# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: pterodo, primitive bear

# Reference: http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/

admin-ru.ru
adobe.update-service.net
apploadapp.webhop.me
brokbridge.com
cat.gotdns.ch
check-update.ru
childrights.in.ua
conhost.myftp.org
docdownload.ddns.net
downloads.email-attachments.ru
downloads.file-attachments.ru
dyndownload.serveirc.com
e.muravej.ua
email-attachments.ru
file-attachments.ru
freefiles.myftp.biz
getmyfile.webhop.me
googlefiles.serveftp.com
grom56.ddns.net
grom90.ddns.net
hrome-update.ru
hrome-updater.ru
loaderskypetm.webhop.me
loadsoulip.serveftp.com
mail.file-attachments.ru
mails.redirectme.net
mars-ru.ru
msrestore.ru
oficialsite.webhop.me
parkingdoma.webhop.me
poligjong.webhop.me
polistar.ddns.net
proxy-spread.ru
rms.admin-ru.ru
samotsvety.com.ua
skypeemocache.ru
skypeupdate.ru
spbpool.ddns.net
spread-service.ru
spread-ss.ru
spread-updates.ru
stor.tainfo.com.ua
tortilla.sytes.net
ukrnet.serveftp.com
ukrway.galaktion.ru
umachka.ua
update-service.net
updatesp.ddns.net
updateviber.sytes.net
webclidie.webhop.me
win-restore.ru
winloaded.sytes.net
winupdateloader.ru
yfperoliz.webhop.me

# Reference: https://arstechnica.com/information-technology/2018/11/ukraine-detects-new-pterado-backdoor-malware-warns-of-russian-cyberattack/

updates-spreadwork.pw
dataoffice.zapto.org
bitsadmin.ddns.net

# Reference: https://cert.gov.ua/news/46

natos-drp.ddns.net
nato-drp.ddns.net
ukraine-news.ddns.net
ukraina-drp.ddns.net
tovar-es.ddns.net
start-usb.ddns.net
sovetkirov.ddns.net
singles-office.ddns.net
single-office.ddns.net
yousister.ddns.net
wq03.ddns.net
wq02.ddns.net
wq01.ddns.net
werdikt.ddns.net
wareface.ddns.net
vnc-new.ddns.net
ut03.ddns.net
ut02.ddns.net
ut01.ddns.net
us03.ddns.net
us02.ddns.net
us01.ddns.net
topline.myftp.org
sushi-bar.ddns.net
po03.ddns.net
po02.ddns.net
po01.ddns.net
pk03.ddns.net
pk02.ddns.net
pk01.ddns.net
orizoh88.ddns.net
optima-se.ddns.net
new-club.ddns.net
mykarina.ddns.net
microsoft-single.ddns.net
metro-exodus.ddns.net
marishka.ddns.net
macdocs.ddns.net
karasto01.ddns.net
gr03.ddns.net
gr02.ddns.net
gr01.ddns.net
connect-updates.ddns.net
chrome-update.ddns.net

# Reference: https://blog.threatstop.com/russian-apt-gamaredon-group

splin-body.site
torrent-stel.space
torent-updates.ddns.net
torrent-updates.ddns.net
splin-upd.site
splin-upd1.site
torrent-supd.space

# Reference: https://cert.gov.ua/news/42

http://95.142.45.58
single-office.ddns.net

# Reference: https://cert.gov.ua/news/46

bitsadmin.ddns.net
dataoffice.zapto.org
updates-spreadwork.pw

# Reference: https://twitter.com/VK_Intel/status/1084955795358330880

spread-system.info

# Reference: https://twitter.com/VK_Intel/status/1080919080616439808

torrent-supd.space

# Reference: https://twitter.com/ClearskySec/status/1065267794474950657

chrome-update.ddns.net
connect-updates.ddns.net
gr01.ddns.net
gr02.ddns.net
gr03.ddns.net
karasto01.ddns.net
macdocs.ddns.net
marishka.ddns.net
metro-exodus.ddns.net
microsoft-single.ddns.net
mykarina.ddns.net
natos-drp.ddns.net
nato-drp.ddns.net
new-club.ddns.net
orizoh88.ddns.net
optima-se.ddns.net
pk01.ddns.net
pk02.ddns.net
pk03.ddns.net
po01.ddns.net
po02.ddns.net
po03.ddns.net
singles-office.ddns.net
single-office.ddns.net
sovetkirov.ddns.net
start-usb.ddns.net
sushi-bar.ddns.net
topline.myftp.org
tovar-es.ddns.net
ukraina-drp.ddns.net
ukraine-news.ddns.net
us01.ddns.net
us02.ddns.net
us03.ddns.net
ut01.ddns.net
ut02.ddns.net
ut03.ddns.net
vnc-new.ddns.net
wareface.ddns.net
werdikt.ddns.net
wq01.ddns.net
wq02.ddns.net
wq03.ddns.net
yousister.ddns.net

# Reference: https://twitter.com/CSIRTCV/status/1083420779486855169

errors-analyses.ddns.net
spr-files.ddns.net
spr-updates.ddns.net

# Reference: https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution/

admin-ru.ru
adobe.update-service.net
apploadapp.webhop.me
brokbridge.com
cat.gotdns.ch
check-update.ru
childrights.in.ua
conhost.myftp.org
docdownload.ddns.net
downloads.email-attachments.ru
downloads.file-attachments.ru
dyndownload.serveirc.com
e.muravej.ua
email-attachments.ru
file-attachments.ru
freefiles.myftp.biz
getmyfile.webhop.me
googlefiles.serveftp.com
grom56.ddns.net
grom90.ddns.net
hrome-update.ru
hrome-updater.ru
loaderskypetm.webhop.me
loadsoulip.serveftp.com
mail.file-attachments.ru
mails.redirectme.net
mars-ru.ru
msrestore.ru
oficialsite.webhop.me
parkingdoma.webhop.me
poligjong.webhop.me
polistar.ddns.net
proxy-spread.ru
rms.admin-ru.ru
samotsvety.com.ua
skypeemocache.ru
skypeupdate.ru
spbpool.ddns.net
spread-service.ru
spread-ss.ru
spread-updates.ru
stor.tainfo.com.ua
tortilla.sytes.net
ukrnet.serveftp.com
ukrway.galaktion.ru
umachka.ua
update-service.net
updatesp.ddns.net
updateviber.sytes.net
webclidie.webhop.me
win-restore.ru
winloaded.sytes.net
winupdateloader.ru
yfperoliz.webhop.me

# Reference: https://twitter.com/ClearskySec/status/1065267790943268865

dropdrop.ddns.net
drop-new.ddns.net
drop-news.ddns.net
google-drive.ddns.net
google-drp.ddns.net
google-drop.ddns.net

