May Malspam Campaigns

gistfile1.txt

5/1/2026,RE: REPRESENTACI�N DE PAGO (Q112700-TAM20648); arj -> xloader,Attachment,5
5/1/2026,invoice + a few clarifications; gz -> remcos,Attachment,7
5/2/2026,Your April SSA Statement Is Ready For Review; zip -> cmd -> screenconnect,Attachment,4
5/2/2026,Purchase Order No-4010014227 // Date-04.05.26; xlam -> hta -> xworm,Attachment,3
5/4/2026,Zoom Update Available � v6.3.11 Now Ready to Install; link -> tiflux,Link,3
5/5/2026,Curriculum vitae; xls -> hta -> reverseloader -> xloader continued to may 8,Attachment,18
5/5/2026,Re: New Order (PO7656-05-04 ) Confirmation & PI Request; rar -> donutloader -> originlogger,Attachment,2
5/5/2026,Webmail Workspace: Your invoice is available; gz -> remcos,Attachment,14
5/5/2026,Arrival Notice(BL#: TAOG66729900) Vessel/Voyage: ONE OWL 0033E; zip -> phantomstealer,Attachment,6
5/7/2026,CONFIRM PAYMENT INVOICE�; rar -> originlogger,Attachment,3
5/7/2026,Quotation Number Q/DOM/026/26-27; zip -> originlogger,Attachment,3
5/8/2026,Statement & Invoice Records Attached; zip -> cmd -> action1,Attachment,6
5/11/2026,FW: Re Tran_Europeasia -Requests; gz -> remcos,Attachment,5
5/11/2026,Wire Transfer Update; link -> screenconnect continued to 5/15,Link,57
5/13/2026,PURCHASE ORDER PO 67001-24; xls -> xloader,Attachment,2
5/13/2026,RE: (CAMBODIA)FLY-102531-SGNSAIDMK-ERA(2026); xlam -> hta -> xworm,Attachment,3
5/13/2026,SOLICITUD DE COTIZACI�N; arj -> xworm continued to 5/15,Attachment,3
5/13/2026,Re: Reverse Invioce; zip -> js -> ps1 -> xloader,Attachment,2
5/17/2026,RE: Requesting for urgent Quotation; gz ->,Attachment,5
5/17/2026,NEW RFQ for PR-10453180; rar -> js -> purelogsstealer continued to 5/19,Attachment,3
5/17/2026,Sender netblock is 77.83.39.0/24; docx -> rtf -> zip|dll -> xloader continued to 4/25,Attachment,15
5/18/2026,FIRST REMINDER: MISSED PMT NOTIFICATION- DHL- DELIVERYNOTE; 7z -> originlogger,Attachment,4
5/19/2026,Sender netblock is 77.83.39.0/24; r15 -> js  donutloader -> originlogger,Attachment,8
5/22/2026,Investment Opportunity;7z -> originlogger,Attachment,2
5/23/2026,RE: Shipment Documents (Waybill No: 7247888303); gz -> vbs -> remcos,Attachment,2
5/26/2026,RE: Advance Payment Confirmation No. 2026/00113; rar -> donutloader -> originlogger,Attachment,2
5/27/2026,Quotation /Product Inquiry; rar -> darkcloud,Attachment,2
5/30/2026,Autorizaci�n de Nota de Cr�dito ; r11 > originlogger,Attachment,2
5/30/2026,Your State Farm ACH Remittance Are Ready for Signature; link -> msi -> overlord rat,Link,8

darkcloud, 67a7cba58174a668ef6769e8ad4e57655de1608cc51401a7ab786d767d66d246, mail.gfbglobalfood.com
darkcloud, 87781f2abc3d80ca44b52bf6c4790d4c87fa85c23836619b9f759b27983a7237, mail.gfbglobalfood.com
darkcloud, ac62029ef58ca6788411049a3203583a5a5de639dd41171461faad3850c4d882, mail.gfbglobalfood.com
darkcloud, bf69f267d59823eddabbfe3ca489c9b6ffa2505db9e92affe9bb141306521079, mail.sepcon.net
darkcloud, fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28, mail.gfbglobalfood.com
