From fc54b3d94e5bf27b333804a0d0e73d70b3bc04a2 Mon Sep 17 00:00:00 2001
From: Mar-Pic <marpic268@gmail.com>
Date: Wed, 12 Mar 2025 18:24:32 +0100
Subject: [PATCH] Create iocs (March 2025) - Emmenhtalv3

---
 emmenhtal/iocs (March 2025) - Emmenhtalv3 | 509 ++++++++++++++++++++++
 1 file changed, 509 insertions(+)
 create mode 100644 emmenhtal/iocs (March 2025) - Emmenhtalv3

diff --git a/emmenhtal/iocs (March 2025) - Emmenhtalv3 b/emmenhtal/iocs (March 2025) - Emmenhtalv3
new file mode 100644
index 0000000..f7cde2f
--- /dev/null
+++ b/emmenhtal/iocs (March 2025) - Emmenhtalv3	
@@ -0,0 +1,509 @@
+Emmenhtal v3 hashes:
+037aa969f2a8170b56541a85db7bc1a3d4fa4f290d8b8dc86f26ed070e953ce8
+0998bf1d86f20fad6bba0ce849aeaaf4aa73d830e65d92f2ac1ad6737712a9bf
+0bb436b3213f517ff6fdebc0f86425b3d654784067e1c79653aa048c1848437e
+143d53dd44c0788fe857b065af3e6a42b032536d23c5ed1d17d9b2442cb4ea24
+16a7d2b54484565343269cc2f5b3ebe27861ce1fce074a944c249e1f08de4012
+19df8851bb2dc7465aaca175c1540f3726151608fda596a6e5c4211064780c39
+1f1541f5996471d46c7b5213db6f871f6ae387b60fc554b42f62619167ab35f3
+1f4cec1de4b4487a9028f8b0f3d8c67a8b0311f5486e719eb184267722f3a8e0
+230752d2637adadefefeb71d0e60bbd230cd5db4c32a368c17c9b60f7b06fdc4
+239ccb17acba139a7f027946cc5b631140c2237401ec8652d798f8b58484fd12
+25f0e4afca493b40781c84f82e867e89104d3fd75655dd0a073cb013bb576256
+263c238ebdeac06fc7155eed6abeabc37fdbb339bbcb6a5d0d8dbbd0df04cd2b
+294077afe48900657abcfba367f87b4b65c7d37d8a99568eca4340b96db1cf29
+294b9547f30953a10fde8952735af23143f218ffb5e004d232cc5d0095637ea1
+2b32ef48dc30ab04fdc5c18cc92c2fd4495f55dbae66a5f80da90edcf383b6d1
+2d6cebbd14ca04f32f5f5c62663a2b29d6b483f8dc8df4a4e58af087c541cd49
+2d7eb85c042c5a7998b3f97bfa0f3c3efc3464b6f74a72e0e74a560b921fe22c
+2f682333ce7363e9743e5c5dd71804dea4543bf93caddcbb8e5e50f65341120e
+2f90d883f87c555b8725fa44c23cc6283c62fd044e964eb84551bc7a62751063
+31e0c5ccea168d6b0ef71e5e8ae2dc057b7d9b438bbce10c8d5c51c1ae10a3ed
+36ce3a0fd5268c42727ed4434ee117ce2cf32f1f31f0fef95600f97e2e93cd18
+3727b9fa65275a3e0a894e60c9a20efee1155bbcf6459795b35565af2c554c53
+39f1d8e1b45d60b58efed1743da079d107e97357be42af2b1cdb726a4273cfaa
+3f58043755e83d41031cd3deedb9b113df4c37c5122d8812bcad85684bc99021
+410958b94166838cc821df67e8cab7e3cd17ca946b3e9ee40e096d8e345c773e
+434c79278534d381c4fd92f43cf57d14e6625cf1bb08985dc6709d7fbb7c2455
+4491e2b3016c8c24cbca1233c5e7fbb336b9efa2d56f0525e8eabfebdea1e0a4
+46f744fa9e56ea57bbb7cef8807dd8ba680bb6b0bc37cd0299e7cfa2c4fb6eca
+4d533a5c7998f6c8f678cdceb7be2ce243078f4e4416d04ffa80a4909f1d916e
+4e4abe19cf7561beb631e28508a5a413618321e9ef76c29f6188e4400ded2af5
+4eab63cdb4c9ceca6297c0a5035badb7cbf082adf0aa5acf413531442db5d144
+500c5223f6289c92d63aca126ec5605daf8db77ea64e3ffb8dc2b7524dc2744f
+56318b0dad1004da786178deddfb1a96363a2fa5e817c9a5ea44ee62cbc49805
+56c4659726289f388007d551089d68e392d0c2d47d1a055cdbf229b09f381994
+56f71d97ed96428e2f46830a87a003320458f5f2f8793dbc376361dd1302e3b8
+57e8c8ac01217b03c2a27674f3cb09dae495889a5cc5e0b582be87ac412ee4ac
+594ca8689fce4550a7270176ac2682109d4fc2234af939e2f07bf23714775902
+5a25d1d7d3732d311909e9ef55dd49a2847cbd2bb8d25189c42525df6dc8e23e
+62b33971fb1cc1c40865969cb6a34cec2fd825578fb89732e7283eba9393a21c
+6330c86f578a35ee2a163d326942db8cf7070b5518981766583054adba06f76c
+6856a24fa656cf671b974e8d04b32dc9bb178cdde47422d0a441ce65f0bf88ba
