
https://hqedya.dm.files.1drv.com/y4mkH62ash2lXVgKN9_VyYA6A873WVnv0MmdKN3J8lgqzQwX228oEQAE7VHASJ0H10TAKBNAaJOHs32rsAueBln53tcnZY5Da4MLKawn3IO4795dlfxeKLtDELmige6S5t0k1Y8YpfElx51JawCbaJGT5ERlPdirRRa8lYNx4_kkAf1owODiR4iQ6ZmcisEhhUJkhlxfFDfW_qNCR2cBb6Q7A/0915_485668588839.doc?download&psid=1
https://6zkrmg.dm.files.1drv.com/y4mBhTPLcGGLdqOFvYwjxCKD5yr6X5SuAErBgFSM0X7rph3YkSbPZWd2vgKm1GYprtI2uKQ1VOj97XkMhfsgqSqE8A8AQFgomjPb3yg1vTs-ggYQvoskJ09OzmM1Z5m6R-ZQp6vGsgL36l-njcePmbPKxFqb7NIqKKa3RFGvubgOa6iWGe5soNlo8Z3eXGgiSv5QIIKFyUUm8fPErjeZ9RwQA/0915_1058779685048.doc?download&psid=1
https://sozupg.sn.files.1drv.com/y4m3dJEIrBsY_OFYMLpmzW2-uQMYj_G-V_Dj1ulpRFvxyNjtN5slHHH7BQmBPD8sQ7nJkD71iT_l8p3kIWYOisvvI5cKvuZbgFeQ_TDMtTdipVc-MfCMufyDzWIZbvK-c-AaG2zARZiOMzSodAv1U5Ulln74eebSmvMylXLReW5-TTs9QWc49OfY78CYtI6eeJE85sCL9TS8jJfDcLQtQYGCw/0915_1569607502000.doc?download&psid=1
https://fxis4w.sn.files.1drv.com/y4mkIZJrB0-hhzts8aqL2DASz5V-XpQTiJ8hEhmz-HODjz9fItpSwF6jfx9LhHodd1B3bU2fBI6ZLuJ8FFoBbx381GEl0nDi7t6SQLqPc2o17ZT2R4x7OwkF-vmd7Gsyr51FeEFiAjWdDGewh0MLLlzYH88tuGjrMdPHTa3WCCY1Hm-oWHjE0SCvxB3g7TVXP2ZjCfaA0L6LIex0XEQz3JSyA/0915_2371983845302.doc?download&psid=1
https://qpmkbq.bn.files.1drv.com/y4msBQnF9mrlaJMpnyf_lOWvRUR_ohmAtDSBfIf7V4q7h3GqMHAJRZn01LFlIguGKJJnh9tbfW3BBS16e1rYHJ9R-G4P1N9iXboxnQ8BcQuRORW-Y4s5RsWI8Bj2S6dZfTEtMnLLFBnjnlj_9V75ZWbmv08aoaemu24VoK_3ME-gfnP8Yy625FbYkbuz30ZHhw_uIpX_Gb5A96bpOQOth5Gyg/0915_863397381556.doc?download&psid=1
https://aejk1q.bl.files.1drv.com/y4mbtw3LW-0mkFaSx2WzXXAbYMCV4rnvc5Q5ybjPeJlqaPW6VM4LZCwiLSq3jE5rKg1FiVr04ux3t6_hM9zC-jzfxVrTp7OmJwBk-EA36Ac94FYDfgiuwusCghjAgnezQPDX0hhDMstdpEP9uWKJJpdQ1HGnHLvt2ycS7aDwaFU7xLrQ7xlERVbBTq1DvOASWZ_g7JvqlaB4n1qKzkpzSyN4A/0915_930760218747.doc?download&psid=1
https://zcbtna.bl.files.1drv.com/y4m8TMGq-DBb9MSeEuYeyM70WdRb0yIA46qlUWoo10ASfG9wc_Yv0PWZmeTRxA3Zlls4F2qslMM_0MWNj3l-wo99SYCzWUnYKzRebnEPxFQweroPj4vw9D-ubxn3kwmX-gLeOzYGN-dNdSj3ht2IddU6S6aTBy-g1DNCGinLZa6gBbpMRWisgvDLzRiaENp_2g8sRLqTKYftvLT6ULVxEhvJg/0915_2431336207544.doc?download&psid=1
