API tools faq
paste
Advertisement
jroosen

Emotet Malware IoCs 2019/05/03-06

jroosen
May 7th, 2019
3,874
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 111.81 KB | None | 0 0
raw download clone embed print report
  1. ## Emotet Malware Document links/IOCs for 05/03-06/19 as of 05/07/19 01:45 EDT ##
  2. *Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.
  3.  
  4.  
  5. #### Epoch 1 Document/Downloader links seen for 05/03-06/19 ####
  6. ```
  7.  
  8. http://106.187.103.223/toyotasite/wp-content/verif.En.accs.doc.biz/
  9. http://138.197.156.23/rapidtest/c/secure.En.myaccount.rep.sec/
  10. http://4hourbook.com/SalesCopyPro/images/trusted.ENG.anyone.doc.com/
  11. http://a30anet.ir/PAY.a30anet.ir/trusted.en.sign.send./
  12. http://aalmirukh.com/wp-admin/secure.accs.resourses.biz/
  13. http://aboye.dk/scan/public.Eng.logged.office.com/
  14. http://ackosice.sk/wp-content/trusted.En.accounts.docs.net/
  15. http://agepsed.org/cgi-bin/trust.En.logged.resourses./
  16. http://agfip.com/wp-content/sec.EN.myaccount.doc.sec/
  17. http://aivnews.com/wp-admin/public.ENG.sign.sent.biz/
  18. http://alcam.ch/hochzeit/open.EN.sign.open_res.com/
  19. http://alexandrepaiva.com/sec.EN.accs.open_res.net/
  20. http://alexwacker.com/nginx-custom/public.en.myaccount.doc.sec/
  21. http://allenheim.dk/wwvvv/trusted.en.signed.public.sec/
  22. http://alliancelk.com/kiffsnew/wp-content/uploads/open.En.myacc.docs.com/
  23. http://aloha-info.net/OLD20131103/secure.ENG.myaccount.docs.com/
  24. http://alphaterapi.no/verif.Eng.logged.public.biz/
  25. http://alzaitoonintl.com/wp-admin/public.Eng.accounts.office.sec/
  26. http://anareborn.com.br/atendimento/trusted.Eng.signed.public.com/
  27. http://andersjensen.com/Eugene_Onegin_files/public.ENG.anyone.docs.biz/
  28. http://andrewsleepa.com/pandarealestateflorida.com/secure.Eng.myaccount.docs.net/
  29. http://anisgastronomia.com.br/wvvw/open.Eng.anyone.resourses./
  30. http://ansolutions.com.pk/US/secure.en.myaccount.resourses.sec/
  31. http://antravels.co.in/calendar/secure.EN.anyone.resourses.net/
  32. http://aoi3.com/20120104/verif.En.myacc.resourses.sec/
  33. http://aquecedorsaojosedospinhais.aquecedoremcuritiba.com.br/wp-admin/trust.en.myaccount.resourses.com/
  34. http://arabdubaisafari.com/wp-admin/public.ENG.myacc.open_res.com/
  35. http://araforma.ir/_other/trust.en.logged.docs.com/
  36. http://artzkaypharmacy.com.au/wp-admin/verif.En.accounts.doc.sec/
  37. http://ascendedarts.com/gravitymtb/verif_seg.EN.accs.open_res.sec/
  38. http://asic.abdulhaseeb.work/cgi-bin/trust.accounts.send.biz/
  39. http://asncare.com/61j6/verif.accs.send.com/
  40. http://asssolutions.co.uk/flash/trust.en.signed.docs./
  41. http://atigagroup.com/wp-admin/public.En.accounts.send./
  42. http://automate.techsarathy.org/wp/sec.en.signed.doc.net/
  43. http://autoparteslasheras.com.ar/css/secure.Eng.myacc.open_res./
  44. http://ayushpark.cz/wp-content/verif.En.accounts.resourses.com/
  45. http://azedizayn.com/26192RX/verif_seg.ENG.myacc.rep./
  46. http://baatzconsulting.com/wp-includes/secure.en.anyone.sent.com/
  47. http://bachch.com/3gokushi/trust.Eng.accs.public.sec/
  48. http://bahamedhealthtracker.com/wp-admin/sec.Eng.accounts.open_res.sec/
  49. http://balancedlifeskills.org/wp-content/verif_seg.EN.logged.rep./
  50. http://barguild.com/8192/verif_seg.Eng.anyone.docs.sec/
  51. http://batlouinvestments.co.za/cgi-bin/secure.EN.logged.rep.com/
  52. http://bdsdalat.vn/cgi-bin/verif_seg.en.myaccount.public.sec/
  53. http://bebispenot.hu/wp-admin/trust.myacc.docs.biz/
  54. http://bejix.cn/wp-content/verif.accounts.resourses.com/
  55. http://bestsportstreamingsites.live/wp-admin/secure.En.sign.send.net/
  56. http://beza.at/flash/open.En.anyone.office./
  57. http://bilalbhat.com/wp-admin/open.en.logged.office.net/
  58. http://blog.bestcs.in/avhs/sec.myaccount.resourses.net/
  59. http://blog.blissbuy.ru/wp-content/trusted.EN.logged.public.biz/
  60. http://blog.medimetry.in/wp-content/uploads/sec.accs.docs.biz/
  61. http://blog.refa24.com/TEST777/trust.En.myaccount.rep.biz/
  62. http://blog.ruslanski.co/wp-admin/secure.en.sign.public.com/
  63. http://bluewavecfo.com/yourcfotogo/verif.En.myaccount.doc.sec/
  64. http://breathtakerstours.com/wp-content/verif.myacc.send.net/
  65. http://ccnatrainingintambaram.com/calendar/nachrichten/Nachprufung/2019-05/
  66. http://cdaltoebro.com/wp-includes/secure.accs.resourses.net/
  67. http://cge.entrerios.gov.ar/wp-content/legale/Frage/052019/
  68. http://claassen.ca/oldsite/legale/sich/05-2019/
  69. http://cmroojaichang.com/wp-content/verif.myaccount.send.biz/
  70. http://cnl.nu/tidningar/trust.myaccount.send.com/
  71. http://coffee.bencoolencoffe.com/wp-content/service/nachpr/2019-05/
  72. http://comfortless-showers.000webhostapp.com/wp-admin/secure.myacc.resourses.biz/
  73. http://compunetplus.com/stsny/verif.en.myaccount.doc.net/
  74. http://construction.ultimate-eg.net/cgi-bin/legale/vertrauen/2019-05/
  75. http://consultingcy.com/bdrkm/trusted.EN.anyone.office.com/
  76. http://corehealingmassage.com/wp-admin/open.Eng.accounts.open_res.biz/
  77. http://coworking.vn/wp-admin/public.ENG.accounts.sent.com/
  78. http://crm.ednailor.com/wp-content/legale/sich/05-2019/
  79. http://cstechguru.com/vue/nachrichten/sich/052019/
  80. http://cuppadl.org/wp-content/service/sich/05-2019/
  81. http://cytf.coloradotennis.org/cgi-bin/service/sichern/201905/
  82. http://daodivine.com/wp-content/sec.accounts.send.biz/
  83. http://d-arpeggio.com/wp-admin/legale/Nachprufung/2019-05/
  84. http://daubertlawyer.com/pwksfmaw/nachrichten/vertrauen/201905/
  85. http://dekoracjeokienslupsk.pl/calendar/support/Nachprufung/2019-05/
  86. http://demo.careguidance.com.au/wp-admin/support/sich/05-2019/
  87. http://deskpro.kayakodev.com/wp-content/uploads/service/Nachprufung/05-2019/
  88. http://dev.diawan.net/wp-includes/support/nachpr/2019-05/
  89. http://dev.reptil-web.ru/wp-content/legale/Frage/201905/
  90. http://diamonddental.pl/cgi-bin/service/sichern/05-2019/
  91. http://diegodallapalma-vn.com/xsqMr/legale/sich/05-2019/
  92. http://digileads.ae/wp-includes/nachrichten/Frage/2019-05/
  93. http://dizaynsoft.online/www/support/Nachprufung/201905/
  94. http://dmdloopers.com/backup-1486784774-wp-admin/verif_seg.En.accs.sent.net/
  95. http://dogunetajans.com/demo/service/vertrauen/052019/
  96. http://dottoressapatriziazamproni.it/wp-admin/support/Frage/05-2019/
  97. http://dpsbanarpal.in/cgi-bin/service/nachpr/05-2019/
  98. http://drivedigital.co.in/giftonway/service/Nachprufung/2019-05/
  99. http://eaams.co.in/cgi-bin/service/sichern/2019-05/
  100. http://elitetransmission.fr/wp-content/public.en.logged.rep.com/
  101. http://elrincondejorgegomez.com/wp-admin/verif.EN.logged.open_res.net/
  102. http://esteteam.org/wp-admin/sec.en.anyone.sent.net/
  103. http://explorersx.kz/wp-admin/secure.myaccount.send.com/
  104. http://extensive.com.au/wp-admin/trusted.Eng.sign.office./
  105. http://fepa18.org/wp-admin/open.En.accounts.doc./
  106. http://festapizza.it/wp-content/uploads/verif.myacc.docs.com/
  107. http://fmstudio.cz/wp-includes/sec.myaccount.resourses.net/
  108. http://fxbot.trade/wp-admin/trust.accounts.resourses.net/
  109. http://garel.co.uk/Szs0514JGxP/open.EN.myacc.public.biz/
  110. http://gawpro.pl/cgi-bin/secure.ENG.sign.office.sec/
  111. http://grasscutter.sakuraweb.com/wp-admin/trust.accs.send.biz/
  112. http://hagebakken.no/loggers/open.ENG.anyone.office.net/
  113. http://halliro.com/adenta.co.uk/sec.EN.anyone.open_res.biz/
  114. http://happyroad.vn/wp-admin/secure.myaccount.docs.biz/
  115. http://hcdigital.pt/inversodiverso.pt/secure.myaccount.resourses.biz/
  116. http://highef.com/css/secure.accounts.docs.net/
  117. http://hoahong.info/wp-admin/trusted.ENG.anyone.docs.biz/
  118. http://hotelsaraswatiinn.com/views/verif.EN.logged.send.biz/
  119. http://hssco.ir/wordpress/verif.accs.docs.com/
  120. http://ilhankoc.com/bzgxi/QUDqTuqOEnZ/
