Emotet Malware IoCs for 2019/03/22/19

## Emotet Malware Document links/IOCs for 03/22/19 as of 03/23/19 01:15 EDT ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 03/22/19 ####
```

http://0dzs.comicfishing.com/wp-content/trust.myacc.resourses.com/
http://134.209.64.168/u3dkdp0/trust.accs.docs.net/
http://2013.kaunasphoto.com/wp-content/sec.accs.send.net/
http://2013.kaunasphoto.com/wp-content/verif.accounts.docs.com/
http://247everydaysport.com/oslh4nf/trust.myacc.docs.net/
http://912graphics.com/wp-includes/trust.myacc.docs.com/
http://aapnnihotel.in/frubox.in/secure.myacc.resourses.net/
http://abcdcreative.com/cgi-bin/sec.accounts.docs.com/
http://adsmith.in/fonts/sec.accs.resourses.biz/
http://agtrade.hu/images/trust.myacc.send.com/
http://ajmcarter.com/cp/sendincsecure/service/question/EN/03-2019/
http://albayrakyalcin.com/wp-admin/secure.myacc.send.net/
http://albus.kz/wp-admin/verif.myaccount.docs.biz/
http://alsinaeventos.com.ar/wp-admin/trust.myaccount.docs.biz/
http://amenie-tech.com/wp-includes/verif.myaccount.send.biz/
http://applestore.kz/wp-admin/secure.myacc.resourses.net/
http://arasys.ir/wp-includes/trust.accs.send.com/
http://artprintgard.ro/cgi-bin/verif.myaccount.docs.net/
http://aupa.xyz/wp-includes/secure.myaccount.send.net/
http://ayodhyatrade.com/ww4w/sec.myacc.docs.biz/
http://babycool.com.tr/wp-admin/secure.accounts.docs.com/
http://bahoma.com/bahoma.net/secure.myaccount.docs.net/
http://bettery.hu/wp-admin/verif.accs.send.net/
http://bizjournalsnet.com/wp-includes/sec.accounts.docs.biz/
http://blu-motion.co.za/wp-admin/sec.myacc.resourses.net/
http://brigma.com/brigmail/sec.accs.resourses.net/
http://btworldofcomputer.com/wp-admin/verif.myacc.docs.biz/
http://bucanieriperu.com/wp-admin/trust.myaccount.docs.com/
http://buybywe.com/roundcube/sec.myaccount.docs.biz/
http://buybywe.com/roundcube/secure.accs.docs.com/
http://bytesoftware.com.br/starter/trust.accs.send.com/
http://casacachada.pt/cgi-bin/secure.accounts.resourses.biz/
http://cbsportsphotography.com/iaa3zsq/secure.accounts.send.biz/
http://chavakuk.demo.btechinfo.com/Iaf6U7/secure.accs.docs.net/
http://chobshops.com/cgi-bin/verif.myacc.resourses.com/
http://clinicanatur.com.br/wp-admin/sec.accounts.docs.biz/
http://club-finance.eclair.ec-lyon.fr/wp-content/verif.accs.resourses.net/
http://completerubbishremoval.net.au/TEST777/verif.myaccount.resourses.net/
http://crazyhalftime.com/wp-includes/verif.myaccount.send.net/
http://dakedava.ir/wp-includes/sec.myacc.docs.net/
http://danhba.dulichvietnam.com.vn/wp-content/secure.accounts.resourses.biz/
http://davidgriffin.io/ytpawk3j4/verif.accs.send.biz/
http://dealsammler.de/wp-admin/sendincsecure/legal/verif/EN_en/032019/
http://dekorant.com.tr/images/sec.accounts.resourses.net/
http://dhirendra.com.np/icon/secure.myaccount.docs.biz/
http://discoverthat.com.au/wp-admin/sec.accs.send.net/
http://dlink.info/wp-admin/secure.accs.docs.biz/
http://dlink.info/wp-admin/sendincsec/messages/sec/En_en/2019-03/
http://dochoixyz.com/wp-admin/trust.accs.resourses.net/
http://dradaeze.com/wp-content/secure.myacc.send.net/
http://dralife.com/language/secure.accounts.resourses.com/
http://drbalaji.org/cgi-bin/trust.accounts.docs.com/
http://dreamsmattress.in/wp-admin/sendincsecure/legal/question/EN/03-2019/
http://drmosesmdconsultingclinic.com/wp-content/sendincsec/legal/question/en_EN/2019-03/
http://dropnshop.co.id/css/secure.myaccount.resourses.biz/
http://dropnshop.co.id/css/verif.accs.send.biz/
http://drszamitogep.hu/_BACKUP-20190208-HACKED/secure.myaccount.resourses.com/
http://drszamitogep.hu/_BACKUP-20190208-HACKED/trust.accounts.docs.com/
http://duca-cameroun.org/wp-includes/trust.accounts.docs.net/
http://dvcedu.vn/wp-content/verif.myaccount.send.com/
http://easport.info/wp-admin/sendincverif/messages/ios/en_EN/201903/
http://edermatic.com.br/wp-admin/sendincencrypt/support/sec/En/03-2019/
http://edtech.iae.edu.vn/wp-includes/verif.myaccount.send.com/
http://ellensbrook.com.au/wp-includes/trust.accs.send.net/
http://epixeiroconsulting.biz/test/trust.accounts.resourses.net/
http://feder-edusi.quartdepoblet.es/img/verif.accounts.resourses.com/
http://fishingcan.com/cgi-bin/secure.accs.resourses.biz/
http://foodphotography.in/v1/sec.myacc.resourses.com/
http://frame25-dev.co.uk/s/secure.accounts.docs.biz/
http://gavinsmithpoker.co.uk/wp-includes/secure.myacc.send.com/
http://gazetadorn.com.br/wp-admin/verif.accs.send.biz/
http://gdv.stomp.digital/wp-content/trust.myacc.resourses.net/
http://gelatidoro.sk/zrdgo4p/trust.accounts.resourses.com/
http://geoclimachillers.com/wp-includes/sendincverif/legal/verif/EN/03-2019/
http://geologia.geoss.pt/wp-content/verif.myaccount.resourses.biz/
http://gmt-thailand.com/images/secure.accounts.resourses.net/
http://harga-toyotasemarang.com/wp-content/sec.myaccount.resourses.net/
http://hbsnepal.com.np/wp-admin/verif.accounts.docs.biz/
http://himafis.mipa.uns.ac.id/wp-content/uploads/sec.accounts.docs.net/
http://hoangdat.vn/wp-admin/sec.accs.resourses.net/
http://holon.co.il/wp-content/sendinc/messages/verif/EN_en/201903/
http://humanventures.in/aryasamajandheri.humanventures.in/sendincencrypt/support/question/En_en/032019/
http://inovatips.com/9yorcan/trust.myacc.send.com/
http://iqkqqq.com/7t8yjje/verif.myacc.docs.net/
http://jiniastore.com/wp-admin/verif.myacc.resourses.com/
http://jp-exceed.com/ggtmsoj/secure.myaccount.resourses.net/
http://kamir.es/controllers/trust.myaccount.docs.net/
http://kennedyprosper.com.ng/xdctw/verif.accounts.resourses.com/
http://kianse.ir/svsvbk/sendincencrypt/legal/sec/en_EN/032019/
http://kickykart.com/wp-content/sendincsecure/service/verif/EN_en/201903/
http://kredittkortinfo.no/wp-content/sec.accounts.docs.com/
http://kunnskapsfilm.no/wp-content/verif.accs.docs.net/
http://l8st.win/wp-includes/verif.myaccount.send.com/
http://laconversation-spectacle.fr/wp-admin/trust.accs.resourses.biz/
http://larissapharma.com/fobn/trust.accounts.send.net/
http://lifestylescape.com/wp-includes/sec.accounts.resourses.net/
http://loweralabamagolf.com/wp-admin/sec.myaccount.docs.net/
http://majorpart.co.th/kfu3prn/verif.accs.docs.com/
http://makson.co.in/Admin/trust.myacc.send.com/
http://mangaml.com/jdownloader/scripts/pyload_stop/trust.myaccount.resourses.net/
http://manorviews.co.nz/cgi-bin/trust.myaccount.send.biz/
http://martstudio.si/modules/secure.myacc.send.com/
http://mcbeth.com.au/nick.mcbeth.com.au/trust.myaccount.resourses.com/
http://medius.ge/wp-admin/sec.accounts.send.net/
http://mireiatorrent.com/wp-includes/verif.myaccount.docs.net/
http://mktfan.com/admin/verif.accounts.send.net/
http://mkwu.borneo.ac.id/wp-content/sec.myacc.send.net/
http://modeltfordclubofamerica.com/shop/sec.accounts.resourses.com/
http://modoutlet.club/wp-admin/sec.accounts.resourses.net/
http://modps11.lib.kmutt.ac.th/wp-includes/trust.accounts.docs.com/
http://moredarom.ru/pecvuodfel/verif.accounts.resourses.net/
http://mwfurniture.vn/wp-content/verif.accounts.docs.com/
http://mytime.com.hk/wp-content/themes/mytime_cn/trust.accs.resourses.com/
http://nammuzey.uz/includes/verif.myaccount.docs.com/
http://nazara.id/ghezons/trust.myacc.send.biz/
http://neovimabackpack.pro/wp-includes/secure.myaccount.docs.net/
http://nghetaynhapkhau.com/wp-includes/sec.myaccount.send.com/
http://ngl-consulting.pt/maps1315/trust.myacc.send.net/
http://nhatrangtropicana.com/wp-content/sec.myaccount.docs.net/
http://nissanlevanluong.com.vn/apxiay8/verif.accounts.send.net/
http://noithathofaco.net/wp-content/sendincverif/service/ios/En_en/2019-03/
http://noithathofaco.net/wp-content/trust.accs.resourses.net/
http://noithattunglam.com/wp-admin/sec.myaccount.send.biz/
http://nuochoacharme.xyz/wp-includes/verif.accounts.send.net/
http://obraauxiliadora.com.br/wp-admin/sendincsec/messages/trust/En_en/03-2019/
http://ocean-web.biz/pana/trust.myacc.docs.net/
http://ogricc.com/vsgpn5j/sec.myacc.resourses.net/
http://oltelectrics.com/wp-content/sec.accounts.send.biz/
http://oltelectrics.com/wp-content/sec.myaccount.send.biz/
http://omada.edu.gr/wordpress/verif.myacc.resourses.com/
http://opark.in/wp-includes/sendincverif/support/secure/En/2019-03/
http://overnightfilmfestival.com/9uyruon/trust.accs.send.com/
http://pacificbizsolutions.co.uk/wordpress/trust.accounts.docs.biz/
http://parbio.es/wp-content/sec.myaccount.send.com/
http://parenting.ilmci.com/wp-includes/trust.accs.send.net/
http://patinvietnam.vn/wp-includes/verif.accounts.docs.com/
http://pauamaengineering.com/cadovw7/verif.accounts.send.com/
http://pirani.dst.uz/wp-includes/sec.accounts.send.net/
http://pokokhijau.com/wp-admin/trust.myaccount.send.com/
http://portalfreightforwarder.com.my/hzjvbhz/sec.myacc.docs.com/
http://ppusvjetlost.com.ba/xd6re7a/scan/verif.myaccount.resourses.com/
http://preserved-diesels.co.uk/wp-content/verif.accounts.resourses.biz/
http://profilegeomatics.ca/rvsincludefile/secure.myacc.resourses.net/
http://project.hoangnq.com/tour/images/catalog/sec.accs.docs.net/
http://projectwatch.ie/mychat/sec.myacc.send.biz/
http://promitprofil.com/wp-admin/trust.accounts.send.biz/
http://property-in-vietnam.com/cgi-bin/sendincsec/legal/secure/en_EN/201903/
http://psiconegocios.com.br/wp-includes/sec.myacc.resourses.net/
http://qlstandard.com.mx/docs/secure.myaccount.resourses.com/
http://quadkits.combinedfashions.com/wp-content/trust.accs.docs.net/
http://quatrina.com.br/cgi-bin/verif.myacc.resourses.com/
http://readnow.ml/wp-includes/sendincverif/support/secure/EN_en/03-2019/
http://ritikastonegallery.net/new/verif.myacc.docs.net/
http://roxhospedagem.com.br/chatonline2/verif.accounts.send.net/
http://rsleather-intnl.com/wp-includes/secure.accs.send.com/
http://sanafarm.vn/wp-admin/verif.accs.send.com/
http://sanphamgold.vn/wp-content/secure.accs.resourses.biz/
http://sdsgroup.co.il/wp-admin/secure.accounts.send.com/
http://serendipityph.com/wp-admin/secure.myaccount.resourses.com/
http://sftw.trainingmentor.co.uk/wp-admin/secure.myaccount.resourses.biz/
http://shagua.name/fonts/sendincsecure/legal/verif/EN_en/032019/
http://shoparsi.com/wp-includes/sec.myacc.send.net/
http://shopbeauty.org/wp-admin/sec.myacc.send.com/
http://sloar.xyz/wp-admin/sec.myacc.docs.net/
http://sniper71-reborn.com/wp-content/verif.myacc.docs.com/
http://softtest.lsp.goozmo.com/cgi-bin/trust.accounts.resourses.biz/
http://softzone.ro/newfolde_r/sendincsecure/support/question/en_EN/2019-03/
http://solucanciftlikleri.com/wp-includes/secure.accs.docs.net/
http://songlinhtran.vn/OosCQKy7/sec.myaccount.docs.biz/
http://songlinhtran.vn/OosCQKy7/sendincencrypt/service/question/EN_en/03-2019/
http://sorcererguild.com/dgzivlx/trust.myacc.send.net/
http://spartanproducts.com/lighterbox2OPTIMIZED/trust.myaccount.resourses.com/
http://spp.co.id/f8rtr3z/trust.accounts.docs.net/
http://srivanividyalaya.com/wp-includes/sec.myaccount.send.biz/
http://storiesdesired.com/stories/secure.myaccount.docs.com/
http://styllaz.com/wp-content/themes/zaradise/secure.myacc.docs.com/
http://superkarting-uk.com/Pictures/trust.myacc.resourses.com/
http://taringabaptist.org.au/wp/verif.accounts.docs.com/
http://test.capsule-life.ru/wp-includes/trust.accounts.resourses.net/
http://test.globallean.net/wp-content/uploads/sec.myacc.send.net/
http://thanhthanhtungstone.com/wp-admin/secure.myacc.docs.biz/
http://thebirks.org/test/sec.accounts.resourses.biz/
http://theinitiative.com/initiative2/secure.myacc.docs.net/
http://theshowzone.com/dzXTs-oS3jd_aAKpXSCGI-Mo/verif.myacc.send.biz/
http://tkbhaktimulya.web.id/wp-includes/verif.myaccount.resourses.biz/
http://tk-lovech.org/db3ii9k/sec.myaccount.send.net/
http://tlslbrands.com/wp-content/sec.myaccount.resourses.com/
http://tongtongbaby.us/wp-includes/trust.accs.resourses.biz/
http://tsk-winery.com/wp-includes/sendincsecure/support/verif/en_EN/2019-03/
http://tubepsango.com/pdcooc9/sec.accs.send.com/
http://uommamnhancach.edu.vn/wp-admin/secure.accounts.resourses.biz/
http://vasistagowthamipyramid.org/stylesl/trust.accounts.resourses.net/
http://villasmauritius.co.uk/wp-includes/sendincsecure/support/sec/EN_en/2019-03/
http://waverleychauffeurs.com/wp-content/secure.accs.resourses.net/
http://webtvset.com/Connections/trust.accounts.resourses.net/
http://weg-aus-dem-hamsterrad.de/r5romlp/verif.myacc.resourses.biz/
http://wickedcloudsok.com/cgi-bin/verif.accs.resourses.biz/
http://wirasaba.com/mail.wirasaba.com/secure.accs.send.com/
http://www.3djqw.com/wp-admin/sendincsec/support/ios/En/03-2019/
http://www.5ibet365.com/wp-admin/sendincsec/legal/sec/En/201903/
http://www.5ibet365.com/wp-admin/trust.accounts.send.com/
http://www.danataifco.ir/wp-includes/verif.myaccount.send.net/
http://www.form7.sadek-webdesigner.com/wp-content/secure.accounts.resourses.biz/
http://www.form8.sadek-webdesigner.com/wp-content/sec.accounts.resourses.biz/
http://www.gescoworld.com/nwfraum/trust.myaccount.send.com/
http://www.grupoaro.com.co/cgi-bin/sec.myaccount.resourses.com/
http://www.hurrican.sk/img/secure.accs.send.biz/
http://www.innovatehub.co.uk/wp-content/trust.accs.resourses.biz/
http://www.kuy-ah.id/megabusbandung.com/secure.myacc.docs.biz/
http://www.monfoodland.mn/wp-admin/secure.accs.docs.net/
http://www.promo-snap.com/wp-content/secure.accounts.resourses.biz/
http://www.shreyagupta.co.in/a7kuxbk/sec.myacc.resourses.net/
http://www.storiesdesired.com/stories/secure.myaccount.docs.com/
http://www.zhaozewei.top/wp-content/verif.myacc.docs.net/
http://xn--dammkrret-z2a.se/wp-admin/verif.accounts.docs.biz/
http://xn--e1asabbgiee9g.xn--p1ai/wp-includes/trust.accs.resourses.biz/
http://xn----zhcbeat6aupuu3f.org.il/wp-content/secure.accs.resourses.net/
http://xsoft.tomsk.ru/kdlkxl/verif.accounts.resourses.net/
http://yelarsan.es/wp-content/uploads/sendinc/messages/ios/En/03-2019/
http://yelarsan.es/wp-content/uploads/trust.accs.docs.biz/
http://yos.inonu.edu.tr/wp-content/uploads/sendinc/service/sec/en_EN/032019/
http://yos.inonu.edu.tr/wp-content/uploads/verif.myaccount.docs.biz/
https://ayanafriedman.co.il/blogs/sec.myacc.resourses.net/
https://completerubbishremoval.net.au/TEST777/verif.myaccount.resourses.net/
https://cowvpen2018.xyz/wp-content/sec.accounts.resourses.biz/
https://daodivine.com/wp-content/sec.accounts.send.biz/
https://dradaeze.com/wp-content/secure.myacc.send.net/
https://euforikoi.xyz/application/sendincverif/messages/question/en_EN/03-2019/
https://frame25-dev.co.uk/s/secure.accounts.docs.biz/
https://frame25-dev.co.uk/wp-includes/sendincsecure/service/verif/EN/201903/
https://gadgetglob.com/wp-content/verif.accs.docs.net/
https://haicunoi.ro/cgi-bin/sec.accs.docs.com/
https://inovatips.com/9yorcan/sendincverif/legal/question/EN_en/201903/
https://inovatips.com/9yorcan/trust.myacc.send.com/
https://kickykart.com/wp-content/sendincsecure/service/verif/EN_en/201903/
https://library.phibi.my.id/plt/verif.myaccount.docs.net/
https://loweralabamagolf.com/wp-admin/sec.myaccount.docs.net/
https://mhsalum.isinqa.com/tjsml4o/secure.myaccount.send.net/
https://modoutlet.club/wp-admin/sec.accounts.resourses.net/
https://modps11.lib.kmutt.ac.th/wp-includes/trust.accounts.docs.com/
https://money360.brightoak.com/wp-content/secure.myaccount.docs.com/
https://money360.brightoak.com/wp-content/secure.myaccount.docs.com//
https://money360.brightoak.com/wp-content/secure.myaccount.docs.com/\/
https://newerlife.org/nnbct1l/secure.myacc.send.net/
https://newsonline.news/wwpp55/sendinc/service/question/En_en/201903/
https://ogricc.com/vsgpn5j/sec.myacc.resourses.net/
https://ogricc.com/wp-content/sendinc/messages/sec/En/032019/
https://patinvietnam.vn/wp-includes/verif.accounts.docs.com/
https://rajans.lk/sitemaps/trust.myaccount.send.biz/
https://save24x7.com/wp-content/secure.accs.docs.net/
https://sisitel.com/wp-admin/secure.accs.send.net/
https://students.allstardentalacademy.com/wk0xsed/trust.accounts.send.biz/
https://tapchicaythuoc.com/cgi-bin/trust.myaccount.docs.biz/
https://utit.vn/wp-includes/sendinc/support/verif/En_en/032019/
https://vrfantasy.csps.tyc.edu.tw/wp-includes/sec.accounts.resourses.net/
https://waverleychauffeurs.com/wp-content/secure.accs.resourses.net/
https://weg-aus-dem-hamsterrad.de/r5romlp/verif.myacc.resourses.biz/
https://www.imageia.co.il/wp-admin/secure.myacc.docs.net/
https://www.innovatehub.co.uk/wp-content/trust.accs.resourses.biz/
https://www.kuy-ah.id/megabusbandung.com/secure.myacc.docs.biz/
https://www.netimoveis.me/wp-content/sendincverif/service/secure/EN_en/032019/
https://www.promo-snap.com/wp-content/secure.accounts.resourses.biz/
https://www.zhaozewei.top/wp-content/verif.myacc.docs.net/