+6a7a9234b08d2d32840e5d2b882b66e1e0bc9a7f6d7d56eabc4b7665f0febdc6
+6e59c0ce986ae8ef4a4e14f5b868de2424b6b0e02d0fa9a59b52a61230bb27fc
+6fc3daad8bc4975ac66ecdfbc78c8f03787a2d3b54ea5cfb36996143bb04d715
+6fc41e727cc16e0889a2731622181eba0d3ed3fdcfb67bb05364eee637d4cd55
+76decabd545d8123351f43cdd5b83cb0433eaf8d3707e8402c4242d09791631b
+7eec43db72c545dafdbb3254663cecab878b39264129a6180f93bdda5d70f965
+7f6b08b152943a7b6e6edcc1dcb041e971e30d7604dc9ff5566fa592e41f386c
+813b42b5087622058651a3ea3d728ea405a8c0dad4f627ece8ac564797dbde5f
+818636fbc9e9e1c5fbb7f82bad0462b4979a5d1ac65717f8a294196de521027b
+853c2c0ccb094bb8c151afb87d1f26f4734f920cf579a998474d55ef8dde542a
+85b6ef624a998d870ebfa64e0830e3d15490451b4036317a81a2bb22f06d2255
+86c0312fdca17d2195d8f70070abaa998c89007813a6cab4accee192e0fcffd1
+86c1fcb2da73d1ab64bba2295d93cc979e655f01b82feab9f1312aeaacba18ca
+892426f0beb5e81ab0ec83974d03c30decaa40b5279165070d57484fd10232c9
+89d9cfaeb2aa7c91f522026b2cfba2a109d5c61cf849ea32969c8e0c01a968ae
+8b0106295c1d4e9a6f4b9cbb37cd316aac34143e2130a6138c35b1a42110f0ea
+8b86a78a708d965b32694dd55f2ee9be44cd59ae27ee1cb0e0b0c95179b6d929
+8ba48f95fca5ed732783e28cd7e34cccee456d50da25cfbda344949d4732c95d
+8ced7b9e0a717f94bc138cd0ea587019638ecb89b7856a0a631d0be625750539
+8dc5dca66cf2a9ee83795214fbab364b4ba952d8ea6d45b3a2cbc532ebded9a1
+93cd948dc1ab39ee0cf84d30df53f31f305ffb2d561e5b2798bbfac8562284df
+995b380e857dbd301d6b2e1459901580f6d91ec0c2798d93b7282207ad55ea78
+9af4fecc55aa44c267729775d2db29f95a608b749cf639898bdbcbe4aa161cf3
+9b6e9518bb1f4b0bcefae67761ea157c5b962f10a8a70000740d3eb05671c04f
+9bd8013a676d9305bb3d5676fa69572649be48bccd5273e4e27d5d883f8bf401
+9fecd101b197813ed41c06de2583ebf236a61cbfa9ff490a5b9a13ba97b8bb44
+a11d01ad10e47eeb3f92b9c12f6a1a180aeb06934db357901747b0698f3fb23b
+a72d17e148ea6b7f6fce0be8a37254f2805f263832c8b73c7b0596213fe332f3
+a96d2410cefbfec1bc6d7989082df6b7985366670ae190efb9d59329bf394bc1
+abd4882abb040bfafe512d23ddf30362594db2552c2810f5f268b360894d67d0
+ac6ef864fbb7b3d8a0ea8fd7de9744f8a2da3acfce2fb94294c73f51a931db28
+b34e5eed91bff312e1e54638026ad2ce569e98b1d79362f98c0d195565b8ca74
+bc24525b35f76dd876cd7bea7aa8c964007e4f99a4986fc8e428932c6dc0a06d
+becf2352b6881d3b35f25de4e4c4e1003b44a2b034b02b41b5c1623edb847ad3
+c072a21f1f55aba61c5f4a6d0015d4921ce1aeee72827aa300a8cfd8b4fbaead
+c25eaad7016adf81dbb33144aaaa0886e07e20664f78f12fbdbf0ecc1b585af6
+c2fd9ef3ce188943b8e55f686a075e8f6d9a74c02c753af060c83c0db6d71d1a
+c736d44134d6e443706c1db36bd6b37981f57a47ba2c45a3dc0457f17c63f237
+c790cdf04e002c94965de0c683a7bbcb9c0998d79e5fd5cd9c920e3c9e5c4914
+ca4d81d3145eb0a7745074d4d2e96cfae658ce697883815c7d7c25c0c3a535ab
+ca83d5b923b0815ac613d6a07af4f1241f31a213ece0014db2b8bcd830a8ed8e
+ce364055274af5bd92fca9b90494e7e05510f73105095dd95fa378a2ed8b7cb6
+cf6879d411f2263e4b9b28c544cb8ab919dc01962bd26d40f1fc2a8f51ae3ded
+d258a1d8ce3593124bbd5b36b2e8b19589a5b5c0f5d43616812a0316b613cf23
+d3619472a378ac582c175be6669b677ded7001c7887d1a22313866f08858aef7
+db9d2f47a52588c4d0132a3eb0a8fc290f142f8c69d808bb7fe9b1be6c585990
+de6a6d2c5436ca1fae600ae250d0118a13754bf1a8e72684d84a96e5ab8280ca
+dffdda5092b49622eb45606a32a23015c08e81df9fc4a8ba75bc1f6c32fa1b8e
+e19e7cd68f1e2eb71015e9575655ac3a846cad3b3de26ca46bf135d2c2bdfcbd
+e2bca952200eaf761e3b80ce5f232a0fe519d3617df52589f3e478e65f248212