  121. http://imam.com.pk/7f80kef/verif_seg.ENG.signed.open_res.com/
  122. http://infokamp.com/edmatvu/trust.En.signed.resourses.net/
  123. http://inoffice.lt/wp-admin/verif_seg.En.sign.docs./
  124. http://jayracing.com/focus/trust.En.anyone.docs./
  125. http://johansensolutions.com/advertising-post/open.EN.myaccount.sent.biz/
  126. http://juiceworld.in/wp-admin/verif.myacc.send.net/
  127. http://kdooenzoo.nl/wp-admin/verif_seg.En.signed.docs.net/
  128. http://kevs.in/wp-content/uploads/secure.myacc.docs.biz/
  129. http://kreatis.pl/sitefiles/verif_seg.ENG.accounts.open_res.net/
  130. http://kreditunion.id/wp-content/sec.accounts.resourses.biz/
  131. http://kummer.to/TestUnterdomain/verif_seg.ENG.anyone.send.net/
  132. http://kuyabunso.com.au/cgi-bin/sec.en.myaccount.docs.sec/
  133. http://lacvietgroup.vn/css/verif.accounts.resourses.net/
  134. http://laserowakasia.pl/wp-includes/secure.accs.send.net/
  135. http://leadershipcbalumni.org/wp-content/public.En.sign.docs.com/
  136. http://lohasun.com/wp-admin/verif.Eng.sign.rep.sec/
  137. http://medyalogg.com/wp-content/ai1wm-backups/open.En.myaccount.docs./
  138. http://meknan.net/cgi-bin/secure.accs.send.com/
  139. http://mmcrts.com/11/trust.ENG.myaccount.resourses.com/
  140. http://mmj.my/wp-includes/SimplePie/Content/secure.accs.send.com/
  141. http://myhealthyappshop.com/au13/sec.ENG.accs.send.com/
  142. http://neuwav.com/neuwav-reporting/open.En.logged.public.net/
  143. http://newlitbits.ca/cgi-bin/trust.ENG.myacc.send.com/
  144. http://nissanlaocai.com.vn/wp-content/verif.En.myacc.send.biz/
  145. http://noithatgothanhdat.com.vn/wp-includes/open.EN.anyone.open_res.net/
  146. http://noithatvanphongdanang.vn/wp-admin/trust.accounts.docs.net/
  147. http://ocean-web.biz/pana/public.Eng.signed.docs.sec/
  148. http://oneconnectacademy.org/wp-admin/verif.accounts.resourses.com/
  149. http://peterfabri.co.uk/feng/secure.EN.accounts.doc./
  150. http://phongthuylinhchi.com/wp-includes/trust.En.sign.public.sec/
  151. http://pmdigital.pl/wp-includes/public.EN.sign.docs.biz/
  152. http://progpconsultoria.com.br/wp-content/uploads/2019/open.En.myaccount.send./
  153. http://programmernusantara.com/wp-includes/sec.accs.resourses.net/
  154. http://projektszkoleniowy.pl/wp-snapshots/secure.accs.send.net/
  155. http://rajachomesolutions.com/wp-includes/verif.En.accounts.office.net/
  156. http://romanemperorsroute.org/wp-content/open.Eng.accs.rep.com/
  157. http://sistemahoteleiro.com/clients/trust.accounts.docs.net/
  158. http://sonaudio.com/wp-admin/verif.accounts.send.biz/
  159. http://songdung.vn/4d4ixle/trust.accs.resourses.biz/
  160. http://srishti.saintgits.org/2017test/open.ENG.logged.open_res./
  161. http://strategicseminars.be/qsql/secure.myacc.resourses.biz/
  162. http://sukienthienduc.com/bga8/sec.myacc.resourses.biz/
  163. http://suremerciesofdavid.com/wp-content/open.EN.sign.sent.com/
  164. http://t3-thanglongcapital.top/wordpress/verif.En.signed.sent.biz/
  165. http://tattoocum.online/engl/open.en.myacc.resourses.com/
  166. http://thaiwoodproduct.com/secureservices/secure.accounts.resourses.com/
  167. http://tiendacalypso.co/wp-admin/sec.ENG.accounts.resourses.sec/
  168. http://tipa.asia/wp-includes/trust.EN.accs.office.sec/
  169. http://toools.es/bankinter_/sec.accs.resourses.com/
  170. http://toshnet.com/cgi-bin/verif.EN.accs.public.com/
  171. http://try1stgolf.com/ebay/verif.en.myaccount.send.biz/
  172. http://unitedworks.info/test/sec.myaccount.resourses.net/
  173. http://uzmandisdoktoru.net/_wildcard_/trust.ENG.sign.rep.biz/
  174. http://vancouvermeatmarket.com/wp-includes/open.ENG.accounts.office.sec/
  175. http://vcube-vvp.com/cgi-bin/verif_seg.en.accounts.public.biz/
  176. http://vdvlugt.org/kaethe/verif_seg.en.myacc.open_res.sec/
  177. http://www.18w1bella.ivystudent.website/wp-content/nachrichten/sichern/052019/
  178. http://www.asic.abdulhaseeb.work/cgi-bin/trust.accounts.send.biz/
  179. http://www.austinheights.egamicreative.com/cgi-bin/legale/nachpr/052019/
  180. http://www.blog.packmyload.com/wp-includes/service/nachpr/05-2019/
  181. http://www.jiajialw.com/membt/sec.EN.logged.resourses.biz/
  182. http://www.mediashack.at/error/verif_seg.en.myaccount.open_res./
  183. http://xzylacorp.com/Support/trusted.EN.sign.resourses.net/
  184. http://yeez.net/_notes/trust.En.sign.office./
  185. http://yokozuna.ch/barca/verif_seg.Eng.accs.rep.biz/
  186. http://youngwivesclub.co.za/wp-admin/secure.myacc.resourses.net/
  187. http://zvarga.com/wp-admin/public.en.signed.office.net/
  188. https://austad.no/images/public.en.accs.docs.biz/
  189. https://automotivedefense.com/wp-content/public.EN.myaccount.sent.net/
  190. https://blog.bestcs.in/avhs/sec.myaccount.resourses.net/
  191. https://blog.medimetry.in/wp-content/uploads/sec.accs.docs.biz/
  192. https://ebpay.cash/wp-includes/secure.EN.anyone.sent./
  193. https://elitetransmission.fr/wp-content/public.en.logged.rep.com/
  194. https://fepa18.org/wp-admin/open.En.accounts.doc./
  195. https://fmstudio.cz/wp-includes/sec.myaccount.resourses.net/
  196. https://fmstudio.cz/wp-includes/support/nachpr/201904/
  197. https://frequenciesoffreedom.com/wp-admin/secure.myaccount.send.net/
  198. https://gently.org.uk/stats/trusted.ENG.myacc.resourses./
  199. https://kitkatmatcha.synology.me/qzp/open.EN.signed.doc.net/
  200. https://kreatis.pl/sitefiles/verif_seg.ENG.accounts.open_res.net/
  201. https://nguyenlieuthuoc.com/wp-includes/trusted.Eng.sign.sent.com/
  202. https://noithatvanphongdanang.vn/wp-admin/trust.accounts.docs.net/
  203. https://noyieweb.jp/images/verif.EN.sign.open_res./
  204. https://ouropretocultural.com.br/pdf_espanhol/secure.accounts.send.net/
  205. https://ouropretocultural.com.br/pdf_espanhol/trusted.Eng.signed.open_res./
  206. https://santa-o.com.ua/bin/trusted.Eng.myaccount.docs.net/
  207. https://thebusinessmonk.live/custom-files/secure.accs.send.net/
  208. https://tiendacalypso.co/wp-admin/sec.ENG.accounts.resourses.sec/
  209. https://www.festapizza.it/wp-content/uploads/public.En.accs.resourses.com/
  210. https://www.festapizza.it/wp-content/uploads/verif.myacc.docs.com/
  211. https://www.jiajialw.com/membt/sec.EN.logged.resourses.biz/
  212. https://www.ryblevka.com.ua/wp-content/sec.EN.anyone.resourses.sec/
  213. https://www.salondivin.ro/tur-virtual/public.Eng.myaccount.public./
  214. https://www.vemdemanu.com.br/wp-includes/sec.Eng.accounts.docs.biz/
  215.  
  216.  
  217. ```
  218. #### Epoch 2 Document/Downloader links seen for 05/03-06/19 ####
  219. ```
  220.  
  221. http://000359.xyz/b/ssZQGvirvoYpfwO/
  222. http://0618.cn/wp-admin/FILE/saJi3anvi/
  223. http://170spadinacondo.com/wp-includes/sxmp2l-j183f-hiqlwx/
  224. http://178.128.123.139/jf56pet/LLC/mkk2ptnwcvx7fgnbu4s0y4du_35lidmch-179559427/
  225. http://3d.co.th/US/INC/IscvgJKxS/
  226. http://45.7.231.94/wp-content/61adn-45dng-rbfflxl/
  227. http://4gstartup.com/wp-content/gi5jhh-3jrd33w-vxflqgt/
  228. http://4gstartup.com/wp-content/LLC/COfrmugcpIOEYNkHlXQKX/
  229. http://5711020660025.sci.dusit.ac.th/docs/lm/gDiyduZVrYbVHnpHuCkGvIuCsHeWjk/
  230. http://8bdolce.co.kr/wp-content/uploads/Scan/hzZgljsqZWAhPpiRgfBdPBptTp/
  231. http://92.50.4.18/DRFARSHAD/DRFARSHADERP/f6122-f4r3l-zrptc/
  232. http://9933.az/wp-content/LLC/6ph2d3hy9cxmypxhxaq3n3mmln_nq505ig9cf-284464809/
  233. http://abandonstudios.com/wp-admin/js/widgets/Document/jal7qtcf2y3cqt1vkacms9s16mulyn_fgzv7a5ftg-37987136856523/
  234. http://abbslaw.edu.in/wp-content/x2kq-aq8eu4q-ghbnkig/
  235. http://abigailanklam.com/uploads/iy3a3gzk0ihqji2qe9fvn737ij4il7_c5xx36ev2g-035337292/
  236. http://absorvalor.pt/calendar/Document/f136nu6gcru75iacrrzufhl_17i7ptvf-554283144216/
  237. http://ackosice.sk/wp-content/Pages/mz9baiazvn3un5e31dp9_rll1kx8-43767854460/
  238. http://acquaplay.com.br/a/xufdd-2n6ff-gpap/
  239. http://adape.me/tavano/ljv95m-gb0ifv-wymdebk/
  240. http://adityaproduction.com/wp-admin/af84go-h63kus-ftxb/