```
#### Epoch 2 Document/Downloader links seen for 03/22/19 ####
```

http://0dzs.comicfishing.com/wp-content/US/info/Invoice/cskIs-ChCG_WLptSTsjk-TW/
http://140.143.224.37/fb5sreu/456sj-jp7hi-cqman/
http://180-degree.com/jde/file/wMuac-R85HU_moUqo-DYu/
http://1lorawicz.pl/language/f69u-29kzr9-dtvdnbuxu/
http://247everydaysport.com/oslh4nf/En/file/19165475/pQsVY-Cx2_YUFSj-Xl/
http://acdswd.cn/hitokoto/50s0-hikeql-hefaybcv/
http://agara.edu.ge/components/8qm4-3sybf-nntpycdd/
http://alatbarber.com/ryxqrrh/dlv2c-x57vpr-eznuozdvl/
http://algarmen.com/wp-content/bni8-js5s5o-nhdwp/
http://allsignsofohio.com/EN_US/def6-1ugvc-vcjp/
http://allthegoodparts.com/wp-includes/llprm-tfsir2-hegod/
http://alpinaemlak.com/wp-contents/7h1a0-6slc70-doodljp/
http://alpinaemlak.com/wp-contents/gr6o-5u5u6r-xiledpx/
http://animalswithdetail.com/wp-admin/cmfvs-upm4du-uiwqak/
http://aussiescanners.com/forum/en8xj-glwxb-mlscdmnzv/
http://bloodybits.com/edwinjefferson.com/lpjyl-sku17s-qzixznv/
http://businessinsiderau.com/wp-includes/p93g-bi64p-ntxu/
http://bytesoftware.com.br/starter/tkv3n-7ndnw-uoqbgx/
http://cbaia.com/app/cache/nz66x-93zi91-zduyxo/
http://cddvd.kz/cgi-bin/dw4m-uc95n-ssds/
http://chang.be/carole/mvuk-smnz2z-skoee/
http://chawtechsolutions.in/marbel/tucmv-z5oog-trcgptrv/
http://ciga.ro/layouts/blbmxp-qcwlff-rnjpolp/
http://claudiogarcia.es/wp-content/9ihj-vdu5s9-lxkyydrw/
http://claudiogarcia.es/wp-content/wllyf-rhkjj7-emfwadc/
http://colbydix.com/mailer/ayzmf-bcwjgtl-dqojfyz/
http://conteudo.canguru.life/wp-content/gopy0-23uc6m-gwjk/
http://coozca.com.ve/templates/rpnf-jhh1i7-pbdsnofmq/
http://crashingdeep.com/wp-includes/98i9-39k094-sdtmsy/
http://crearquitectos.es/templates/h943v-9vdbw-ciesxhhv/
http://ctm-catalogo.it/cgi-bin/0nt11-gs6gy5-hrogcd/
http://daarchoob.com/sp95nmm/uq4w-7q7gd-cmwtqog/
http://daarchoob.com/sp95nmm/US_us/New_invoice/QBMQ-BP_WEpII-gBS/
http://dailynuochoacharme.com/wp-admin/EN_en/Jeaa-im_b-WpX/
http://dandavner.com/blog/n70l-hujh9z-bcjsbiq/
http://datos.com.tw/logssite/7muytss-1pcmi4a-ikmu/
http://dda.co.ir/wp-snapshots/f5bm-kk0si7-gwuhod/
http://dealsammler.de/wp-admin/En/file/Invoice_Notice/hpzd-3CqyS_XDHPNfjg-8e/
http://dekormc.pl/pub/1a1797q-9x15g3n-eojxkb/
http://diaocngaynay.vn/diaocngaynay/En/download/JQwue-sWy_nnY-yBS/
http://diaocngaynay.vn/diaocngaynay/z3uw-i3jdg-rjwlqhlbd/
http://digitalcore.lt/wp-admin/3ndgk-k1g50y-fovmpsl/
http://digitalcore.lt/wp-admin/ew89-9yb52-bpvjpqgrc/
http://dingesgang.com/wp-admin/uhgv-jsyr0r-kotcqw/
http://dinobacciotti.com.br/2eqt/vdm8-uyuyv-dfiwnrk/
http://divacontrol.ro/images/skvw-bgosp-tmqlklda/
http://doorspro.ie/wp-content/6huqlw-ykwgh-urhcca/
http://drabeys.com/wp-includes/tyi2u-7wf0p-folimmy/
http://dramitinos.gr/images/89a7z-5iwov8-ljgh/
http://drbalaji.org/cgi-bin/info/New_invoice/ddDV-4nJ0_ITcOFSe-wpJ/
http://drcheena.in/wp-includes/1t8xr-csl7q-shakoxnoa/
http://dream-sequence.cc/mm.ms.com/uz7e-qul6b1-ftpb/
http://drlaszlozopcsak.com/administrator/ta33r-qvjhi-wsdgfbhl/
http://drmarins.com/wp-includes/kp12-ahzhz-kkqkvk/
http://drpradeepupadhayaya.com.np/osticket/wwuv-brfcos-cupo/
http://dtk-ad.co.th/css/yw8y-nrej4-xohf/
http://duca-cameroun.org/wp-includes/6c8q-zphfy-vmntexpe/
http://edandtrish.com/ares/dxak2-xicwl-dzmzrht/
http://edwinjefferson.com/lpjyl-sku17s-qzixznv/
http://egsa.at/Service-Report-2969/7srr-o5cyj-djdwha/
http://egywebtest.ml/wp-admin/cuoq-ft4jz-slcpebrl/
http://emirays.com/wvw/85hw-6ykoa-dhnqv/
http://engadgetlt.com/wp-includes/046dh-bu84e-ejyhat/
http://enpress-publisher.com/wp-admin/7oye-bsxj12-ehcmaa/
http://erica.id.au/scripts_index/fd68d-rf3ks3-oxlbbiae/
http://ernyegoavil.com/mineria/vftn-clanm4-rukatjqja/
http://esenolcum.com/wp-content/jc2na50-687mr-pvwkg/
http://eurofutura.com/yii/29i2j-m2cqj85-hgxhuo/
http://evergreenschoolskatsina.com/wp-admin/x8ic-qmwfo6-htiyuql/
http://eziyuan.net/404/syi5t9c-gs4alw-wdxxy/
http://falmer.de/test/wpTest/wp-content/uploads/6dse9my-qkxok-mjth/
http://famaweb.ir/intro/k6ypwu-bt55zh-jlzg/
http://favoritbt.t-online.hu/logon/t34aj9f-nynfij6-ruwrwu/
http://fetva.imambuharivakfi.org/wp-admin/En_us/file/Invoice/TUOky-5G9_WlKgLVOf-wI/
http://firstimpress.dk/nyhedsmail-hjemmeside-aarhus/q6yv7-wyb03-nhihj/
http://firstmnd.com/wp/wp-content/r9ach-n2ju9-ofow/
http://firstmnd.com/wp/wp-content/US_us/doc/Invoice_number/PYOY-WFHxS_Xctn-nlw/
http://fisika.mipa.uns.ac.id/icopia/files/og61-tn6jj-qlvknqz/
http://fixxo.nl/wp-includes/55pksn-2ux6049-qeziwz/
http://flyingmutts.com/corporation/New_invoice/1033530/HiJMQ-Jo_UQGwdlyF-8e/
http://form8.sadek-webdesigner.com/wp-content/En/doc/Invoice/858151748288104/khGq-8Q_WVyl-qWb/
http://foundation.wheremindsgrow.org/dhl2/7dt6-qb33dl-afrnq/
http://fumicolcali.com/wblev-6pox5-vpckk/
http://gamarepro.com/plugins/cxdhd-v9vdz-mfem/
http://gamarepro.com/plugins/qntqw-q4d0zw-sfrpucuyv/
http://ganzetec.com/m2013/files/temp/5seko-uy8ym-piseiw/
http://gccpharr.org/assets/palw-n7z3ec-rdfis/
http://geoclimachillers.com/wp-includes/9e1a-2guide-eojv/
http://getawebsite.co/wfa/2wnh-hs2t6-fyepj/
http://gisec.com.mx/expertos/eb4a-nv14v4-tkcfhs/
http://gisec.com.mx/expertos/info/wCoO-ATunM_cgsaPhB-bd/
http://golemaryam17.com/templates/lzac-749jvd-mjir/
http://gpdiffusionemercato.it/E-Commerce/a68c-g2a2a-efxfcgfd/
http://grupoweb.cl/wp-admin/2nzxd-herwps-hbtzr/
http://haru1ban.net/files/7tuz-ii3di-ofrrbki/
http://haru1ban.net/files/wsfh-qoq5j-nusyjkzcd/
http://hds69.pl/ww4w/fwi0-a7lzzd-zkbazu/
http://hds69.pl/ww4w/hnq4-v7heb-qbdfeh/
http://healthwiseonline.com.au/wp-admin/m63bo-o72ir-pzahllu/
http://healthwiseonline.com.au/wp-admin/tmlva-l12qym-zxqgzv/
http://helpforhealth.co.nz/z2o7soy/xyqy2-hfpd0-fizes/
http://holon.co.il/wp-content/doc/New_invoice/GAwNO-Df_kkYPva-Cw/
http://horseshows.io/c2nkrlt/gv1cf-k5tp3s-ktndifn/
http://hotel-krishnainternational.com/wp-admin/wqz67-zmwhb-kdsctt/
http://iais.ac.id/wp-content/24zn-vqd0b-obycastzd/
http://ibustan.com/wp-content/En_us/EHnX-krVs_XAIgrmZ-LDb/
http://icei.pucminas.br/templates/n68g-sfbwbe-adhvs/
http://ilimler.net/wp-includes/lunh-svvld-wycr/
http://impro.in/components/uks1-ggp59-turwy/
http://junkmover.ca/wp-includes/6z64w-p6lb0f-sbfqq/
http://junkmover.ca/wp-includes/85k4w-f7zaw-bbkorlb/
http://kamel.com.pl/wp-content/2a8f-0imsul-ruzjl/
http://kan.kan2.go.th/css/l0wp-e0qbn-iiuib/
http://kannada.awgp.org/wp-content/uploads/gva6-789j6-vabtovc/
http://ksoncrossfit.com/rylawpc/yg9o-1q4hhq-etsozwiv/
http://kuliner.ilmci.com/wp-content/bnla6-97kbu7-cpgsilot/
http://larissapharma.com/fobn/z5y5-9i0nb-rtvsahdi/
http://lastmilecdn.net/wp-includes/0gwd-lkj33r-maqwc/
http://libtech.com.au/wp-content/uploads/2016/07/ijrke-ixohw8-extxidmdy/
http://lista.al/cgi-bin/o2su-h3ho8-vktoquxnn/
http://makson.co.in/Admin/8z8v-iqdsv1-jlzcpoks/
http://mangaml.com/jdownloader/scripts/pyload_stop/doc/Copy_Invoice/MhlO-FcAmf_VWxqQwDej-Ryg/
http://martinamasaze.cz/modules/pree-4x0be-obvfoh/
http://mcbeth.com.au/nick.mcbeth.com.au/uqgw-sbacnv-sayidi/
http://medical.moallem.sch.ir/administrator/wbka71-lmu27-vhofm/
http://meliposhesh.com/oblkafe/scan/tEPHW-xfKIh_i-mvP/
http://miduma.eu/libraries/v4s9-1ah2l1-qohimntni/
http://millcreekfoundation.org/libraries/cqzcm-1x06sy-jxmrts/
http://multiesfera.com/wp-content/doc/Copy_Invoice/51608445168/DmfU-Yv_l-uaN/
http://multiesfera.com/wp-content/xzbmz-4d1cqa-fggqdhv/
http://mundialbaloes.com.br/cgi-bin/En_us/company/New_invoice/ursKs-Sufrf_A-O6/
http://mwfurniture.vn/wp-content/download/Inv/Iccpf-da_XVWYnPD-4Fs/
http://mybibibox.com/wp/corporation/Copy_Invoice/236341447/RvaRW-RKVcE_jeox-Hry/
http://myphamsachnhatban.vn/wp-snapshots/kgp8-nu0lx-wkxhupq/
http://naps.com.mk/wp-content/4ng15-8tleks-ecgqskeco/
http://naqaae.com/db/work/config/4joho-h2t6ck-nfug/
http://nbj.engaged.it/wp-includes/En/iibG-1T_OoNw-m8h/
http://nessadvocacia.com.br/wp-includes/7e1gddy-tyt0c-aartorj/
http://netlink.com/wp-content/plugins/all-in-one-wp-migration/storage/doc/Copy_Invoice/469302181479406/FHoLy-13a_ZIEFBA-gXE/
http://new.hostdone.com/wp-includes/e9zzj-sfmf3-lsinhdd/
http://newbizop.net/assets/tfxd-99vh5a-wvxk/
http://ngan.cc/wp-includes/r3fv-coivjt-qtldpn/
http://nganstore.net/wp-admin/l2dk-9tc5e-gapyok/
http://nhadephungyen.com/wp-includes/nkngr-0ugbb3-dkkeugytl/
http://nuochoavungkin.net/wp-admin/9lo2-0w4brj-uhspnnt/
http://octoplustech.com/wp/US_us/57449522331016/jAfG-SR_uQ-XW/
http://offertodeals.com/wp-admin/02sk-7ih49g-jnsawd/
http://oma-life.co.il/includes/w40nl1-mkw5af0-gnyahb/
http://omgbeautyshop.com/wp-content/ucrh-rlght-mtycnn/
http://onecommunityrising.com/wp-content/file/New_invoice/CBcgX-GhZeT_EggmRsJgB-rz/
http://opark.in/wp-includes/9cuo-90nwi5-vjzragcfh/
http://opatrimonio.imb.br/wp-content/wg1jbk-a92by-kyrzm/
http://overnightfilmfestival.com/Project/cmcc-v2r2q-lmgfrjuv/
http://oyunrengi.com/maps1311/872cc-4laag-gedlzioj/
http://pandeglangkec.pandeglangkab.go.id/images/hmkm-7ep7xg-mwwamrvqe/
http://papaya.ne.jp/tools/3xb98-sxff7y-hmupb/
http://papaya.ne.jp/tools/US/Invoice_number/QzHjQ-vdkX_M-9A/
http://parbio.es/wp-content/US/Copy_Invoice/63935993395/BmBb-TVcm_YwLffCcP-TJ/
http://parsat.org/wp-snapshots/79va-1h1qqj-aqidxv/
http://pasilhok.desa.id/wp-admin/US/xerox/VpSwm-Rz_lU-Fk/
http://past.com.tr/wp-admin/document/Invoice_Notice/bDMIn-Rz_BOSvqBBQe-b5/
http://pearlywhites.co.in/cgi-bin/gv7f4-xl5q6-zvzuwu/
http://photos.morningsunedu.org/cgi-bin/US/llc/726111242866/ycbI-RX_mtgy-RH/
http://picntic.com/blog/wp-includes/26j4-cl97tm-podge/
http://pierwszajazda.com.pl/modules/dq50-61o2yp-cwil/
http://plugnstage.com/logo/m63st-ivk7l-tpdt/
http://popart-a-la-papp.ro/wp-content/EN_en/file/Inv/THUjC-eEGQ9_mjAIjNhQ-HI/
http://ppusvjetlost.com.ba/xd6re7a/scan/Copy_Invoice/LwOe-nfO_YyT-yn/
http://pratikal.com.my/4f6g1hw/file/Copy_Invoice/sDQwi-6D6_HsZL-wk/
http://profilegeomatics.ca/rvsincludefile/EN_en/jipvv-zKX2_X-Vw/
http://projectwatch.ie/mychat/scan/0608446/nmDxe-CuQ3_AGYZ-AE/
http://property-in-vietnam.com/cgi-bin/En/xerox/Copy_Invoice/vdlUV-BHGtl_pZzKctW-UJc/
http://pro-sealsolutions.com/wp-content/US/doc/NhjMY-ykk_q-Myv/
http://psponto.com.br/css/En/mzyG-Pjf_jEKuQsA-bwI/
http://pufferfiz.net/spikyfishgames/gdlr6-f5dsdj-xpfdickg/
http://pulsejobs.net/services/Invoice/IZPU-NrK92_bxOYgkRsl-Oa9/
http://pustaka.geotek.lipi.go.id/wp-content/uploads/2019/p294-4yl2l-wqasood/
http://ra-design-bad.de/blogs/xt40-hll4x-oiyvco/
http://restauracja-finezja.com.pl/cgi-bin/EN_en/document/Copy_Invoice/GLMO-BT_UKTXWJy-fic/
http://rezidenciahron.sk/_sub/pi59h-h2f22l-kjvxeusk/
http://roxhospedagem.com.br/chatonline2/i7qj1-fq7hi5-tswvimbkh/
http://sag.ceo/wp-content/ruhkq-hr2ie-vjktnqnm/
http://sag.ceo/wp-content/US_us/file/Zrqg-jFrTk_fbaO-Ft/
http://san-enterprises.net/wp-includes/En_us/doc/tfRh-Qhj9_DQN-G6j/
http://san-lian.com/wp-admin/En_us/Invoice_Notice/rhqdC-Awl_MqB-s5/
http://sanliurfa.gaziantepfirsat.com/wp-admin/En/scan/Copy_Invoice/wrNa-az_wkFwcfChF-J5/
http://senteca.com/wp-content/plugins/js_composer/zzfn-edgfr-hojhze/
http://servinfo.com.uy/crm/6zpu-x5hypk-qwgddvzam/
http://setka-magaz.com/wp-content/Invoice_number/WEuC-Vl_IczROTqE-o9L/
http://shagua.name/fonts/En_us/Inv/dXsc-LEJ_rrM-YKV/
http://shagua.name/fonts/US/unRu-9OW_llPlWNeDZ-g7/
http://shapeshifters.net.nz/slade/scan/New_invoice/juJr-hR9u_b-g4/
http://shopchungcu-bietthu.com/wp-snapshots/corporation/Inv/YjtSd-bv_fkObl-Ku/
http://shophaimy.online/wp-content/En/document/JUJA-g2Q_Lw-eYX/
http://shopinsta.in/shopinsta/0iluzo7-5x4e59-pkanra/
http://simplenetworking.online/yes-old/download/Inv/FQdE-P8Vnk_ylIBbV-WHn/
http://sinyack.com/wp-includes/En_us/doc/Hyerj-oyIUb_He-kH/
http://sinyack.com/wp-includes/US_us/weMz-pXNx6_GzxirvmIc-ppD/
http://sirocomena.com/mhjisei3p/Invoice_number/oCAwF-kz8_shv-P7u/
http://skanecostad.se/wp-admin/En/download/0106001144/kNdy-Ho_oOed-tT/
http://smartjusticeaz.org/wp-content/thr3-r4ehh-doqhrfvcr/
http://sudmc.org/wp-content/ldvwc-7effd-mhljser/
http://sumeruhospital.org.np/cgi-bin/corporation/Copy_Invoice/XlgB-MUf3_JnS-a3/
http://s-vrach.com.ua/wp-content/US_us/file/Copy_Invoice/SDcJP-cp88_PlClHgmpB-4x/
http://swiss-cleaning.com/wp-content/6513368411/kFdy-bN_QziKZb-JV/
http://tacticsco.com/Dev3/En_us/New_invoice/CqpLD-Gp_sMyKQQ-RKM/
http://taskforce1.net/wp-admin/gvfy-tm4hg-uzfxge/
http://tavrprocedure.com/wp-admin/En_us/company/New_invoice/xLNvb-RruE_NmEruVM-gKX/
http://taynguyen.dulichvietnam.com.vn/wp-includes/Requests/Cookie/sudden.conf/US_us/OLJOA-Ov_sqJttWlN-3F/
http://teamintune.lk/ganbmxe/document/Invoice_number/OomMZ-DzI_doghv-95/
http://techaids.in/cgi-bin/download/Inv/yoDJ-8DDDE_Re-hM/
http://technoites.com/wp-content/uploads/En_us/scan/Invoice/5730316225081/wELMW-KNj_MUHf-djz/
http://techsolutionit.com/wp-admin/US_us/llc/Copy_Invoice/NPJo-Eb5o_WWuBe-zI/
http://test.atnc.in/wp-admin/css/colors/6e2xl-8odh7-itbjtntln/
http://the1sissycuckold.com/mincpke/GTKIw-4TF_KrVreBtvs-XF0/
http://ticket2go.by/wp-content/AdaD-0fe8t_BdqPaxzNF-Qb/
http://tom11.com/blog_images/US/company/Copy_Invoice/0796507623/MhwMz-iRRN_zrZQ-3q/
http://tr.capers.co/xjoma8v/076l-4cctr-pnkr/
http://udhaiyamdhall.com/images/m43kn-63ojv-rclno/
http://urbanfoodeu.de/wp-includes/7u5a54-7h61ivc-cggx/
http://uzbek.travel/components/iw0p-i2fz03-hojkhmcm/
http://valfin.es/wp-admin/adx8-pf6gn-wrsaufn/
http://vandekonijnen.be/aspnet_client/system_web/jowqx-xzq3y-hwgcam/
http://van-stratum.co.uk/www.haishabu.com/8xcod-zz9hk-kdymyso/
http://vicentinos.com.br/wp-content/vaeao-wdl5w-pomqkvtfy/
http://vinhomeswestpoint-doducduc.com/wp-admin/En_us/doc/New_invoice/496524996/VssL-Bjl_rkWMe-pi/
http://virginiabuddhisttemple.org/0qjktat/1jzz-whdza-hljb/
http://visionmaker.pt/cgi-bin/En/scan/Copy_Invoice/BMluK-yFUOr_AQmND-5kD/
http://vivavolei.cbv.com.br/templates/0xn1q-rroj5c-czjusav/
http://walkinaluuki.pl/beta/gwl5i-atpdh-qilvnqjj/
http://warah.com.ar/2PS/qquw-3593k3-zjwnblnj/
http://wardesign.com/catalog/35h5nn-5b07b1s-ratqzy/
http://warmingmission.com/wp-includes/50o8-9m05h-ebdrn/
http://waservices.uk/cgi-bin/EN_en/info/Copy_Invoice/rjShV-4X_oI-wV6/
http://wcdr.pbas.es/pressthiso/0jo6m-mjdmqr-tgccsd/
http://webforchurch.com/wp-content/x8n5j-tj0bb-xqcwo/
http://webzine.jejuhub.org/wp-content/uploads/967y-k6ypva-qnijwnwee/
http://wegrowth.shop/errors/g1m4-sbeyj-lubo/
http://workforcesolutions.org.uk/wp/En/doc/Inv/Soqeu-a57C_gVILhC-vas/
http://www.91fhb.com/mhjisei3p/En_us/file/New_invoice/WGkwd-XNJX4_Z-4h/
http://www.adonis.com.bd/wp-includes/company/69085359229/lYIi-R1k_wws-El/
http://www.alfomindomitrasukses.com/wp/US/document/CjPZM-8Gj_rp-zl/
http://www.cbmagency.com/wp-content/6t7k-f9kn4-almgnytn/
http://www.cevdetozturk.com/css/company/7534046/ziNM-0PSIt_WM-JT/
http://www.daemconcepcion.cl/blog/Copy_Invoice/ukIU-BNap_vboStiYy-iKq/