https://iryqjg.dm.files.1drv.com/y4mOpVkHpssVbrlaX_okqL0ne8Nf8m3x-Ya-Nf0Vc2VkXi4asHm2inbnWISgEJ8zT3qE4YdvmBlWUig39chADG02jf2Kuf3LbXu0SK24h4x70aYhhDsHBp2bBpRCMMlqUKz6Mqq51CpWOK-RcmMta0bFZoYeLI5ft1IlHMFNtFsTh0Mazo588WMK0iXf4G8JyUInVSNHDkSsSo_qp3RnIrZFA/0915_2365641049347.doc?download&psid=1
https://hqfmag.dm.files.1drv.com/y4m8pFZNh0fd4TXVtxcKF9jWc5PU-JwpdwGw0WazUFWuFwcwMorR7zCZQZqz4INV2KEDWIc1OF5L6b8q138bzhE-AnJ0PdqKjIDtyBs0roj2z2oSOXhLoRBpR0L5UfJIl1Ky_mqOFOb6AfHznNrVIulFXg8TXVNrrYqgAUq3tep1zb9D0gcK_7QmQj5VbpQohgGqU06sOBQJQIAd87V3JsN6w/0915_1320805753981.doc?download&psid=1
https://ul59vq.dm.files.1drv.com/y4mAimW-IqyauDbgCpZ74ZCDqwV-rdf2g7CKFo3O6OaqtRH9kEDS6M8n8apQlTGBHyuY3MDhpGM9NMlLq3_fXC05xHJJhNnkZG8EjU5R9bmp_UF-ikDG-jBjGYxkvtibASfMeKdO3eCKOTrzIrHrubo1P8tH3rJr2QlqA_8lq5onBDIoTHnJrNAb-dP2lqL0CcPLzpQB6EAvaOuw-Sc-uJoaQ/0915_845107403793.doc?download&psid=1
https://4siupw.sn.files.1drv.com/y4mp8wVSQjmJYrCFHT4l1KSrxY3q6BwA75ld4s02NZzd0iE_5eWNAKmk5v_bFPllkOKZ-LV4PyPlmE1HWBbTDJXBm8xM0_v85FYbnQpXlXJcp2gsvfM9I1cny28SISySUIROcmOH1u4KoKM5PDx5XcEF70blvHQy-gpejA1diJGjRuRr2SLTIBI4x8K0G60p7XtrtRm0pkbSXgayj5gJtsKCw/0915_1432928135629.doc?download&psid=1
https://buiidw.bl.files.1drv.com/y4mW0akFWyYOt0ab0yn7yiUz9T86jl9TLWP04addhCExuWymch4CnB04-7k9LlbtRlrqVmc0rx3sDdP8mWy6u3lXDxlqQj7bxkEBxw7ju5_NTa-_Q_cpsXguIA1p8eUdWTy8DXGzVso4EiZt621-riizlniWUluLXEH7Gv4xLJvI1PYqJfTOhhxMU0VwFuUOYReEvrACzP38e-6ZgX8YyRkwA/0915_2121773768090.doc?download&psid=1
https://ctxemw.bn.files.1drv.com/y4mEtkuoVRy4ptAbqVAo45w-lDsAnjmKA5XuL8zF4EjzFgRHStK6irWX-zDWqxY_PED9KLZCu410UiQoaFyo6GhXAv6ZYk7GXpaANuxdw1CN22DlgllbfUDdq-bSixA0K5qaluKRLMOE-YsDtDCF_zUWnZCh_vLk7-EWISF6__fC4Jz-8yfz4Tge6Mzbkks57e69X9TuRKMKGGCOPDG4Lni0A/0915_375846314903.doc?download&psid=1