+e2f58eb3269102becdcd5226c57c396cba77b47dd905aac698ab5ce77d42ead6
+e357aa56f5f3662dbef26b5d2bdecf0484c376581336f33cec3cf9c821240321
+e59292be1e1b053e058e7ff01191169d2e1ea39f5126d385b7d8ca1db5ce18e7
+e745a130b7186ce9af7a76560753fba772876ba80d4c4a4b86810294090382b9
+ed470aedeabd169050ee2eb95bb4c2f4d4a7a8076a3e8beab1203d9b36a51e64
+eda8612cd3fc678b6a404ace12cef5946ac1db954c7eeb84dbda2916f8d635b3
+f09efc82210960f00dc3b0627ace6ef193e3f2ab07d2fd026329e225ffca27af
+f4516382419c1e89aa4d8960ce581ad030e838703ceade4e9876eba3d1da6b84
+fb3dd217018106d28f273bd7a2c3e9a9526d1c001f5b527ae25f0448e080a796
+fc21d65cf91f2f265d67176a818b725244118f3ec3ab27c73f2317e8714e30e9
+fd0b7e36ce143c2d9e9f9965989c6b5614d326974edbd625aa110ddddc0113c9
+
+URLs leading to .NET intermediary Loader
+hxxps://kp.ferrysurgicallustily.shop/publicpublicpublic.xll
+hxxps://ne1.discoverconicalcrouton.shop/f38186770bffa4a12a7170942b9c0d71ac736142924da24a.xlt
+hxxps://pegas.durablyscrimmage.rent/awjxs.captcha
+hxxps://perent.ganderbrisklyonly.shop/laminar.w32
+hxxps://perent1.ganderbrisklyonly.shop/gnosis.mp3
+hxxps://perent2.ganderbrisklyonly.shop/MUAKI.mp3
+hxxps://perent3.ganderbrisklyonly.shop/Bluebird.mp3
+hxxps://perent4.ganderbrisklyonly.shop/freshbodyshop.mp3
+hxxps://pn5.gapdevoutlycitrus.shop/f40b7a79ed8433ee4d221f3553f422e9
+hxxps://w66.discoverconicalcrouton.shop/f38186770bffa4a12a7170942b9c0d71ac736142924da24a.xlt
+hxxps://x2.eioae.shop/413a42a4c715693c37e5256e144fd76cc51160b74617024d.xll
+hxxps://x22.eioae.shop/413a42a4c715693c37e5256e144fd76cc51160b74617024d.xll
+hxxps://x5.eioae.shop/17f9c91b5a59bdf35c05b9d1a24f18f6467247cda6cf0b27.wbk
+hxxps://x73.eioae.shop/e490f7cb5ac6db0e512604f0774f036f0c7f1b4ac3fb75a3.accdb
+hxxps://x75.eioae.shop/17f9c91b5a59bdf35c05b9d1a24f18f6467247cda6cf0b27.wbk
+
+.NET intermediary Loader hashes
+013b605d0694ae106a277579f4d7a3c47288f379084a44cbfbdeb16b0c70bb4d
+058bf176108ac455d6f7f6f31ff6f1615a0968b07ea86c3d4459a2b6549e8ebe
+06615e040d851f2ff4ac9b462f9b8f7afceb1959878e13cead69f11b5466a7ad
+0999ab366635d3dedc365f3900353abe2688a418eadcfa5622beb8b35954b973
+0e5ccc54ceff545116e9d83249bc9955b4934fb4bcbcb0974e7c7b437a8ce45f
+0eaa2ce05b1f3bea7c5968e886ffb2b4aa6e0246c1030e97641486d460890a6e
+1787ca8267b567eac2f958992ab8903127aa34d843702552b69e8aef0e0865b2
+19ebe09fd94dfc61006618bcd7f32ca58b04db6e178f676b9c4a86b584429bcf
+2c2d737487a4d2a1520f0d1310d002e078152acc9c31c80f4a8d37737d2d5a59
+35d23e383947ab3fbe10a339252d8453fea105f9387010d93852bf86381525c6
+3cd1deb8bea013f6f6b197dd7ae140502e936a78e7f55e7f5d0bf7db44d219da
+46f830664c7e6030410042d15364c59096c27074cda7f0bc3b244aa3e49282eb
+4b4254d70fd292c32b87841c0c9920ddc9f329493ee73b723d13d3fc66038ef8
+509a33a089ec30c828259d529a1d9fe3ce84d1ab57064147e1202df9657b014c
+57b2cb1adb81aaab06200bd39717974236016959792ff7cc8d1f4536efa69b9d
+82a4f9b8fb67524344168fc8a1f263fa43d363be86ae43a8fa85845c8eaedce9
+926aa04bd6b01fc647e2afc96b9fc21db153292a55767e4cc025358fc47b9726
+9c7a1501f82e639f616c9727e9bff00b2ef7e25bca4141652c3ef569a0638643
+baa0f226181c0189354592ed8155b1b7081dfc056f3a2beca4ff335c86635734
+caeb84f5f8e850133d2b158ba85d0cb247132273ac7fdbdf1c6a12325c01ce63
+e3e0a0e573e75946af0107490fecde71d248e479f804c1608d4e705549326100
+e95b85a5c408e6218d9372313d963eb630b346ae01951e1f512dc98c029b5465
+
+Final stage hashes
+1ddd06ba789cbe306708405b9cd60221 - Rhadamanthys