http://www.daemconcepcion.cl/blog/scan/Invoice_number/XuZk-MtUs_fPFmNU-Qia/
http://www.elegantauto.lt/dummy/En/company/New_invoice/294061177/Dabzj-tHHns_aCoXQlCH-HRO/
http://www.ephraimmaina.com/wp-content/corporation/New_invoice/GWEeB-cnsf_lP-cxi/
http://www.favoritbt.t-online.hu/logon/t34aj9f-nynfij6-ruwrwu/
http://www.ibustan.com/wp-content/En/download/New_invoice/991966022/PSbV-fFgEt_G-0vh/
http://www.megaloexpress.com/wp-content/document/655951571557/ikmM-CDG_MNwp-vQ/
http://www.miamigardensslidingdoorrepair.com/wp-content/themes/twentynineteen/irbt-1yrds3-zyobg/
http://www.muestraweb.thinkingondemand.com/wp-admin/En/file/39620331/VaFD-XRMo_olqvJKR-Ks/
http://www.olney-headwear.co.uk/deleteme/css/tcvye-lmkm8-fgoykouex/
http://www.oprecht-advies.nl/wp-admin/p1tjp-lscosc-wkpoiilwb/
http://www.oprecht-advies.nl/wp-admin/ye6r-0cxl17-bzwsib/
http://www.udhaiyamdhall.com/images/m43kn-63ojv-rclno/
http://www.xseel.com/wp-admin/En_us/xerox/QxcK-4UA_vWn-0v/
http://www.zf768.com/wp-admin/xerox/5669415165952/KOqV-am_CNlj-nE/
http://xn--12co8a6cdw9dmf.xyz/wp-includes/26r2-yr01fu-sbrhrdp/
http://xn--80ajoksa8ap9b.xn--p1ai/administrator/k9npb-02ofmi-gxjuhlxk/
http://xn--m3ceafca9cn1gc9rcdc0hzdh.news/wp-includes/tbhai-39ypgu-rujw/
http://zalogag.malopolska.pl/demo/wjpn-dad8h-lueh/
https://abi.com.vn/BaoMat/m2t0v-v9q4c-gqkr/
https://abi.com.vn/BaoMat/pbqpq-8un6md-ijxkg/
https://acdswd.cn/hitokoto/50s0-hikeql-hefaybcv/
https://alatbarber.com/ryxqrrh/dlv2c-x57vpr-eznuozdvl/
https://asasliteratura.com.br/wp-includes/j0m0h1-w9egkz-isrjve/
https://barbeque.kz/comments/c8ax-j8t5sqd-faks/
https://conteudo.canguru.life/wp-content/gopy0-23uc6m-gwjk/
https://dap-udea.co/wp-content/xr3i4-638ij-sybf/
https://datagambar.club/xerox/shosy-d00dsx-ywhq/
https://drcheena.in/wp-includes/1t8xr-csl7q-shakoxnoa/
https://egywebtest.ml/wp-admin/cuoq-ft4jz-slcpebrl/
https://etprimewomenawards.com/apply2/uploads/fgrxy-5ojck-hquvi/
https://ewoij.xyz/5es8-hj2zd-xqfy/
https://fbufz.xyz/h63vb-m2mtnp-icvf/
https://gilsanbus.com/wp-content/languages/US/xerox/OTVpo-Xmk5B_CJFbl-eT/
https://horseshows.io/c2nkrlt/gv1cf-k5tp3s-ktndifn/
https://hotexpress.co/wp-includes/2yf7g-jhgeam-hxemkci/
https://ilimler.net/wp-includes/lunh-svvld-wycr/
https://inclusao.enap.gov.br/wp-content/uploads/corporation/New_invoice/22758867047/slVF-pLP_kO-scd/
https://jensnet.se/wp-admin/En_us/corporation/Copy_Invoice/tIcM-A1S_VzaatoF-q4/
https://kebabkungen.se/wp-includes/91tmv-1exbm-vahujshoi/
https://kebulak.com/puppies/En/doc/9422359844265/trOvk-MMR_ddd-RG6/
https://ksoncrossfit.com/rylawpc/yg9o-1q4hhq-etsozwiv/
https://ksoncrossfit.com:443/rylawpc/yg9o-1q4hhq-etsozwiv/
https://nhanhoamotor.vn/blogs/media/nzg2-eizh8g-eynfnzka/
https://nralegal.com/wp-content/3adehg-k7k0504-ayrepow/
https://picntic.com/blog/wp-includes/26j4-cl97tm-podge/
https://qualityansweringservice.com/icon/6pdb4-xhsyg-ttclzjitc/
https://qualityansweringservice.com/icon/loxo-yecsgh-rdcvwmcz/
https://ra-design-bad.de/blogs/xt40-hll4x-oiyvco/
https://senteca.com/wp-content/plugins/js_composer/zzfn-edgfr-hojhze/
https://servinfo.com.uy/crm/6zpu-x5hypk-qwgddvzam/
https://smartjusticeaz.org/wp-content/thr3-r4ehh-doqhrfvcr/
https://smartjusticeaz.org/wp-content/xerox/Invoice/42628542/scWEA-tv_zqQJMkr-eU/
https://taynguyen.dulichvietnam.com.vn/wp-includes/Requests/Cookie/sudden.conf/guio-gxwfvo-hsatdk/
https://taynguyen.dulichvietnam.com.vn/wp-includes/Requests/Cookie/sudden.conf/US_us/OLJOA-Ov_sqJttWlN-3F/
https://trangbatdongsanhanoi.com/wp-admin/jab5-5fd4t-azil/
https://vrfantasy.gallery/wp-admin/m0br4-dhj2z-yusjws/
https://vrfantasy.gallery/wp-admin/n69hj-be9cd8-veyfywvy/
https://walkinaluuki.pl/beta/gwl5i-atpdh-qilvnqjj/
https://www.hk026.com/2zsjmbk/49r6e-90ofc-uytr/
https://www.hk026.com/2zsjmbk/company/Invoice_Notice/TBeD-1c10c_puCHSL-oP/
https://www.imageia.co.il/wp-admin/ezbmy-03gnsb-xkvgw/
https://www.pietdeconinck.be/jkrw9vw/EN_en/file/524141659740308/MXwa-666Y_HuJ-d3/
https://www.psc-prosupport.jp/wp/wdx0u-nmpa3-uxbrprx/
https://www.udhaiyamdhall.com/images/Invoice_Notice/GaPbd-8EQo_BIV-hK/
https://www.udhaiyamdhall.com/images/m43kn-63ojv-rclno/
https://wzydw.com/wp-content/uploads/EN_en/Invoice/3456507/WDMRT-HPh_tQXMIZdl-go/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-22 18:08:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
6ff77f28f96520609121a2dea2931bd0b8612471277d01833af3a0811d2e7d47
446481f322c6fa31d4626aa76e0781b92d368b61b683d9004bc7565ee4af5ed3
a128b8c960f96cb051f69fbd41e0b890799f01eee49bd7a76dd964883dafe45d
c795a567d6ade6b6725b1a6868d2dcf68929c3508baabdb9dc7d8a684b2dbc47
955819dac450e03742bfe494bff424d156355a9e7630361498c16ed52d69bb88
21b2b7e92c8f7e405062af2ecca54753fb6fe4f93000d262cd1bae4f89c81310
9a6d8774a8b3642c967f5a0eab478e1395438adacca56322fc2236929231542e
c67553f35ab372521cfe9a12dabb885229fbed6b1fec2831f0dcfc1c72588970
42a2612b0d54652cab53c717a8e6b7452df3c4f3737a805f40ec25e05db38f77
9eb6636ab173eb2ef9b6cfadbeb9dec79227b465e5d48d1c4c990eea449628d6
1a1036c657758f1401ac109691f92d0d1b100d7aca1366e67fed042e485d54e6
2f4acd07ee727586c63e796a94ab64e33f82bf12488d81b70bbdb5fa46772212
a688566181802c7719686995445b912cc2fbb9a601a449fddf60917a522dcd87
830ac4f52e37951a334a590c4ab9bf2a44d3cfed42f2a0f199e7ad95d2f77780
bdebdae5fd38d4214fd6a21a7958261690c4f5dcd9d615a9361bc0836ed2ad5c
36e35f6977ac23d7f2e27aee6b84d9668ad9af0eb39f5173c201a0f0c0139761
f9529f127813bdd7aa0a0e87adfa7af0bed03e9b8c0159d9f110a2d1e3cb3d8e
1b50b1567032a1247d2e5d50d7d85815f8709654eee8688d97d988a339140fcd
2fcab8e52e1c52a8078a1835175e31fc95eadaf23830f582b9e3067c9697627b
2febdbaa811bb063e2d793f102886bd23430760504b09809001b299b8b652f3b
e618eec84ceb286bdd9ab7da260d8a7be33333db07076b5df7a8d3fdd056bb6d
288d1a562127a19c4e9350ba8cd2bb1277ca45959096fa24f5d24cfba61ed317
304f91aaf3e16820f75f0db4ae9a6b6a7819e51da8d9bac651e6a9bb129db294
1578131c038370aee4746c655e9a5c48742d93446b0b8393b711c33dfc3fc037
b76fed1913a8af6d4b3fd4bc2a9fbc74d9f27e8dce3e20975455661694a4cbd3
ce11e02c0e0fa010ce2208522334b5fcf6b1e8594f04c14a3ca77783cd194000
17455ae622e61caa0eef0a1ebe66534269b9f2e58c5844f96e2b32b7afe87800
9e9b0acb163351a93afba4afc7d48347051e8282b0e804b2886798c91c0e28bf
45151cb8f18eeb6d35134f6b36480224be4f20a07c0091f9ae143c2e3d93bb18
2e5886c67041af290c242b457ba4a00f754d1324cec05753980402e7edd1ce4e
971ebf3ffe21812e6cf0a2a90928c89a4aa68ff29f5679e81e7384683b5b4a5c
2a859e1269db3c31dc37db4513fffb836c3356b055582e6bc81611ba1ed5acb2
f951d9f6ef0523f3d6877379ca56db20690770c14222c5e0aab38aed2727e597
f432ed0e6b575dc4717254fbf3d952e125bf0ba3f5fd6508011226546ea8a786
8c921e547a84cad868d1cfbaceb01f9525828952e0225997a5835bc4ab534ac9
e2820ec79d18ee4845fd9bd79ac08f23c0dc0a350be815c980dfebbf36b54fe9
956b4c5b9f3490d05301da9a799690d7249d5fdffb55ec5aa84dd107f77e5b6f
3c8c2f5f55e50ae8ccd29177cab280df616484147a179948c8ed8a805c3eb9b4
5e0ab523d4ef9f8d74729a6d16e928135523d79e6516734ee3676fab51a6bbf1
94175f6404af2c6de995aa6f8f37bdb2faeafe5f952297b6f13c3052cefcb618
cc1548cb2be7da8fb0867181dcbb821bef162493511b078b1a52388d315e4013
6eacdaead54fe8220f850947bc6fe62cc1bc816553e350770ad41403cd32487a

http://www.bilgiegitimonline.com/wp-admin/mXWp/
https://www.yanjiaozhan.com/wp-includes/ug7/
http://barabooseniorhigh.com/En/JHS/
http://www.majoristanbul.com/cgi-bin/1OF/
http://bloodybits.com/edwinjefferson.com/jx7/

Creation Time	2019-03-22 14:15:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
2f62faab8bd08aad3f5ad56c86a1a6d3229d8c7c2cc7bda687dee557ee9aa1ad
7ed922b325d58284386eefa55b9f847346d1a20c4d0ea1989e4d09849e968521
f6b70a2e459528dd2b0c8ab6b75bbadba8294f8fe5167a54a86f290b2880b2fe
18b9bb430c5428037a3a4fd9c9acbbb0e081cc8e22519e0912a1f3d9e8868f15
9b855837eddf0daa7234703164549a0df98e422a938b4c3d6d6fbb37cdb9de24
56d6488a1b865cef4425d95aced79a4ad03364810e505fb1964d20be3a40de53
4244790f0aff7e8fba8ac9db874c45e61d2720f49ea07560899f97ab25f0725d
d59d88ca8518754e1cfb08161ff9327f4b14bd3af0d88324718b3e71b8cef219
1a1f1531a79a0d79fa3e30f82919ffc7e7be80f08f467db09db1b9e9edb5690d
68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e
68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e
09180849c7d8f84720654004ebc94d15ecf4a4f11d4df4e7889ac2367e015253
5eadb970f1e71a7c4561ad1a4c6a5918eb4405e7a132d12e27d3d078271dd149
51b64da96738e415736d01e1092dbb2d200c51b3f99c657edd108839e3e5e239
76d224cc236ff33eee391d3d404b411ea28a170dfa1c9db929541b69e76b3fa3
06b35e157a6e8667812f2201b2c7a96b32653d474c161ae382026d6a3b3044b0
6eedd85521fd514dd16512d5f31a9415a0361817fab74fe52ba2445f30918247
3cd2d8078d1f47d7f7231be0d700ee4feea986a7cb73b8bd130b55460c2d37f3
78350758fdb5063ad34abfb6d868f1c05e8c2bfb6fa065e2f6e1159e5a38977e
6683fa863bb7df9f2b9318c1baa4951efaa1a26d3e3aac41144e9076b77ddf62
3c70cc38f8deaf228dac3a324b9f2026d132fd5c40dcacfbe964ccf3c02c01a4
5fe1e0c139f7be733575408723a657a83f0eed5f9619dd65ff1db57f879e22ae
fb032a4a18582bf61887bc3b82d627d7ff7255c8adcea916b294168cccbf2497
b1a6d760127a26149c7f006c651219942ae88d8415e8056db193b2d0b77cd839

http://artmikhalchyk.com/wp-includes/mYW3/
http://franosbarbershop.com/wp-content/plugins/IUh1/
http://arexcargo.com/wp-includes/QBci/
http://altarfx.com/wordpress/wQYt/
http://uitcs.acm.org/wp-content/fqSlt/

Creation Time	2019-03-22 07:55:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
76a2f748578e73b76924608d9d7eea072719cb2023a7df866f52dcca3570ce07
577458d6f57d9b0fee68e838cf422b6d3b46009dbfceda1cdad9891a0202a079
8a79ee32602dd7367cee54b65d647098b8ea54e24a3d863b8a1186e2b0577608
76a7aa7d52d63745995b4ab3882ae63341e4f5250a3217bb5ce2b5a94f4d6192
e5f703b201adb114ecbdadd28d9b1eb3a420305c3483998c15b5db665cc1706f
66c6737038a5176887092dee089a8d50bad3da455e983c9b445fcf25dd1237ac
e6123eab533f6cbcca704a71b5a7b353fa79a8e9bbd6d3567e37a27f678701eb
a47c9fa4a386540e251e442dfb09f1efcfb98c7fc040bd4274bfa3aaf792b462
d72395a923956e1411a0cae8a6ad07c8e45179fd32c12b08a66c78533d15e1d6
d521847d867fe5a9ec310b22c0ea21ea578d5c290aa94674ad8a0c6e6125d7ee
38d5b912ec805254271ff0e76ce85b354e4be7f7d6079d6146aad7140f2abfbb
16ddb2f9f7c65ed7a96ae488eaf6e46ac9b9a21728eae96ede1e39f79f32828c
373f694c93dc8d43cbae9089b19bc4c5b32ed869590af552072228c254877e34
392cd9ed1e4363f5491dabfd0e5f29636da12f5b615d2ee4f2d6a81a1c1bfbcf
32c63778eceb95204b5ee4e42ad9f1729baf3a310cbefe442e9498c79079d9dc
9415ba39274b1a3b748089ad43fcd45e1c738c6c611a9a6c2d5aca1862c2d60e
80157d65303964874f0beb79096b73b0d6d097c6a6d789a2b31afd39db466e2c
177bd2ec85a8f6996c39e3c96bdc42c5d2ec8c6100a771cb34ce18c2c2044a4b
f9bf3c65808d658147811018cd5fd270a4c63fa2f1a44f6a3d8e33c99279f517
6b929f16003661045dac429f09c2d61a4beb8e147df5839a9bd69f133772e64a
5e7dbfe298961222b3f4649a2899028e165823a265607a2f318c2bba29602a81
df4e77a282d0ba4d38a55e15347d6f252a08d901e815efe1ddaf640d4b14cb54
c2f5c297a897ed5babfcf79b00a0909f68ede8bd9816364080dc25df8da82792
86ec1668079b9cad25b0e121142d25e9bb61e1b95027a4f6e372d93c72be8933
242cbff73d85b876a2d753fa779af6b87a31eddb7403d807f2581d7c76223cdc
c8edac1036d969803bbf1b17946ba7f9d0ccc491ee91f68151b1d89c91ff25de
62ab2dc3b4672ffc073bec10a30a201b1aaf140238ad1099e9a4b16b30f7b330
f341efa9b0ba50028b3f7f0ff845ff2fa12cdf1637798a4d931082aee8ee6fc0
df0eeac4a3ce0c933ffb8ea9bd5c2255f4da043305adb21984cb9732d519c1dd
1b3b52a706b3fd75ade98f76abdd50bf502fbc3c85f4a9ca7d5a8f83b8745a8b
9beb8f592d4e8efdeba7b8e0e0c73164a439a32ab49541a530b79f9a868433cd
4e2856d5aaccd5931755a1b092ee0302fffc2223a91dfd1ffab2d49a67da8d53
5b060606b8fdd21378b36c574a1b1c1efa3453c0a52a91691aa63c4656c72133

http://franosbarbershop.com/wp-content/plugins/IUh1/
http://artmikhalchyk.com/wp-includes/mYW3/
http://arexcargo.com/wp-includes/QBci/
http://uitcs.acm.org/wp-content/fqSlt/
http://altarfx.com/wordpress/wQYt/

Creation Time	2019-03-21 19:59:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
ce8b11c995caacb1c8b3cdffd5d130a535488e5571697c7767243de62b549b7e
06f1746d654f82ef1521ab12d11d577b2f0f700d6c8f557e7b3f433a933f88be
f878bd2d0d261601d1e61230bcd8a9c2fe2ab4485f5f0fcd2be852d1e0b14beb
c5af840fa8ead0e12439115f65449743ccb90928e4ed3ab04d97acd7f96f2527
aaf376a7c9befc585e5918e34dc05a592b08567af979e1cf08bf661be7283667
60a9d55d21bf269ea6ad6888ac431996d170b423536161935b7e0ff0adbd4955
3e162ebba05c72d2990f4e0af75c5c9ac4bbde64a0db841080b5ada07cc420ad
16cae56936ebd97473e750aba2daed1e259c95a489b89a8538bc85dd9ee8c365
636f15a3b75ab89500d18f95d7bfc0fb9f1874f6c66ad72fa00cebd722c1c742
a2485702ecfaf67327f936a1ab87489e572cf6e8f0f50f8748a32538fbe881e1
7db0b444dccd5344caf4bdd0c16cf9111545bcdd01735c09e391a318c439048a
2ac058ab4bf534db27a1788862160d1e2e912568c9433001b02964a8a8b2d229
b8ada0d1c80ecb6f72ced29d17ab2ee959b2716aab12b189c97ce974ec319109
b28cdee3b0311c8870682cc465a855f74589416bd797ec7e504e629473503ff3
b25ce3670e58ad46d38e74b2439731778d38aca30cb1a69525fac1efe14d12e7
3ff5ad2c6b2d78863a68525d8d86c9f6c25c9525eef639f0214018f21209eaad
1a7d1d5458a2ed2951063b75fe47a448bea4d2a6fad60995a8649e20353e5eae
bc987e7b5bd775460bdfe88b6b9147a2f88664361c4d0a332869ec51b19e2578
118e1fe0787681eeaa375cb15afedb78f8cf1ab63fbf1ad135fae0f547a15dea
5ea849e68b8d9de929c7e6840bb4671ffe56b0e0b52190a1f58e381e88742894
087aabe1a51cff0adb78f83e2e4a1d9414eb0c56a9c17c780050f76904f95939
a68a7976f82460ba2b79c49795b916bc78e5905be020c9bbe9f56dc0b57d4e25
11b5a0df795927c02f3e42e65147f41fe34c52bd05c10acf346cdd200979570a
52c80a6243f7c772f106b6cdb42183d6984ae47f34571274e20ac47970603432
b867122c361adc23e15aab41518b5c0e1c45b2f98e38caebd06c223f7ed6f35e
7bbba3d31aa7f6207281c6812d28edddab61e92da406cc26adfdc2e2263f11a3
5164857f347b536f53d894d4b028d58fde37fdf2edfd1c34a8397208ada2a37e
a337737afef555d73355e12a5dd03b7fd34757154cf2571333e671763d9b1d76
9df1c015db6a4f4a046d8be445dc10f87269562e7b72d6118d7efc4393c26a2d
2307b1f1943b999c2aabc28d74bccabf516336b861da31241b0d89c370a03550
096b035d9b5dfd04c0522c6744dd2f0dc019951f002fae123105d45f0efce6bf
be3778cfd7908b66e9f4bfbc3b062da0bf20e56d0e9346647d4c2942ff907ba1
f721664865b3aec5a6f195bbc6d237a25c0eb2332db1cfb42e17d0c3d812df32
e8c672af328d3f1b8163cbaff7c0274de81e0aa5ec3affe75e784b07b1cc9b2b
055c83e2f02fa644f4e42b3a4b29bf9111cd1cb95da0aa7983baef18a17ac107
64cb3edc7f913bcd6d48e5b70c70e708e19beca32d51b68167120c63664930e4
9bf28478fb24d4604f4d2af36e834cd4a98b9b2bf12e9eb3648f26556e3b412d
e662ee2b45bef7cfd1f5cce53a6e62eecdf5c9587dc5c8ab702e0ae5f14a7932
3fac0d2fa665f4ecd1a71313155554762cbe05ed3410469190bbb4dbd7fda89d
0a7845d33ec00acbe9c1bdc559d170d1acbecc10f810fd2fa55087cd1d7c83a0
9667307637583d9ae668ee6ee20ba1cc9d91b2dbb24964da2e9e6c8d0fbf7d19

http://www.palmettoslidingdoorrepair.com/wp-admin/user/6C/
http://iheartflix.com/wp-content/2SP/
https://www.mqhealthcare.com/wp-content/GwV/
http://oykadanismanlik.net/wp-admin/HVN/
http://qc-isf.com/zaxyzgc/fLXk/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 03/22/19 ####
```