https://ul4ymg.dm.files.1drv.com/y4muaLnFznO8hA-P91IAxTe_L7L5SUCcvZodkWBCM5mx34YZZ9rewvr6C5hRrLiBeMgqSCcwcN0QSSyHmU9RqhrY2T8fb5zK8lWrEL2RbVZeAbiKiD3tnxzFaHvdveqTlIQdn6Di6LMElGz8l8-_RwovmWOGxsU9q9jk8tUAHmIUloqpxX9BoHAVRG-W8pm1Nhg4fki3Pu8n-ZBqSptFxbbRg/0915_863397381556.doc?download&psid=1
https://zczska.bl.files.1drv.com/y4mUSPrTk_ALwnVzFePIbv-8j0gcm8ltmrsmgO8c4yPWdFIa6Je2k9LwJLfSJTV3hNFBhPHX_6NrjhODdNyAUQxcZcTmWBldj1AgbGGI3LcOhzQq5PKRTPbu02ovvbc5Gl9tF6gEQEfVFCSYj81FkjCpHahpINZYcZW-cIz9bjBb0nKoNn2pZ4KgyCKFYbvgdUmbGZSUCFQRcx7weceBHszwg/0915_9088588810193.doc?download&psid=1
https://6zkyeq.dm.files.1drv.com/y4mCg2dngkL2lPAzZVPe1Cfp6mqqWgUr-8pqE_VtrR7_1I-NBT9SkCEeZQCjoElznXL82ZQeWYknn0_uk2PNfi3qCSO6sslHYj4yD7tCfJz_2DmAngVlTdw0b67yKjMumebgvcsnCE1WA52b6ZLuAVDdMh74Di5pIl02sdJd8UHpvwAgTZ-eU3lFYBtwz9LZ9fjKvR8Kxr-eIB2Y_n8lq30EA/0915_2431336207544.doc?download&psid=1
https://irycmw.dm.files.1drv.com/y4mXQCyhWzH5EsyNPewz6dDDKbH-lSzJvRFiL7CDhMLA32Y7FvZaaEKs4sFx4u7s9vW5Vn5yALvP1lMWyuRrYlmw3W01MCjcLkdP_gFDq0dJ3013dolTXD_OzvwrddhBvqI6zLS9Rvsk20jKJHj0MuRWETfNLXlPynkJ2Avbw1mbINrULK0PANVrOu_8Yce-3IGvUU1Ca_EsDmujazyLb2xTA/0915_2371983845302.doc?download&psid=1
https://a23npg.bl.files.1drv.com/y4m2v4YJNZtwz6wUmNzO6L9_OOpJokdSkAp4rumxoBvkDJ1EcwpKtVOTgR5WccvrdtPZwXiYMZgA_Fdern4OioPvK1jQpgAjeobo0r5zE_1K60A55SBpTNcVZI36A28ETy_IwNNVbNLnLoKWypsrhkWkm3Yr70l4rcE-VeMfwksA2VXa7qLi3vKKRARpgkAflm8C0fXeOypNaAImMuhGfnAfA/0915_2349028333268.doc?download&psid=1
https://sobaza.sn.files.1drv.com/y4mwzyVIcRYvoKvJCnOczoKG5KFE9p5YZ95k5Stu-kCEdon26xEdu36q2iHWlce4y0zoqxX7pagNHm9eNpMfcUfuyEga77wJLeX6VccBWjCYX-tGLTBal-toGXZnbr7rQbaXD1wH9sbHkHdiSUX6QGqQpBl7bzyoqHXkImugIuYXm-n2NiYABsJ7g5NLX5LUQ76i_hS5ZRDaW8EuVsFpI3cSQ/0915_10990408510619.doc?download&psid=1
https://zca3sw.bl.files.1drv.com/y4myyv9m7iiaImmq_NBNl0XNM26Oi0o7TiZC6OCxONXYsJ4aeBLhvehDFhY75fj_Es6QmQDTri8hn76AZMeUjUTBBjH6maiVc7NO8dRSO3oTBb1oGenJO_cOUCWeI-UZHOsJdnI7qksljKp1-MtzEsQOPe-dMh_oqlTx9LMrW-JWnCb7cbGRh3GoWEYpxAK8h34CijYtQu8zM_w6eJNHJV4xg/0915_2436624154640.doc?download&psid=1
