system.net

system.security

alonqood.com

os.ns.rankingplac.pl

el8.pw

kulup.isikun.edu.tr

stream.read

gg.ibiz.cc

wscript.shell

drawing.graphics

system.windows

raw.githubusercontent.com

ddl7.data.hu

pomf.cat

doc.cherrycoffeeequipment.com

boisedelariviere.com

fetzhost.net

labid.com.my

matkalv.5gbfree.com

rgho.st

www.wealthandhealthops.com

aircraftpns.com

anonfile.xyz

daratad.5gbfree.com

ddl3.data.hu

hinrichsen.de

khoun-legal.com

sukem.zapto.org

www.athensheartcenter.com

www.fluidsystems.ml

www.pelicanlinetravels.com

www.wvhmedicine.ru

dryversdocumentgritsettings.com

srv-file1.gofile.io

vanesa.ddns.net

dsecti0n.gotdns.ch

ciagov.gotdns.ch

www.enterprizehost.com

remote-01.web-access.us

metrowifi.no-ip.org

mail.microsoft-invites.com

host-101.ipsec.io

securetx.ddns.net

jdirving.email

kernel32.ddns.net

192.ho4x.com

ahyses.ddns.net

snthostings.com

wowyy.ga

ns.topbrains.pl

pn.ns.sse.net.pl

w2.ns.rankingplac.pl

www.bcbsarizona.org

kernel32.dll

csrsv.exe

nc.exe

'mess.exe

system.core

cryptography.cs

psversiontable.ps

ketty.exe

temp+'fleeb.exe

temp+'f.exe

cannot.log

default-nco.html

rankingplac.pl

invoke-shellcode.ps1

syshost.exe

scrobj.dll

'powershell.exe

tor.exe

kn+'.zip

minecraft.exe

taskdefinition.reg

rootfolder.reg

u1848931.tmp

schtasks.exe

c:\windows\temp\task2.xml

c:\windows\temp\upltask.xml

c:\windows\dynascr.exe

kl.crt

st.crt

cry.crt

t1.crt

t2.crt

t3.crt

t4.crt

t5.crt

bd.crt

forms.key

forms.sys

_.ps

pythonw.exe

winx64.exe

iesecv.exe

patload.exe

update.exe

anna.exe

logo.png

doc.exe

order.exe

044ae4aa5e0f2e8df02bd41bdc2670b0.exe

powex.exe

calculator.exe

windro.exe

praisefud.exe

kundelo.exe

lawdsijdoef.exe

dwnysn.exe

mjnspx.exe

qolcls.exe

ultxkr.exe

vjadwb.exe

yspcsr.exe

1080qw.exe

flash.pl

3d0a4fb54941eb10214f3c1a5fb3ed99.exe

ken1.exe

word.exe

yhaooo.exe

pfifdp.exe

win1.exe

ctob.exe

calafile.exe

owe.exe

ik_001.exe

abacoss.exe

com.exe

comu.exe

igbo.exe

kele.exe

kells.exe

office.exe

seccrypt.exe

lnm.exe

eter.exe

xvcbkty.exe

kntgszu.exe

klckcp.exe

javaupdat3s2016.exe

count.php

jusched.exe

a.exe

miracle.exe

b.exe

lumia.exe

obi.exe

guyo.exe

nach.exe

may2.exe

qebhhu.exe

counter.php

topbrains.pl

login.php

rollzedice

044ae4aa5e0f2e8df02bd41bdc2670b0

921e1b3c55168c2632318b6d22a7bfe6

192.168.52.129

0.0.0.0

76.74.127.38

54.213.195.138

65.112.221.34

192.168.56.144

35.165.38.15

94.102.58.30

89.248.166.140

185.45.193.17

185.141.27.35

185.117.75.43

185.141.25.243

185.141.27.34

185.45.193.169

84.200.65.20

95.211.139.88

145.131.7.190

159.203.18.172

50.3.74.72

84.200.84.185

66.11.115.25

52.28.242.165

212.99.114.202

185.117.72.45

159.203.89.248

103.238.227.201

93.176.84.34

66.192.70.39

52.86.125.177

46.101.203.156

45.63.109.205

146.148.58.157

107.170.132.24

98.103.103.170

93.187.43.200

78.229.133.134