45a41df2a026bc33049e4cadecd09e385d34eea3b126b4951ca2597bbc38bc04
7fa2282e3d2c8332a4326c653088c43493c6fc639a69330c55978516a2b1e6a0
f4185f32530fe6736156f29ae5559795ad602add7435d609cee70e5a1093ce18
43469656e19ea140d1eaf7a47323d5c3265bc70ed26f695a18d4064d186bcba6
2a4fc0ba9218bf64548a4a469d5dd4a380f6fa06ecb6f53a1e7ac369ba5c2323
36ff9ac532756dd3f3ef0847f8771711bf0f3d8aaddd3380fee62043572286fc
ab2ead00580fb28f6cd6f863d0f722a1bd4a6b31e204f617e14812338f48a104
af5fe755cb5f678b2b6487999f479062f17306de1907c61bd95e823fd8df4d3d
17765be11f99f4e02fcb3fa2b7e39fae2f2c5e5de87fc2a7741cc1b28d6d73f9
a902c66290c5653b57be3661353e81027de5dc8ece5674a55ab6d2f3e8c7bebb
98a48dcf836a172fc0260495f28be6291e26a83dd46913e9a7e8837ed85b22a1
8d548902a9a322111080bad698ebffada9d1c766e65b799b622537fe20ee9fa4
c59c2dd176f7e8b795e841cadd456d444ba38f379d70f25363b72e37098d8215
c203006f84a1f9b236fe05b4e96b3b203682cab224b0dc5059d38cfb60ccc130
5af624f29b579c029eef953f476560727701474cf0de65ee6fb92601bb765343
6ec6fbfb73d8fff0e9397512b73b4ef8b322322b6a989bd82d25bda48ba17a76
dadb64179154f50d9d686a9b36b3e3862886305794f2acd0b1c1985a73f34c19
ccf706d4ae446291253d6bb12fb56221b219f5d8dc0a60825f32c27089a008b1
be196abef2442013cf8863e9b47379c1a8311ce15f8910296e3f543cc16247a5
7eb603fe796b1c930dcc2de273c8952955517365a373eaea0ed267591216abcf
d53298b33883ebb34bd5642beb4f22bf95357909ac05485fab8b791c475a22cd
ca52d0edf1fcbf42b7f564639267360cc2037b50ad0d1ba4400b63a8c1ce99f3
1134f1c1e7423c9211f6350fb08e28fe53c87a7aefb80277980a744683437f17
449c5852731fb8a0b9d3266609e511ac458df4787e4bb269361e22b66c6b0724
288791a29876a2eacd17cee6a1206f03cf858a5786216766c3f34d0c6508d459
f482187b34bb69fae554404d04c867479c89a039d9302d1198ce61dba1f49586
4b837587ae66afc103650a05c95a65c11c31e45c97942806ba4450c3557c822f
b0225d1db3cf9c84278ee04ccbf3f572346904c0ed0e0b68bb4a27793807bae6
f1c4cae43e45359bbdde0659fcb334ccd925dbcf9480243d28e45ebb6cb0467a
9536e87475566f9bb320c6dadb34ce48945d524cec4e4e3ca6c2f48b90995348
c77b6cb5f78e6e73d4b391249ea6ee551bda2cd4ecfaf4aaa8063d7450d9361f
8e7a9cc84cc787cbf8ac26132d480e1a5773e3d6a6daa195924354e8a44b4714
f035053d24d2c5cb82db61c58e2d22f59d67723770e07bf269a306770f787835
d4e1ac97dac2327d63107c4bc9831006297015860688a6e1d12c1f20b1c2827b
72694d381a5260d4b5e25bf06f331f78547d22bab472f6ffafcf2a06b2ae4540
e2602a9a5f21b1994c0090f81c5bc790c382700e0d0c398350febf51fa07c88f
09243ded0812e7ff12ad453441ed3240324a2fdafc183b9d663ab90bc833b232
f78d2d13c02e24375e6861fde44bef1d902e844abd35f5854638847196579403
8d8c6dc56427b0351db3e5a0b126b34c3f8872ab6b24d18062a972c4672eb096
baea94497f91bcdda510aefc33b74474eb93f73ffb9751e74b084b724e34d74a
02354a218d943b2f89e347e9579742101f8b069d8f982d705a40ddd9cd9a870b
6c175bd5db2df55da983c5dd2e48abb5b344b54c17d1c2a4c5d164a60afe2e14
54f05fa1d43841ec8e1d54ee165ea9af3bed082906d81dfe1bb9120273a39e75
e4ca2a3a37714d6c5b501644e1bbdb7562c6b81777bb5488d1348ebe23a0579e
a699edda99806c419f86c6882b7ef13f3de3ae1f637799785050057ac39e6eae
6f05356cf1bb3bd4b65b7fedbefba73e0d81da0251359502a243a87deac780e6
319eeb3a17ff3955820baf9d2caa5ef87ae9f7bf672718aebb7e95669925b4f7
1fec9d84b3c1f9ca2ab138c9b9973aa5260b4a091918b8d847be088b0677dba6
7d6aad75596f05c1041f2d3223273dcaef83ceacb4a336dfeb2fba4f5d77874e
56a224203c94ee3fe4a23f38961a9027dec751e11a3f7dd34473be5b6a315ff5
38201b96e7a587a05ca47bc8b82dddb1d5cdd964e780be61b0c012da21c42b1f
9b5a8d28e584532d0b7596653508391e423bd2a85c6e52fbcdf07ad3d07fc0fd
d594bff66762fc458e764fbefdf1467b638fe96c81de679d8eaa184b5a7d8aaa
758d27107c69dde80aa4089a04d8c19a04e62d87cb93f3d683ebf0b60516b942
a27c3ad1f0aed3546fd63f2bde46b0e24367bf6b5a6e16bacba5485cb105986b
58f3b640195ee674fdf399c0c0c0e27679ef89ef3b50a4250c37a560d1b23c6e
19507f5a8f5695e4b71cd9a34e0eb2695a20a6d3e8264445ed6a178c1e97f175
718bfad97ee671af16c9696c9d6dc76faf006d635858c80dcc3ac0f1a7740d79
1e45b2f16e01e4760c0286604bb32905991640b855058f8bef489fcc0b97a090
2c6eee10cbb758c8160343869b1ada943f6ed670859303f665978248ca223dfb
d26dd4c47034a91bc60efe5b842a37e25388a92c917c622b0c9d46400a9e07d3
3840c3e938e7a5d0c954a266bb19455166c36dab3fe8bdfaf8fe189f0b3422d2
5c388bd075d8761389ef4235f46c591497a1baf6018f604bd7cc6e49706e1d1c
082b6bd60b139f81a680e374e3f0ae315405cd739ec1ea6ab8555ee029bf2aeb
7548e6a1f4bd54dd075839561b872f0589e567a7544f64c6a414faea4062af95
bfc55d9b8ae4cf9817ee0cc6e19ee976d4ab8c032de49edbd4f980dad3ab5072
c161c967f095ab9681cdf946f8bf982aa068d6c4a32327eddedaaa241b3c0a21
bba98112fac6f8650625ab7f1846421ac69d745f4e0ba672b412a3e3f052cd7b
13bd43f00e99c71945ed4dee067f8b78b914e5130fd29ad4860e6167e6048697
1bc5996665994ba5ee80391558dac5b139f48e50e9481a96e94b24f042239cd1
a56320f50790bbf77cd7e31d1e57446a7702cfad3c2aa3cad97feab00c9082a0
9870b721d1e19d95784e10ec7ee5811aa22e0ac945e89a4f8d572bbf227b8667
859428f3df38343d2ec3a53467d2b624bab12c882a904a2bcd9d617e9ac81886
b107631423a197d0d104aace2724441b8faa23904268de6e07eac97fc852b9e5
32919b3c6543effe0d6844ffa9b4bdee8e8bc0fd5f3ebb9fac951dccb46e46e6
465a8a1c1731d15c93becea90a9c8ae4385b1a2e907568ee1f89542b131fd007
19a346f330fc9a020edc1df9c7bd46feead73d4ff81e0cf12f31be5a188102ea
297b7881d5c04d918a93a42df985ef3a0f1977cfe140f826d9c48b79cc849e41
0f21e50b34c3b7781357cccd701a2908a3ac7d99e956f6a651f62122d407f954
9e3410b355bf1752dc02dd7ae7204333d553bf0b5243b69ba43f2d2361ef6651
9d84ca14abadd5f507934896b988ff06f7a8e5c31d18c181852dd423ed7d93e4
d14f135ca57fa92ade92a44757f59792456ffdcf82ca6b52ced13b70e42aaef6
fbb67847079a245891012c392dfee41fab7e6c0d37f94195e26781ef0c1cf2b0
5607123f4c1482095fab9bee8cea10922c0503721e56ff64268e13df649274c7
2fb36ade7a02a09ac3f24bc63db86a47379b9c0f9738d5ebfdcbb1057b57751c
a73719087034fec15ff29ab726100f4e2d2831228c75f0904a81babce1758c22
89f79058498a92fc898400a1ed7dcff3b2879aa2f69f3314a3dd8c505105ecb4
314f917d7bbd980be5d4b6c2262f987a4142ebdb08ca4c822bb420b494a4c633
599a7da8bee34a4c324d255e6cd82ce1bc14e8fc69b0e29cb772edc475869659
b4516b8b5856c3060c7e4a46b7777a71cbbc74025478a86b5c80962ac0b44f54
cea9e7aced17f60296569ebe6736a310b467ddb9c16c8e71e48af83522271e78
445cd384d113e1ccd77714e80a808717082e267ce51f8a726e252718d802b2b3
afad992cfbf0711142ca7dd53a79671c8fa157fb074a3e3d3eadaa338fb51ad8
ecc801c4f54483ef4239172232a64acf54ba8f54d62fc9dfc6b6f4b27cf1b030
14c371f8aa493e7eb00ae359a8fb9595ffab3d3fcc58b9f1683b2f6f1d8afd57
a6022fe421029d74fa167dd07896b65c5f69c0a677496e3fb2993b4bae2ed551
65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92
5d67158e34b0a1f2d1bc6f7fa77c3e2a6034f191b58b970e5aeee27204352c36
e94236e1cb02262c875f07a853aa6d19945489e368c0bf120a98afd79fa312e2
402abf330b6dcab9a916e35309057e0b50556485e3cd2b3802d21278d1b5123b
d075d08d68a2091d628db473ae3b03f13c8fa883671982e9377793a9f97a3ca4
33a6a786acbec3e8ab7ce11143696c88f826ad1324400cce6fe9a9340c9b73f6
1b207b835de61257f508a0fcc5aa711af52c4a3cf7b6554fa2df9122b9bd9730
f59fc6a68846fae7e22088226a397b0022f9e3ab7f4c873c5a8d9f99ea23a9e7
07dde81a3e0c34802ffbfe016e1d0abfd89686738461535d7a244a9156961cc9
cb7b18a2b8a12c11adef5d846f7a79a1f4a1589ace6939f8e194a10c6087163d
f7ba3047cbbaadb9d91bca117f74748a4bfb1799d416047243e1f28dcd6efa71
393e742b8cf99786ae9ad8501167375b5c6f8565ef543662d7c7d1f4eebfd9c4
1a02248c1968abb232dedecdfc61aa29067e8b6e3dbfdcbe461e42a8083263cd
f48595a272cc1301b83d8b78bfb0bfc0bde2000233559d8c612dd05869df896d
3cbac2c3d96b12387a971e47b556e24ca3cb6396ca4e9e0751fd4f8ec2a30a80
aaf04479a53137f3cca609638cb4f2fd663058192476bb256d718b8e29fb7860
d8c18c62dc7638e9ab7b088d426508b314bbb0f47f02a56e6bfb86ea860d107a
1d8515554ecfa6ef5fac4ca25512bb4762f5ec888bb6a1d009c9e431e7f1696b
7bdfc272d0e41bdf9e3e066d540f9ea5181c39dee98a16b6f6e92389c28ce79e
ba8aaca4dfb35315e502e66aede7be7aff535af42934024bd61391db8977f2ba
73110a5782b679fa8126d866d02965a6d6a9ddb8bca586a21955722a7e95fbbb
99dd24a2c6ec9cc1dce06631de77a321bf9791e3d3b88a4ded8ae4ad189badcc
59dca62157d1879e52f101571cd1921380355ad7ce2a8d4c05ed58e9c15ca8e0
d55d425df2d1ecba4cb9c6d9a464911f42392f44cf8052f426f7b2a0bbbb9012
835e2a9873e13cd1e7aba0602687e2c91d7795c4f6648669cfcf00dccd520893
4effb767500ff0356065310477ae3c1fb44ad305567ebbda0edcf0026a7c43e0
c5c9b70113a46270e520f96ac44132d8475f9346c19a4610997362c5f475cf4e
23895fb3bd632125e9143da7d7e1dd37c08d4dc2ecc2b2bb998ba0f8a3912178
d65efc7c0d566742bf07e2ff2be5077766b30d9ce5d89a77cc76e4531590b308
954f94ad1a9d94bd97bcc53175e93cda428706844db4608dea2219df60c6d4d0
a0375218c2f0cd6edbe031d87740d21741cadf8a4c770f3a3756830cc96059bb
695128113653b29cee6652a6700d39f6099a6ee60a1e6196331161768b72a9d3
d65727cd3ef21cf35d6b2f2836193497cbd167fcdaa7d2a278f05b163a4ba29e
fca72eeafbdb2630285cae0e466cda728aadf8eed074f53fc58675fbb924f288
28200b635b4a7b9b4dbfcb9941e92effbb8a9e9135c5b1dfd01c171432cd396e
f97a9b5ec9fab24a50759a2ab660dba38a2647bc9cb28009dc3649c03ea3bff1
419873c8ac78dc8c57b02b06890202e674be119f5a00bb49a3838b3358d0bfee
1db2c8727ebfeb036847a72f57260f72acb69117c695c3086371b1ec1df96525
fb2b818e1df71a18f591ea7f3f177346aa8da4320628ed799808b24297d7a8f3
effaca071f5139e25dd7dcd89bd503b5042d4deafdeb7c43c6f672f7f13627b4
dece314bcdee5698be911d16f7b5398fa652fa2378bc33725db35d34d19a7753
3a573e258b4e7fa264c7cda434c76a4fb363659e9f1486da4e7d474d8aed8570
50167c454b2dddfed79469cbf81846a2ae22c2534e44bcc9b2c711123b8524be
d4ef15f4ce39a5db72f8a73614a5b143d47a9b152fdc3997e4f1cad05574e50e
059938da56b8f83491433aad3c90586a822dc4861caed4d1d6d6f6cc4442a162
8e9df4143469bf169555f036e045f3986ead74168927c73d38fbc80ea7dd6880
6d1d5b29daa8c656aa21deaa4280ff3a8b0319e05f551f5e3913fa90de494351
eaefa55ee293ed9e256458295682ce793bb3ae11a013e5d7658f12781b1e7ece
39e4a6870aa8d3bbf4c49cbaddacecda09c4f2581d1151470c42e20c710605c4
4f6d6e1c1eada828a6107396c9c923f750ae9d307b4af14d01a5bd7fb99c3f36
f8247a6641b778a3ea467bf39e3285dbba81d73caa908382c91e6d0b61f47e87
df622b74d6743bb441c9cf9f4ce34255506c351ea63d3d309c62764a45e7f145
6f12493e4f7c0aaae0b81cc6a8d1637d09b06316766276410002eabf7fa4f2fd
03cb0ae4880690aa10488f47d79e6ef7df10fede1b5d31a909d662059b870290
760476bb4e93f41f6a1fd8db3cfacdc8eca14ef18ff353d7660df229ba21d225
ead156838d1a927dfec705758ce181593bf77ca542360e10fee1eec12e62a3d7
7d6337da66da2d53b9464ac96d0e77cff4e5b12996cdaf65926d27e6092639ce
246b6c5f34794edd5595cdf57cf2c4318cf7d17000d87a29aec6879903201dde
df7fec0ef4f9c0b6916eb450bd285eda5e9d7b3f532e34ab5fa3d6cce43842e0
f50362df5c3ed1354bf262c5f410731d1a0b48615c171be5739e04dd6b5a8ba1
15ac4814dbe553c29f81d6e711f24c064ecb4e648b4a0c3e88c16f783760ec0d
a22dc2c1a86d26937a4f22ada9d3d1ad562d09d2c5e92f17311c32efebc9bcbe
a54d2fce80cd053ae85db2e4e268f32a85cc211b1eb5149dd0e2cecbb7f95091
767c51fee6535b36556e15e71036b2093efadb91dfd72195908fa9cbe2bf5feb
14c84b71768e7e0ab8ee6d3c10a5fc07cf624ede94a1dfa2edde4b0cce806bf6
5512ce4ff6d9620c107a5e57d206eafed8f8bce5415134bf121a54308fc44868
35d189ef1cf34660dba3bd96556cfea51db31372f0a5e38aadd3160f8d56a423
f3780ea4cef28262d477ac2695f1cec2a93f3161c4030cfb1053768111438a4d
d275b71ab153e7d5e3fce20c25ffb3ff7a843a7fc6aaf4ca3c83e08491e16b10
f0625b5be4c24550341da0c463b14bbd26014221182783dd3a1740949ac03e91
4ad3ae37ca30cf4053e82fbd75c224e41e99833f016e82ddf1c9f1988b470ae7
f18509f2e9f9212a842639cebade583a4f9f40bab6fa773c4549c117d6ee865d
f199600282a205e81ca83ec8a10f2b06e34784e0b555e3cfb83257fbc7b0e890
6472cedf4a9989eddeb329fc8f77a7dae14ecfcb9e6c94d100a35ea45f56561b
4b10e386edaa7ae5edb84318fa0bff7d470bc048ce650d6d46f400930167e2c8
fb5c1fc1a5e34330916fda839c6bccda824bf6bff93d1b3cbd2537dc689c0868
8d005da1efa4f5a8b6c1604f0806657bc9d6507040910a3864d131a5c9febbbd
c76630f820ac3916ac169edba09e464260742bdd880f7668a984f67c0caa437b
636823fc4f08d2265a64412decba722a28b20596739130013ac2575428d7ca6d
fb34b0620eef75e515e24c8e6e0e8dce2e632113c628d2080ab53751da591d1b
d3f34d156c68d1c883aec42716ddbd80910ec19e1a6632884ee0c8ea37873233
cd143267bcbe9fff046c747c4f1410804ec5945004cefa86e2fc1f08a4643559
2f96f237419bbfdfa8fa10a46a17171b1851a14e885b00509b91beed40df7b43
d8d08416a1d02abf51e88867df26b1dd5234646b36c3092d5cd3e3faaff17e8c
bdc25b303ba1075454fe0c57bb34805fc17346a15005aa63a5a1c0e2b3bf7aea
641610ade121fe184d9d24a83408080ad7bce83d926aeb954020975fb0ed9ef5
0c6319f61d1d19966805d160fb6900136d9bd004a23d6af5274f1f48f8a52b60
1cfe7f2145ee356186a06ae2183f50dd9a21f7e5762869ff47f25db3f60390b4
8ed7d9cd18df3c4639592a5a9f68aa6a6f2a8ba048965735bfe8a22fbe5c5823
f7004b325f2918f46b77aac7c19627d869d3d8e55296ec1fe3bc6c86e9ef2c87
57489b4919393acb25d92bec69ee6c63bd67aac3290e05f74c89f75e0abb7f09
189d4c378e3faf496fd7a3c0c74482a3b2df76f992405d669937c6c8ad739e3f
9419b874e1c98f510d86757d49404a67b7edc73eb6ed52e8dd6c141841793d4a
f6b606cf2838cb7800311d98dc2a1c0a1f90502168b0b538ef1380210ca5f8a0
d65df28d2141eb45694d6dcedbdbe8e569ea4c567231a7a907929f7894a861ac
967cbf3dc3233a26babf66fcef093921eabe2eecc1b8f2ec625103e29d903dcd
8de315b503cfcf98dce23171785af5a25013636a7fbe4f0f0890acc853086074
c1c7f2e8e52d6cb986c29e4a0fe2d5a8df01eb0fd6787a72ba09725fc6746764
40df81822601f7c8e1dcdbf8fcc5f0566a42f312a5f648a1eff6887c030d968e
02117f95389631c601620099bcbb179452c5786ce8c3860c982cac1f69a78f63
5ef29d1155f1d5d64a05c32ba5b04d0be2588261b29dd5646fc190cd5cb9ce11
60dfc0be22599e95d9c229a6e642c4e28c4f077ee6ad02c9b3845788da8ca64d
86c43a5b91485c92a27b98e2c70f6412a445ad9576341bd7f362bb65aebab53d
109d6c8b9b51b150f1c107166564e0b06e0de92e1f1a7c104e676c44588e81f7
dd498e15e3c4786491ef313cc7c2a98bb80666f9048ddcbb231eb9766cbf67fd
78225539e166877d0e8e7efa949d06c092318ccd0cba8c281f03d6bba14da6ff
df50dfc50d3845305ec5b7108592bd1e1e28ced16fafefa06cfe591415b841bf
11cd369945c79855ebd5d26a87b5d915c2410df65a2d13237a0d20eb265498da
4ba527c11c9f9ab82df872741a2c21d4431f59fcb06bb107aa808f0ffc5514d8
5f738db7f3db887bbd21972d5bd49a9a8488a5754dac33e9e9e343c43874b858
b71dfe4d0767ac2a14f52614b1fb4a0843df901a7e968fb3e6cdd3e13cb7ee8c
c41ae90da9d3166a581f1ff6040a8e7cf0155b14a98da2ef9c1b6c697482a8a6
426d5596ccfb21cfb940c3466640325492dc3fdfbd21fff20dbc0d446b7a8ebd
0e24d3179bc9384b91ad536175c4e6d15d08084e673683bb472411781085ba28
9619ad5b5890ea8dc9948abfd83d4418239056514958dfb8f2851629c4649812
73ddc47fc5ee06bddd987ce92107f85e364332e0aa8bbfbbef52672c60dc3b01
12b6667966fdb5f8f520e70652323a05ab55d85eb58d385a4f87d76b8ee89240
fbca436d1b7b92ee8014df85fe87bfff98fefb3c24552b7b500aecfc34e3aff6
619295c36c3077b52e73d169f28472eabd95f46ba12be9ad1e4c9b2e39af9e9a
92377143b92802e2a9b2d4c110852f3f3b10e53c6c0d806e5c5a1ba56d65663b
f537bd6a15eae3d5352103faa1b809354a5037826363446740300220511a1a0c
2f8510defb5906be695375354359e076eb469204f64ba26387771b1308cad1d1
2f3a96b3a2fbce976048e70a946391b4870a27a0c7a77209b8fa6e81c73a0271
086e2104ba87891cc21a038012f2d6789ba5533bac35f069590158eb429aa8f2
f98490164bdc9caebced242d19cee70c3832c948b684afb248b016d97ea342fc
a6c1c74139ce6a4d0820893303fb26bc8feb9c831a04de1d190536a4c490b59e
e987d3efa34ac9ae1f097611e040a90d133d4fdf492ed579da37b292df20b57d
fff109d6dda7802f58328f1b8385f7b2cb56a5c70c1f44e5471015518400a406
5879b3cee823db955ff756cebd236680a83e3b4a6507555169a053a520dc63fb
fb1a28a5bcec25f3a501f7f767f78dedc59c65f59070af44c5ae244d59f3ab2c
6df23531d3d2989dd6f6fdf7586bc0b9689d9831a7c46ece113b0c55d5902a87
9fea456700f8cb956f59e35f805da399ec146f9a75c4a84be8546c4a916eee5f
448662b2b324c7c3be630514d4abe2280f68c044952242243a769dbcade059da
59b5c1940b2b37d02e805f25a74fd162139a61d6c39549911ff566331941b7cd
127b8fb7d0595d193ef0211e02b3f56cc400224e49df9e4b45db831e9d0ec1e8
f626dd3a81f5293889651703ee09868e9df71aa82d2896353aa0b085aa75c718
d113c89289dc10e2b3f75ad340e5fb3a021add4b992f3a4bba3ddbf8a92bee8f
eb6e0a59004c3c0c6dc19d434ae6adb825cac275b10399d4038e23b513417616
1a62b3b0663968cf95f28075ceae66be6be4daef9de3bbf5046c272b0fcc61af
2990995c41f3d5ab189b9d4eb3756aea342bd17bffedc1670e44aea885862c91
3eb4bd05afcdef37c6712767bc985e602e768f7cb20bb218a92952627f43e55b
060fe885cfb4957bccadbcec547c2ba5ddb851404a49b1ca5b27a6381e9c608b
111b11726f1c868b21cd040766b1531cc2b00957df1ea788d71f14715c6c9906
af633bd6ad0559700e9f52c308582b0e62de826ccfa9154822a6c3d1a7a0ed0f
b9244152e7b0adaec7e1fe72eb0cc5ad4d370d8789732e4dede163e6369d9d46