  241. http://admin.vigorella.com.au/admin/paclm/imerxtMFDFrPcYpXHLuQehyH/
  242. http://adrianevillela.com.br/blog/jfgxu-cejo6-yilqeqw/
  243. http://adrianevillela.grupoguc.com.br/blog/2zz5-qa17en-ycjli/
  244. http://africamarket.shop/calendar/lm/me7jizqztx3olsg29b6jr3z_wuk8m7t53-016922159173440/
  245. http://ahoraseguro.dmcintl.com/wp-admin/ams0ch-h8quayo-sqzapxm/
  246. http://ahuratech.com/wp-admin/Scan/5b4bixkcui5e91xis396c563d0y_bu40zk5-852284955204/
  247. http://aiepsy.org/wp-includes/WdbtbDHhsNzmtjYkwkk/
  248. http://airspares.co/wp-content/Document/cxucnykcd_89p1lwc-203448619/
  249. http://akeswari.org/wp-includes/lm/sJuoTPODsGGsGVwJMGNpBZyXhR/
  250. http://akeswari.org/wp-includes/Scan/NRgtuE0DmxEc/
  251. http://allhealthylifestyles.com/9yng/Document/KoYiCtoxcIBmB/
  252. http://alliedcontainer-line.com/wp-admin/g8iynq-q55zn-rqaw/
  253. http://allowmefirstbuildcon.com/35rnm2e/paclm/m9ixgkeioqa5y1s_9slxjzpc8-660235145/
  254. http://allucharitablefoundation.org/wp-content/paclm/nxOrLHDupzBckL/
  255. http://alpina-expert.pl/t1onlaf/ipq63opzm3uot9wp7pw_itqcmke-894392111979/
  256. http://alpreco.ro/wp-includes/Scan/qme9yyhchfcn_6ok3sr-108976209/
  257. http://alumichapas.com.br/wp-includes/pwdr-wk50d1-lszi/
  258. http://ampservice.ru/installation/LLC/uujf4hulx055j12egj5c9bbgevk_qaimfogwf-961324571426280/
  259. http://ampservice.ru/installation/paclm/NXuXFiYmnUAJakkKSIzTwvKxKeJIW/
  260. http://androappy.com/nrfqm/23jkct90jd44ggdfl76f_uhbd1-379456650337219/
  261. http://andyelliott.us/AIF/r67g80lujgz0p77gg6ecp8r4_o4akncrwh-465247106455076/
  262. http://anima-terapie.cz/media/Document/e3guogv4gkhfdo3715ie5_cgv6w31-85048606085/
  263. http://anjoue.jp/academy/Document/gMzGtXNcPbLhCB/
  264. http://antonieta.es/wp-includes/parts_service/tWYUTOrqONYYLgTFgPFml/
  265. http://apkfall.com/wp-admin/Document/m5no3rrq739i_87lug-887005396907/
  266. http://appomattoxautoworks.com/zform/Pages/GdleqLOBzsQlKryN/
  267. http://aprights.com/about/INC/YMCHSQlbZxbaq/
  268. http://arcfactorystore.com/COPYRIGHT/parts_service/yPBEZuHoltqCRmYSh/
  269. http://arcoelectric-idaho.com/wp-content/sites/hwhsaMJvOjoVHUbjBSTh/
  270. http://arledia.be/image/8hodov14ectvq2j_7n978-27038202003/
  271. http://artemodularplus.com/wp-includes/zj2elqe-mvxxug-hmeug/
  272. http://ascestas.com.br/Pages/hpam4mc9u5gg8heyli_f7dh4r-74986951/
  273. http://asic.abdulhaseeb.work/cgi-bin/DOC/uvlk6os0m9cz2skhkdhatqo054bpu_w5gq09lsn-294089105/
  274. http://asncare.com/61j6/Pages/bgJPUkAROZbaKWXjshxT/
  275. http://aspbuero.de/picture_library/LLC/06lm49k7gpl_4x524-9768435853/
  276. http://auction-zero.com/wp-admin/paclm/pnja600x494g9iiiws_5rjhrh9a-130054833/
  277. http://auto-diagnost.com.ua/wp-includes/mjouh-jy9pwo-aowoj/
  278. http://autoreduc.com/translations/esp/br2brrxdd4j2nc3vcsvigm3uv9wnv_alui5-138781194700/
  279. http://autoseven.ro/wp-content/esp/QLWXanUjholwJuNjbkLetgSqOi/
  280. http://avanttipisos.com.br/catalogo-virtual/tAdIyMyd/
  281. http://avatartw.kayakodev.com/wp-content/uploads/parts_service/joi8ho2nwuc8qnm82tp6_l50hq50yr-401163121/
  282. http://aviciena.id/data/FILE/0cij5yhvf81mp8_rxyd5grrh8-92274744344/
  283. http://avtousluga.by/wp-admin/VPeAysovJKTTMybWsp/
  284. http://awas.ws/JUS/Pages/mOSIehpnpqqFgpRkmTrisdjldXOGI/
  285. http://axwell.kayakodev.com/wp-content/uploads/INC/7ufoulqfu1fqgdnsv1v1trvhsh_emcevi0cp-31910285899/
  286. http://ayashige.sakura.ne.jp/CGI/Scan/fz6cvw5e8ngufnol3p982w_bnti9car8u-67621092197/
  287. http://azisonssports.com/wp-content/uploads/q2qh-gyg3m1-yggbs/
  288. http://backup2.robinandelaine.com/wp-content/FILE/74ceydrol0svayu37m6mzlrq1co2_9wajadiz-1098892684/
  289. http://baermedia.ch/assets/YucyYxEpEw/
  290. http://balageriabank.com/wp-admin/v1zb-x4a7d-ozgjzr/
  291. http://bandit.godsshopp.com/wp-admin/INC/q5enq8y67olkqrspdt_4dtexdgw-297260993224/
  292. http://banglarsiksha.in/purulia_govt_girls_school/czui7-gghr3kr-hdjzsh/
  293. http://batikayuarimbi.com/wp-includes/sDrmyckOakRqjmuyvTyaFsnHtZKID/
  294. http://baycitiesbiblecollege.org/wp-includes/parts_service/wruysx3a0e0bjgp9d_nzfx2uyr84-7383594337179/
  295. http://bbookshelf.org/cgi-bin/by640-b4izg-linok/
  296. http://bcreative.expert/wp-includes/42om-4avhth-uhfl/
  297. http://bdsdalat.vn/cgi-bin/INC/bos9lxzna29lsyi1clme6se05_vnwyihpt-647885291573/
  298. http://beautyeverest.com/wp-snapshots/mLAVKBYFC/
  299. http://bebispenot.hu/wp-admin/DOC/WJclZAxvymvdQiJXYqLEn/
  300. http://bejix.cn/wp-content/DOC/wu7vi5ys8i4ihf0ym_rrfprb-421640917/
  301. http://benjw.net/wp-includes/Pages/gqxl09oe0wnb4cwn7_kbxxuw-45498136689703/
  302. http://benzophen.com/pouchdirect/r6e9-eba9cy-boyp/
  303. http://bernardoascensao.com/jobs/esp/cn7prd1j0y60rw2aa9u01539a_skq88ihuvc-08889859774/
  304. http://beta.tuko.com.ph/wp-includes/msqrp1t-0oiam-ynjaf/
  305. http://bfquantitysurveyor.com/wp-includes/eemdrd-jao2li-ggtfz/
  306. http://bgadv.adv.br/wp-admin/Scan/od682m6w0amefmdbz_nen6ng-13823474677/
  307. http://bhainarindersingh.akalitcanada.com/calendar/1eu7pc-nk2q3k-ejuo/
  308. http://bibadaktil.larus-info.net/wp-includes/kx8t2gu-ikfd4dh-jzllo/
  309. http://billink.in/wp-content/Document/hb01e8iqya46jx5hfxii_4oyu3k9s-6659241931/
  310. http://bimasaj.com/wp-content/uploads/FILE/MesFCEDijPos/
  311. http://bimeparsian.com/jz/esp/dccKaumjHEDnzyzm/
  312. http://bionicbiomed.com/wp-includes/qdzwb-rcib59-bcnl/
  313. http://bizneskombain.ru/Test/INC/rhk9q1u67jrntb6gabs1fmh635g_cafni-16508123881544/
  314. http://bizridertrip.com/wp-includes/ona5n7k-ykduv-ncmycnq/
  315. http://bkdd.enrekangkab.go.id/awstats-icon/INC/2ijymn26v7uarffbkd6lx_u0p6k569-27092581718/
  316. http://black77.dothome.co.kr/wp-admin/oghbo-ozo9gcb-znpkot/
  317. http://blautech.com.br/wp-includes/apey8kcd4qmsx5agz64sy2k6vej_6q8ggb-319883588/
  318. http://blog.athletehumanity.org/cgi-bin/sites/rOTJgoHDO/
  319. http://blog.autoridadefitness.com/wp-admin/Document/DxWuWuMzYjttmoUFjBIKgdwkqOyls/
  320. http://blog.bijin-co.jp/wp-admin/esp/xEbgYILWzfVkBrGz/
  321. http://blog.bijin-co.jp/wp-admin/i6bk-ofwiho-lmab/
  322. http://blog.blissbuy.ru/wp-content/parts_service/qjsbgVce/
  323. http://blog.booketea.com/wp-content/dut6dlqqf27ayyv70po5xif53oq_v9ie9-422511994072/
  324. http://blog.carousselcards.ro/wp-snapshots/tmp/DOC/PNiXFMFNFIZqfdXS/
  325. http://blog.geekshark.ro/wp-content/DOC/wy6yk5rpmnbs_8l9z1l9-17881109072/
  326. http://blog.gxlfqy.xyz/pevg/4jtrylpgbtfrp89ocn07m_jhs6axzk-85293100/
  327. http://blog.hudle.in/wp-admin/baiitkcjgp8qa_lzdzlr1-8439527366/
  328. http://blog.jftechnologie.pl/wp-admin/FILE/l1pq1s34uqbx1fghbam9irjm1n8b_mamvy9x-3772286339166/
  329. http://blog.jjie.net/wp-admin/esp/tqq2lh16o2oot3tz3vgco598_yngzzmipe-799270229677718/
  330. http://blog.kopila.co/wp-includes/Document/EKQRnJXfnmkcQK/
  331. http://blog.kopila.co/wp-includes/LLC/JSuwgPIaKbwMmEvgavQQ/
  332. http://blog.medimetry.in/wp-content/uploads/parts_service/eJnoHSrMkxGIqBR/
  333. http://blog.memeal.ai/wp-content/uploads/Document/ZFsLCmoHkqBbcmElpDUfJSE/
  334. http://blog.memeal.ai/wp-content/uploads/paclm/bSObtJpwzLRNyKmecBbxlFkb/
  335. http://blog.momnjo.com/wp-content/Pages/ftOUMsOBBfkOlBBzbxUmiSgjcj/
  336. http://blog.ploytrip.com/z9cr/Pages/UxiQlIomnGiGKODewvEaBYLyCJh/
  337. http://blog.ruslanski.co/wp-admin/lm/lcTqgLUCfJBNxSqmfR/
  338. http://blog.sanaozel.site/wp-content/Pages/rfyc82g6d6y72g1i743_uguxulop-012824346/
  339. http://blog.taxmann.com/wp-content/INC/kDSvKbPatSbXtqkFmEZqw/
  340. http://blog.thaicarecloud.org/wp-content/awtCcOlDLuWLcIYofN/
  341. http://blog.vitrinemors.com.br/wp-admin/LLC/2qrdl2ij3qu2wlrntpg_3ylzg55c-91259395520759/
  342. http://blog.webysirin.com/irdtu/Pages/bjhb4084e9ua730tde1_0uzp2jccmo-4893119854/
  343. http://blogs.ct.utfpr.edu.br/direc/kScyjjaDwMkMIvbnmGA/
  344. http://b-m-l.pl/demo2/kmumy-n15lc-hxfbhwj/
  345. http://bninternationalbd.com/wp-content/0qhwx-kj6i5-prlnj/
  346. http://bodycoat.in/wp-content/FILE/lHHnjYARzarrfJOaUUVxjqdiHI/
  347. http://bomfire.com/wp-admin/FILE/zy2ed0i4sobg3sfk9yt8_xom9osu8-12019337669/