donuotloader-masslogger, 7e99f5e3d4efc4aece3e91b7cbbbcf2ffcb21072a8f14bd874047383e77fe5ab, mail.trimnt.com
donutloader-originlogger, 23fb715b157db7e94a8290e896c01a84358f0c0700cf22fd567b7a92c0e39dd2, ftp://ftp.enogcaen-br.com
donutloader-originlogger, 30aaf6117b38d0cf7865b59543cc26e104fd7cdfcdd24457e84cf62222aba480, ftp.lodenrandmarines.com
donutloader-originlogger, 76e089a21b93f2349ca1dacfd8d4fae4b57702f302103a83ca7c0d988991100e, https://api.telegram.org/bot8680413855
donutloader-originlogger, bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3, ftp.piovau.com
donutloader-originlogger, c54a5569fe7cc95554e343f5ac829389fccbf6417000bf6573c4b64bd48c7d80, ftp.piovau.com
donutloader-originlogger, cf600cc2c68bfa74e2da5c7a19f92bdfd6db8254e0a9fc9b2ccc5ae644e17457, ftp.lodenrandmarines.com:21
donutloader-originlogger, d2fc36eedc354152ab7bcb96436c54c45cdd8fda7212cdc1ddbe826f61acc457, ftp.piovau.com:12099
expiro, 53898e8a1aa8fa8b3a0da356ad85cc1215f4d6b5aef341fae96a41085db349a2, fwiwk.biz/qlldgrktddhaiych
guloader-remcos, 8f4a618be0b59f1156fb4b17347182412e54fc962360aab89e6e8b2e86f6605a, 130.12.181.40:2404
guloader-remcos, dce2215fa2cb24ff3e7d99536ddcb9d0fa28329f976d5355b699d5fa56bdec00, 103.67.163.0:2404
lokibot, c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb, http://158.94.211.95/kelly/five/fre.php
masslogger, 4903fbe3e8ee4bc49035c9fb6e8fd3d258f3daadf237d6b1f8dd3fe41cb4ced9, mail.trimnt.com
originlogger, 09783fa659755aba97256704aaf284df35d698ee9aff8cecd0eeeabe3a576a89, forsacecobol.online
originlogger, 0cc4908f69d187162159c88a008c495e3f3b44f07f1fdbb8ff047796cf5ac775, ftp.ienco-gr.com
originlogger, 145512ad0ee1ebe7ca3e4298be88ffa7cdb984b535128430a65acccc9d19ff14, ftp.lodenrandmarines.com
originlogger, 3ee1860c0f5353263b70752681bd78872a5b9abf642b93669993f28f83933215, ftp.crescentegramas.com.br
originlogger, 6d60f9d8fb1f18a32661a5b4a9db33f3607707c29c26e36d5988b6cc6ad88c46, https://api.telegram.org/bot8664834551
originlogger, 6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849, ftp.hhautoinvestment.co.tz
originlogger, 7590a307a9cfbe88f7aea528b890bf8f1e8d81228ef06fd65ceb06ab758fe0ee, ftp://ftp.piovau.com
originlogger, 8efda310e1548c396caa8fe3e31168c386215e880ac3000b57047643d2702f25, mail.hotelbeiramar.com
originlogger, a6455dea59980cdbab8c1a1002a84b1db5531e646a292a0c6489e7818bae445c, forsacecobol.online
originlogger, ce3562ba09381cf9931edac0983a7f732b5d1007ea878416fed7fb3a9958cb8d, ftp.duct-master.com
originlogger, ede6cfb8415518ad6598ec1ed1899183d9fd8f61534f47840ad3c2c85a59bcb1, mail.chinaplasticsac.com
originlogger, fdb7456a43bc3c0296c18043bf32f21b8a29d099f91fb690a6816d202d6ad51a, ftp.siangeetech.com
overlord, 3e98101a03ad5606130bf5998799c05c6de7dcd97ad9e79bc776f3b5fb830609, 64.89.161.167:5173
phantomstealer, db70c9fe8b6e8671b6cf3d30993ab457643b05220af94c5117e9b08c500fe81c, s4.serv00.com
purelogsstealer, 0148984347249e50ef716b263576217b91b5ba7e745563bc372c33c49c751299, 2.27.62.123:4449