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-22 18:01:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
2f302690b0aaff3466bb341ea1b7021fdb9040df402cfb7f74db2a6799c1ffc0
4f70ef85b70279e499d665d292b486c2f3efef583c97b30f37841f60a7815b3c
c1f247af8e622f5f4d206b2a06c36828f75d77fc808e91708fef07f349656cab
2c2a13e65703deb11c645ebd69f0001e647cd73db8bb89367786701ada11a794
f40006f93f77d43826014d51126b5e92d5eebcc98c1e908caa909aad9836fe78
272b5f08b1fc608eb5505f254102a6b5e12272bd4652d27df7633b5ad67022d3
cbab81bd449e4fae3a483999cf55ac7d419e3d58a0335356e12653e19bfb843d
5b8546968f17de6acfc42c520d303b8f27b5ad4b407ad5549855126cf195c4fc
aac58b552eaf2af0d951ebebba37093b9920d55d6d8483bf34d814bec014275d
5dd066d2f078cd782e4d83b8fc17e4c3c77549a1a2d99501a73e10e4c9834a0f
3a47c3eff4efb56b40a20c4d46660d1b145521ef74ee73fba66f879c8dbd0053
2e43abe410ace7b0baca1fcf7c7b734456ff49a279d4f27636d973ddbdd142ff
2bc9f0d1cc70797eafbf6a0ed042a87eae4fd3834b6e16edc0bac2d3ec1c414c
4af8af7566b27b6a1af71d6a97be6112e4f306eaaafdf6245e18e981507cbd80
5cdfeb44bb777e446bfbc704700841e5716b33b198abc139b244289b4a001b42
ad9e75077d3219eb3b339842546adcc35319a6fe3c8012b50a1b081f740d1670
1382d166140fc947332563a66465af39252a3af2d745664c3a825dca15a062b8
4e786307e2871b649ce7359512c9e1985a85edace0a0ef1f303483972b3ca7eb
be5c9dcf64999e202720a2575e45cf1d29dc96ae6699eb6e008fcc6d5e2234bb
34c0719de0c2a33e3a6f8bc3c2c401ac3238334b4b22a2789e6c1841b41f3d22
a1107c0f17eb8a82444ba32268681e659a977e74a5e37e0d53d707a0462c25aa
e4d1551f3f7a3846059bc15541a56014dd17263321eb5d343f78aaf08f2eaa39
62c2091a5e1628dc09ec3c50ab9bbaf8f53d1e64edc3fd624bb0dabf0070cd02
74f07f70ea0f276023a6ef8c3ac5797b2e678d98938876c8de6f9a5ecc27687c
55e50d21545145456425d036bd88b9f5ecb0474332d153cc80e0c8674760a81f
70db645e055cbd0805cc42c1f237eb716e3119f9992ad7f66d8ebb27a121757c
925fea58611e4858da119a98827ccd40885156106b4c9a715ea9f7849b39f3d3
15f873614c41eae16f972e18b77c563654eae405963924f22e29cd9099a5dcf5
f13b7d8bec4daba478c07801cc968f723fd50a463712dcf98ea2b6515bd16993
9f8ef7945102b95feb6d81d8e972c6ffe23c168d6b79c8083c7ab93cf96374ce
0ebdfa79fa7c8f16d952085b0782534e338465e8edb043d9aa2f175bbe4e62dc
306fcb518e80bc9b2cb4e50d8938e00efd38a60a840c05b49e82de5ba6105354
4bf1fab7259b8f05467c067a63e8ce3d506f424be4964363ec892d3134007adf
2aa5b92ab1888e6ede4e7b4cc35a249fd94df6f78092e3d03f1e63287b6348cb
7a90da71844c2cf3b3923c48120e623d5a1977de4bb903857e0677ae1b4414bc
f38aab7d707b88da457d15c90d53918b46c060ed50accf32d7d980d321e98081
a04ae44598fdeb27c5155cbd8552b0fbd1c61e934ddc6b5014a23f998b3569d5
8572f4c8c186b629d0bea6095a3e2f3e69af1252f43a9804a97e1a6cf0bd5f1a
ff35902999ff768466ac70e0ac6f10049ba2e3363a231ccb917e122d4a87c247
2a71e0203713376f5c98730bbf259d920d350fda24f6c7cf3c157053fa8552ce
40425470c680e22914a9d405cd2aa8eb51007d5e8bff29572dd441e4597ef58a
e718b83989a52f9f9c290b54ee79750fdc2f712659864b3cbb569436dde0257c
0613502a5dd92900dc77b5a09ae31e05759533d7518713d0a6c0d29604308325