  348. http://bookforit.rs/wp-includes/esp/EDKWOWuyVpbkXwiVwjVYu/
  349. http://bosskun.space/wp-includes/o7ewl-wfpzmeb-gkotr/
  350. http://bosungtw.co.kr/wp-includes/DOC/ObRnmOSOiDKyYAksWHutcKbHo/
  351. http://bpr.nerd-workshop.com/wp-admin/ow9y-dsbo8ey-lhjigdt/
  352. http://bricorate.com/ih88/Pages/rcncl7amwh3lqy66_u4swl331xc-963915737275/
  353. http://brinks.store/spxc/sites/FlksjMMlSiJkhDTynW/
  354. http://brotechvn.com/wldcehb/FILE/u63iTUadlDN/
  355. http://build.joseisidroreyes.com/wp-includes/7x8t8c-hhuvk-crsnfm/
  356. http://buysellfx24.ru/scib/7yn9r-hozuj5-ztsoomc/
  357. http://bz-group.com/wp-includes/3kpf4r-3cys90m-gqbd/
  358. http://camilanutricionista.com.br/blog/o404tv-mle9dkx-mugwt/
  359. http://candasyapi.com/cgi-bin/kbd3o6aik_n6gtdbv-55/
  360. http://candasyapi.com/cgi-bin/qzky-qrg7un-xsdrvd/
  361. http://canetafixa.com.br/wp-includes/Scan/76vvinvzu9esyw5oz3f33mbtjoeyx_p84w62-706696352773/
  362. http://capasso.de/wp-content/LLC/i4g59hocgmvg_webvq-58056058172/
  363. http://capitalift.cl/css/fkhvgmi-2den63-ehzesd/
  364. http://caraterbaik.berita.usm.ac.id/wp-content/g9vlt-w7ngdvl-liiq/
  365. http://carmelon.ofekhorizon.com/wp-admin/w09dpxm-lhf7r-cfqen/
  366. http://casamento.chacarasantana.com.br/wp-content/dosu-a5r9d-atlwv/
  367. http://casana.com/favicon/295g5-6hlg4dz-dylfowc/
  368. http://cat-school.ru/us/710yf0n_ua7x4j-7479994/
  369. http://cat-school.ru/us/km3a-g6dety-wrzj/
  370. http://cbl-mmg.com/fkya/paclm/rPIDBOQIFfWncWKfyrUcPKM/
  371. http://cbsmun.org/wp-admin/Document/kfsGCwywenzornHMhNtOdNK/
  372. http://cdaltoebro.com/wp-includes/nzfmtk-608ss-ofvye/
  373. http://cgt-chile.cl/wp-includes/DOC/HfNgYAYqquLFHEcmjCllWxEObGXV/
  374. http://characterthelight.jp/common/sites/LUlhZxUzDLgQKddZyMvCKZvXat/
  375. http://chevalblanc.com.pk/wp-admin/albq-pb5y2r-feykbkl/
  376. http://chinadnb.com/wp-content/llmu4-ev7vvz-ehoeqsx/
  377. http://chiro.lead-tracker.com/cgi-bin/3cjzauq-geagp-vbltl/
  378. http://chirurgiakrakow.com.pl/wp-includes/d3gh1io-m0xzn-lojiasw/
  379. http://christopherandersson.se/cgi-bin/qod2zmo-6c9ca-rvgxuko/
  380. http://citroen-retail.pl/wp-admin/kjjvd89-y9ntemp-ohjsaiw/
  381. http://cld-net.com/wp-content/uploads/fyUFnbhBhldxhgXM/
  382. http://clientes.grupoendor.com/test/lv93y-o9dzn-yfnma/
  383. http://clinicamultiser.belcastro.adm.br/wp-content/wh1kybw-xuqqp-aeeso/
  384. http://cloudwala.in/asset/sites/VQtwaTMhm/
  385. http://coachbagsoutletfactory.net/wp-content/INC/hQYoIbbJjQkUUcrsCHE/
  386. http://coaching.idees-decora.tn/wp-content/ylcxuj-xq429da-ueesri/
  387. http://cocobays.vn/wp-content/paclm/3zwivi7s95_nxgn81-13338007552/
  388. http://coloradolatinoforum.org/wp-admin/9rrym9t-6umqovn-gekkrfj/
  389. http://colormerun.vn/wp-admin/Pages/vumsbdgcjm17n8qtawde80lovhz_hd2dq07-777785434129/
  390. http://coloroll.net/wp-includes/hzla-4jyolw-kibpf/
  391. http://community.diygeeks.org/wp-content/Scan/it53y8s7pkaizwi86h_aodr24-4164303803/
  392. http://comosomos.es/luvyadg/RsyoKGOiQHHCw/
  393. http://conferences.ad-apsmapeta.or.id/wp-content/g7so-55bv9d2-xmnj/
  394. http://congtacocam.gnsvn.vn/wp-admin/4g8tsv6-9oxymyg-zvwcsc/
  395. http://conspiracydocumentaries.net/cgi-bin/w8v67x-pzc0yt9-jcjl/
  396. http://cophieutot.vn/pxha/parts_service/3di4wk87bkue4fsvit9p2_malguq1za-024897855/
  397. http://cophieutot.vn/pxha/TvEBFkCTShdOUFkxupuGJHkwVyZa/
  398. http://corehealingmassage.com/wp-admin/TwhjPoZom/
  399. http://coworking.vn/wp-admin/paclm/1lvtbbymbg_zsvdpc-67462271087/
  400. http://cqurus.com.ec/wp-admin/4tw9-a12ogg-gbem/
  401. http://cristalandia.to.gov.br/wp-includes/Document/tkgpy8cxbmh3lur43fzqoqjpkr_zvajv8r9cv-4804638209/
  402. http://crm.ednailor.com/wp-content/w56cl-eurgwa-ldcr/
  403. http://ctf-1111.net/wp/Scan/engqklr4739vfv750q7hpk_jvzle83l-10753419/
  404. http://cuppadl.org/wp-content/ytqmj-ch8ne-vjvpc/
  405. http://curmudgeonintransit.com/f9fm/DOC/fj19qanep33_msiv6q-949526099/
  406. http://curtains.kz/wp-includes/Document/lBxCvnbuDhJPziQM/
  407. http://dadtzarchery.com/wp-admin/r3ew-bwvpru-hdqp/
  408. http://dalmo.win/8ml59tf/LLC/ti3ui14eh57fh00d9j1qrsoia18_z73f3h-33716907/
  409. http://daos.live/urgabol/DOC/mr4wqleqba93_hy43fddhl-36991923294016/
  410. http://darianinc.com/INK_PIMS/v1.1/modules/work_mgt/FILE/zKyuvruXVJPrANqSGAzwUppdakYaQ/
  411. http://darktowergaming.com/l9ld-0dpofc-hiwewg/parts_service/UEDSVNiTQ/
  412. http://datco.vn/cgi-bin/Document/IsPDIOnhPWzt/
  413. http://datco.vn/cgi-bin/parts_service/3hnvp95uhk0iksd5wh2vd3v22i7yj_yl17ow-01437863/
  414. http://datrephuquoc.net/wp-includes/u7875iw91kgse9417_m68h1y33pj-496550662603696/
  415. http://davidtal.co.il/wp-content/strbd-58hrudd-bdhgx/
  416. http://dcc.com.vn/wp-includes/Document/nyRkSGM8DbF/
  417. http://dcc.com.vn/wp-includes/m1wuj-bu0ya-ayud/
  418. http://debuurtzaak.nl/cgi-bin/uk5ek-ogwe4x6-ewyv/
  419. http://deccangroup.org/deccan1/skmk-dq0iw-lkiebbr/
  420. http://demirendustriyel.com.tr/wp-includes/LLC/8hrd0iaxtfca_drf3g-28237112672512/
  421. http://demo.sshc.ir/wp-content/Scan/PdsZmZhFCDckbboSqwPoa/
  422. http://demoo.tk/store/tvrx2le53p2ph_63qresymi-20666281672606/
  423. http://demowordpress.ideapp.com.mx/wp-admin/sbal-t7q8w99-tfaecxz/
  424. http://designyourdreams.co.uk/calendar/sc79uv-ly8aau-tnesark/
  425. http://despachodeabogadosbou.mx/wp-admin/1k9lpu-2nvta-xtteuy/
  426. http://detmaylinhphuong.vn/wp-includes/fonts/FILE/yftvil6rzzkijuy_sxn4efmj-987455061056849/
  427. http://detmaylinhphuong.vn/wp-includes/fonts/INC/6yh3xdsw_6902e0q7uk-20835125/
  428. http://deuglo.com/hrmanagement/ihyx0f-q9drzmz-xguqhxi/
  429. http://dev.colombiafacil.com/aj966rj/Scan/8seis4jt_dvoaxymk55-270795321/
  430. http://dev4.idomains.co.uk/cgi-bin/1yknrj-9t053-vhbubut/
  431. http://diana.eduformat.com/wp-includes/dsyyf7-5g5uvp-wzjy/
  432. http://diaque.cn/wp-admin/Document/XyGKFEcLXrZT/
  433. http://dientoandammay-env.mrqdpvvgj9.us-east-2.elasticbeanstalk.com/wp-admin/kshlk-0ygfqw-vvswgh/
  434. http://digitalkwikad.com/jhalani/vjt7enb-01bn71h-sztuim/
  435. http://digitalonlinecourse.in/wp-admin/DOC/fqmydi48gq5z8a_ivg0718-7351182106/
  436. http://dinkes.mataramkota.go.id/wp-admin/Document/vlYhPJxdaxTkaKBFlTIvzXEn/
  437. http://dinofils.com/wp-admin/7f53kw0suia3ty6mepq0nk5vqgpro_cspbx-45988021188/
  438. http://divisolutions.net/videos/Document/wuqkl4rtbixtisbr6nyx8xs4ft_z6dg9pei-526900454141/
  439. http://dizzgames.com/comment/4lyg-olem76-vziibsn/
  440. http://dj-joker.pl/etc/Scan/o7Zvz3HN/
  441. http://djxdrone.fr/wp-includes/wpb0u8itcdh_rfcfpxvb-250379630/
  442. http://dobrean.ro/wp-content/esp/xGKOQpZJPCLLyhUmxmxte/
  443. http://docfully.com/wp-content/parts_service/8bag0o2rziq7_uqh53-86137533/
  444. http://donate.iqraintfoundation.org/wp-includes/iihlc-8djyy-ewmqhsa/
  445. http://doufside.com/gmail_files/LLC/Qlj8ICZ4B/
  446. http://dp5a.surabaya.go.id/wp-content/tyz4-52rml3-tdltzm/
  447. http://drezina.hu/airport/INC/AzrRYHEZHncEavTKsQLFq/
  448. http://drhsetayesh.ir/wp-admin/DOC/ZMmKLcweqBQMEJgKrb/
  449. http://drkamalsgroup.com/wp-content/uploads/2019/04/IjEzvbBVv/
  450. http://drmahmoodian.ir/wp-includes/DOC/e0iy32sahiq3lalt_esmh4nc-173015288747675/
  451. http://duffi.de/wp-admin/INC/q3umw2lvf0jme42mdv7_yiwb5773t-310569600916/
  452. http://dynamik.mphpages.com/iiyo/esp/nf60cq024d8_oi2z4-731348627362832/
  453. http://easyprints.info/wp-admin/pnbln-mtypr-eeca/
  454. http://eco-chem.hr/nj3h/Document/tlHVNeJFLgbDdUkYydSFsIMgZ/
  455. http://eco-chem.hr/nj3h/LLC/JEroT2Oy3t/
  456. http://ec-p.ru/storage/LLC/TUbTlMFsr2D/
  457. http://ec-p.ru/uiyj/esp/NTlNxebqT/
  458. http://ed-des.pp.ua/cgi-bin/Document/ozokyHWXWVdbLazyTYJn/
  459. http://ed-des.pp.ua/cgi-bin/lm/9xecdv18s587ro0iagcbqmmknz_b89asx66-1035865617/
  460. http://ekcasaute.ca/wp-content/7vdr32azuntij22mq4yl6ul7msiyw_pf15rr03-318842626767198/
  461. http://elitetransmission.fr/wp-content/Pages/ttrgxyacs2qcnklru_0jk32o4w-47168856156/
  462. http://elitgaz.su/k1npbd6/INC/xc14xuuqb_8wkuhhmni2-19023689/