+0d4b962192f01548aed826546ebc7a42 - Lumma
+
+Malicious URLs leading to Emmenhtal v3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Bulginess[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Carwash[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Cosmos[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Elves[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Estrogen[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Grant[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Overpay[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Trespass[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Vascular[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_proton[.]mp3
+hxxps://u1[.]optdropper[.]shop/Siarhei_Korbut_-_Pavement[.]mp3
+hxxps://u1[.]optdropper[.]shop/Siarhei_Korbut_-_Proclaim[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Judicial[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Large[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Nanny[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Recent[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Shrug[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Trespass[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Unwed[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Devotion[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Flaxseed[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Humongous[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Laborious[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Mockup[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Remedial[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Pavement[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Prison[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Proclaim[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Removing[.]mp3
+hxxp://solve[.]lzmb[.]org/awjsx[.]captcha
+hxxp://solve[.]porw[.]org/awjsx[.]captcha
+hxxp://solve[.]xfzz[.]org/awjsx[.]captcha?u=9820a9e0-2059-4f1e-acb6-7d94c618116a%20#%20%E2%9C%85%20
+hxxp://u1[.]possibleshimmer[.]shop/linkin-park-faint[.]mp3
+hxxp://u1[.]previewcapped[.]shop/linkinpark-faint[.]mp3
+hxxp://u1[.]previewcapped[.]shop/linkin-park-faint[.]mp3
+hxxps://solve[.]bogx[.]org/awjsx[.]captcha
+hxxps://solve[.]bogx[.]org/awjsx[.]captcha?u=9d729900-5f9c-4818-aad3-2446c1b3386e
+hxxps://solve[.]hhxe[.]org/awjsx[.]captcha?u=990e823a-6237-4c3d-8518-93eaf18eb8a6
+hxxps://solve[.]lzmb[.]org/awjsx[.]captcha?u=160598e4-a119-4c96-acbe-d93559070030
+hxxps://solve[.]lzmb[.]org/awjsx[.]captcha?u=5770a247-db5b-4ee2-bd51-0255535f1d07
+hxxps://solve[.]lzmb[.]org/awjsx[.]captcha?u=8875cfd9-a140-4593-b595-40bbd1c460e3
+hxxps://solve[.]lzmb[.]org/awjsx[.]captcha?u=8aacc0bc-116c-46b2-99cc-3c235b367ff3
+hxxps://solve[.]porw[.]org/awjsx[.]captcha
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=0b32c1b6-1db8-4976-b085-03b412811a8d
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=15a9d03c-429e-431e-a486-bd14f8718611
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=599b5227-c697-4880-b9c2-0a830b394fe6
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=622ec16a-f93c-4c81-9f1d-d5b9299e2aef
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=6b173563-10ed-4847-b1b4-de098cd6861f
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=7b70c524-99a4-4fe8-873c-1d30a48a5749