http://mercalzado.com/ib9j3yx/T_K/
http://www.camereco.com/wp-content/languages/yW_c/
http://kianse.ir/svsvbk/bz_QS/
http://dqbdesign.com/wp-admin/ee_YO/
http://ongbrotar.cl/wp-includes/M_z/

Creation Time	2019-03-22 14:08:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
634ae1d72084cd2e32ec48b8f7a6e2b1153b2871b61c690d1dc128dd1174c39a
98f1254a9dbd1c2c77dbdd2abd3f31d346a384ef12fc0c886f7f128ccb36f585
4d0c6f8f87f3739cce92c608e00d89c67fc28d3de377ce5e3d5a249275f8aca5
40c945b9c3126b2439517d67ed0337bd3d83cc49c24a1eb58d6180ca0e7ab044
931a1116054623b9e7d2e5c91bc38411022405d210bafdecff94dc4bafec0aba
3e75d5232b9e43be06a66f7b0eca6fd742a39bb7fa7118a3e56937d010fa7bab
30860762b0f707f4dd3147b3975409d79bba9c5bc26d0c745c429fada906c1e5
dbc81f70d77ba2d6f381ef0ae449533a6185e0a99e8a0c8a50cc97d46c641ba8
1513eba86e60704e774ec947cb9ca7e388e248cec16c00804a4eb428df2eecfa
f68530b5e431af7770f354682a364240f1af4d321e20604c68dfb8580d98f99b
1b98899b97f0533fb3c3960fc2492ebcb42d4e9ee5bbf65d902850e24ba197ad
cb8b086cdce68e562282e14afd535c143f6e7e4c8e3c6cdf55e2b585d528642d
f58f1473373e696df466838c90f0b22dcb0fae4b2311d77656e5ad2f251de2dc
ce2da3e1eb2ee0ee2607d436abd946c7f15706f2638339c8b56aa54ca50811c6
7c9354f5fe14b02fe97407074bec0a238a1dab10320a16c2f13a2d49c9917848
5a68bbf45f70df757d3cb5593c4b71defe4d3ee5f6c2bc4b6346f3b0de162be0
df9fd7ce7bec341c12f34427851845c4a5d36eea503a0f1ff1e0fe6350d52f45
32d638378279db2b770364f09c4f06ddedd8d473bc36044da1abb3dcb45e7630
f83d5d6081c38339390256ab4c7cfc033e1eb67c77179281153d7f6c69f76fd0

http://www.plantationslidingdoorrepair.net/wp-content/Fz/
http://gestationaldiabetes.eastus.cloudapp.azure.com/wp-content/2F/
http://urist-advokat-mogilev.by/wp-content/XIBe/
http://ariasms.ir/wp-content/RM/
http://doodleninja.in/wp-includes/KMg/

Creation Time	2019-03-22 12:08:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
8fd7cd30ac457f6db842f3e11962b5507278c8c6ddeea12bf8bc0b9b456c0734
98a153b7ae621df15d695fc659de6d43fe09b243aa69f52410b947be22419331
a3af437b48617f2ee2180c69962ba2387beeb75f0d73b9750158681e46a8d3ac
2f832241a56ba13c615d46ff22704370ab8304e7f7e94b0ae7c6807756dd41a4
547b1e08a451005474344e7764737b22e3649172797be664aa31dd2c6a6cd15b
ab68d277d0c99ca0135d2b12ec1e311acf8312a3ac7bc8c2c9e097feafc676ba
8eaa97068eebac201fad10ae4f60ed104c9a506a894bc6306b980f3eecee1d6e
02cdab8f207602d812213486c3f71dfadd329e85925d0f0587fdf245486e368e
84c306808cad03604110604ac3414edf6990c703ed7cbd9970f8b81e326e0fbe
c3d7926e0ab4ba48a0406232ddc016f663f093a4254fd9e022940f4cc7ef2a98
807cee360dd2af6fe52539765ec51e527f71533363a9df9556c92cbe098f633b
f7a9789d8abe13e7844f176c5242a38d9010fe9f9ee78af2873895dca8df2b46
e76f7895c02adfe28bbed22afd964e544832f11dcc987ac30517889800e20a04

http://www.plantationslidingdoorrepair.net/wp-content/Fz/
http://gestationaldiabetes.eastus.cloudapp.azure.com/wp-content/2F/
http://urist-advokat-mogilev.by/wp-content/XIBe/
http://ariasms.ir/wp-content/RM/
http://doodleninja.in/wp-includes/KMg/