  463. http://embalagenscardozo.com.br/wp-includes/lm/JaNXgEKxMsGToXeJhm/
  464. http://emermia.org/wp-admin/Scan/ik0P3VFT/
  465. http://envases-matriplast.com/prueba/Document/t9qck5al5_vogis60f5-51913072975606/
  466. http://eqbryum.ml/wp-admin/9lcj-t53o3-nzthx/
  467. http://equipnet.ir/images/INC/owXRWzeFaJAibBYvZFnE/
  468. http://escolabarretodejiujitsu.com.br/v5bd/FILE/wt8rnjq52zjgsk143k0mriprv5z_sl6ui62cg-0835748684/
  469. http://espak.co/wp-admin/Document/fatanfiq92yzzhjr1gc_omu3st-772329328827433/
  470. http://euwinecn.com/aa/hNDAhgQcvlTRtnJFxTNU/
  471. http://evelinayoung.com/pmdn/DOC/GSUHnxoWp/
  472. http://ewomg.com/blogs/DOC/QHpryPqastqd/
  473. http://explorersx.kz/wp-admin/5b3iri-t5toltf-orfvsc/
  474. http://extendedfamilyweb.club/wp-includes/Pages/kb3qmxuoc917oipnrpthhui5aop_lerh8uhpq5-964113950/
  475. http://extremesandblasting.ca/wp-content/lm/urWMWGNWoKMhwGBwUV/
  476. http://faithchorale.com/epk/xv4ekgw2vpgxac59izvndgexakdk_p4273rh-4866130747/
  477. http://famille-sak.com/chouchane/LLC/Ag2jkpW5j/
  478. http://fepa18.org/wp-admin/vZJPXdJUKbsQoR/
  479. http://foodblog.club/9vmdo7k/21k32-r7uiou-rssigpr/
  480. http://forumbolaindonesia.com/wp-admin/Document/qvkndbamk21wwyjigi_048gkx5-5506768399/
  481. http://fotobot.ir/wp-admin/sites/kkeb60wfibwst8utsbrquceq6gkh_or0pbfdl1c-754853850161/
  482. http://franosbarbershop.com/wp-content/fyg8-t2gv8m-hgptkb/
  483. http://ftwork.co.uk/old/assets/LLC/wu6vrj1ak44o4xkigqtz_psqz6qxq-63978921/
  484. http://fundacionsuperamigos.com/cgi-bin/sites/FIwthgGobIzUjCjVzuRVXj/
  485. http://garnitury-producent.com.pl/wp-admin/paclm/wuls8nj5vf4hxswt6p3tze4q0_d5ixwl6s-17704577630/
  486. http://gem-st.com/wp-content/parts_service/YReZAzpfGeeCSDdJLNGzN/
  487. http://geodynamics.com.pk/awpg/DOC/9f1n2wqp_p9p466-0687958098/
  488. http://giambeosausinh.com.vn/wp-admin/d57k-96x6jyh-xzrdqkh/
  489. http://giangphan.vn/evhu/sites/dyhx36nd177e17b36auwyoo89r7vg_pyrwoh9zer-9704006111/
  490. http://giaydankinhchongnang.com/wp-admin/LLC/PBkbDflzwUjeAFZwQdojZP/
  491. http://glasspro.kz/wp-admin/lm/ab0xacmyxgcr5oq1dmx_b8bwrxj5g-1248840572/
  492. http://glatech.ir/wbd47a1/paclm/6m9zv0snkzefi2oa7ys_bgsxzb5n-1732641113/
  493. http://globalautosaleslanka.com/demo/eyefyyXO/
  494. http://globalmanagement-ks.com/icon/Pages/q3g0vr0etjcvsllauu_bvh7r9fi9f-8405939656/
  495. http://globalvit.ru/!old_enough/vz21-vh9udz-blpt/
  496. http://gn52.cn/css/LLC/yPvjbOhgRRNgSKXFMOOhsLFFZAey/
  497. http://gn52.cn/css/Pages/CmUzPDxvmcX/
  498. http://gownz.vn/te/parts_service/jRONkuAdl/
  499. http://grandview-property.biz/wp-includes/FILE/CNHVOwKibgeaSNdRUsduFcTEDhlD/
  500. http://granzeier.com/projects/oc9s1q03vdhtrc5nwt_7elngug-6674537289/
  501. http://greenstarquan7.org/wp-admin/DOC/uihhi345bpeqt2s8i5a56l72_zca5uscxb-72015272398351/
  502. http://gs.jsscxx.com/wp-admin/0uyxmexw8eqqu2qx3n86mgp8fhgts_ckwzep6-991398249321281/
  503. http://habbies.in/dropboxkb/tnt9hrb-a76sy9-sadteh/
  504. http://habi.ir/wp-content/Document/YywKdXkLh/
  505. http://hada-y.com/WWE/gbHPZTMobPbfhfMcFNTpSpyJVbS/
  506. http://hadimkoygunlukdaire.com/wp-admin/LLC/a91wy7mq9qjman84_wbmw5h-5132787275214/
  507. http://haisonconsultant.com.vn/wp-content/uploads/ac95-ks48wbs-bnsg/
  508. http://hawkinscs.com/INC/ej2n0zrxm5soc7jq7_du67i8-333785461/
  509. http://healthyruns.com/mb0b/Pages/4fe72wms5jwjy4xmd17crc3tqy_0ohwtx3by6-52970741/
  510. http://heartspeed.cn/calendar/esp/27zi0kp4aj7s4qpa1_y0ntkkt-3264791814/
  511. http://hellocode.id/wp-includes/rjrn5-9xc6c-rywnk/
  512. http://himappa.feb.unpad.ac.id/images/parts_service/nhQNyhEbyeiYUpQeU/
  513. http://hniold.mageexperts.com/html/parts_service/vpnfoa7tgl_qbrtpv45hf-64095293/
  514. http://honmastore.com/cgi-bin/EsuafwyTKO/
  515. http://hr24.com.ua/saeu/DOC/gbbVNHvZlEDKZnqyNvimmS/
  516. http://hsweert.nl/lcfr/Pages/v7m69kapz185opg5i3dcyhx_ip5ddnl-93348988764605/
  517. http://hubrisia.com/wp-content/uploads/DOC/YkEbhBHCuzUtrv/
  518. http://humandevelopmentmag.org/cgi-bin/Pages/tomamkpzkwed8lahovafiih_0tt6gowlu-10562221070/
  519. http://iglecia.com/threelittlepigsgotoyoga/le857qcgyhkphk14_qt8cill0nl-123868710004/
  520. http://imagesbrushup.com/zy9j/PLAQBIbOXapelVCtSzQF/
  521. http://imam.com.pk/7f80kef/FILE/QQBYc5Ot/
  522. http://imboni.org/wp-includes/INC/fghz3tbu33yn_k66ebx-54661321/
  523. http://imnet.ro/Document/ywXmTGBHZrtxCQYZveIWmYW/
  524. http://inpolpe.com/stock/Document/ofu14i5Xo/
  525. http://inspirationmedtech.com/freeallaquix.com/parts_service/m2cgq22unygscz95ynetijoj7_7xrkvzs-526446308377/
  526. http://inter-ag.ru/wp-content/cg76-vwaqlo-utjjp/
  527. http://ipoffice.ph/cebujob.net/zdkm-bs4jr-tqyfrn/
  528. http://jhamkatrekkingteam.com/wp-content/a32h-18q6ml-ywipupa/
  529. http://jiancepai.com/wp-includes/INC/mTOGROlWtgqUVtptZExJ/
  530. http://jivine.com/sechdule_css/Document/zveixqtll5o1qxlkdlkwwxt9_z2kzj-39972165/
  531. http://jivine.com/sechdule_css/skGlccnSjbgG/
  532. http://joelscoolstuff.000webhostapp.com/wp-admin/INC/z6ayxgq90dnienk_cd4ob-621061856/
  533. http://journal.noesa.co.id/wp-admin/8m9wc1j8ttxslkx0po9q51kj_mctvz4tmu-79419847933/
  534. http://jugl.ro/cgi-bin/Document/4ckm032czbsgmcoey39j6i13lv_13lweu-53013366/
  535. http://jugl.ro/cgi-bin/lm/s9rg17u08e7k5m15va2u1q_rx1egasqih-636673797660761/
  536. http://junaryaphoto.com/wp-includes/esp/HlcyQHzMIebFxh/
  537. http://jvmahlow.de/wp-admin/Scan/td8nxrcnc9ntmco49_615sw-577633401958136/
  538. http://jvmahlow.de/wp-admin/ZWfaMcJmjYmgfATQmTZQGPGEYjjEJB/
  539. http://kalat.com.vn/wp-includes/INC/H8ehc4PiXX/
  540. http://kdooenzoo.nl/wp-admin/LLC/0vLPkliS/
  541. http://kiborg.eu/wp-includes/FILE/kRCIKEYOUYEgXuPHlTHBHbaDns/
  542. http://kijrung.com/zohoverify/LLC/8bjjt9iioc861yffnnemb2k61_7jry2lu-7573521462304/
  543. http://kinzish.com/cgi-bin/Document/oi5atetqp9qwuxrrgnv7u9b_51vfwp7089-99528555/
  544. http://kitaooji-kinseiin.jp/wp-content/tdns46unnon8jp2d1kz5y6d2ms_zzcxt56kd-15051739986/
  545. http://kupuimorazom.org.ua/wp-content/plugins/tinymce-advanced/sites/0y87n4z90clxjjsa7sdwtohqmec_3539lk3-05529807340/
  546. http://kuwana-vn.com/wp-admin/DOC/xnYybfJYsL/
  547. http://kuwana-vn.com/wp-admin/TpDuaYBEmqfxyRQ/
  548. http://kvarta-m.by/cgiweb/lm/ipceyhhxd8arao8nop2kpalnzol_6mafrk62uv-01898998528341/
  549. http://kvarta-m.by/cgiweb/sites/NdCLsPtmjYB/
  550. http://kviv-avto.ru/wp-admin/INC/KPaIMsFtFLjPcthVImVdBNmwnc/
  551. http://kviv-avto.ru/wp-admin/Scan/WWlvyhiEACMaKtsjJYMCVfAtL/
  552. http://kynmandesign.co.uk/picture_library/jzb4mnmlh50er9hzj3dxf_swznp5-06132370479904/
  553. http://larissapharma.com/wp-admin/lm/5j5m39udmdzno88srr6xmyt6_vf9t9-9622876406533/
  554. http://larissapharma.com/wp-admin/Pages/sdtx1nlu_v4cow4-0877628001022/
  555. http://laserowakasia.pl/wp-includes/INC/kVScbgrQYtVlS/
  556. http://lauren-winter.com/winter-robotik.com/Pages/65vq3d5gqzp2qr4wj2wou_lrwtt7ul-932073608/
  557. http://leadershipcbalumni.org/wp-content/parts_service/cwnzpFDQTMdMqnUbTOjlEfeCP/
  558. http://legalserv.ge/jkmoxed/u2azqyjxeqshkjeuxzjuzvkera_vluffyj9-5428321475/
  559. http://lluismansilla.cat/wp-admin/esp/1cxzolt2i_ycues-4642653128279/
  560. http://locksmithproservice.us/wp-includes/Pages/rpmkxypavdv6j9czsbyk_p19w2w1-15170831221/
  561. http://lohasun.com/wp-admin/Document/2ybL6bjsGkXa/
  562. http://lohasun.com/wp-admin/sites/501cu2i9_ih1cae-7324304949/
  563. http://luanhaxa.vn/sqeh/INC/x6yufaymc4d3gpdnoi2qao3f1trfk1_18aolclev-5636079340/
  564. http://luanhaxa.vn/sqeh/lm/xyrrhdcyuk_qyirb-35314660/
  565. http://macarons.al/macarons/lm/786edyskgkf4otktvgvne26eeq8p_04es7z-0843658307/
  566. http://maidservicesandiego.net/wp-includes/Document/AhzhIWcgRvLto/
  567. http://mail.adrianevillela.com.br/blog/nLzmfYEiWdFRKaNl/
  568. http://mail.athomehousing.co.uk/wp-admin/8knqo-cmwr7-vgcw/
  569. http://mail.clinicamultiser.com.br/wp-content/DOC/KgJtEkmQ/
  570. http://mainbild.ru/wp-content/FILE/2nm98of9ql9bow9zlvqzco2cz_hwhfhgib-992754034572995/
  571. http://maket.pro/phpMyAdmin/parts_service/IFjeEQIENmDQpN/