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=99ba590d-e4c4-4187-b92c-dc6df3f41834
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=e1c732b5-e581-4708-8315-59833f83f88
+hxxps://solve[.]porw[.]org/awjsx[.]captcha?u=e1c732b5-e581-4708-8315-59833f83f889
+hxxps://solve[.]xfzz[.]org/awjsx[.]captcha
+hxxps://solve[.]xfzz[.]org/awjsx[.]captcha?u=62f35f34-c2f3-4b17-91cf-075643cd0770
+hxxps://solve[.]xfzz[.]org/awjsx[.]captcha?u=85e3f989-27a3-4f24-87ab-2c25c4728817
+hxxps://solve[.]xfzz[.]org/awjsx[.]captcha?u=9820a9e0-2059-4f1e-acb6-7d94c618116a
+hxxps://solve[.]xfzz[.]org/awjsx[.]captcha?u=9c3d9d6d-6119-4a9f-a0c8-b88370b49595%20#%20%E2%9C%85%20
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Bulginess[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Carwash[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Cosmos[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Diligent[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Dime[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Elves[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Estrogen[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Grant[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Overpay[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_proton[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Trespass[.]mp3
+hxxps://u1[.]drizzleraving[.]shop/Siarhei_Korbut_-_Vascular[.]mp3
+hxxps://u1[.]giddinessrebirth[.]shop/guajira[.]mp3
+hxxps://u1[.]grapplereturnunstamped[.]shop/sh_UJAF3[.]mp3
+hxxps://u1[.]optdropper[.]shop/Siarhei_Korbut_-_Aging[.]mp3
+hxxps://u1[.]optdropper[.]shop/Siarhei_Korbut_-_Failing[.]mp3
+hxxps://u1[.]optdropper[.]shop/Siarhei_Korbut_-_Pavement[.]mp3
+hxxps://u1[.]optdropper[.]shop/Siarhei_Korbut_-_Proclaim[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Judicial[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Large[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Nanny[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Recent[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Shrug[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Trespass[.]mp3
+hxxps://u1[.]overuseunderuse[.]shop/Siarhei_Korbut_-_Unwed[.]mp3
+hxxps://u1[.]possibleshimmer[.]shop/linkin-park-faint[.]mp3
+hxxps://u1[.]previewcapped[.]shop/linkinpark-faint[.]mp3
+hxxps://u1[.]previewcapped[.]shop/linkin-park-faint[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Devotion[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Disown[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Flaxseed[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Garden[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Humongous[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Ice[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Laborious[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Mockup[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Remedial[.]mp3
+hxxps://u1[.]puckerlinguist[.]shop/Siarhei_Korbut_-_Salary[.]mp3
+hxxps://u1[.]sulkuntie[.]shop/guajira[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Pavement[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Prison[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Proclaim[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Removing[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Thirstily[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Thirstily[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Tinfoil[.]mp3