Creation Time	2019-03-21 15:07:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
2ceff8b964e28e3e3e22cb5402388d1579d1775d69e1566aa3651304db09d291
b3a3e2574dd7795795ce69d2632fbe89faf9aebb62ec3d822fe24ff4b5ff7fcd
fc2a637fb3dcdf6176a7ec5de78e4ff7178e69a3ee79058090b810c05c11074d
eb1da76dea426a3883d544944e7f61a101b38d8d631376f80e7348da0b4a0d77
de7ee927c05756d507fea20952d39a5b4c450edf5af4cf26438af6c7950fd02f
a2e4f1d11f0222ec46429bc9ed9af8d30bdd5713991232c7dc01e3f8d859dc53
938bec3c96ece76474ce55f056c692090556a42474dcefca9fe324ae55b7422e
88368ffbdabd464e62e5c3ef635ed4049abcc515a05e457c9b75d8f7564c6b39
d1b1d5fcc932f610d3bafc19b4a4ff22caaf8d2d07b02bbc4aa7d96759f681c6
f350204912353f05749e5650f5af6d2d6997412e66f6d7613ab455da07fc5167
6b11d4062b01fdc2c31388bd5cfde91daad119bedd2821df9ecb15e61aaf4e39
f84cf4b2f74d46c278336998cbdafc4c504d4f7d92159f3f544a56fd6efb034a
6bb9d7441344516184ec128484ac936c598bd6e97a3d0cafb2ce9ca0646b648e
f37ce648dfd725eb92b0d943e76fe4db1ea99a0cee807d9e180772267aafbcfc
1927493309e8283ca5acc7611fb06ed3ba0614a9b9ee58e42f0d05a39e7e9330
c5fad6bef7050c279684827049a54939186a086fce741302eefd9fb437482ca7
5b6b7894bd61356eb562f86f7b6ebbd0d44bde0ed133adbacffe224ebb53b1ac
969c79c5d5346f38f74342951b0bba068af173e699eff0a3533fb9846e4dc5e7
874eef0cc0b123ec06f927f06cf9edf3a6756af2eabc69403070a34e39a4f959
c9ae0d5a5a3ab98891987d3d305f7bdfa279449a3bd5b49137216890cd03cc01
cd15d42de2ece59aa7b78ede50c2d3b5297f7637c928ebc92d9da2f56f055d01
2178b5e7d90fd60e0830c4560bfaae3e7f5c100e121b5b097b5b28697e1d27e2
d9f98b73769e307527748556add720f71670140251908205bef755d6de52b71d
38a1e31b2486dd7b380d0ae2a2be548de061c180006b542ee32c1aede08b26f2
6f0bf1f1302c4d3bab6b0a34c4374e84c78581bd2bee054a322908d897416cd3
12a2532da58f7b531bc4d06c2c930ddae87b1e4a92d3d007825dddefd28431db
6ddd5a92f5bc648a1d993499ef5619ede9b68ece256ffdbbfdb4ea77e7bf837b
32bba2361b24e6a130d3f0bb96528a08626648897cc74273e0f977f73d36de0f
1b700680908ff3592b0fa5400c81b73e54767f7df6c355a7e3c87a828fdda377
6d2d602a59c9edc9948b32166a1f2bdb1a6616a19b53aacb5871c42d48bed262
25f619d5da8eba95097b9297217d9650f2ad34563e91cb7124979992826632e7
809489ff00ea233b9e64ceff56da7aa6c915168614d1f2cafdcf4eeae3a77c55
9de183ccf1493fd4e592f67bfef4e8ad01218f866d5812047338e10c5cf79d23
d3d4e794b15a2758f70a49f8ac1e8041a321aad86b7f158288dbed2f48ece7e4
a3d5a4e7e08c0ac7f90688022cca87fa108a83c454c2a83bb8f481533016761b
ae3e15fb81937bf00b3a36785e0145b41bf8d904af7151a7e8abb0249967efe7
cf27d0eacd5aac3c82c80e60d73e185ec871b5350c8118f2d5931c02e4db1b86
620f8b004d9025d11466ac548f07d0826ea4aa7ea78109d5dc91fb403a64af02
9c77f5abee45c5f577b4a4478c579fec7564b5e77e8544e08ee108def1c46c50
44d855d2d229adeebdb8ee1aa67cf53254ea12f5f0f0b1ccda9eb4f459c91c0b
b21d6be1fa45da91d16e9197f7c90f2d1eaad52f013c436d6fae5d749c746d3e
1e51a7dd4cd77b24a1fb22b905f05f4ef2660e8c0ff7186cbfeda91abd3ad7ed
533ef1d2270013663393a29a5864f84793f8e9ed5024eb291e83b4559910e890
3b5e01ebf7933b62e9d5c9a898c02d24c4334bdf2a75fb7910994ac98d5cc638