https://dvylew.sn.files.1drv.com/y4mxqd5w7Qwi2N9fC0a3a2eDdMj7Sxu-3CF0BUKG5BSSa3EULPQ-O7N3tXQqAe7U64kXWGb_KoD7T5PFyaRrGRLv9dYr6Raz9i0Vyb0y9JkL8DPhx8nt44KSGiQmjQNL0dTnFplDMQ2Phh6BmpKsm1_ZWX5H8SEvat9Pxu8N0ocOVQBHbi6tDp4dsGZ6N1QljhMNUxpJVvi8z-OIvrpVGAeGA/0915_1865054706334.doc?download&psid=1
https://fxljqa.sn.files.1drv.com/y4m2YJNg3xffvubAMZZ9nF19CeGCwm4BuEO1b9QWy9mO4HmjyTez2xP9ysXnNCgHdd8iy2KIUS7qmGCLIwNSKyuRq8H0WVkfE-EUf7L4OO4886SDO0WWfbM5fwVy4oEUk3y1Jwn78odzGrGsedTZ7V7CngihXsmjO1cTa2YbqVbW3NSPfg2mpJxu50f98Gcxhip2YIN-JzRXf5CWFG4WaguLw/0915_1709295963075.doc?download&psid=1
https://6zla1a.dm.files.1drv.com/y4m1DqMIV12Zat61qC3-9jHvvC_CCBvMJTR2Mb-G_OlqXRtzEBRSpPmB7xFiLIYcFJ5eccQm4bkYUOFTXCAnJLbHSz2fILimdP75R5DX9BBPzXxcbll1zMBEliNFXVLMGnZAhyGsdQZbzJtN_95hsQSDV1-HdYey5156xSSPbNQCcsSkYDtraRhrRJRVlrat451UOs0jQhPP8O40vBmgndl2w/0915_472015608988.doc?download&psid=1
https://hqdndw.dm.files.1drv.com/y4mQJx5bphtEMM9cLhAy47UY3v1c3N7iacyFbcsaABrSf5HjN38mwFhS5wUR6dl9vTttkN6zjqoU7IzG6QVKvwoXOw9LdPCf9xekMlomShNcaq_ZapP6G3-horb--x_JI3XWw7OcVWtr05EJE6R9umNuHztSalaN-Oa7NkSPkJZtwIby9UFn2h7aEnLdvHQ9MhillmFEGWdDV0e71lDk19YHQ/0915_1630171209326.doc?download&psid=1
https://dvylew.sn.files.1drv.com/y4m930_LpiutKYc5YF1UHjdC8v-rx55WkxRAZCsV0fm0kH51t7zo6H_N9m4mjDODrNfNwG8F1v59yIxP9EPnGm-5avm_8N8vx_X0bep1pYRCS99kGb7mcIkLn6SAhjdjIdO0n9gjBE7Yrs4dugazOiOLINc6TyVT3PNq0btlEwTddUzP2wPVylmIWu77DyHL0CX6er-walpNYIHoObIGRaDSQ/0915_1865054706334.doc?download&psid=1
https://dvylew.sn.files.1drv.com/y4mxqd5w7Qwi2N9fC0a3a2eDdMj7Sxu-3CF0BUKG5BSSa3EULPQ-O7N3tXQqAe7U64kXWGb_KoD7T5PFyaRrGRLv9dYr6Raz9i0Vyb0y9JkL8DPhx8nt44KSGiQmjQNL0dTnFplDMQ2Phh6BmpKsm1_ZWX5H8SEvat9Pxu8N0ocOVQBHbi6tDp4dsGZ6N1QljhMNUxpJVvi8z-OIvrpVGAeGA/0915_1865054706334.doc?download&psid=1
https://sobh4a.sn.files.1drv.com/y4mdEeYhw4XyguYJzf9hJBQnneNBENnTumM8bGwFhx5KTIGGkwXcGh--AQGUAgbFpEG2vhnCpgh_rrL86qaD04aEJKfStdQCh3WSAphYGzNhxP5rOQhQDryXyLsGngiAB2bUxW1FnLJzZ84T4k8KdiqEc9Eltw2LKUA7wBmb9STmVsHX4uGtma1UPvZYDG8HIs3rWiecDO98DtQrKeM7pV1-A/0915_1058779685048.doc?download&psid=1