# Reference: https://twitter.com/VK_Intel/status/1117303080545079296

winroutes.ddns.net

# Reference: https://twitter.com/h4ckak/status/1117234914158530560

winrouts.ddns.net

# Reference: https://twitter.com/h4ckak/status/1117789601765007360

lisingrout.ddns.net

# Reference: https://twitter.com/Timele9527/status/1118331760612388864

word-service.site

# Reference: https://twitter.com/Timele9527/status/1118343183971360769

libre4.space

# Reference: https://twitter.com/zlab_team/status/1121013394251948036
# Reference: https://blog.yoroi.company/research/the-russian-shadow-in-eastern-europe-ukrainian-mod-campaign/

bitwork.ddns.net
librework.ddns.net

# Reference: https://twitter.com/ThreatBookLabs/status/1123149311573815297
# Reference: https://x.threatbook.cn/nodev4/vb4/article?threatInfoID=1417 (Chinese)
# Reference: https://otx.alienvault.com/pulse/5cc80eba055a4f569561dad5
# Reference: https://www.virustotal.com/gui/ip-address/185.200.241.88/relations

advansed-template.site
alenko.site
attach.website
beercraft.fun
beercraft.space
bits-mars.fun
bits-mars.site
bits-mars.space
bits-tor.fun
bits-tor.site
bits-tor.space
bits-tor.website
bitsadmin.space
bitsadmin1.space
bitsadmin10.space
bitsadmin2.space
bitsadmin3.space
bitsadmin4.space
bitsadmin5.space
bitsadmin6.space
bitsadmin7.space
bitsadmin8.space
bitsadmin9.space
bitsbitsa.space
bitsbitsb.space
bitsbitsc.space
bitsbitsd.space
bitsbitsf.space
bitsbitsg.space
bitsbitsh.space
bitsbitsi.space
bitsbitsk.space
bitsbitsl.space
cleaners.fun
cornelius.website
cyberworld.host
cyberworld.website
demiurg.site
demiurg.space
demiurg.website
dilana.space
drivegoogle.site
drovka.space
dwn-files.site
fix-template.site
gameland.host
gameland.space
gameland.website
gameworld.website
google-drive.site
haker.fun
haker.host
haker.space
haker.website
immortals.site
immortals.space
immortals.website
lebrederm.space
lebreman.space
libda.site
libdab.site
libdad.site
libdadi.site
libdado.site
libdaf.site
libdag.site
libdah.site
libdak.site
libdal.site
libdam.site
libdan.site
libdas.site
libre-360.site
libre-exel.site
libre-office.site
libre-ppt.site
libre-word.site
libre1.space
libre2.space
libre3.space
libre4.space
libre5.space
librerty.space
libres.space
libressimo.space
macros1.space
macros2.space
macros3.space
macros4.space
macros5.space
masseffect.fun
masseffect.site
masseffect.space
masseffect.website
microsoft-analise.site
microsoft-bits.site
microsoft-macros.site
microsoft-office.site
microsoft-usb.site
mirkwood.space
mototo.fun
mototo.site
mototo.space
mototo.website
new-template.site
niam.space
normal-template.site
normandia.website
ogmar.fun
ogmar.site
ogmar.website
ogremage.site
ogremage.space
ogremage.website
old-template.site
overload.space
overload.website
rainak.space
riki.space
rud.ddns.net
saprit.fun
saprit.site
saprit.space
saprit.website
sheppard.fun
sheppard.website
skymage.fun
skymage.space
skymage.website
sorg.space
ssu-gov.site
ssu-gov.website
stan-stana.site
stan-stana.space
stan-stana.website
stereo-bit.fun
stereo-bit.space
termit.space
termit.website
termits.fun
watcher.host
wayto.host
wayto.website
wifa.site
wifa.space
wifa.website
wifb.site
wifb.space
wifc.host
wifc.site
wifc.space
wifc.website
wifo.host
wifo.space
wifo.website
wifu.site
wifu.space
wifu.website
wify.space
wify.website
word-checker.site
word-online.site
word-proxy.site
word-service.site
word-update.site
wordmacros.space
xakep.fun
xakep.site
zanzar.space
bitqueshions.ddns.net
gamework.ddns.net
telemetriya.hopto.org
torrent-videos.ddns.net
usbqueshions.ddns.net
wordqueshion.ddns.net
workan.ddns.net
workusb.ddns.net

# Reference: https://twitter.com/JAMESWT_MHT/status/1131226380694413312

bitvers.ddns.net
tor-file.ddns.net
wincreator.ddns.net

# Reference: https://twitter.com/Timele9527/status/1139816501869871104

templates.hopto.org

# Reference: https://twitter.com/HONKONE_K/status/1143725710340587520

curt.hopto.org

# Reference: https://twitter.com/VK_Intel/status/1143696009261932544

bit-rnbo.ddns.net
rnbo-ua.ddns.net

# Reference: https://twitter.com/VK_Intel/status/1147021849567617026

barathrum.space
zombieland.info

# Reference: https://thehackernews.com/2019/07/linux-gnome-spyware.html

clsass.ddns.net
kotl.space

# Reference: https://twitter.com/Timele9527/status/1154570300635303937
# Reference: https://www.virustotal.com/gui/ip-address/5.252.193.204/relations
# Reference: https://www.virustotal.com/gui/file/79fd962eb0c256f32786dab4d42cb416f6c1e6766bf0e2dcafdf5ffa2c5e61c1/detection
# Reference: https://otx.alienvault.com/pulse/5d3ac45e3bc2987b3b0031dc
# Reference: https://app.any.run/tasks/dee82850-9e19-4a53-b9b4-e5d88df913be/

advansed-template.site
bits-tor.fun
bits-tor.host
bits-tor.site
bits-tor.space
bits-tor.website
bitsadmin10.space
bitsadmin2.space
bitsadmin3.space
bitsadmin4.space
bitsadmin5.space
bitsadmin6.space
bitsadmin7.space
bitsadmin8.space
bitsadmin9.space
bitsbitsa.space
bitsbitsb.space
bitsbitsc.space
bitsbitsi.space
bitsbitsk.space
bitsbitsl.space
certificate-verif.ddns.net
cyberworld.host
cyberworld.website
dilana.space
drovka.space
fix-template.site
furion.space
gameland.space
gameland.website
gameworld.space
gameworld.website
haker.fun
haker.host
haker.space
haker.website
libda.site
libdab.site
libdac.site
libdad.site
libdade.site
libdadi.site
libdado.site
libdaf.site
libdag.site
libdah.site
libdak.site
libdal.site
libdam.site
libdan.site
libdas.site
libre-360.site
libre-exel.site
libre-office.site
libre-ppt.site
libre-word.site
libre1.space
libre2.space
libre3.space
libre4.space
libre5.space
librerty.space
libressimo.space
macros1.space
macros2.space
macros3.space
macros4.space
macros5.space
niam.space
orlean.space
overload.space
overload.website
overwatch.host
rainak.space
redict.ddns.net
riki.space
wayto.host
wifa.site
wifa.space
wifa.website
wifb.site
wifb.space
wifb.website
wifc.host
wifc.site
wifc.space
wifc.website
wifo.host
wifo.site
wifo.space
wifo.website
wifu.site
wifu.space
wifu.website
wifx.site
wify.space
wify.website
wordmacros.space
xakep.fun
xakep.website
zombieland.host
zombieland.info