+hxxps://u1[.]superheroomen[.]shop/Siarhei_Korbut_-_Tinfoil[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/1158vpjyw3[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/1158vpjyw3[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/7yonlp2wdh[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/7yonlp2wdh[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/jsaavqkipi[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/jsaavqkipi[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/n81p9yktig[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/n81p9yktig[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/pijso4gx41[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/pijso4gx41[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Backspace[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Backspace[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Cork[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Cork[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Defiance[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Defiance[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Division[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Division[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Endurance[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Endurance[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Motto[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Motto[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Radiance[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Radiance[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Recoil[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Recoil[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Sandlot[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Sandlot[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Spiny[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Spiny[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Stamina[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Stamina[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Tapeless[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Tapeless[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Underhand[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Underhand[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Undertook[.]mp3
+hxxps://u1[.]wannabeclobber[.]shop/Siarhei_Korbut_-_Undertook[.]mp3
+hxxp://wezimin.shop/blindspot.mp3 
+hxxp://bytes.microstorage.shop/
+hxxp://appp.file-factory.pro/ 
+hxxp://195.211.191.120/agreements.mp4
+hxxp://def.ball-strike-up.shop/ 
+hxxp://incognito.uploads.it.com/
+hxxp://timing.silver-card-maker.cloud/
+hxxps://grazine.shop/screamingloud.mp3 
+hxxps://likinom.shop/gazingshadowporta.mp3
+hxxp://tesnok.shop/matchingoutfit.mp3 
+hxxps://available-files.oss-ap-northeast-2.aliyuncs.com/hitzina.mp3 
+hxxp://eptidown1.b-cdn.net/Anthony.mp3 
+hxxps://pub-9c4ec7f3f95c448b85e464d2b533aac1.r2.dev/Guba.mp3
+hxxp://items.kycc-camera.shop/ 
+hxxp://tag.shufflerline.shop/ 
+hxxp://usa.trendys.cloud/
+hxxp://wezimin.shop/blindspot.mp3 
+hxxp://bytes.microstorage.shop/
+hxxp://def.ball-strike-up.shop/ 