52.36.245.145

52.196.119.113

46.246.87.205

24.111.1.135

222.230.139.166

192.241.129.69

187.228.46.144

166.78.124.106

149.56.178.124

138.121.170.12

11.79.40.53

104.233.102.23

104.131.154.119

100.100.100.100

198.50.137.173

84.200.84.187

192.168.137.241

93.171.205.35

162.253.133.189

62.109.8.21

http://94.102.53.238/~yahoo/csrsv.exe',"$env:appdata\csrsv.exe

http://23.239.12.15:8080/index.asp")))|%{$_-bxor$k[$i++%$k.length

http://93.174.94.135/~kali/ketty.exe

http://alonqood.com/abacom.exe

http://76.74.127.38/default-nco.html

http://54.213.195.138/s2.txt?u=

http://el8.pw/ps/codeexecution/invoke-shellcode.ps1

http://powerwormjqj42hu.onion/get.php?s=setup&amp

http://drobbox-api.dynu.com/update

http://ec2-35-167-185-55.us-west-2.compute.amazonaws.com:8080/ansfrf

http://89.248.170.218/~yahoo/csrsv.exe

http://80.82.64.45/~yakar/msvmonr.exe

http://cajos.in/0x/1.exe

http://ddl7.data.hu/get/0/9507148/patload.exe

http://185.45.193.17/update.exe

https://a.pomf.cat/xsakpo.exe

http://www.macwizinfo.com/updates/anna.exe

http://doc.cherrycoffeeequipment.com/nw/logo.png

http://185.117.75.43/update.exe

http://185.141.25.243/file.exe

http://185.141.27.34/update.exe

http://boisedelariviere.com/backup/css/newconfig.exe

http://ddl7.data.hu/get/0/9499830/money.exe

http://hnng.moe/f/inx

http://labid.com.my/m/m1.exe

http://labid.com.my/spe/spendy.exe

http://matkalv.5gbfree.com/loso/fasoo.exe

http://nikil.tk/i1/iz_001.exe

http://rgho.st/6hrkjylx4

http://worldnit.com/kuku.exe

http://worldnit.com/operamini.exe

https://a.pomf.cat/drktzz.exe

https://a.pomf.cat/hsmqrh.exe

https://a.pomf.cat/pabfzv.exe

https://a.pomf.cat/tpaesb.exe

https://a.pomf.cat/vhcwbo.exe

https://a.pomf.cat/wopkwj.exe

https://www.dropbox.com/s/gx6kxkfi7ky2j6f/dropbox.exe?dl=1

http://185.45.193.169/update.exe

http://aircraftpns.com/_layout/images/sysmonitor.exe

http://anonfile.xyz/f/3d0a4fb54941eb10214f3c1a5fb3ed99.exe

http://brokelimiteds.in/wp-admin/css/upload/ken1.exe

http://danhviet.com.vn/z/v/doc.exe

http://ddl2.data.hu/get/0/9589621/k000.exe

http://ddl3.data.hu/get/0/9551162/ske.exe

http://getlohnumceders.honor.es/kimt.exe

http://icbg-iq.com/scripts/kinetics/categories/3rmax.exe

http://kiana.com/flowplayer/aquafresh.exe

http://matkalv.5gbfree.com/noza/odeee.exe

http://matkalv.5gbfree.com/vosa/doc.exe

http://nikil.tk/k1/ik_001.exe

http://trolda.5gbfree.com/fosee/doc.exe

http://worldnit.com/abacoss.exe

http://worldnit.com/com.exe

http://worldnit.com/comu.exe

http://worldnit.com/igbo.exe

http://worldnit.com/kele.exe

http://worldnit.com/kells.exe

http://worldnit.com/office.exe

http://worldnit.com/seccrypt.exe

http://www.athensheartcenter.com/crm/cgi-bin/lnm.exe

http://www.fluidsystems.ml/p1/pa_001.exe

http://www.matrimonioadvisor.it/pariglia.exe

http://www.telemedia.co.za/wp-content/ozone/slim.exe

http://www.wvhmedicine.ru/1/p2.exe