# Reference: https://twitter.com/Timele9527/status/1157458188792262656

shell-create.ddns.net

# Reference: https://twitter.com/Timele9527/status/1158554492746383361
# Reference: https://www.virustotal.com/gui/file/96f9f7a5c6a7452f385727708c69bf158e2d9461ad1bc683ba9082306b210e0e/detection

libre-templates.ddns.net

# Reference: https://twitter.com/spider_girl22/status/1171262839295635457

office-constructor.ddns.net

# Reference: https://twitter.com/Rmy_Reserve/status/1174592994395054080

weeklite.ddns.net

# Reference: https://twitter.com/spider_girl22/status/1192276592522776576

inbox-office.ddns.net

# Reference: https://twitter.com/spider_girl22/status/1192638857478463488

micro-set.ddns.net
office-crash.ddns.net

# Reference: https://twitter.com/ccxsaber/status/1192630060513136640

get-icons.ddns.net

# Reference: https://twitter.com/ccxsaber/status/1192630027847950338

micro-office.ddns.net

# Reference: https://twitter.com/spider_girl22/status/1193731348239773698

office-lite.ddns.net

# Reference: https://twitter.com/MalCrawler/status/1192796411752042496
# Reference: https://www.virustotal.com/gui/ip-address/2.59.41.5/relations

bitread.ddns.net
bitvers.ddns.net
checkhurl.fun
checkhurl.info
checkhurl.site
checkhurl.space
checkhurl.website
const-gov.ddns.net
constructor-word.ddns.net
creative-office.ddns.net
document-listing.ddns.net
document-write.ddns.net
duktas-dde.ddns.net
get-icons.ddns.net
kornet-ua.ddns.net
kristo-ua.ddns.net
l3ccd25c.justinstalledpanel.com
libre-boot.ddns.net
libresoft.ddns.net
list-sert.ddns.net
lookups.ddns.net
message-office.ddns.net
micro-office.ddns.net
military-ua.ddns.net
my-certificates.ddns.net
network-crash.ddns.net
rnbo-ua.ddns.net
shell-sertificates.ddns.net
suipost.ddns.net
sv-menedgment.ddns.net
templates.hopto.org
tempwook.ddns.net
tesla-pos.ddns.net
underlord.fun
underlord.site
underlord.space
unhcr.ddns.net

# Reference: https://twitter.com/angel11VR/status/1196488408652275712
# Reference: https://pastebin.com/Vhb4KF5L

win-apu.ddns.net

# Reference: https://twitter.com/Rmy_Reserve/status/1199105567379402752

paparije.ddns.net
win-gu.ddns.net

# Reference: https://twitter.com/Rmy_Reserve/status/1198992468244455430

brousework.ddns.net
yotaset.ddns.net

# Reference: https://twitter.com/DeadlyLynn/status/1196769711557447681

win-ss.ddns.net

# Reference: https://twitter.com/DeadlyLynn/status/1199310720971628544

korneliuswork.ddns.net

# Reference: https://twitter.com/TippedMyCows/status/1201966780727607298

kavkazwork.ddns.net
reklama-network.ddns.net

# Reference: https://twitter.com/DeadlyLynn/status/1210785247039635462

document-out.hopto.org
libcrash.ddns.net

# Reference: https://twitter.com/WaChinYu1/status/1215292666776313857
# Reference: https://twitter.com/JAMESWT_MHT/status/1215580348853170176

listenwork.ddns.net
pasive.ddns.net

# Reference: https://twitter.com/TippedMyCows/status/1215376917047775232

document-out.ddns.net

# Reference: https://twitter.com/DeadlyLynn/status/1217805735070822400

dominikanos.hopto.org
kreps.hopto.org

# Reference: https://twitter.com/Rmy_Reserve/status/1217064837051645954

dochlist.hopto.org
skrembler.hopto.org

# Reference: https://twitter.com/TippedMyCows/status/1217514381866688517

susget.hopto.org

# Reference: https://twitter.com/DeadlyLynn/status/1194869515173019648

office-out.ddns.net

# Reference: https://twitter.com/dewan202/status/1194004664716541954

word-gread.ddns.net

# Reference: https://twitter.com/KorbenD_Intel/status/1065018358075146240
# Reference: https://www.virustotal.com/gui/ip-address/185.231.155.209/relations

dr01.ddns.net
dr02.ddns.net
dropper.crimea.com
dropper01.crimea.com

# Reference: https://twitter.com/DrunkBinary/status/1019904469155368960

realy.ddns.net

# Reference: https://twitter.com/VK_Intel/status/1220238381319323648

masseffect.space

# Reference: https://twitter.com/MarsFacebook/status/1219183410289102849

perdector.hopto.org

# Reference: https://twitter.com/WaChinYu1/status/1221897054693228545

kastoget.hopto.org
papir.hopto.org

# Reference: https://www.virustotal.com/gui/ip-address/141.8.195.60/relations

feodosh.hopto.org
ironiya.ddns.net
karab.hopto.org
kastoget.hopto.org
kentes.hopto.org
kutan.ddns.net
lobanus.hopto.org
office-carambol.ddns.net
provansales.ddns.net
selena.myftp.biz
stive.hopto.org
zariks.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/188.225.25.50/details
# Reference: https://app.any.run/tasks/6bf01afd-9d07-47df-88be-ad4b388e31a1/

babir.bounceme.net
bitupd.ddns.net
honvoi.hopto.org
kara.3utilities.com
livas.3utilities.com
sakira.3utilities.com
scr-out.ddns.net
sonik.hopto.org
tele.3utilities.com
tempget.ddns.net
tesla-fun.ddns.net
tesla-getro.ddns.net
tesla-opt.ddns.net
tesla-preat.ddns.net
tesla-tehno.ddns.net
tesla-ufis.ddns.net
tesla-unit.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/176.57.215.22/relations

bitclass.ddns.net
cretors.ddns.net
getclass.ddns.net
wizartopen.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/188.225.24.161/details

internetcreate.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/141.8.192.153/relations

carambol-oru.ddns.net
down-vv.ddns.net
librebooton.ddns.net
office-menedgment.ddns.net
sambiras.myftp.org
tempcr.ddns.net
temppost.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/195.88.208.81/relations

device-update.ddns.net
flash01.ddns.net
fsu01.ddns.net
katalisto01.ddns.net
my-update.ddns.net
office-updates.ddns.net
service-device.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/142.93.110.250/relations

armaruru.ddns.net
device-update.ddns.net
droper-sp.ddns.net
droper-spr.ddns.net
droper.ddns.net
dropius.ddns.net
spr-d2.ddns.net
spr-d4.ddns.net
spr-d5.ddns.net
spr-d6.ddns.net
telo-spread.ddns.net

# Reference: https://twitter.com/Zhx_8885/status/1228178125151850496
# Reference: https://www.virustotal.com/gui/ip-address/141.8.194.74/relations
# Reference: https://app.any.run/tasks/b5d0290e-5355-4568-b702-1a0390495902/
# Reference: https://app.any.run/tasks/c0063d98-84d1-4ed9-94eb-9397302a1887/
# Reference: https://app.any.run/tasks/bc0e9a03-2742-4ad6-acb6-e43a290e5db7/
# Reference: https://app.any.run/tasks/a2e4d04d-17ff-499a-b78d-b655a221fe3c/

error-office.myftp.biz
error-word.myftp.biz
kasimovschmuck.hopto.org
mikhailkasimov.myftp.biz
mikhailkasimov.myftp.org
schmuckkasim.3utilities.com
writedoc.bounceme.net