https://1sav5q.bn.files.1drv.com/y4mz2ig7UGW3nC5NsUbDINxPfh_OfiUMC_MHpBFOvxf7SafAuiMBODXbH_zG3I94hvynbzW5233zrNVuW66UdQLlNR1jwlBppT8Y9VtfDrAzSQAkJHHvk1bPJmd-2uCwnawLuKQeL1GpHgEFgH9olBQAlpHwFTCZ2TCrqLf_klZMna_5jzxtRRFtavViiF1-PsqJcb--itBDvn8UVdEgZB49g/0915_18475800010799.doc?download&psid=1
MALDOC FILE HASHES
0a3d1165c9040255eb261d478a81625a
0ac74a264b20974a8c3df695c009d25b
194f954aed939adac683b67c9c8ff113
1cece4ed86aa5b5a69a5b8cdae076682
1fa9df9d2d29556b1fdf5390a766fdbe
29246b46316088684aeabaf09b378322
2d6dcc8fc427b0ec90d0e4c995387aed
37c09c49b8d4b0a2353c20cd89de22e8
4e742ec73fc097cd9ea0302f5954f5cb
58e604645409dc30b2c8c8885201da2b
5e8a0eddb024705756901c782d2f07f7
7e8b8ed18e4e24be93ffbe763d5aa0b9
83455cd4a96481efdff25ce44ff31d28
94ba9bb8b4894a227f110589304f283e
9c148ca713be342a44e87608a8574330
b5f64858eca9bda888f556f1f6b964cd
d1ddcdaa68a9dfa53b66b3de240ed461
d2a258c367678fa0aba73d7166c665d2
d7b035f727363978606976b15327f0c3
e31a63fbdc6b537ef232591dd9cc3379
ea11da40146b88037069a3bafdd2ba3e
ebaecddacccc3d50bd4e5900d32175c0
fa474e79cac2220e2c1468a6f46881e6
EMBEDDED DOC FILE HASH
reform.doc
66f0841b0221a6eb2fc911681ed4f167
HANCITOR PAYLOAD FILE HASH
hhhh.mp3
f136e6867003dcb712d2b2bf6164dcf6
HANCITOR C2
http://gateigesste.ru/8/forum.php
http://pseckragdon.ru/8/forum.php
http://uslanclers.ru/8/forum.php
COBALT STRIKE STAGER DOWNLOAD URLS
http://faz0nol.ru/1409.bin
http://faz0nol.ru/1409s.bin
COBALT STRIKE STAGER FILE HASHES
1409.bin
3af696a511c8d46fd3b17dae9437d7f4
1409s.bin
dcc37a2d1bb022bff02962ca7ebcae7c
COBALT STRIKE BEACON DOWNLOAD URLS
http://45.66.158.14/WtOB
https://45.66.158.14/sZAN
COBALT STRIKE BEACON FILE HASHES
sZAN
0f10b13832e4c1d55cdd1863516fdb94
WtOB
577a70abcf0e29c49ae37c422e693212
COBALT STRIKE C2s
http://45.66.158.14/ptj
https://45.66.158.14/push