https://hechizosyconjurodeamor.info/wp-includes/FGF/
http://siamnatural.com/tmp/EmC/
http://chefmongiovi.com/wp/yigA/
http://simplyresponsive.com/samples/3I/
http://visa.org.ua/wp-content/nnSZ/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 03/22/19 ####
```

5a903896dc891f1fdb01b0a23fc8cccc6924b56b12d9172293287cf180d63795
2d84325d559da69677cad0f104e34c8ea0ac80b801bcf18dcc5069ff1c1d0644
11b1276804c4e85c600d545a435da79ff49fc41d2f6673a539e8875e39457282
13aedbbbac5641a512239f6c1f400350d4b0cafbb294ec5d7c832be4c5bb1e1a
1a0fba7de614009c4b4d75d3bd8e20dcf92a561765a8c0d8ebe3a2eb5ed5bfea
bc7b60ed6a96ae9f08b1cd7032f6ac985509afd8f1db86e3e9f7ee299d5d3ded
4a5ec2a1e0ccdfa246e5c82143a5829907e08a52247458b40ecc6f92e1e4301c
9a99b414e2e3fd39d36ce5200c63dcd48e00fcac24153d64875cae48397081cc
394e87edf181909b37b88ce39ed56d41f8642ae3a1a82ca58ca6f7fd61f1c3eb
23442bb69aa5660c044514d757fab48177c84e00bc552c4b49bd7763d0ff6d96
cb82ed05314bfb7041acb9e02ee55284f06cc496f64690989adae6e710c2c2cd
c442e5a44daeccb862cc0fb62ee2d07c32859b4b9b32a434e94d7eb167d255fd
50e5303dd3beb7eb73fea61ef4e45cfa39f2fc53a6edfcbb14b1f80a606899c8
8a2df21008b3b145ef4db8217c663718079e77946894ad0928da093094da2d4b
9443e12df6418b81a3a67127863b2563d424bcdc873ea5e922695b257f86e1e7
b20ff57784ac081e2a692a319bfa164d5f170aa1f5ecf929f2a476b885e28c7f
c59c208bae30c50fa289e9ebfe79b29ec83beffe3c7d7b905fea8ef9aa632ed8
11b61a233afb6b5b504f8b57fbc8ade4d9d8a1f3c175462098a45eb9be6cf6f8
5209b009c5b803acbab7988cd566827bd07482afe6e65327a4b31f00aa8084e4
faffe9e156153e7eb693265aa456e586da230d3623e41a9c252bfb9c16e50433
4c7198eb8109aae91f7ddf800f8f0dc9d4d5e0b1a858c3a72a3a614f27bf6844
7c89000216f89c42e7d7737855d50d80f67075fbc8a5321a3f766a6447d7ce00
81928baca2541a21037ae041186234aa7081d10820c84587094ecae3b23b69ce
3460e74544750e3ac5fb8a4ff1f1bec41a00e5412fca97e9351c00887314fd91
822a0febbb98db2ecb861b32e74109b7e19e17ae657bae2745b4c7ad8ff74b79
cff9d38ecf406eeaf40a174b39add4613e768188a5938381aff640180286fbf4
a69369621a9f902c43c34531906aba95c1b54da151ea6bff28abbfc0136d5016
9a5bede53c2b65890d2129a81efdfb60702f9f7e81e322949fd1d56f95346b5a
9a955e2ae5be2ed5f7417055ca4a961511c63fe3719a55a06dcfa5eca47c6c5d
49294c66a923a003e867290f99a8504327f3724a548b32006bbc0bca47229c1c
1bf0af6626f17493ecf556207b20334f3d30a6914e9aadf3052c78968c6eea6f
ef4366d075bc2092c7a20dd31b17d334ff6a738896c2484f866e6916dd73293a
423698f3d9682bc42238b4885166732761eed60e822cc25292a66143a2fcd34d
c45670c78862706077e9535351ea5e1204c9750097fc88f2db54081041cf213f
30c9713f4374fae0d5c1e03402ae82608b3c115d8ed3b2609da888fc9da65785
e2eb46eb7ffdee44a39056285da2692ace2809224e093e6eef56878e5c90e73c
858a1358ded6753fc5dde7cd1617b2e6e17b7e950cedcd36266bbc726ba489c7
fa8d5b64e92358b5b22c6345025f724f193f495ae0575e7303321b2e714c5ea0
aa8c63273f8f026f4e7b864603be7e2935a23ae65b4f5714b7e49b8555d5f874
5136351e46aba10b0e6e2da9c13744709e7e24062565b31285a830874fa5a66e
0f170c2950a0bf84d4bb07a1ef2dfda9a39b6402c3274995e18375abd72d212a
de3c2e0b0e638900b845590f583058659786da30781c462ceb84277cb583c1b9
36ae7aef2c3abf8f70ee21b91341ced9d9fd5a3132f9fedd776e2c82a662d59b
cd28829803d293a6a08ef198ed205f06af18055cae6de530fa1351ff7edb56ca
ab1c123918f4b74a3c41e7970f4babfd486faf033d0390a7fc36f6402b53c474
ea884103b0ed07268adbff920b0c967b22cb420d6c8d8f919faaf0afb86a1c90
8c4f316bfb521a0f67673f4403dd512e320c095e33529360c50a080ed8859405
7b01124242e41d85ac188b9d8b99926659f76dccd27f0844c397ec060708c6f8
f9d20bb8c4a2f29e0d41867ad55eb686cdc46e823717b8dcf19892a9e27dda2d
183c76680738c0736dbc963d5904cf8f2388f36910d3d6dc6151d115380f9455
bc338709ab20615cecd64168d875739683c3c4b5988586be40ff726dca9e249c
944b1c184a14b052c51e66f44a4398fb3b1957bf589f3b2aa1a4f5b93ba819d6
cb4c0f7bfe4bbd4395562e1224814dd384951ecded3ec05ccb866fe75926b522
84e5658f7934cd65be5854efbaf3f1dbc20696a94d4f60bd831130cfcd7aba70
35cd0d580f646c7a5b7afd785936b57fbb50765c74ce8c1eed89120b8b0ae5bc
121cf720962dec7254d2018e71762c9341d477f874108e09b3bfb93365426fac
5cdff3733c746faf24c45ebe9d20fcb7a562bd525998412ee5b3dba667f505c2
6465ee81ea189b688305aed9141e45675de49209c277ce0c6e2d54e53c932e70
ec01e590ecc45ec40cd0160a23cb7e8a5b87399fbe1f47f8e2750695c5425685
0bb08e2e5ac792ce7ad71db7b97b6daca459167e115b0d9d3ab10a24715732ee
8bceea575c0516daaff5dfbcbc8bc3b16c50930daa40c7896f96ad1733875a06
be7265e7621a2f1cd27bf7125e8ad94fdb22f97831db716e5d62bac06970e089
9e4939015f917e22117b3a34fcab0b5a80d98d249d66a15ec17a99acbd8bc91a
c1255f9a2277851351ef9dd7a77aeb38563310361904629c48b9085d3cf9f873
f6d998935822acb3989d42eef9e38747ebfd2affec174392965ff629ebba2e32
d412929005cb57f435ace39740de7fc288f704791210b9827d490cbab36d1803
dd610686112212de301fce3426830c881c468116cc05bf98bfd6f2f31d5da43a
167651fb065250e0bb4c067f01e970430807351576a5b655f1868537f5dde01f
85cf6a59c3f2b2c4340517f25b99705b540b4197b61ec838e629ceab8749be8e
17cd017dd43e5c685bea7287e5d6a312af45af133380415cde0c9815651a00a2
d9145797e5ef112409a2cb3f91e1fe7bb8bd1078138bcdfc681ef24f815a141c
dfe8d7d59f507be2f67d7f7763273e64fc75d6e1e9dfdc04b1e30023c8c6ae88
1551d5aadc0e98437ad5252a9e3c1346b3fc65a3bd3ee445ef910e46495f702d
cd6e2c3cd2dfe204168a9ddb3f1fc7afd49c12cb16fd29ba46d6430fa10bc53e
1139ac1409b67a88fa512038134f9bf007de22edd75e2124cf0956cee6f43177
b8ea99d0657dfdd950b5ff8cd38f989103aa387113e2364b8dfe0d3f7fd4a653
3d3a0cd1d5a5603249ce110c03a4df07aa0ade261ea62f532406bb5932350b14
24c93cb39f6dd4b762db5e5131f819e4538ed501df45eb6293e0aadbef696874
f0571c4898316099baa21b7cb880a54c727c767b7b935a14c64151948001d8fd
6a7ae2481b591f37f2247550f961c599cdbb75abc6d9ef8b68bb3653cd42d1b4
c557bb202830c0532b0329ac36f5dcb4fa14434d2f9af693226d58353ce9f25d
1cdaaf5dde9fcadc1fda9378b991181fce292f6a66646a9cf243acfd68b82782
cdc00024488a64562b75ff25c45971a9b795bada45f9507cd3945e5a18a81ece
3bc69b190045f1154faa06ca1af63bfe9cbfbf8dc9c5629e67ed25b33589e7f2
aebf851637d5f32fa5c0690d7fde85d4719be348ed1810e6b1e2d58a58e7dfa4
99a17e032c993a0a2be1866adc2973495007e56f65819c215fca4deba6066dd7
d7aa3f388651c1edc2b1dfc59903123eb07a06183e6d401fd91211bbc1fc5006
c394cfa9f9d3528d0eae58febcf4960add21bcef04c22ecab5b5f2d2341b374a
953655d3e819aeef875e03a6da83e051933f34372060e4b93888f1c8c5a34d84
d5eca8a816ddbfa58885b9ec6ff4b95ab8cc19d8ade6c6f01e3171d6c152ebb0
6596ba5d7024fc197f32386c8b45a3829b99c489b9e93da74e9b4eade3fd67e2
7f52c551d657f6cb12f1b0b210ac02e5fef4ebb60701013af1fc978ed9421782
c207675939234e8b67eb7a52a8c97aaf992f50782cfe5f77fced23f7ca0f900d
bdffec5fb459c96a261ffc4e17ef4cb5307546a04e400813214d40c7eb37ae02
755bb5a39a816239b9af2e05b2997c7b0396379eecaf4dcde6ff461df6c28d87
3b3c49d4bfbdb67f02d4b075863288fd7c097285b6d4902313531becfd03f916
b6289f203551269f2f11c116fa943a80498c637b157a830c49c6c106e3774426
6fc5adee7a5f35d0b35850c1313b6bb397c9bb40c4ed8cc597561194dc6ca7d9
6f7f10fd6798eb34d4eab7d2c0c8bddd5330249d22d8f9f9cdac8713a01e5c50
4cf291be5be886dc5b413c92988c03618e1db0b2c8cb05775df3ee90cf70028b
a122d691ec9a6377a4727fab8dc6269acc34d7e259eb246693d6902a2e4376df
0f736d550c055ea64571f8e83802cc4668ef79b220cd915b13cef7e02b4831fe
bb3156b1add28407f2b2e9e86308fc4675dce1624a3e429cc9d498891fc55824
67866b382ef0a09cc62868c641abc1262aab6bc207cd283bfaf23c373ed6129d
68107497423eab2f4f704ce43f448e86038bfbd108eab47d8b45fec97fb70b14
25459a6b6c97eeda465442bff9e1d88020149b9418c928b0893147114d0ef542
dd29e9b96d9e475d97b59cd527a4d7e0d9d567c9c4da798c410293bbd40a038a
7ab571c1f77fa14f5e254dff31b237cfe2d71529d1cc5c97b787b434aa0a6bfa
2438ba173066735a170497e3f55902c2a3c88055669443d896247bd45d279152
6695973a7c4348eddb880cfe3148bd623f110049ecef8e6e72da0b117ad7d006
8e8c518291fc6a95f2e0d73d4948ac94a18a17869148ad68378c0058cd9bed49
bcf2775323ed167c9885d0f80b0a750c9fda5c338d8a820916538aaa2db12235
3de43e84fa959efd5d05c54cc1708cbf79bd739451b57659924158cc36cc4370
407440c99449f56ff7cf055e6535e098fbef412881911b64a2d910f4bc9225c1
cf4b21e41c083ada74128c323f8ad34a308e82af0e3100b1d03ea0ad95f4220d
8dffa4eebc88d2d73b33f04b51129f5de64885288248408b065f79db8ad30d67
780bb88b7603cf471058ee4a5d88a690f3ae6e1a8d4373f392fecd7a34b36b96
e5a1978de6d95498df5e92834fc42c74b40ed34b004269b5ea7a90daadb573e6
6135f8643a8911a3ce8ba27be8aa6f93e6d749225cf0c5eb175daa0ff92ec9b9
9146e6017fc0600c31a71c55a03f869d83b018dbe20a471cd7e34a0d80bc722f
208800a8c416af804c3b164c4b108483cec8c88ef48ab90934bc78e8a7b80c37
ed5874db43aad92fe19d659025d36635db81a6b3b1819a28da356a9df5b7c5a6
164ec9db93aa516b3016e7f35c4542f8c457af62ac0b2330a304eb0defaf7de2
24f1fc3a78ebaa0435b53054fbc00cc835affd3ca2066160386c5a261d88002e
1318346d32849490611b6e7c631ffc755e743548cdd7f3602d1eef46b9b458b6
dd701d987c9e6f920dd1df6c6997d962f8d1b305c7dfd20ec2dc8f1aac0fae76
6b43de57852eac97ec3ef355e26cfa3c3d3cf6e908fa6a76310f9904021831ec
dea053daaf46ea13635366875cb05561eba35e75dbfd056d035f7918848c8e63
4bb00850772fe6d5c2ac341b213c607428df29b6382cb3cddd58fc4901d38819
6d652e2e3d3e5aa23a4eb5b5df6f3639828000004dad936a39ce77e42661f4ed
5d6e310dcabadc98d5a6ce0550fd817c5af08f8ee28d6978a7328526396a7934
96472ddecbe4a607a644526c3bb8d215d4b0e752ebdc6e98bb20aa0f814fa1a3
dfdfa04446810a069c5a6e5f7509ae6f9ad29f27ca7ec5f1ef76abad47072a79
4c1841f15700f1c2352d0243708e37bff150b337a712898a3ece9ee7eedad61a
60f02e6ad6847fb9522fc5a064fd46dbf94baf32a389c95d70c9db625e1cccab
985a765d644d126a4615d64a33e55ecbcc6e27f8e033aabcaafa513c43d3fd69
070d83cbb948257e733e07fbea9776d517472d5f78b9141cc45e7828fb919b6e
59b37e0e8059057db1080c6f983c6b47675ce86f7a71f2c758201815623ef1cc
39d39f0ac278ba737ea24368ea54c8df27e2f033e9fb0000c74cb268bf22d317
95a91bc1ccf8585e5f72d5b7ecfb75690aa3d7150f2fb1424dea7aa7e82b8bcf
26a2a360454d48ad8575c6cb133a068467be84899af8fef3d153d7c4c9ad9911
ac2e5e0922ca30ca1e7a762e1d8d97e006fdea7109ff1195fc8a20a50386c7f9
a0421b82fda2dd4a87afdf490ba5932083e0366373c7be74bb19bdbe426046cc
d9418262fdf5dbb26ce5dc2acf11131c8b293a6465d935cdef51d638bbd018dd
e85ce9d5a247785ff7e9a11e743fdd9df836b4ee2fb3d180d596a1b3ab3bf58d
a855f198d5d4724165c53754791088027b82be6f6c190aa750bc63610c28e9c6
39a00b5000b3c32be3a154c2da37836f1dc76b5fa3b64c736eac04ca04738c9e
6c0c8928e55511e1a307006dbf51aa0877d1242e4c6e3cdac397cdf9512828e5
3091fde83d6ad2d3293677db497478b9c5bb3b1963d55d118ab2a4488e120996
186ae048f50942db723816fd603835deb024480dd5f5a28fa8ec8f1892d1822d
3203501c8bc635993a3320c268708de16636382583e55bdb3cab19eeaa891b07
c24ba9ec2fe0e00ec9177c4594400c22e3a484dec5fe6674f7c93d1b382cfb3c
65d1c9fec44af72758d57422fa0f58d75024282994a765a0637ca934c0ba7974
a37cebeebfb9038bb7c1326b6413bd0f37b4bc645f98f8e2801aaef98f220265
c6dfe0aa9e4893e82144d5dfd2d0dbb630817de88352c8942ca17691eff97a68
ea02f5e8afbe4d5116e70a41373570c65efc749b9e7819eb3e21c3926c1bc2e2
c4b0e7422985fde0749e27363c85b09bb2f240c165838eeee0b2123d51a64e9b
ddcaf1115d914d2f682110fb15ed1fe69ad497d26cfce6e3fe47ac2c62260491
5863de41b9abf502c36b6d7b19f3ead544ff4ee54cf9f42679c31b23711224cd
2390f3b1101f95b9d8933adb9ac7ea9745d8b87b565a1c161fd962413c05fa65
c67f0ee08464cbea966c8f11164895e7b22e85e11a64b06e3b7065319c8c6e20
c69eb4074c497025aeab7db333848eaf0251ca0935361090919f0ff17bd55e97
76829c41776d1b14da634b0576b64fd175da93d39e54e46b59baf781faa30161
a850033ad6a401111e12ccf3c7563d5bb2bf603bd16706eac1d99cdb8be4cb65
80b44db307732a046eb47bf4a0ee8b5eb133760c4aa735b2681ab646cba3ff42
ad7c14ad542cc62fcf78fde25ad70a0948aaa72e69b439cf2735277e232900cb
a19733cdfa9da08ee1af69a09c83d1eb950051d4b41b54f55f5e2309b1789f0b
d90d329a634f8a511b068fee200f3a6e5b0417ca0e530261828a0edd8452324e
ce9605942bad475e783e469e9676dd66ce92e014e87e314ace3d01a1a506ef6d
0907fac554c8cff4ce2f1643df1fc7debf565aaab917554406de4595a68ad454
d4b1383b91935703e8cc97b55d93580b5ea23415e8f0aad2a024b8052641a2c8
3754e63381d20d57686e134970765a0a36319675c67442e7b3dda876e4f5424e
5f8c4caff70f9c974041b0c6c403aff1037439c4512cc08566b11ce9a35c07a9
390348fa431c7ba32536dab122b31ed1fd5b8a81f2d32a3bea29847772a996e8
0ff981aef9c239470eca9c3b8495141e0159bd09d88082647dcd434e48287473
7d708e088c23cdcdb277baec0143fb6050fbbd85c78dd77768ecb693a27084a0
4064e83df049bf723c2161d947afe783cdda68edbcdc7f45863fdddbe763c9a1
82100e00a4bc29e35a19890a28e34f211896fa433d6c7b249d9955e5d1009f7d
e841c4f68cc12fac0537e997d06f4ad48477a7f9993c6521785087d2a9458055
61f5b914b2c90f6266912fcb6df488bc7094c7299a9544570e2c313f7046c40e
54e5952c86e681bec00f27506e0dbe0b6abd56cb3cc09cdc9a4dfc4aa959077a
8af545a8b2046b7516e6a797f98194ea60f2ee1c95cb025e4777ef86e0386789
5437c0c6e25eb72e75108f511f778372525907738d60ff5f516a1373e265f221
77b35fd87c5754c2f612253d53728581892ecd67e018b73c30ff244befe0ed2a
29de9e8843c8933d8bca4e016088f0bb6030a6d8d2e60d1c19f1ade8e1e82976
678bf06e9fc3fe52cf36346b6dc482f3b6da9faeeaeee2c2a755e3f793cb2856
2e9082236b374080bc04e23723a133c94d7755cb526233deab7d345021acc568
3d0a893421ea71d612a0fa74c26de946741ec627651117962d615d2ae9b502ef
c60c4a25489ab0ea8f326514cd0b02b94382fa6a19697be55f7bdc37410b1013
407518df4215a038471dc7b8b00e07b32c2f25d604aa85259ede2064f6ae73d2
5cfd52ce1104d06e0077e3dae3d72098b2d0bcf70fb2464f6bb0152715df791d
7a9cca4d1c52ea4bb359fe2535f9f3137931f74e66cb886a9c87fd0cd0229561
6594e83189d638342f2851090336b6d2ee81fe39d352519be5f2935335a26c4c
fae0d084c9bed28b62469d889181f3d2c3a74c67c503c67a4fa82037cb85d3b4
9bd25876e18cd0794110323ebe4b8884b6954a2d3f85beed5753367fec55f0a3
2f5e0e232d2784e1efa5c891e501bdbb7ee1df55c11a144966d45db477c2910d
3d532fe9f51590675edec97ac86dee8335de7890f7c8d0f234b029024f6a940a
bca45e52d4eb9569eea4bce83df5bc016b028076aff0d776d33f876d1eba1d77
68e048b8770f57a04f98ddc5798b4698c0066a03cfb7f3d68c267ad930a48643
f9c4146981d1138a4737db7e73a8beb50ebf9e362b9aff0a95d360dae5318223
7bd35cc6bf62d5ebf47c39390ad548b3a5eeb8be2baa4290bee6d8a73b9382e9
541ecd26034a3d9b5696d177b044fd43a9edc689494db98029e6e5d25e5d5d21
3559a2bd197337efc92a48079cf97bdb9b083a25fd08b0ff922c2e0378712519
60b2477953ae3301fedf20fbe71e74b2399a98b80b106626912df59e614f8ad8
a3907f6c0390f548a32395016a029671ce45887cdf48ba5181d3af99493f5d36
89ad20663137bad09501da5b5a69ab8f66ee1702223ed8219c8ec8fd448df973
5f44d7139540bb6d384f39e7193bab1900d3486d6d82847f6a50344806769d40
55807c399f14dd3251836df1259b04a5b00261b302bce8cb8af26a55c6cfb97b
1a74ecca0c4848571a17a99179fead68f467837024a3941abf225762bff618ce
ebe7997905b1ec31a780e162f48ed081d43168ef1886a321b0cead2f0e7c392f
c09e4b1149ea60875f2c68ce2aaa24e8054ea1dd3738b6c1ea16fb7a3f8db518
67e5ee2dd30daf198a6760f8aa3c32e41be730385a14c0da064a12b0593f5d35
748d7f8ec45d7e6583a28e71138ead6dcf0d992d7ecbb90f0900c8476f991c96
124e46f3a9ea9f5533f9b2fc02756cfefa8571522bc9b8a2ba4af778a506e659
94723c995bcdf835aa76676a5f7eb42700a9bc604e716dac62fbef6ea85361cc
6d0da82235641875a47467c6b78ce04f23e79430a553db5523e3f300c665458e
c5f9392f89c01f7cfce913b1d0846b67f0080e94df7453cc5d3cf569099875fd
1f19b89bdada8c2014f0e85c4c750654e13ccdd2ee1f6035a78dc94eaabaa776
f14d0d4af0f339b56a529f0f4c80cb9072335e271e71b4dcdd0f778be9ac1095
85f7c992b299374acb1a4185ba3b0eaaaf08fbc6b5fb3b8b6fff852b34c14773
a7ad6f9243018ea046db683055acea186b07ff01df7a27e9498e7467385a7068
1177a3d4bd92efc3a692635912032aa0f74a0cc50c4bdf95da74d4057ed41e3c
69c617bd6db3a1a84646769ce2ec6f81799148dc9bbf5eba59864fa82798afca
eeeac9a9a88e5da673a8a7555dc9703960a0d25489554e4f03005415fd52d37d
eeeac9a9a88e5da673a8a7555dc9703960a0d25489554e4f03005415fd52d37d
2f6b03cd9a87a4a1d2501f5af85ece3d4040a515eaf4d17919f62783d8bb3596
e263180fea9e2353382f8503fdbba00bfd67d161beb8fc1d40ea0707ae430733
c2609ab7bca26e60f4175a0035caedbb37f09698440d2f5531efeb0083d6d60e


```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
109.73.52.242:8080
115.75.36.220:443
138.68.139.199:443
139.59.19.157:80
144.76.117.247:8080
159.65.76.245:443
162.104.1.255:443
165.227.213.173:8080
173.248.147.186:80
174.109.4.153:8090
181.16.4.180:80
181.228.211.100:443
181.56.165.97:53
181.61.221.146:80
185.86.148.222:8080
186.138.205.189:80
186.3.188.74:80
186.5.100.92:443
189.208.239.98:443
189.250.145.98:443
190.117.206.153:443
190.121.143.147:20
190.146.86.180:443
190.15.198.47:80
190.185.241.151:443
190.210.3.93:443
192.155.90.90:7080
192.163.199.254:8080
200.116.26.234:80
200.125.190.126:8080
204.138.46.166:7080
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
219.94.254.93:8080
23.254.203.51:8080
24.137.254.148:80
5.9.128.163:8080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.28.3.120:7080
71.11.157.249:80
71.43.73.58:443
72.47.248.48:8080
82.73.220.225:80
89.211.193.18:80
91.205.215.57:7080
92.48.118.27:8080


```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
31.172.86.183:8080
50.116.63.9:7080

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

108.188.116.179:80
133.242.156.30:7080
138.201.140.110:8080
147.135.210.39:8080
167.114.210.191:8080
173.255.196.209:8080
173.255.250.241:443
178.152.64.225:80
178.62.37.188:443
185.94.252.3:443
186.113.255.229:22
186.4.234.27:443
187.189.195.208:8443
190.211.207.11:443
190.51.51.93:80
190.97.219.241:80
200.113.185.229:8080
200.50.185.54:80
201.212.49.246:7080
201.212.91.189:80
201.220.152.101:80
201.236.95.82:80
201.239.154.191:443
203.143.86.111:8080
208.78.100.202:8080
212.122.71.196:995
217.13.106.160:7080
24.243.101.134:80
31.167.109.122:80
38.131.14.154:80
45.123.3.54:443
45.33.49.124:443
47.180.177.96:443
47.180.177.96:80
5.230.147.179:8080
50.31.0.160:8080
50.80.248.108:443
58.171.215.214:8080
62.75.187.192:8080
63.77.201.245:443
64.13.225.150:8080
67.205.149.117:443
69.198.17.7:8080
70.57.82.196:80
72.214.54.39:80
73.183.131.231:990
78.186.5.109:443
83.222.124.62:8080
85.104.59.244:20
86.98.222.202:443
87.106.139.101:8080
87.106.210.123:80
89.211.201.179:80
94.76.200.114:8080


```
#### Epoch 2 - Spam/Stealer C2s ####
```

104.131.58.132:8080
185.94.252.12:443
5.196.133.206:443

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/07/2019)

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
time period.
Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any one time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
via C2 to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://pastebin.com/grEs7ZuX - @pollo290987
https://otx.alienvault.com/pulse/5c952010afe2cf52626e2e13/ - @SecSome

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch, @urlscanio
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Well at least it is Friday and a crazy week has come to a close. It seems like something has changed in the spamming infrastructure
recently for Emotet and I only got a handful again of malspams but others were getting a lot. What I did get were the same old
templates with UPS Delivery notices, Invoices, Transaction Bills/Receipts. Almost everything was link based and it shows in the
totals above. There were a few direct attached docs though. Some of the UPS malspams were coming with a fake signature in an
attached text file called "digital_sign.txt" something to filter on there.


Today, E1 and E2 had a more normal 3 payload sets today but 1 of the 3 on each was just jumbled previously used payload URLs. The
obfuscation had changed too and it was using a weird VBA that @Unixronin solved pretty fast.

"INFO     ACTION: Create - params ['nABAAA.TagponABAAA.TagwernABAAA.TagnABAAA.TagshenABAAA.TagnABAAA.Tagll -e"

EXE Rehash is still going nuts and we are seeing new hashes every 5 minutes. Doc hashes are more like 8-10 minutes again,
with the exception of the .js or .docx "experiments".

C2s did change for E1 but stayed at 50 combos in total. - recorded above
C2s DID NOT CHANGE for E2 and stayed at 54 combos in total. - recorded above (all they did was reorder them in the exe)

There have been little changes all week. Some like the .js script, C2 rotation slowdown and spam volume changes I have told you about
and others I have not for various reasons. These rapid changes are making me think though that the Emotet actors are trying to
ramp up for something and many on the team agree.
All of this adds up to a need to be vigilant in the coming days. Monday could get ugly so hold onto your hats!

Have a great weekend!

```
#### Sandbox 03/22/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-03-23 at 01:45 UTC - https://cape.contextis.com/analysis/53214/

```

```

Epoch 2 C2 run on 2019-03-23 at 01:45 UTC - https://cape.contextis.com/analysis/53213/
```