# Reference: https://twitter.com/Zhx_8885/status/1227471901028646912

solod.bounceme.net

# Reference: https://www.virustotal.com/gui/ip-address/185.200.241.88/relations

cron-redic.ddns.net
crons.ddns.net

# Reference: https://twitter.com/DeadlyLynn/status/1229702371732623360
# Reference: https://www.virustotal.com/gui/ip-address/176.57.215.115/relations
# Reference: https://app.any.run/tasks/b5e39e8d-8a94-4c69-9140-8015114a35c3/
# Reference: https://app.any.run/tasks/ea5d835d-43a3-4996-9767-3d0069d8ca70/
# Reference: https://app.any.run/tasks/58ad6333-96c4-4616-bba6-c0acc7c1500c/

hedriks.bounceme.net
kristoffer.hopto.org
kristom.hopto.org
livas.3utilities.com
miragena.xyz
sabdja.3utilities.com
samson.3utilities.com
violina.space
violina.website
voyaget.myftp.biz
100hit.ru
288706-ce34203.tmweb.ru
decos.hopto.org
fangimen.xyz
fingra.xyz
firran.xyz
frondo.xyz
liard.bounceme.net
niso.gotdns.ch
olida.xyz
orlani.xyz
safer.3utilities.com
shokoda.xyz
sonik.hopto.org
tesla-iu.ddns.net
tesla-ny.ddns.net
tesla-res.ddns.net
tesla-rt.ddns.net
tesla-tui.ddns.net
tesla-uos.ddns.net
totilla.xyz
uidertu.myddns.me
upokan.xyz
vois.gotdns.ch

# Reference: https://twitter.com/WaChinYu1/status/1230865020764000262

bbtt.space
himym.space
himym.xyz
underlord.fun
underlord.site
underlord.space

# Reference: https://twitter.com/w3ndige/status/1234574732730753025
# Reference: https://app.any.run/tasks/4622fd63-97dc-433a-b859-9be099f37e20/
# Reference: https://app.any.run/tasks/6401f328-c80f-48f7-95a9-b3b981111e94/
# Reference: https://app.any.run/tasks/a013b184-4d5b-40d6-8cfb-0661ade38657/
# Reference: https://app.any.run/tasks/dade1db1-f1fe-42e9-a48b-b1d28b9584e9/
# Reference: https://app.any.run/tasks/9e666611-5151-4889-858e-4f5797d64e2a/
# Reference: https://gist.github.com/W3ndige/d2eb1969497f65a8f7e572d0299afdb9

bbtt.site
himym.site

# Reference: https://twitter.com/TippedMyCows/status/1235605583404859392
# Reference: https://www.virustotal.com/gui/ip-address/176.119.147.225/relations
# Reference: https://app.any.run/tasks/e41fc213-f939-4de4-936e-a7971f9a2e19/
# Reference: https://app.any.run/tasks/5022d054-250f-41fa-93ad-b0cc1c4aba6a/
# Reference: https://app.any.run/tasks/8050341f-0602-4aae-9a7a-e114152ced89/
# Reference: https://app.any.run/tasks/afc1eea3-75e0-4aec-9b50-d1a6a0eecd41/
# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/

bambinos.bounceme.net
bbtt.website
birbas.hopto.org
forestac.site
forestac.website
forestac.xyz
harpa.site
harpa.space
harpa.website
melos.myftp.biz
midos.hopto.org
saja.myftp.biz
seliconos.3utilities.com
varas.myftp.biz
voyager.myftp.biz

# Reference: https://twitter.com/DeadlyLynn/status/1242727456563269632
# Reference: https://www.virustotal.com/gui/ip-address/141.8.198.69/relations
# Reference: https://app.any.run/tasks/85d62624-8153-482d-a8e7-26e746510eb3/
# Reference: https://app.any.run/tasks/761c45e0-83e1-4068-b7e3-ae40c06547e9/
# Reference: https://app.any.run/tasks/008c9df0-96b2-4616-9b75-d6a95ee74457/

asdfaws.myddns.me
bizavto.myftp.org
federeal.3utilities.com
jikoltew.myftp.biz
kolidus.gotdns.ch
kolyuwer.bounceme.net
liboot.myftp.biz
lopaverus.3utilities.com
milosetuder.myftp.biz
outfish.bounceme.net
redukos.bounceme.net
salioert.3utilities.com
samsorud.myftp.biz
satkower.3utilities.com
wertlook.hopto.org

# Reference: https://twitter.com/Zhx_8885/status/1242857013048012804

koliorew.hopto.org

# Reference: https://twitter.com/Zhx_8885/status/1242859749965627392

teriosad.myftp.org

# Reference: https://twitter.com/WaChinYu1/status/1249752181051478017
# Reference: https://app.any.run/tasks/62e67bce-1c3f-4262-a3b4-93fc7aab8190/

getyuawer.myftp.biz
pankratios.myftp.org

# Reference: https://twitter.com/Zhx_8885/status/1250110743778717696

hirodomus.hopto.org

# Reference: https://www.virustotal.com/gui/ip-address/109.68.213.102/relations

saveriutew.3utilities.com

# Reference: https://www.virustotal.com/gui/ip-address/188.225.79.97/relations

heristomuk.hopto.org
perastyuer.myftp.biz
poizader.hopto.org

# Reference: https://www.virustotal.com/gui/ip-address/188.225.46.94/relations

redisman.ddns.net
reklamgroup.ddns.net

# Reference: https://www.virustotal.com/gui/file/59bef9935d5dae8c0c1f05dd4faf15b642b93baaff3555b02387f49c2153d256/detection

bits-mars.info

# Reference: https://www.virustotal.com/gui/file/fffe5cb20a950f29e462bc04d1662343dc8019c44748a26d39cf604c594b8313/detection

restors.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/5.23.55.101/relations

myimage.host

# Reference: https://twitter.com/ShadowChasing1/status/1250592142034001921
# Reference: https://www.virustotal.com/gui/ip-address/185.248.100.121/relations
# Reference: https://www.virustotal.com/gui/ip-address/195.88.208.196/relations

splin-body.site
splin-body1.site
splin-upd.site
splin-upd1.site

# Reference: https://twitter.com/ShadowChasing1/status/1250592542090878976
# Reference: https://www.virustotal.com/gui/file/1be87dd137ff211e0e2334e053f78c8f9ba00c0c59ea044488a74b9b77270f4a/detection

musik-lis.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/91.210.170.72/relations

actor-tv.ddns.net
addova.xyz
alastari.xyz
amarillio.space
area-tv.hopto.org
baby-tv.ddns.net
borzoy-tv.ddns.net
druweal.xyz
fartiny.xyz
ferranot.xyz
filkos-tv.ddns.net
fulo-tv.ddns.net
geters-tv.ddns.net
gorgopa.xyz
hilos-tv.ddns.net
hres-tv.ddns.net
hudos-tv.ddns.net
huncea.xyz
itango.space
joka-tv.ddns.net
jontap.xyz
kiodas.xyz
kistas-tv.ddns.net
koleran.xyz
liqutan.xyz
lustra-tv.ddns.net
marmari.space
mersi-tv.ddns.net
musik-dreg.ddns.net
musik-erta.ddns.net
musik-file.ddns.net
musik-klo.ddns.net
musik-kreps.ddns.net
musik-lio.ddns.net
musik-lis.ddns.net
musik-lk.ddns.net
musik-pit.ddns.net
musik-qas.ddns.net
musik-sa.ddns.net
onyxi.xyz
orteasd-tv.ddns.net
papai-tv.ddns.net
pardi-tv.ddns.net
podr-tv.ddns.net
pragma-tv.ddns.net
predf-tv.ddns.net
samak-tv.ddns.net
siold-tv.ddns.net
srarda.space
syio-tv.ddns.net
teris-tv.ddns.net
trelial.xyz
troubl.xyz
vantalio.space
veronis.space
vinara.xyz
virtuz.xyz
wiilasto.website