purelogsstealer, 26b40edcb6058e198db20eeeb6c02cb4a0d54c89bce38361f1ea7bedc4e60ebc, 2.27.62.123:4449
purelogsstealer, 2d7b52fa15022f97a866b631885d8789f4014cb254e5aa5e2711c8b6bfffe90b, 2.27.62.123:4449
purelogsstealer, 3d81e153b781f05f4c095f2dbe6751a5db8cd71a9aa634fcf0586440f3535dcc, 2.27.62.123:4449
purelogsstealer, 4acb5601081496ba7576ecd976b1551460028736ce1d820d76c70d0fc4e23d40, 2.27.62.123:4449
purelogsstealer, 7b679a520a543299f7690098878395870cb111ed8cdd7c828abdf6394ad3656d, 2.27.62.123:4449
purelogsstealer, 7bbe89567d6cea79ed64e0f357d113ed5a00651d859d0b9304cf987db952a337, 2.27.62.123:4449
purelogsstealer, 8765a68285521845c3c82b3ed49cd5fcec5fa099f557dd735f231c9f2c7af410, 2.27.62.123:4449
purelogsstealer, 972bf7a2a8d3e3f4250195211f13797c809fcd766bf88a4b726e1ee888b8f28a, 2.27.62.123:4449
purelogsstealer, ba6576128e1ff343101834b5c3b61cfd6b02089ad4977f0b7226ea3c345fa6b9, https://2.27.62.123:4449/ping
remcos, 6a46cc07f5f9740196f0dd8c3aa1cdd50f9b09389727cccafa92ce949741c1b4, 103.67.163.0:2404
remcos, 7f7bbf3140da87669d82e80a8b58c1a982fbd864fbaab92ec14b1c063574972b, 103.67.163.0:2404
remcos, 9a76d571cc8147bc9ecb5612eac9f48f31bc6c3807469094d08df8b571bfa949, 45.9.168.219:2404
remcos, ced82528b08a52a9a0aaaffdeda31641897e0973685562506f88674a3da1cf98, 31.57.216.62:2404
remcos, d448f06355d7484df4c27108b0f9c4ef313c34cafee87eb3d85eec012094300f, 45.9.168.219:2404
reverseloader-xloader, 98a62848ba69cb645343aaabccc2669c5ed6d72d32c0251847c6cbb1e56a8bc8, www.fatih-lihkab.xyz
screenconnect, 7aa3e6f815f9187640aa09543f8c350fa38bd496ca125699bf36f291cdd65eda, instance-wvl008-relay.screenconnect.com
tiflux, f5933672510cd48ab47cc5b6085669588f760143bc28d87cd749898dc4de00d6, agent.tiflux.com
vipkeylogger, 9feb9be42aa71275e2018333ebffeebb4cf01d07998cbf3b702bae571222fa9b, https://api.telegram.org/bot8099843793
vipkeylogger, c869961a929906fab60f2f57bce977823ca211929a20134c478407ab216cdf92, https://api.telegram.org/bot8099843793
vipkeylogger, dcd3ac2042e9b2122791a11679b8d4bb6170286b2b5101655ad157cb6c7c8077, https://api.telegram.org/bot8099843793
xloader, 15816a85abbcc64085fc9cd88b5e1e116bb60dc33d53df8d71a8e2ffe157fd17, http://www.37betnc.com/inu0
xloader, 17a6642be4a37635d5b9a00d9d8b5ff14ae7f4d8e94fdc1c8a53f664513c27da, www.sprocket-modelshop.ru
xloader, 1b9fb328a733320aa7034578f4f3ae4cc2b62f97d0a7a3df9814e6b17af55520, www.rugby-teams.com
xloader, 3b1632e3c027292812e81bedecabfde85d484acc34d7ac745678cca9b8743e35, http://www.jaeschke.coach/h11w/
xloader, 5c70d292553e22cf0b6b807055954a837e86d30ca4914eda11a5ebda4c96ad17, www.aitokenhub.top//33xc
xloader, 79c131e66bd132cec01935296fce8326c5fda972d830b8d53555548ad9dce6ff, http://www.55990846.xyz/17cw/
xloader, 820b4103051393c162b7b00e461a2b86a9cf92f5feb9bc9b77782d680a9d6f89, www.genvideos.org
xloader, 8eb07e3ae06150c7dd7770f383a4816889a2f335e4bff6beae1b5e2296f7170a, http://www.32308172.xyz/0tnq/
xloader, a101c0eb463fab8cd9f1732759f5ad65fc760f1a81c79c98b5fcb0ebb48c8554, www.zixunlu.live
xloader, c69204119150a73dd5191aadfbb68032f250aed78a95831e2cd59fadc546359b, www.maxenergytr.com