https://1fichier.com/?v8w3g736hj

https://a.pomf.cat/klckcp.exe

https://dryversdocumentgritsettings.com/javaupdat3s2016.exe

https://srv-file1.gofile.io/download/sjlkag/84.200.65.20/wscript.exe

http://95.211.139.88:80/index.asp

http://microsoft-update7.myvnc.com:443/index.asp

https://52.39.227.108:443/index.asp

http://polygon.1dn0.xyz/index.asp

https://dsecti0n.gotdns.ch:8080/index.asp

https://50.3.74.72:8080/index.asp

http://hop.wellsfargolegal.com/index.asp

http://chgvaswks045.efgz.efg.corp:888/index.asp

http://84.200.84.185:443/index.asp

http://66.11.115.25:8080/index.asp

http://52.28.242.165:8080/index.asp

http://23.239.12.15:8080/index.asp

http://188.68.59.11:8081/index.asp

http://163.172.175.132:8089/index.asp

http://14.144.144.66:8081/index.asp

https://www.enterprizehost.com:9443/index.asp

https://remote-01.web-access.us/index.asp

https://metrowifi.no-ip.org:8443/index.asp

https://mail.microsoft-invites.com/index.asp

https://host-101.ipsec.io/index.asp

https://93.176.84.34:443/index.asp

https://66.192.70.39:443/index.asp

https://52.86.125.177:443/index.asp

https://46.101.203.156:443/index.asp

https://45.63.109.205:8443/index.asp

https://146.148.58.157:8088/index.asp

https://107.170.132.24:443/index.asp

http://sparta34.no-ip.biz:443/index.asp

http://pie32.mooo.com:8080/index.asp

http://kooks.ddns.net:4444:4444/index.asp

http://home.rzepka.se/index.asp

http://ec2-35-167-185-55.us-west-2.compute.amazonaws.com:443/index.asp

http://ahyses.ddns.net:4444/index.asp

http://98.103.103.168:80/index.asp

http://84.200.2.13:8080/index.asp

http://68.66.9.76/index.asp

http://52.28.250.99:8080/index.asp

http://50.251.57.67:8080/index.asp

http://46.246.87.205/index.asp

http://24.111.1.135:22/index.asp

http://222.230.139.166:80/index.asp

http://197.85.191.186:443/index.asp

http://191.101.31.118:8081/index.asp

http://187.177.151.80:12345/index.asp

http://163.172.151.90:80/index.asp

http://139.59.12.202:80/index.asp

http://138.121.170.12:3138/index.asp

http://138.121.170.12:3136/index.asp

http://138.121.170.12:3133/index.asp

http://137.117.188.120:443/index.asp

http://108.61.217.22:443/index.asp

http://104.145.225.3:8081/index.asp

http://104.130.51.215:80/index.asp

http://94.102.52.13/~yahoo/stchost.exe

http://94.102.52.13/~harvy/scvhost.exe

http://93.174.94.135/~harvy/verfgt.exe

http://201.130.72.171/andac.exe

http://www.amspeconline.com/123/nana.exe

http://alonqood.com/ezeke.exe

http://alonqood.com/nano.exe

http://snthostings.com/billing//includes/db/dannyfinal.exe

http://worldnit.com/vc.exe

http://www.amspeconline.com/123/nazy.exe

https://a.pomf.cat/bvudaf.exe

http://84.200.84.187/google

http://pmlabs.net/cis/test.jpg

http://192.168.137.241:8080

http://93.171.205.35:8080

http://www.bcbs-arizona.org/s2.txt?u=

http://35.165.38.15:80/login/process.php

http://35.164.97.4:80/admin/get.php

http://162.253.133.189:443/admin/get.php