# Reference: https://www.virustotal.com/gui/ip-address/58.158.177.102/relations

hanwha.hopto.org

# Reference: https://app.any.run/tasks/dbfc2cb0-8527-45fb-9af0-ae70e87b03cf/
# Reference: https://app.any.run/tasks/6919cbfb-f193-4125-a282-f3cf7f835e66/
# Reference: https://app.any.run/tasks/dbfc2cb0-8527-45fb-9af0-ae70e87b03cf/

karpa.bounceme.net

# Reference: https://www.anomali.com/files/white-papers/Anomali_Threat_Research-Gamaredon_TTPs_Target_Ukraine-WP.pdf

office-constructor.ddns.net
librebooton.ddns.net
inbox-office.ddns.net
libre-templates.ddns.net
word-gread.ddns.net
win-apu.ddns.net
office-lite.ddns.net
office-crash.ddns.net
office-out.ddns.net
micro-set.ddns.net
win-ss.ddns.net
get-icons.ddns.net
network-crash.ddns.net
constructor-word.ddns.net
tempget.ddns.net
bitclass.ddns.net
bitlocker.ddns.net
const-gov.ddns.net
kornet-ua.ddns.net
certificate-verif.ddns.net
document-listing.ddns.net
shell-create.ddns.net
internet-create.ddns.net
libresoft.ddns.net
creative-office.ddns.net
kristo-ua.ddns.net
lookups.ddns.net
rnbo-ua.ddns.net
sv-menedgment.ddns.net
document-write.ddns.net
my-certificates.ddns.net
bitwork.ddns.net
military-ua.ddns.net
bitupd.ddns.net
internetcreate.ddns.net
shell-sertificates.ddns.net
wizartopen.ddns.net
bitvers.ddns.net
kavkazwork.ddns.net
brousework.ddns.net
paparije.ddns.net
korneliuswork.ddns.net
scr-out.ddns.net
tesla-fun.ddns.net
list-sert.ddns.net
tempwook.ddns.net
micro-office.ddns.net
bit-rnbo.ddns.net
bitread.ddns.net
libre-boot.ddns.net
win-gu.ddns.net
office-menedgment.ddns.net
d-o.ddns.net
carambol-oru.ddns.net

# Reference: https://twitter.com/ShadowChasing1/status/1264480951880441856
# Reference: https://www.virustotal.com/gui/file/6c7aa083ff8f4a33ecb485069b1fbd4f1a5fae780de18f52cbf4eb518a278c48/detection

biotic.space
biotic.website

# Reference: https://www.virustotal.com/gui/file/5bc819f9a202951e68f31649dbd9bda1bb68c5b7065939f24a1e7c0deb7df0e2/detection

barathrum.space
zombieland.info

# Reference: https://www.virustotal.com/gui/file/8d6829dd413eeb94c835f3c4474f48f8406b4f144e308f10ea50837710d200e7/detection

barildan.space
zombieland.space

# Reference: https://www.virustotal.com/gui/file/e6f39725f54becb50f48c2ea56dcd5e8cb3126947c70929664766647043d0159/detection

mapper.space
furion.space

# Reference: https://www.virustotal.com/gui/ip-address/188.225.33.164/relations
# Reference: https://www.virustotal.com/gui/ip-address/188.225.34.160/relations
# Reference: https://www.virustotal.com/gui/ip-address/92.53.124.153/relations

barathrum.space
barildan.space
biotic.space
biotic.website
doctorrr.space
furion.space
kania-tau.space
kinozavr.fun
kinozavr.site
kinozavr.space
kinozavr.website
liara.site
liara.website
m-upd.ddns.net
mapper.space
nellas.space
rashta.space
rulomins.world
torrent-stel.space
torrent-supd.space
u-opt.ddns.net
zombieland.fun
zombieland.host
zombieland.info
zombieland.space
zombieland.website

# Reference: https://twitter.com/Circuitous__/status/1266339237839998976
# Reference: https://www.virustotal.com/gui/ip-address/141.8.198.56/relations

fidel.freedynamicdns.org
ip-server.freedynamicdns.net
kasim.freedynamicdns.org
kasting.freedynamicdns.org
lisbek.freedynamicdns.org
lodukat.freedynamicdns.org
lodus.freedynamicdns.org
mishail.freedynamicdns.org
ncio.freedynamicdns.net
polits.freedynamicdns.org