  572. http://mameradirastislavice.sk/wp-content/qrVAGcTZtPZNJDbuMWSrNz/
  573. http://manualdareconquista.com/Search-Replace-DB/0i7tk-pr0s4-rpdtehd/
  574. http://manualdareconquista.com/Search-Replace-DB/parts_service/phcz1fnn94ej2fpt9vc1w8e7ve_efs6naz-3849760247915/
  575. http://manutdtransfer.news/wp-content/plugins/cms-commander-client/DOC/evuf9qgo0b_vx5tii4-7702513317/
  576. http://manutdtransfer.news/wp-content/plugins/cms-commander-client/NRDLdNgISyXoUbMZjouhGRUAJ/
  577. http://marketing.petable.care/wp-content/cpxmne0mul38rsgdxncdw1yulqbcet_0rryxqeb9t-9691010862757/
  578. http://masens.be/igzpp/lm/rxdpzhjbg19eogitm4pfjl9htsei7_sldvr-691251343103387/
  579. http://mawrmarketing.co.uk/sandbox/jNmhTckKrKrFpqOL/
  580. http://maxcreativesolution.com/wp-content/qt10krk1pxdmwd7kec7t3sp_l4nf6jfsc-71444705202/
  581. http://maxgroup.vn/__MACOSX/DOC/4duyq5gmcuu375q2589qi8k0i3k4h1_cgufr5-8018679562762/
  582. http://maxgroup.vn/__MACOSX/Document/PzLwVKvPWVnHEXkDpCqBr/
  583. http://maxology.co.za/cgi-bin/INC/2h2hqfcw756o89ppt_vgk6t83f81-159867646479276/
  584. http://medovica.com/vujgtlo/3wire4m9_n21bbe-2156816613610/
  585. http://meknan.net/cgi-bin/cqop-vfzfu-koohdb/
  586. http://melgil.com.br/a/paclm/mkuyau2l_kjiwpzz-436679505348/
  587. http://merodeshonline.com/wp/LLC/sESWIHNzmGuuyHMuqIGzD/
  588. http://mestand.com/wp-content/INC/NkFXuurNtwITOjNDbtrcnRRubFfbHB/
  589. http://mnonly.com/faq/p7advozpc5r3v10_4hotghozv3-23739326662/
  590. http://mobilabmb.ro/wp-admin/Scan/aOeoCGqCk/
  591. http://mobilitypioneers.lu/blogs/lm/5yqyc89z7njo7cvw7gj_04roz5d-5355090859891/
  592. http://modtyres.co.za/calendar/Pages/RwbZlNYez/
  593. http://momentsbynatali.com/wp-admin/esp/enrtva1rkjkf_t7t6o3u2b4-073321770327/
  594. http://mormedia.biz/colindepaula/Pages/MXpxopCji/
  595. http://mtdc.com.my/csm/mtdc_tenant/uploadedImages/FILE/o3xzk5h347jxshu8k73a66d4j0k087_aid8t27-174416710418/
  596. http://mtdc.com.my/csm/mtdc_tenant/uploadedImages/INC/ErfRjWbgc5K/
  597. http://mulate.eu/wp-admin/Document/mFHbKdoPlbfdUdN/
  598. http://nangmuislinedep.com.vn/wp-content/pgbgOfwvndTUMZuS/
  599. http://nangmuislinedep.com.vn/wp-content/ZmSxYGYcnVUbcIIct/
  600. http://neoneet.com/blog_img/Document/1q3jw5lpahxa8sk72brbkwptlm9_7wgt4-32694547/
  601. http://newagent.meeracle.com.my/tq1s/LLC/kzkCWFEmhSi/
  602. http://newlifepentecostal.org/wp-content/uploads/2019/LLC/LLC/p3k5n42wjwi68vvbjo0aqpqlf7qr62_ul9b8-95646978580162/
  603. http://nguyenminhhoang.xyz/wordpress/Pages/uba4fk0373img0f7553f_d09ugnkkd5-08819672926/
  604. http://nisi-web.threeon.io/db_dumps/FILE/ebk0cs8q4rkl0p40l_xgwtjp-892746124109/
  605. http://noaprojekt.pl/wp-admin/parts_service/8dkjfpjjomdwhdxoeiuifnh3lxpap_x2j0p60y3-13485141/
  606. http://noithat-fami.com.vn/om8n/DrTYRsrUBPflQwsmsHtZHjjfH/
  607. http://northquestinvestments.london/amw1tgm/esp/PeoMauEygsHm/
  608. http://notriicka.ir/wp-snapshots/lm/fh4vwn4804n4a_cx5u3be-9396461161/
  609. http://notspam.ml/wp-admin/Pages/espLunAjWsTlpVEPozgWEc/
  610. http://nrc-soluciones.com.ar/soporte/u7nhl33d9rdi8n1txl3iat9ekso_1lifgdhw-5265685413296/
  611. http://ntaneet-nic.in/cgi-bin/Pages/InSYHyDHvYTNMysjjVPdjJPWu/
  612. http://ntozakeattorneys.co.za/wp-admin/lm/DTmlqMvsLMPNUHSJHPsrMLKCwrky/
  613. http://nurcom.kz/d3zomgm4iirez4c75bprdqa1_w3vbx1cu-35654999/
  614. http://nxtgreen.co.in/cgi-bin/dd8i5tlwzxg88z_it4287fb-83343559963074/
  615. http://octasolar.com.br/site/parts_service/2fkm9bcrtcj2knz_9si0c-828505747194627/
  616. http://oldays.tk/wp-admin/ri1f-zwvypu-nfyq/
  617. http://onlineschool.center/wp-admin/Document/yGCsJSbouQBN/
  618. http://onvacationbolivia.com/wp-content/Document/xyff3cuhe6mq9g65v1zo_5tcb1cxnk-0364266887510/
  619. http://ouryurestaurant.com.au/wp-admin/4gsdpilhgjy7ft6j99tdaxvtw_t0b2c9j4h-697283551/
  620. http://oyunlist.com/wp-includes/FILE/E0dQF3BrjsK6/
  621. http://painterzindubai.com/cgi-bin/lm/UAebSiKTegqLVzjfz/
  622. http://palabrastudio.com/flag/FILE/muJxXXMaPLBmRmq/
  623. http://palmiyetohumculuk.com.tr/ac/FILE/cx381gq8uamy_w639rrebp-0084802356989/
  624. http://pathaayamrestaurant.com/options-misc/INC/FpqMeubB/
  625. http://paulstechnologies.co.in/wp-content/mmikv-tlt7rl-jbqcn/
  626. http://paulstechnologies.co.in/wp-content/whv1j27989t1wgoxk6l4d98mkpx_9dw1ti50-762822895267/
  627. http://pawn-stars-shop-uk.com/njvs/Document/rk38yd54zm9jj72bw_ks75d-68780852428/
  628. http://pawn-stars-shop-uk.com/njvs/sites/YInRYQRoca/
  629. http://pensiunea-anamaria-bargau.ro/wp-includes/lm/QCBWbFgcWa/
  630. http://perkim.bondowosokab.go.id/wp-includes/Pages/jyatnkrij4q4zawhbxf9cj23fq6e1s_tf6ku1s16-697389466881345/
  631. http://pestservice.site/0jqb/PRTMXPLgelhVfYArLieKGPbsoEVuD/
  632. http://photo-midorikawa.info/blogs/NehDOtipfblhIrbhQaKqHjGWxsa/
  633. http://piegg.com/wp-content/77wszn7k8xpxs_97swpij7dc-39610063200/
  634. http://piidpel.kemendesa.go.id/ngcr/sites/bblhemuhe2tsn1q_z712zf-279336711/
  635. http://pippisvillavillekula.com/wp-content/Document/v5ds4g78blp6omprrtsk7idnink8no_mbvx3ng-74129967/
  636. http://pmdigital.pl/wp-includes/INC/uLzXxBrWJB/
  637. http://pnd-co1.ir/wp-admin/jTcXTZUKyVBayQU/
  638. http://poliklinika-majnaric.com/wp-includes/pvFesNHOlcFLSZ/
  639. http://pomohouse.com/wp-content/h1hbm6-dsc5vhc-ikbb/
  640. http://portalsete.com.br/wp-admin/sites/fRjMOSbpWjI/
  641. http://postcraft.nl/wp-includes/DOC/9ucn9lbk0evvl3w_y5xxqjs-51364579987/
  642. http://pp.hotel-le-verdon.fr/wp-admin/vwyw609eg_q4z6b5vb-447854009/
  643. http://pr.finet.hk/wp-content/uploads/lm/tJqbOIzpNnAojYjKfZZTHURdjYo/
  644. http://preownedlaptops.online/ks5l/Document/yxDNOiJEE/
  645. http://progpconsultoria.com.br/wp-content/uploads/2019/mtwQEAEeeFBnTuyxpgGGpToBfv/
  646. http://programmephenix.com/mnvv/nati-xyu31h-djkrvd/
  647. http://progressimos.com/administrator/paclm/shewunrxfqofa7l0r1bqpsv_jt9umsge-64903301/
  648. http://projetoidea.com/wp-admin/css/colors/Document/bOfkSUDpZJnkUpVhOTvSCniJUo/
  649. http://queenslandworldwide.com/wp-includes/Document/TSKypjDzolNZmYhskHHxxsBqergocB/
  650. http://rajachomesolutions.com/wp-includes/WCFVkOrSYEDRATDAUkVq/
  651. http://randpassconsulting.co.za/tanaka/esp/tMrrtPPZGMLJB/
  652. http://rayofhope.ga/owed/LLC/MlOQNscDVMgzLghPUoSDbh/
  653. http://reborn24.com/wp-includes/paclm/bvWfaPrrtYzWfmUTsji/
  654. http://redmeteordigitalseo.com/wp-admin/EiqUyfsamGypESkkwfYPhhxe/
  655. http://resourcesyndicate.com/ws6g/seo29f-r66g1-vddel/
  656. http://rfsignals.ga/wp-includes/Document/DpPDLElXFQJNz/
  657. http://rogerfleck.com/heldt.adv.br/paclm/kkatjehzwf2u_r4k5x-42644584/
  658. http://royalcastleisback.com/shop/o56nfq4dovs15dp12qcdfy_mg6owx-8087626464/
  659. http://rpmrealty.ca/beta/paclm/slz1jxe3feshr8vkplqbcmfh_t12t6cbmg3-1873836606/
  660. http://russiancelebrant.com.au/sijx/LLC/53p16znegdle7i045skph_95k3jjm85-8011757415/
  661. http://russianfooddirectory.com/wp-admin/esp/pZgsnxsaYICHHNQNIuArp/
  662. http://rvta.co.uk/wp-content/uploads/1inofhovvs_qv7irpgp-09528951076247/
  663. http://rvta.co.uk/wp-content/uploads/FILE/4id0vs6k03q69ylkps_hzihd55jv-7221840743847/
  664. http://ryblevka.com.ua/wp-content/qrBRyjUmVghuaTLERuZmjEJABTKadT/
  665. http://sainikchandrapur.org/wp-content/DOC/usFRLpfIIEDJ/
  666. http://samcloud.spacialdev.com/wp-includes/INC/FhWddbcmDtUNHeeTNOUrBvsB/
  667. http://sanjeevanifoundations.in/wp-content/FILE/0hrvupw0qo9arxon9qer1ii_oyfdb6vcc-172111567259719/
  668. http://sausagedog-design.co.uk/wp-admin/LLC/tm21at84ricxhmsmgr1t9eyn3y2_k814dyf9-85042375682936/
  669. http://sayds.in/wp-content/uploads/paclm/grkmru2h2httve5vrs_bpchijtth-0292583104/
  670. http://sbwellness.org/wp-content/LadwguXLXw/
  671. http://seashorelogistics.com/wp-includes/paclm/nq69a2c65h1fypr61_04awey6h9s-343465956/
  672. http://selectfreshproduce.co.ke/bkpi/INC/nh5se2c9sedmbtfvr1i_ecayvl5w-03427521/
  673. http://serom38.fr/wp-content/INC/FurcQzUYyFx/
  674. http://serpscrape.com/wp-includes/Pages/ipAIoSmqmzJroHHOkyijT/
  675. http://serviziperortopedia.it/wp-includes/paclm/nJqHOkYRZRQQsgCOluXnBr/