xloader, f196058d2595ddb2109cf81051fbae83021d76859e282f5d9c2949e783a799c7, http://www.55990846.xyz/17cw/
xworm, 034cf72ffacee3d03aacd2514b7f877186deb5a4333da129029f837b69e18638, petro4prime.ydns.eu
xworm, 034cf72ffacee3d03aacd2514b7f877186deb5a4333da129029f837b69e18638, petro4prime.ydns.eu:5909
xworm, 190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70, petro4prime.ydns.eu:5909
xworm, 23302932f0ea57c976c2944dd569c0eca3ebad2739654e689dc5c3941f951104, aaslooria.com:6000
xworm, 3125fba8f67f7987d00efab2c13304c4dce193fb3ac740e43befb881f2ba7174, petro4prime.ydns.eu:5909
xworm, 467ad7cc014c2098f96b7fb681cfda600bb614f2eeb68fd296b70dfd961d02df, 82.29.96.71:11483
xworm, 490644b09dd5e68cfea06b6380672071ec83ae4a04dcbb1a61322dcabdf9e0d3, petro4prime.ydns.eu:5909
xworm, 497eeaf4e2c3a4aca41459d25af00b1995dbf6353476df9cc4df678086203cd7, aaslooria.com:6000
xworm, 500cd979076c01f3873bd08de8f09163f74eb25a462ea66037b92a0665524012, 203.202.232.149:2222
xworm, 51cf4209be2c160f3182f2488e68eec40edd7e9f9f76224fa4b66d4ec74a35bd, 103.83.86.92:3333
xworm, 67435818ec3ccd9768649f84d5753d7130b7833333beadbd4b5975e3eb08bdeb, petro4prime.ydns.eu:5909
xworm, 6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842, petro4prime.ydns.eu:5909
xworm, 6ac830bd7321a7add3991a03ed8c82104d17f6d6fa2fff5541cb73dcf773aa21, 203.202.232.149:2222
xworm, 6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503, 103.83.86.92:3333
xworm, 797a4574316768c9e35bca960303066617e47069c78ea1f1d949cfa3535eb2de, doel.ydns.eu:5909
xworm, 929377892a5f6ecf77f07cb7af98debcdb03d1f325530ecf0e26e85b0313c7b0, aaslooria.com:6000
xworm, 98e383fe1a46c68e47372e14aa68069adc1dd1f222988b8cade631c95b3bf46a, petro4prime.ydns.eu:5909
xworm, a1fb2c28972c3deebd64a0cd156c42216104ede73a1270aa384650c245677417, petro4prime.ydns.eu:5909
xworm, a312f9d970cce223d5ae325b879331f6c81b8449c8ce11e702d41f74a82e9f6a, jar5.ydns.eu:5909
xworm, a5ebbaa4a872d243346d6782105ac90537577d63fe490065b13c8eca8bfa91cc, 130.12.181.11:7433
xworm, c0a8b8107c1cab0d63a0807962527a46274571278d5b39e68ec5978a196e8b6b, 103.83.86.92:3333
xworm, c4ac52caa570bb4ce0964a9ab44642334df1c26ede0682174097d588e4c970a0, petro4prime.ydns.eu:5909
xworm, db232cdc7fa77347a41af1313242bff38f2c5fbdf8f53f5083c59f3b8d318826, petro4prime.ydns.eu:5909
xworm, e5b8fdc2746717bdc8ba46d4924f05020926448f5f26f218e233bd6c3e287c3f, petro4prime.ydns.eu:5909
xworm, fd55e57a095fc22e451fd7288ec7d450ab4d55a57a76adea5fd812175e127b8b, petro4prime.ydns.eu:5909
xworm-originlogger, 9bad04d6ae85c68c1c9aa2718fae8e1713e77b13e2b6c069c26491d72ae63b17, ftp.duct-master.com
xworm-originlogger, c46fb5ba26a3d86088e348980056f53a5967e319d185d63af8d75728f2ea7de9, ftp.duct-master.com

backup@enogcaen-br.com
bakup@ienco-gr.com
bsenerioown@crescentegramas.com.br
chuksviruxx@chinaplasticsac.com
cloudbackupdanny@piovau.com
CMMO@hhautoinvestment.co.tz
hr@lodenrandmarines.com
joaquim@hotelbeiramar.com
mohammedddxxx@duct-master.com
muna_m@siangeetech.com
origin1@forsacecobol.online