# Reference: https://twitter.com/h2jazi/status/1270718708013387777

posateriu.myftp.org

# Reference: https://github.com/eset/malware-ioc/tree/master/gamaredon

abdurs.space
abies.space
actor-tv.ddns.net
acutifolia.space
addova.xyz
advansed-template.site
aganta.space
alastari.xyz
alenko.site
alenko.website
amarillio.space
anadima.website
apino.space
araino.space
arionda.space
armita.space
aromaticus.space
atropoides.space
aukci.space
babitors.myftp.biz
baby-tv.ddns.net
baill.space
barrigal.space
batmeast.space
bbtt.site
bbtt.space
bbtt.website
beasty.space
beepapa.space
beercraft.fun
beercraft.space
beercraft.website
benzoin.space
bergius.space
beriuatcj.hopto.org
bernado.website
birion.website
bits-mars.fun
bits-mars.info
bits-mars.site
bits-mars.space
bits-mars.website
bits-tor.fun
bits-tor.site
bits-tor.space
bits-tor.website
bitsadmin1.space
bitsadmin10.space
bitsadmin2.space
bitsadmin3.space
bitsadmin4.space
bitsadmin5.space
bitsadmin6.space
bitsadmin7.space
bitsadmin8.space
bitsadmin9.space
bitsbitsa.space
bitsbitsb.space
bitsbitsc.space
bitsbitsd.space
bitsbitsf.space
bitsbitsg.space
bitsbitsh.space
bitsbitsi.space
bitsbitsk.space
bitsbitsl.space
bizavto.myftp.org
blackardi.space
borigl.space
bowira.website
burago.space
callitris.space
caprjhjkqwer.hopto.org
cartu.myftp.org
caryophyllus.space
casopruy.myftp.org
cathartica.space
centifolia.space
cephaelis.space
cerasus.space
ceredukos.hopto.org
cereffiopas.hopto.org
certerasdfuj.hopto.org
ceyudfg.hopto.org
chachand.space
chairada.space
chamomilla.ru
changato.space
charika.website
cioasdg.hopto.org
cleaners.fun
codfgsdf.hopto.org
codfjert.myftp.org
comedas.space
copiran.space
coprtyuqw.hopto.org
cornelius.website
corovana.space
cosdfghdf.hopto.org
cowtor.space
cozsdv.hopto.org
cozxcgbx.myftp.org
cpasah.hopto.org
cpozsxcgbxf.myftp.org
crons.ddns.net
ctert.myftp.org
cubeba.space
cudawer.hopto.org
cudrg.myftp.org
cufjdfge.myftp.org
cuiasef.myftp.org
cupana.space
cyberworld.host
cyberworld.website
davaris.space
delile.space
deloperaw.bounceme.net
demiurg.fun
demiurg.site
demiurg.space
demiurg.website
denovar.space
derpenta.space
deviar.space
dilana.space
dolori.website
dorogavi.space
dortama.space
drovka.space
dryand.space
elecan.space
entona.website
eregorn.space
error-word.myftp.biz
erythrina.space
europaea.ru
excelsa.space
fangimen.xyz
farfara.space
fartiny.xyz
federeal.3utilities.com
feodal.bounceme.net
feridonutop.myftp.org
ferranot.xyz
fidel.freedynamicdns.org
fillin.space
firecor.space
firestarters.site
firran.xyz
fix-template.site
fizanta.space
flackch.space
foenum.space
forestac.site
forestac.website
forestac.xyz
fragrans.ru
frangula.space
frondo.xyz
frostani.website
fuagrado.space
fulo-tv.ddns.net
fuubara.space
gameland.host
gameland.space
gameland.website
gameworld.space
gameworld.website
gereston.gotdns.ch
gerotron.gotdns.ch
gerotumans.myftp.org
gerusta.space
get-icons.ddns.net
geterotuks.hopto.org
geters-tv.ddns.net
getro.bounceme.net
getyuawer.myftp.biz
gochir.space
godrick.space
gogora.space
gorgopa.xyz
goronta.website
gostio.website
grandiora.website
graveolens.space
groover.fun
groover.website
guitin.space
gulif.space
haker.fun
haker.host
haker.space
haker.website
hariva.space
harpa.site
harpa.space
harpa.website
hasuduwert.hopto.org
heartal.space
heavar.space
hedriks.bounceme.net
hestomig.hopto.org
himym.site
hirodomus.hopto.org
hispidus.space
hottob.space
houtt.ru
hres-tv.ddns.net
httpsnc.hopto.org
humulusa.ru
huncea.xyz
huugara.space
huvasi.website
hyditta.space
immortals.site
immortals.space
immortals.website
imperatoria.space
indicum.space
inogri.space
ip-server.freedynamicdns.net
isoga.space
itango.space
jdaeus.space
jeera.space
jgnatii.space
jikardo.myftp.org
jogara.space
jontap.xyz
karapuls.3utilities.com
karikatos.hopto.org
katalisto01.ddns.net
kelogir.myftp.biz
kilazurus.hopto.org
kilewqrt.hopto.org
kilosadwert.hopto.org
kiloster.bounceme.net
kilotrace.myftp.org
kiodas.xyz
kirasto.website
kistas-tv.ddns.net
kokoni.space
koleran.xyz
kolidus.gotdns.ch
kolinstro.space
korogav.space
krikorro.space
kristol.space
kristom.hopto.org
kristomen.myftp.org
krossin.website
krugotto.space
ksevada.space
landraba.website
laricio.space
lebrederm.space
lebreman.space
leeri.space
leronti.space
leucadendron.ru
libcrash.ddns.net
libda.site
libdab.site
libdac.site
libdad.site
libdade.site
libdadi.site
libdado.site
libdaf.site
libdag.site
libdah.site
libdak.site
libdal.site
libdam.site
libdan.site
libdas.site
liboot.myftp.biz
libre1.space
libre2.space
libre3.space
libre4.space
librerty.space
libres.space
libressimo.space
liferat.space
lifista.space
lindras.space
lionello.website
liqutan.xyz
lodafert.hopto.org
lodus.freedynamicdns.org
loomand.space
lopasir.bounceme.net
lopaverus.3utilities.com
louthi.space
lycopodium.ru
macros1.space
macros2.space
macros3.space
macros4.space
malaky.site
malaky.website
malaky.xyz
malio-tv.hopto.org
mallotus.ru
maltikor.website
mandicap.space
mapper.space
mardallo.space
margatti.space
margon.website
marmari.space
marrubium.ru
masseffect.fun
masseffect.site
masseffect.space
masseffect.website
matricaria.ru
mazdok.myftp.org
mediacentr.space
melos.myftp.biz
melroses.space
menyanthes.ru
mersi-tv.ddns.net
mestara.space
miragena.xyz
mirani.website
mirkwood.space
mishel.freedynamicdns.org
mokushi.space
mototo.fun
mototo.site
mototo.space
mototo.website
musata.space
musik-dreg.ddns.net
musik-file.ddns.net
musik-jiolter.ddns.net
musik-klo.ddns.net
musik-kreps.ddns.net
musik-lio.ddns.net
musik-lis.ddns.net
musik-lk.ddns.net
musik-oretus.ddns.net
musik-pit.ddns.net
musik-qas.ddns.net
musik-sa.ddns.net
myristica.ru
naligo.space
naomat.space
naveria.website
ncio.freedynamicdns.net
ncov-2020.hopto.org
ncov-2020.site
nebola.space
nebora.space
nenadi.space
new-template.site
niam.space
nikao.website
nikolosad.myftp.org
normal-template.site
normandia.fun
normandia.website
nubiran.space
obendo.space
oenanthe.ru
office-constructor.ddns.net
officinale.space
ogmar.fun
ogmar.site
ogmar.space
ogmar.website
ogremage.site
ogremage.space
ogremage.website
old-template.site
olida.xyz
onyxi.xyz
opatusir.hopto.org
operitors.myftp.org
opitrqwer.3utilities.com
oput.freedynamicdns.org
orangae.space
orlani.xyz
orlean.space
orlenndi.space
orteasd-tv.ddns.net
oteruiowert.ddns.net
overload.space
overload.website
overwatch.host
pankratios.myftp.org
pannora.website
paparitto.space
papatti.space
paperonni.space
papir.hopto.org
pardi-tv.ddns.net
pasucoorew.hopto.org
pasudukus.hopto.org
patran.space
patrici.space
paullinia.space
pennatifolius.space
pennyal.space
perafidors.hopto.org
periaorew.hopto.org
perlandi.space
pestani.space
petroselinum.space
phellandrium.ru
physostigma.space
piantra.website
picea.space
pilocarpus.space
pinus.space
piscidia.space
pistacia.space
plotor.space
poasdrwety.hopto.org
podagenus.hopto.org
podr-tv.ddns.net
pointerra.space
polandi.website
poletton.space
polindar.space
polygala.space
poporaca.website
porilis.space
poronoc.website
potatin.space
poyrag.space
predf-tv.ddns.net
pridafi.website
primaver.space
proponda.space
pterocarpus.space
punica.space
purshiana.space
quadrivalvis.space
quarta.space
quassia.space
quercus.space
quillaja.space
rabio.website
radonta.space
raggina.space
rainak.space
rantai.space
redukos.bounceme.net
reiloster.hopto.org
remeno.space
rheum.space
rhus.space
ricinus.space
riki.space
risko.hopto.org
roseum.space
rosmarinus.space
rossalt.space
roundi.space
rubus.space
rud.ddns.net
russic.website
saazer.space
sabdja.3utilities.com
sabinar.website
saccharum.space
saijar.gotdns.ch
salivar.space
samail.space
samak-tv.ddns.net
samalo.space
samarutus.hopto.org
sambiras.myftp.org
santalum.space
saponaria.space
saprit.fun
saprit.site
saprit.space
saprit.website
sarakinod.myftp.biz
sarutnoum.hopto.org
sativum.space
satkower.3utilities.com
saveriutew.3utilities.com
savert-tv.hopto.org
saxifraga.space
scopolia.space
sehadus.3utilities.com
seletos.3utilities.com
sendobin.space
senega.space
serpyllum.space
serumondus.hopto.org
sesamum.space
sevena.space
sheppard.fun
sheppard.website
shiodai.space
shokoda.xyz
shoppersi.space
sidochan.space
silenser.fun
silenser.site
silenser.space
silenser.website
silenser.xyz
sinapis.space
skymage.fun
skymage.space
skymage.website
slonar.website
solonra.space
sonik.hopto.org
sorg.space
spirantra.space
srarda.space
stairu.space
stan-stana.fun
stan-stana.site
stan-stana.space
stan-stana.website
statsinfo.space
steinh.space
stenama.space
stereo-bit.fun
stereo-bit.site
stereo-bit.space
stereo-bit.website
stolina.website
stonewa.space
strychnos.space
styrax.space
succedanea.space
sylvestris.ru
symphytum.space
tamarindus.space
tarapi.space
tclvds.site
tekora.space
terihorew.hopto.org
teris-tv.ddns.net
termit.site
termit.space
termit.website
termits.fun
terokitos.hopto.org
tesla-getro.ddns.net
tesla-opt.ddns.net
tesla-preat.ddns.net
tesla-res.ddns.net
tesla-rt.ddns.net
tesla-tehno.ddns.net
tesla-ufis.ddns.net
thymus.space
tiamor.space
tilia.space
tinctorum.space
toqq.website
torrent-vnc.ddns.net
toxifera.space
traksa.space
trelial.xyz
trigonella.space
triticum.space
troubl.xyz
tussilago.space
tyctyc.ddns.net
ulmifolia.space
uncaria.space
underlord.site
underlord.space
upokan.xyz
urceola.space
urginea.space
usbqueshions.ddns.net
usitatissimum.ru
utilissima.ru
vabalt.space
valeriana.space
vantalio.space
venomart.space
veratrum.space
verbascum.space
veronis.space
vertigos.space
vestak.space
veterra.space
vibraska.website
victios.space
vidika.website
vinara.xyz
vinifera.space
violina.website
virtuz.xyz
viruanta.website
viscum.space
vitis.space
volotin.space
vomica.space
voyaget.myftp.biz
vratio.space
vulgare.space
watcher.host
wavera.space
wayto.host
wayto.website
weaman.space
wertlook.hopto.org
weweca.website
wifa.site
wifa.space
wifa.website
wifb.site
wifb.space
wifb.website
wifc.host
wifc.site
wifc.space
wifc.website
wifo.host
wifo.site
wifo.space
wifo.website
wifu.site
wifu.space
wifu.website
wifx.site
wify.space
wify.website
wiilasto.website
wildbar.space
win-apu.ddns.net
wordmacros.space
wostrigo.website
writedoc.bounceme.net
xakep.fun
xakep.site
xakep.website
yiorewasdf.myftp.org
zanusson.website
zanzar.space
zaoeryuijas.hopto.org
zareton.space
zikoarew.myftp.biz
zingiber.space