+hxxp://items.kycc-camera.shop/ 
+hxxp://tag.shufflerline.shop/ 
+
+Malicious domains leading to Emmenhtal v3
+solve.bogx.org
+solve.hhxe.org
+solve.lzmb.org
+solve.nkve.org
+solve.porw.org
+solve.pvsu.org
+solve.xfzz.org
+solve.xtxy.org
+u1.drizzleraving.shop
+u1.galvanizegestationludicrous.shop
+u1.giddinessrebirth.shop
+u1.gossipsurrender.shop
+u1.grapplereturnunstamped.shop
+u1.jumpcelibateencounter.shop
+u1.landladyscreenconnected.shop
+u1.optdropper.shop
+u1.overuseunderuse.shop
+u1.possibleshimmer.shop
+u1.previewcapped.shop
+u1.puckerlinguist.shop
+u1.servicelandingkaraoke.shop
+u1.shalebrussels.shop
+u1.shredderradar.shop
+u1.stungoverhaul.shop
+u1.subtyperesource.shop
+u1.sulkuntie.shop
+u1.superheroomen.shop
+u1.wannabeclobber.shop
+u1.wroughtunrulysteed.shop
+
+Other infrastructure leading to Emmenhtal v2 or v3
+ hxxps://jekin.shop/straightahead.mp3
+ hxxps://desimol.shop/mishticfreg.mp3
+ hxxps://jizil.shop/gitanjli.mp3
+ hxxps://grazine.shop/screamingloud.mp3
+ hxxps://tesnok.shop/matchingoutfit.mp3
+ hxxps://hismajesty.shop/beautifulway.mp3
+ hxxps://likinom.shop/gazingshadowporta.mp3
+ hxxps://holker.shop/hangthere.mp3
+ hxxps://colorfulkeepsakes.shop/aslisong.mp3
+ hxxps://colorfulmoments.shop/aslisong.mp3
+ hxxps://colorfultreasures.shop/albumsong.mp3
+ hxxps://warsad.shop/slightingthunder.mp3
+ hxxps://collectiblegifts.shop/angoori.mp3
+ hxxps://pinmore.shop/benjaminlokman.mp3
+ hxxps://classicwraps.shop/zroom.mp3
+ hxxps://classykeepsakes.shop/zaracbat.mp3
+ hxxps://classydelights.shop/zruribat.mp3
+ hxxps://cariz.shop/junkypool.mp3
+ hxxps://refereng.shop/tozemeniaclo.mp3
+ hxxps://sazak.shop/olokaretoze.mp4
+ hxxps://wezimin.shop/blindspot.mp3
+ hxxps://fersiko.shop/tozekoluma.mp4
+ hxxps://iquestzone.shop/biawal.mp4
+ hxxps://ishadowquest.shop/bhegibili.mp4
+ hxxps://yezmil.shop/youretoze.mp4
+ hxxps://espardo.shop/mishtikloa.mp4
+ hxxps://edonlo.shop/rubakuna.mp4
+ hxxps://jozeni.shop/reetozela.mp4
+ hxxps://desime.shop/shelllockrub.mp4
+ hxxps://klipjaqemiu.shop/web44.mp4
+ hxxps://ipixeledge.shop/visual.mp4
+ hxxps://ipixelquest.shop/visual.mp4
+ hxxps://monekam.shop/subwaysurf.mp4
+ hxxps://ineobattle.shop/round.mp4
+ hxxps://bizmir.shop/powergem.mp3
+ hxxps://leksion.shop/thonrub.mp4
+ hxxps://ipixelblaze.shop/display.mp4
+ hxxps://utahano.shop/sadlyfist.mp3
+ hxxps://ilegendrush.shop/sadimiti.mp3
+ hxxps://opisso.shop/farkinrub.mp3
+ hxxps://igamexp.shop/walkthrogh.mp4
+ hxxps://iepicboost.shop/vidiya.mp4
+ hxxps://iepicplay.shop/vidya.mp4
+ hxxps://rtshoop.shop/rubving.mp4
+ hxxps://iinfinitybattle.shop/overview.mp4
+ hxxps://igamezone.shop/gameplay.mp4
+ hxxps://igameinfinity.shop/suno.mp3
+ hxxps://ixpforge.shop/playit.mp4
+ hxxps://igamercore.shop/guides.mp4
+ hxxps://igamerblast.shop/listen.mp3
+ hxxps://sesimok.shop/ournewcolour.mp3
+ hxxps://igameforge.shop/gamegawan.mp3
+ hxxps://atariq.shop/sports.mp4
+ hxxps://igamedash.shop/gamemusic.mp3
+ hxxps://josehan.shop/sherilianwe.mp4
+ hxxps://iepic.shop/vidya.mp4
+ hxxps://itechvortex.shop/movie.mp4
+ hxxps://ialphazone.shop/soundtrack.mp3
+ hxxps://ixpzone.shop/letswatch.mp4
+ hxxps://dulaan.shop/lonelylonweb.mp4
+ hxxps://ibattleboost.shop/suno.mp3
+ hxxps://ishadowstrike.shop/balan.mp4
+ hxxps://resmuna.shop/emobonwebko.mp4
+ hxxps://iarenablaze.shop/listentoit.mp3
+ hxxps://rubana.shop/webingloadf.mp4