  676. http://servyouth.org/wp-includes/d59814l9l20q04gjrl_x7vsov6sjg-78774900983/
  677. http://shahrubanu.com/fkix/427zyjgqewhxzauclqwgpo9qe7icwp_qvp9i63-13273134/
  678. http://shahrubanu.com/fkix/paclm/QPcBYSGYAjawCtm/
  679. http://shop.superdouble.org/u9rc/0tw86y02eh7b_85meqbhx11-9280594398051/
  680. http://shoppingcreditcard.site/nxve/INC/AoqcvMnUhozmwc/
  681. http://simonenogueira.com.br/oqazl/esp/a0q7d48zmsntgqf_q3n0lr5a8-794080952/
  682. http://smacdigital.in/wp-includes/sites/h3a0ne9tk_xpp424-945989645/
  683. http://smkmitrakencana.sch.id/wp-content/mqEFSSietHWJFKivrCIdPNBpHqpnaP/
  684. http://somethingnew4u.info/wp-includes/paclm/kpusm35vpam9ysz18fi2pu1pof_nxvcqp5qiw-686167943954256/
  685. http://speedcubing.ro/wp-content/WxEWTbGiGwBTWF/
  686. http://srigowthamionline.com/wp-includes/paclm/djo4puwz40_9q64skj5-651614884353/
  687. http://srishti.saintgits.org/2017test/igyu321k9z7paz475xx_3u8wakyj-2226599603/
  688. http://steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/
  689. http://steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/sites/nANIISuFCOTmhNmZ/
  690. http://steveb.co.za/wp-includes/lm/f02h2lkmfb7kcj1nbrlp3i_3cktlst-6819507672/
  691. http://stlouiskitchendesign.xyz/wp-admin/paclm/iBJyRZwYcdJBHeTeZgKMXiNYmiJkGL/
  692. http://strijkert.nl/images/Scan/l9uv88kgjn8m2tbc4pc0a_vagbp1-30861241102713/
  693. http://stylmusique-dance.fr/wp-admin/gd0rw-jkmf8x-bvshgtd/
  694. http://stylmusique-dance.fr/wp-admin/Scan/gc02l101qcp0fb3crq_t59tqt2lt-359499060193581/
  695. http://sulfurvacations.com/crdservices/6g9j4aud1mkkl99ijuv3sbeq_t91rmyji7-08924296/
  696. http://sunrayindustries.in/wp-content/uploads/lLnphTVtuoqRO/
  697. http://supertrening.as/wp-admin/DOC/z4ud7v9cqlov1e_ew27e-0837187980/
  698. http://suremerciesofdavid.com/wp-content/Pages/zmeuceo0f6b2girxge3i_m4jdxhtq1-614443980032611/
  699. http://syncopeafsummit2018.in/wp-admin/xwxem0dgxqvpbltyredb_v4dvmon-2169838020/
  700. http://t3-thanglongcapital.top/wordpress/parts_service/rpPyyYVy/
  701. http://tanimura.dr-clinic.jp/mwbhpwp/INC/3fxbhiasv_7f8c5c2i-8851618082907/
  702. http://tapchidongy.com.vn/getdata/tinymce/plugins/filemanager/RoIyCKahDJmNCbpJdyLwOmL/
  703. http://tapchinguoibenh.com/wp-includes/lm/nDLPXtaP/
  704. http://tassietigerknives.com.au/wp-includes/Document/h8m9enf4s4n91na9qj_1slbr4xew-67186800/
  705. http://taxlegal.mx/cgi-bin/HliEaUfqrmTGVfmUvIYukOMQyUwWv/
  706. http://temp.dkqualitylifestyle.co.za/omox9jx/byktbpp8_eoabihuc-61957179/
  707. http://terradyne.org/mobile/paclm/rj4dpf2iolbcmj2u_ng5yatax-825266693/
  708. http://test.ruiland.com.mx/wp-content/DOC/MiYvypocoTliyWLBnGLlKxM/
  709. http://texasarthritisrelief.com/wp-content/Document/wi0n552n_byicxbe9-14329692/
  710. http://theconnectionsindia.com/wp-admin/INC/cyjeespmksle3d13_d6trnm404e-293210172/
  711. http://themarketplaceuk.co.uk/cgi-bin/TtaKSpZZ/
  712. http://theoraclecasting.co.uk/wp-content/hheFtupxrJDmSftGjhXxhQQv/
  713. http://theoraclecasting.co.uk/wp-content/Pages/dvc9zjg3tbsos_wwgnhoi-787709609/
  714. http://thetahealingakademi.com/cgi-bin/Scan/tbjsfy7bjed05phmk5z91_ri1s0-64806956/
  715. http://thietbitruyenhinh.tv/wp-includes/Document/rqza0x77u5huqtn6cp94m8_dkf6p-02264187669415/
  716. http://thinktank.csoforum.in/wp-content/uploads/2019/DOC/SdycWQvhYEVfLIkwGYEuJ/
  717. http://thomashd.vn/wlztvi4/Pages/hSqJaRvn/
  718. http://thuexemaydonghoi.com/wp-includes/DOC/UjThFKnWkCpRvnwhiaFslaBEIji/
  719. http://thuexemaydonghoi.com/wp-includes/hn99w4k-1zch63l-qekaty/
  720. http://thumuasatthepphelieu.com/wp-content/INC/XCkNNQuOLzotYuEgOQfUqqN/
  721. http://titancctv.com/img/f3q561kb_4hz9e-274656581165/
  722. http://tocgiajojo.com/wp-content/uzsnwg5-o52th-fcfnxm/
  723. http://tokeilaw.com/a8rg/Scan/cx1hzl0c1t_c323w3sjku-0962793952/
  724. http://tokeilaw.com/a8rg/Scan/el13WDVlhSm/
  725. http://tokootomotifonline.xyz/sitemap/9pzn-u7hfft0-gwhdl/
  726. http://tokootomotifonline.xyz/sitemap/parts_service/z6jtjto5x0f68w1hq8ewi2qk_5ixa3mrso-088945941/
  727. http://tokoperalatankantor.xyz/sitemap/TsIccMVVrScfePvHrBIoDFVGcK/
  728. http://tokosuplemenonline.xyz/wp-admin/sites/sixjgknzbqwtdele80vpc1h0ps718_b3xuy0bln-6276763520/
  729. http://toyotadoanhthu3s.net/wp-admin/86s0vl3wunz4vg4w7veq6l53i_gd5dy-6390446360/
  730. http://traindevie.it/wp-includes/FILE/kwm3vq3r954lmpt_tq03yc55au-41720308656/
  731. http://transkrupka.pl/zi6fmqr/Scan/l08a12bt_4bpyx-888432534379155/
  732. http://trehoada2.ballybeauty.vn/wp-content/Pages/RxcvtROyS/
  733. http://trouville.se/wp-admin/INC/CTuIGqgAnm/
  734. http://try1stgolf.com/ebay/DOC/BRyipBnKPUZBV/
  735. http://try-kumagaya.net/4_19/INC/fen0iluzo715x4e59yr_mhlgj-16907241903/
  736. http://tummetott.se/wp-includes/paclm/z32z8wxl5i4xye7xoqq7au7f_67bsid3j-242689280338/
  737. http://turansaribay.com/wp-admin/174va925_3bvwve3-77364583067141/
  738. http://tvsabogados.com/myadmin/js/53034evrhbqrjf11l7nmk1cia6_v5btiub00-26351845/
  739. http://twinbox.biz/HlAGS-YbC7afvsnwR4ytu_xrhstgsY-Ai/parts_service/wq12ndkai0u1tk8_dmvhh09-5921915097/
  740. http://tys-yokohama.co.jp/FCKeditor/BUSYVHdalmqZiLHLBPuMh/
  741. http://tys-yokohama.co.jp/FCKeditor/FILE/eWLmOWAEYCHONEaPUaoeFcFij/
  742. http://uberveiculos.com.br/wp-includes/6b2hgaij5nwk4jyksy7l_zftgygk-538562898836565/
  743. http://ukdn.com/TempHold/510xh7rcpnrrni0lm51bnv5z5_bkvwa0a-76856304/
  744. http://ukdn.com/TempHold/esp/yQKTGLOKeWoZVhRHUpPRSxFsROHXB/
  745. http://unborncreations.com/wp-admin/hqvc-rdvrv-wchxjdq/
  746. http://unioncomm.co.kr/wp-includes/IXR/gr3199tz838z_s7d3uhl8q2-3499376866/
  747. http://urbanmad.com/wp-snapshots/FILE/ptPyzEKwifQYsP/
  748. http://urbariatkavecany.sk/wp-includes/e18ct7nfb92lr3i2m5p2fmfvpge_h95pvij-515950320361320/
  749. http://urbix.com.mx/phpmyadmin/h2rb7-uekj9o-ycrlv/
  750. http://urbix.com.mx/phpmyadmin/SDnjSGLMoQfmJDRodqqZx/
  751. http://urielheldcremations.co.za/gkuzmjm/INC/cdxab0y5_duqaj-553943998306/
  752. http://ussvictory.org/nova3/qkzul2ie_wldvw4e1wd-4883778900654/
  753. http://vantourism.info/wp-content/PXgubNdHTjyx/
  754. http://vaytinchapshinhan.com.vn/wp-admin/veBYgHzyqbSqQIEBpZZhxYekb/
  755. http://vedicaadarshkulam.org/wp-admin/Pages/qrq8r4bn2i86w93xlt_e5cnmcrzc-95523642748682/
  756. http://vegapino.com/wp-admin/vpLZWQJUtSNp/
  757. http://veneer.nhakhoabally.vn/wp-content/parts_service/411ku55zrdsajpqzj8f87o_dwx91heaqm-626592676/
  758. http://verbindingdoorcontact.nl/kxln/INC/PXWKMmKFRTQfZGSYTOhbs/
  759. http://veteransdisabilityinsuranceattorney.com/wp-admin/e6u3tl33f_srobva2p-05883247/
  760. http://veteransdisabilityinsuranceattorney.com/wp-admin/tp37-esyx0-pxqtztw/
  761. http://vic-cash4cars.com.au/wp-content/LLC/h9srpbxwz74iswwspuxgg3nqbt6ixz_c4ad5-20336652544/
  762. http://vicentinos.com.br/wp-content/languages/paclm/wsPSobKugoTzZQpppZIDCPVvrG/
  763. http://victormartinezmoreno.es/seguridad/parts_service/u8a5s8kti1_1hri2q-97732345/
  764. http://viettrungkhaison.com/wp-admin/esp/kcRZGnoGRmZyWSzIXtxZoxDxIRYO/
  765. http://vivafoodsdelivery.com/wp-includes/u4gxxdn-s2fxh-ncqwkq/
  766. http://voyage.co.ua/mailsend/mpulxlvx3jnmvotudf20d6rwjjff_f40abukfy-6425362976073/
  767. http://voyage.co.ua/mailsend/Pages/jk5dyxkd0cb0jh8jy_lbnqgf-33112876/
  768. http://vzdp.org/__MACOSX/Pages/CAAquuyFfCVGh/
  769. http://walstan.com/sites/pages/css/paclm/g45bv2e4cb2nj0moljf_lys6jqi-84198824370/
  770. http://watchmoviesonlinehub.com/gamenews/INC/8vhzzkm1hko8jj_c139z1rht-8760028993553/
  771. http://watchmoviesonlinehub.com/gamenews/j9ki9a-w9pdn-kocltg/
  772. http://webdesign2010.hu/FILE/sites/UOgCWAODyhCRmEJqljwrWc/
  773. http://wellmd.com/wp-admin/SJSYwQyghaqk/
  774. http://wheretoapp.co.za/wp-content/l0mjnd-u5hz2-vvpvqt/
  775. http://wheretoapp.co.za/wp-content/lm/71qogdz927m7_5pqkca0tn-1809866685/
  776. http://wisconsindellsumc.org/psnlo/lm/rUIpaWVqZ/
  777. http://www.allowmefirstbuildcon.com/35rnm2e/paclm/m9ixgkeioqa5y1s_9slxjzpc8-660235145/
  778. http://www.athomehousing-co-uk.peprime.com/wp-admin/wnmj-5v0lj4q-ocgcd/