# Reference: https://intezer.com/blog/linux/evilgnome-rare-malware-spying-on-linux-desktop-users/
# Reference: https://www.virustotal.com/gui/ip-address/185.158.115.44/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.158.115.154/relations

b-class.ddns.net
connets.ddns.net
en-p.ddns.net

# Reference: https://www.virustotal.com/gui/ip-address/188.225.57.152/relations
# Reference: https://www.virustotal.com/gui/domain/inform.3utilities.com/detection
# Reference: https://www.virustotal.com/gui/file/fe934cbb46e88f252ad327ac4735839afbf3b493378fecb7e1dcee961ff12d7c/detection
# Reference: https://twitter.com/_re_fox/status/1273632793789181954

inform.3utilities.com
inform.bounceme.net
inform.gotdns.ch

# Reference: https://twitter.com/_re_fox/status/1273355801013424128
# Reference: https://www.virustotal.com/gui/ip-address/141.8.192.31/relations

malofid.freedynamicdns.org
opertos.freedynamicdns.org
serakuz.freedynamicdns.org

# Reference: https://twitter.com/h2jazi/status/1275476473680408578
# Reference: https://twitter.com/_re_fox/status/1276210660616142849
# Reference: https://twitter.com/_re_fox/status/1276699634623287296
# Reference: https://www.virustotal.com/gui/ip-address/141.8.196.56/relations

history.freedynamicdns.org
krembo.freedynamicdns.org
validat.freedynamicdns.org
vilaged.freedynamicdns.org
sarothamnus.xyz

# Reference: https://www.virustotal.com/gui/ip-address/188.225.78.105/relations
# Reference: https://www.virustotal.com/gui/file/422a90af5fc888f129e93ab69a0168e7714143c6bd20677b51136bb31625e5bf/detection
# Reference: https://www.virustotal.com/gui/file/7d67ff753b9e56b0486dcbd56b50294be3b6405df5a301e80125e067d99fe77a/detection
# Reference: https://www.virustotal.com/gui/file/2151073bc1d3adba7fc283291cb38984017ac7fa07d52e83bccc91d64298753a/detection

188.225.78.105:443

# Generic

/help_Om.php
/mfareboot.php
/posolreboot.php
/rebootor.php
/rnboreboot.php
/zaderreboot.php
/bitprog.waw
/TCGahjr/reinst.php

# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/

/help_01_01.php
/help_01_02.php
/help_01_03.php
/help_01_04.php
/help_01_05.php
/help_01_06.php
/help_01_07.php
/help_01_08.php
/help_01_09.php
/help_01_10.php
/help_01_11.php
/help_01_12.php
/help_02_01.php
/help_02_02.php
/help_02_03.php
/help_02_04.php
/help_02_05.php
/help_02_06.php
/help_02_07.php
/help_02_08.php
/help_02_09.php
/help_02_10.php
/help_02_11.php
/help_02_12.php
/help_03_01.php
/help_03_02.php
/help_03_03.php
/help_03_04.php
/help_03_05.php
/help_03_06.php
/help_03_07.php
/help_03_08.php
/help_03_09.php
/help_03_10.php
/help_03_11.php
/help_03_12.php
/help_04_01.php
/help_04_02.php
/help_04_03.php
/help_04_04.php
/help_04_05.php
/help_04_06.php
/help_04_07.php
/help_04_08.php
/help_04_09.php
/help_04_10.php
/help_04_11.php
/help_04_12.php
/help_05_01.php
/help_05_02.php
/help_05_03.php
/help_05_04.php
/help_05_05.php
/help_05_06.php
/help_05_07.php
/help_05_08.php
/help_05_09.php
/help_05_10.php
/help_05_11.php
/help_05_12.php
/help_06_01.php
/help_06_02.php
/help_06_03.php
/help_06_04.php
/help_06_05.php
/help_06_06.php
/help_06_07.php
/help_06_08.php
/help_06_09.php
/help_06_10.php
/help_06_11.php
/help_06_12.php
/help_07_01.php
/help_07_02.php
/help_07_03.php
/help_07_04.php
/help_07_05.php
/help_07_06.php
/help_07_07.php
/help_07_08.php
/help_07_09.php
/help_07_10.php
/help_07_11.php
/help_07_12.php
/help_08_01.php
/help_08_02.php
/help_08_03.php
/help_08_04.php
/help_08_05.php
/help_08_06.php
/help_08_07.php
/help_08_08.php
/help_08_09.php
/help_08_10.php
/help_08_11.php
/help_08_12.php
/help_09_01.php
/help_09_02.php
/help_09_03.php
/help_09_04.php
/help_09_05.php
/help_09_06.php
/help_09_07.php
/help_09_08.php
/help_09_09.php
/help_09_10.php
/help_09_11.php
/help_09_12.php
/help_10_01.php
/help_10_02.php
/help_10_03.php
/help_10_04.php
/help_10_05.php
/help_10_06.php
/help_10_07.php
/help_10_08.php
/help_10_09.php
/help_10_10.php
/help_10_11.php
/help_10_12.php
/help_11_01.php
/help_11_02.php
/help_11_03.php
/help_11_04.php
/help_11_05.php
/help_11_06.php
/help_11_07.php
/help_11_08.php
/help_11_09.php
/help_11_10.php
/help_11_11.php
/help_11_12.php
/help_12_01.php
/help_12_02.php
/help_12_03.php
/help_12_04.php
/help_12_05.php
/help_12_06.php
/help_12_07.php
/help_12_08.php
/help_12_09.php
/help_12_10.php
/help_12_11.php
/help_12_12.php
/help_13_01.php
/help_13_02.php
/help_13_03.php
/help_13_04.php
/help_13_05.php
/help_13_06.php
/help_13_07.php
/help_13_08.php
/help_13_09.php
/help_13_10.php
/help_13_11.php
/help_13_12.php
/help_14_01.php
/help_14_02.php
/help_14_03.php
/help_14_04.php
/help_14_05.php
/help_14_06.php
/help_14_07.php
/help_14_08.php
/help_14_09.php
/help_14_10.php
/help_14_11.php
/help_14_12.php
/help_15_01.php
/help_15_02.php
/help_15_03.php
/help_15_04.php
/help_15_05.php
/help_15_06.php
/help_15_07.php
/help_15_08.php
/help_15_09.php
/help_15_10.php
/help_15_11.php
/help_15_12.php
/help_16_01.php
/help_16_02.php
/help_16_03.php
/help_16_04.php
/help_16_05.php
/help_16_06.php
/help_16_07.php
/help_16_08.php
/help_16_09.php
/help_16_10.php
/help_16_11.php
/help_16_12.php
/help_17_01.php
/help_17_02.php
/help_17_03.php
/help_17_04.php
/help_17_05.php
/help_17_06.php
/help_17_07.php
/help_17_08.php
/help_17_09.php
/help_17_10.php
/help_17_11.php
/help_17_12.php
/help_18_01.php
/help_18_02.php
/help_18_03.php
/help_18_04.php
/help_18_05.php
/help_18_06.php
/help_18_07.php
/help_18_08.php
/help_18_09.php
/help_18_10.php
/help_18_11.php
/help_18_12.php
/help_19_01.php
/help_19_02.php
/help_19_03.php
/help_19_04.php
/help_19_05.php
/help_19_06.php
/help_19_07.php
/help_19_08.php
/help_19_09.php
/help_19_10.php
/help_19_11.php
/help_19_12.php
/help_20_01.php
/help_20_02.php
/help_20_03.php
/help_20_04.php
/help_20_05.php
/help_20_06.php
/help_20_07.php
/help_20_08.php
/help_20_09.php
/help_20_10.php
/help_20_11.php
/help_20_12.php
/help_21_01.php
/help_21_02.php
/help_21_03.php
/help_21_04.php
/help_21_05.php
/help_21_06.php
/help_21_07.php
/help_21_08.php
/help_21_09.php
/help_21_10.php
/help_21_11.php
/help_21_12.php
/help_22_01.php
/help_22_02.php
/help_22_03.php
/help_22_04.php
/help_22_05.php
/help_22_06.php
/help_22_07.php
/help_22_08.php
/help_22_09.php
/help_22_10.php
/help_22_11.php
/help_22_12.php
/help_23_01.php
/help_23_02.php
/help_23_03.php
/help_23_04.php
/help_23_05.php
/help_23_06.php
/help_23_07.php
/help_23_08.php
/help_23_09.php
/help_23_10.php
/help_23_11.php
/help_23_12.php
/help_24_01.php
/help_24_02.php
/help_24_03.php
/help_24_04.php
/help_24_05.php
/help_24_06.php
/help_24_07.php
/help_24_08.php
/help_24_09.php
/help_24_10.php
/help_24_11.php
/help_24_12.php
/help_25_01.php
/help_25_02.php
/help_25_03.php
/help_25_04.php
/help_25_05.php
/help_25_06.php
/help_25_07.php
/help_25_08.php
/help_25_09.php
/help_25_10.php
/help_25_11.php
/help_25_12.php
/help_26_01.php
/help_26_02.php
/help_26_03.php
/help_26_04.php
/help_26_05.php
/help_26_06.php
/help_26_07.php
/help_26_08.php
/help_26_09.php
/help_26_10.php
/help_26_11.php
/help_26_12.php
/help_27_01.php
/help_27_02.php
/help_27_03.php
/help_27_04.php
/help_27_05.php
/help_27_06.php
/help_27_07.php
/help_27_08.php
/help_27_09.php
/help_27_10.php
/help_27_11.php
/help_27_12.php
/help_28_01.php
/help_28_02.php
/help_28_03.php
/help_28_04.php
/help_28_05.php
/help_28_06.php
/help_28_07.php
/help_28_08.php
/help_28_09.php
/help_28_10.php
/help_28_11.php
/help_28_12.php
/help_29_01.php
/help_29_02.php
/help_29_03.php
/help_29_04.php
/help_29_05.php
/help_29_06.php
/help_29_07.php
/help_29_08.php
/help_29_09.php
/help_29_10.php
/help_29_11.php
/help_29_12.php
/help_30_01.php
/help_30_02.php
/help_30_03.php
/help_30_04.php
/help_30_05.php
/help_30_06.php
/help_30_07.php
/help_30_08.php
/help_30_09.php
/help_30_10.php
/help_30_11.php
/help_30_12.php
/help_31_01.php
/help_31_02.php
/help_31_03.php
/help_31_04.php
/help_31_05.php
/help_31_06.php
/help_31_07.php
/help_31_08.php
/help_31_09.php
/help_31_10.php
/help_31_11.php
/help_31_12.php