+ hxxps://ialpha.shop/ropes.mp4
+ hxxps://angrybrds.shop/gana.mp3
+ hxxps://bimola.shop/rosnaloruba.mp4
+ hxxps://ialphaboost.shop/gana.mp3
+ hxxps://audiomaxx.shop/gana.mp3
+ hxxps://asosz.shop/sports.mp4
+ hxxps://avonex.shop/sports.mp4
+ hxxps://amacys.shop/sports.mp4
+ hxxps://fuzzyz.shop/Munchkin.mp4
+ hxxps://budgetlane.shop/s6.mp4
+ hxxps://evaluehub.shop/s5a.mp3
+ hxxps://colorfulpicks.shop/s5n.mp4
+ hxxps://dazzletouch.shop/tutorial.mp4
+ hxxps://bolddeals.shop/s6.mp4
+ hxxps://collectiblejoy.shop/s5n-1.mp4
+ hxxps://dazewave.shop/S6.mp4
+ hxxps://eretailpro.shop/s61.mp4
+ hxxps://norpor.shop/riiw2-1.mp4
+ hxxps://dareglimpse.shop/S6.mp4
+ hxxps://kiddoloom.shop/rii2.mp4
+ hxxps://creedos.shop/zingaloobylo.mp4
+ hxxps://vermano.shop/Pumpkinzangato.mp4
+ hxxps://chicmoments.shop/s5a.mp3
+ hxxps://adobee.shop/defaultsound.mp3
+ hxxps://woolav.shop/jumpingjack.mp4
+ hxxps://buferingo.shop/razifuturezshow.mp4
+ hxxps://vedingo.shop/Zingmantoku.mp4
+ hxxps://zeemaro.shop/zingfuristic.mp4
+ hxxps://airtbn.shop/story.mp4
+ hxxps://sumala.shop/Pumpkin.mp4
+ hxxps://acepro.shop/fairytales.mp4
+ hxxps://suzixoxo.shop/mischieviingly.mp4
+ hxxps://captivatingkeepsakes.shop/S5.mp4
+ hxxps://requinos.shop/matataakuna.mp4
+ hxxps://yallano.shop/mitchkin.mp4
+ hxxps://dustglow.shop/S6.mp4
+ hxxps://dazzlejoy.shop/S5.mp4
+ hxxps://pixelete.shop/rzy.mp3
+ hxxps://pomppie.shop/RUKE.mp4
+ hxxps://buyloom.shop/s6.mp4
+ hxxps://dewshine.shop/S6.mp4
+ hxxps://dewdropbliss.shop/S6.mp4
+ hxxps://dawnbloom.shop/S6.mp4
+ hxxps://klipzynigou.shop/An4me.mp4
+ hxxps://echoicedeals.shop/s6.mp3
+ hxxps://dunewave.shop/S6.mp4
+ hxxps://ebazaarelite.shop/s6.mp4
+ hxxps://budgetvibe.shop/s6.mp4
+ hxxps://ebuyelite.shop/s6.mp4
+ hxxps://eprime.shop/s6.mp3
+ hxxps://emarketelite.shop/s61.mp4
+ hxxps://driftcharm.shop/S6.mp4
+ hxxps://bargaincove.shop/s6.mp4
+ hxxps://eoutletpro.shop/s61.mp4
+ hxxps://bigpick.shop/s6.mp4
+ hxxps://ebuymore.shop/s61.mp4
+ hxxps://budgetsphere.shop/s6.mp4
+ hxxps://edirect.shop/s61.mp4
+ hxxps://estorepro.shop/s61.mp4
+ hxxps://ecartdirect.shop/s6.mp4
+ hxxps://budgetmart.shop/s6.mp4
+ hxxps://milta.shop/riiw1-2.mp4
+ hxxps://deepvibes.shop/S5.mp4
+ hxxps://oldiger.shop/rzy.mp4
+ hxxps://driftpulse.shop/tutorial.mp4
+ hxxps://kizmond.shop/riiw1.mp4
+ hxxps://eretailzone.shop/s61.mp4
+ hxxps://markitos.shop/riiw2.mp4
+ hxxps://sparticus.shop/s7.mp4
+ hxxps://klipdesak.shop/title.mp4
+ hxxps://eprimemart.shop/s61.mp4
+ hxxps://gustavu.shop/riii2.mp4
+ hxxps://boldway.shop/re6-1.mp4
+ hxxps://edealselite.shop/s61.mp4
+ hxxps://joopshoop.shop/riii1.mp4
+ hxxps://grumpilos.shop/riii2.mp4
+ hxxps://sharethewebs.shop/s6.mp3
+ hxxps://googlsearchings.shop/s5.mp3
+ hxxps://ghazaano.shop/riiiw2.mp4
+ hxxps://gabrize.shop/riiiw1.mp3
+ hxxps://buyluxe.shop/s5n.mp4
+ hxxps://oliveroh.shop/s7.mp4
+ hxxps://espiano.shop/ru1-2.mp3
+ hxxps://rekono.shop/s7.mp4
+ hxxps://adventurevault.shop/re6-2.mp3
+ hxxps://dokedok.shop/ru1-2.mp3
+ hxxps://bigsphere.shop/s5n.mp4
+ hxxps://astonishingbuys.shop/s6.mp4
+ hxxps://bargainland.shop/s5n.mp4
+ hxxps://megahive.shop/s7.mp4
+ hxxps://thepremiumstuffs.shop/s5.mp4
+ hxxps://luxeway.shop/rii2.mp4
+ hxxps://goatstuff.shop/rre4.mp4
+ hxxps://klipderiq.shop/kinko.mp4
+ hxxps://klipdalygeo.shop/ginni.mp4
+ hxxps://kliphuqibue.shop/data.mp4
+