  779. http://www.autoreduc.com/translations/esp/br2brrxdd4j2nc3vcsvigm3uv9wnv_alui5-138781194700/
  780. http://www.bejix.cn/wp-content/DOC/wu7vi5ys8i4ihf0ym_rrfprb-421640917/
  781. http://www.blog.allwedo.com/wp-content/6tfka-azx8v-gtjqq/
  782. http://www.glasspro.kz/wp-admin/lm/ab0xacmyxgcr5oq1dmx_b8bwrxj5g-1248840572/
  783. http://www.habbies.in/dropboxkb/tnt9hrb-a76sy9-sadteh/
  784. http://www.jiancepai.com/wp-includes/INC/mTOGROlWtgqUVtptZExJ/
  785. http://www.mobilitypioneers.lu/blogs/lm/5yqyc89z7njo7cvw7gj_04roz5d-5355090859891/
  786. http://www.pomohouse.com/wp-content/h1hbm6-dsc5vhc-ikbb/
  787. http://www.ryblevka.com.ua/wp-content/qrBRyjUmVghuaTLERuZmjEJABTKadT/
  788. http://www.steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/
  789. http://www.tummetott.se/wp-includes/paclm/z32z8wxl5i4xye7xoqq7au7f_67bsid3j-242689280338/
  790. http://www.unborncreations.com/wp-admin/hqvc-rdvrv-wchxjdq/
  791. http://xginformatica.com/aydasesores.com/DOC/3z96sxsf86p8i3pqji0_7xr6ckmfxd-3681421790197/
  792. http://xkld-nhatban-infinity.com/wp-content/Pages/UdkimCbPaEtCcoeYNaPHFveYuEJ/
  793. http://xn--12cc9cucyay1cc.com/s0h5/Scan/hyzvbp91hgpm_487b48n3u-961769616/
  794. http://xn--m3ctl3exa.com/gbaaazy/DOC/gAcGjrjrjUtnFWNHYAoi/
  795. http://xtravdesigns.com/wp-includes/yxxmorpuzn4pe7zmtjaq7bpsbj6qqj_qsyx2d2-801123510/
  796. http://yusakumiyoshi.jp/_cnskin/sites/quPDOEHRQJJBbdYEMdaREIghX/
  797. http://zerone.jp/about/LLC/pnl9sbwu4qy_ozzj1wj1w-7564791705247/
  798. http://zuix.com/leads/INC/zdwj03ios9nbmiy7ryx6b2apnrod_79t70h-88368783614/
  799. https://000359.xyz/b/ssZQGvirvoYpfwO/
  800. https://acquaplay.com.br/a/xufdd-2n6ff-gpap/
  801. https://ahuratech.com/wp-admin/Scan/5b4bixkcui5e91xis396c563d0y_bu40zk5-852284955204/
  802. https://asnpl.com.au/chkl/LLC/1dxbbzv8_eiubn-11195960/
  803. https://bebispenot.hu/wp-admin/DOC/WJclZAxvymvdQiJXYqLEn/
  804. https://blog.bijin-co.jp/wp-admin/esp/xEbgYILWzfVkBrGz/
  805. https://blog.bijin-co.jp/wp-admin/i6bk-ofwiho-lmab/
  806. https://blog.daxiaogan.ren/wp-admin/FILE/HdAiiYuMaknFL/
  807. https://blog.kopila.co/wp-includes/Document/EKQRnJXfnmkcQK/
  808. https://blog.kopila.co/wp-includes/LLC/JSuwgPIaKbwMmEvgavQQ/
  809. https://blog.medimetry.in/wp-content/uploads/parts_service/eJnoHSrMkxGIqBR/
  810. https://blog.medimetry.in:443/wp-content/uploads/parts_service/eJnoHSrMkxGIqBR/
  811. https://blog.memeal.ai/wp-content/uploads/Document/ZFsLCmoHkqBbcmElpDUfJSE/
  812. https://blog.memeal.ai/wp-content/uploads/paclm/bSObtJpwzLRNyKmecBbxlFkb/
  813. https://blog.roommm.net/wp-includes/FILE/pEWIrRFjpdbAiSAGxkQTR/
  814. https://blog.thaicarecloud.org/wp-content/awtCcOlDLuWLcIYofN/
  815. https://blog.thaicarecloud.org/wp-content/esp/pVbpncDCtzkAknbFKdy/
  816. https://blog.thoai.vn/wp-admin/LLC/gd50b8alb4mr_3kk0ix4zd-469914473/
  817. https://bomfire.com/wp-admin/FILE/zy2ed0i4sobg3sfk9yt8_xom9osu8-12019337669/
  818. https://computerbootup.com/cgi/FILE/rrmecre1o8kyb7_7ibyl-5003418941/
  819. https://curmudgeonintransit.com/f9fm/DOC/fj19qanep33_msiv6q-949526099/
  820. https://dalood.com/sql/FzTbUjXIxBmdeTiXEwv/
  821. https://demoo.tk/store/tvrx2le53p2ph_63qresymi-20666281672606/
  822. https://diskominfo.sibolgakota.go.id/wp-content/mshE-eqmQIhrDtfajyEq_zJBjMJxt-Yo/
  823. https://docfully.com/wp-content/parts_service/8bag0o2rziq7_uqh53-86137533/
  824. https://dotnetdays.ro/cgi-bin/INC/73s559zuqod8z_g39odrkgg6-58079281636/
  825. https://dp5a.surabaya.go.id/wp-content/tyz4-52rml3-tdltzm/
  826. https://elitetransmission.fr/wp-content/Pages/ttrgxyacs2qcnklru_0jk32o4w-47168856156/
  827. https://eqbryum.ml/wp-admin/9lcj-t53o3-nzthx/
  828. https://eqbryum.ml/wp-admin/Pages/r55lwa7xff7muytssw1pc_i4a8w44at-785512967/
  829. https://escolabarretodejiujitsu.com.br/v5bd/FILE/wt8rnjq52zjgsk143k0mriprv5z_sl6ui62cg-0835748684/
  830. https://fotobot.ir/wp-admin/sites/kkeb60wfibwst8utsbrquceq6gkh_or0pbfdl1c-754853850161/
  831. https://franosbarbershop.com/wp-content/fyg8-t2gv8m-hgptkb/
  832. https://giangphan.vn/evhu/sites/dyhx36nd177e17b36auwyoo89r7vg_pyrwoh9zer-9704006111/
  833. https://glatech.ir/wbd47a1/paclm/6m9zv0snkzefi2oa7ys_bgsxzb5n-1732641113/
  834. https://itspueh.nl/cgi-bin/paclm/AEcdpTIsOXIlWmLfWzQpnGCdOkL/
  835. https://jvmahlow.de/wp-admin/Scan/td8nxrcnc9ntmco49_615sw-577633401958136/
  836. https://jvmahlow.de/wp-admin/ZWfaMcJmjYmgfATQmTZQGPGEYjjEJB/
  837. https://keaimi.com/wp-admin/7y5vfx-5i1leat-ffvhu/
  838. https://keaimi.com/wp-admin/tUtubqSehOpyHnaqTFxAHyxoaiSYu/
  839. https://listings.virtuance.com/wp-admin/jlrubop9_zkct0-800845530/
  840. https://luanhaxa.vn/sqeh/INC/x6yufaymc4d3gpdnoi2qao3f1trfk1_18aolclev-5636079340/
  841. https://luanhaxa.vn/sqeh/lm/xyrrhdcyuk_qyirb-35314660/
  842. https://manualdareconquista.com/Search-Replace-DB/0i7tk-pr0s4-rpdtehd/
  843. https://manualdareconquista.com/Search-Replace-DB/parts_service/phcz1fnn94ej2fpt9vc1w8e7ve_efs6naz-3849760247915/
  844. https://marketing.petable.care/wp-content/cpxmne0mul38rsgdxncdw1yulqbcet_0rryxqeb9t-9691010862757/
  845. https://maxgroup.vn/__MACOSX/DOC/4duyq5gmcuu375q2589qi8k0i3k4h1_cgufr5-8018679562762/
  846. https://maxgroup.vn/__MACOSX/Document/PzLwVKvPWVnHEXkDpCqBr/
  847. https://nangmuislinedep.com.vn/wp-content/pgbgOfwvndTUMZuS/
  848. https://nangmuislinedep.com.vn/wp-content/ZmSxYGYcnVUbcIIct/
  849. https://notspam.ml/wp-admin/Pages/espLunAjWsTlpVEPozgWEc/
  850. https://piegg.com/wp-content/77wszn7k8xpxs_97swpij7dc-39610063200/
  851. https://piidpel.kemendesa.go.id/ngcr/sites/bblhemuhe2tsn1q_z712zf-279336711/
  852. https://portalsete.com.br/wp-admin/sites/fRjMOSbpWjI/
  853. https://prearis.be/wp-admin/LLC/sfjcx2ghuc2_qiumnsx410-54676378932/
  854. https://profissaoredator.com.br/wp-admin/sites/IiGsnyFyHpld/
  855. https://programmephenix.com/mnvv/nati-xyu31h-djkrvd/
  856. https://russiancelebrant.com.au/sijx/LLC/53p16znegdle7i045skph_95k3jjm85-8011757415/
  857. https://russianfooddirectory.com/wp-admin/esp/pZgsnxsaYICHHNQNIuArp/
  858. https://sacmsgmgw001b.delta.org/enduser/classify_url.html?url=vn1ThnzZihkgHFvBYSgQsXigd2FROhFqovuC9pBEzpiVgOuDF6NXNoa9h08sWe+d/
  859. https://serviziperortopedia.it/wp-includes/paclm/nJqHOkYRZRQQsgCOluXnBr/
  860. https://servyouth.org/wp-includes/d59814l9l20q04gjrl_x7vsov6sjg-78774900983/
  861. https://smkmitrakencana.sch.id/wp-content/mqEFSSietHWJFKivrCIdPNBpHqpnaP/
  862. https://somethingnew4u.info/wp-includes/paclm/kpusm35vpam9ysz18fi2pu1pof_nxvcqp5qiw-686167943954256/
  863. https://stage.happinesspulse.org/wp-content/plugins/tablepress/lm/69n48itk8qxilwsdzz_sz0cy8ltkz-654037002/
  864. https://steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/
  865. https://texasarthritisrelief.com/wp-content/Document/wi0n552n_byicxbe9-14329692/
  866. https://thetahealingakademi.com/cgi-bin/Scan/tbjsfy7bjed05phmk5z91_ri1s0-64806956/
  867. https://tocgiajojo.com/wp-content/uzsnwg5-o52th-fcfnxm/
  868. https://tokootomotifonline.xyz/sitemap/9pzn-u7hfft0-gwhdl/
  869. https://tokootomotifonline.xyz/sitemap/parts_service/z6jtjto5x0f68w1hq8ewi2qk_5ixa3mrso-088945941/
  870. https://tokoperalatankantor.xyz/sitemap/TsIccMVVrScfePvHrBIoDFVGcK/
  871. https://tokosuplemenonline.xyz/wp-admin/sites/sixjgknzbqwtdele80vpc1h0ps718_b3xuy0bln-6276763520/
  872. https://toprebajas.com/wp-admin/wc5m14-63kcs6-fschrjf/
  873. https://urbariatkavecany.sk/wp-includes/e18ct7nfb92lr3i2m5p2fmfvpge_h95pvij-515950320361320/
  874. https://verbindingdoorcontact.nl/kxln/INC/PXWKMmKFRTQfZGSYTOhbs/
  875. https://www.allowmefirstbuildcon.com/35rnm2e/esp/c8frws6nxk2ttaf6r898572_975855y-7811681013/
  876. https://www.allowmefirstbuildcon.com/35rnm2e/paclm/m9ixgkeioqa5y1s_9slxjzpc8-660235145/
  877. https://www.bimeparsian.com/jz/esp/dccKaumjHEDnzyzm/
  878. https://www.housepital.in/services/paclm/w732u2chvgthcptjbvio_a4h1l-677539267161040/
  879. https://www.jiancepai.com/wp-includes/INC/mTOGROlWtgqUVtptZExJ/
  880. https://www.mobilitypioneers.lu/blogs/lm/5yqyc89z7njo7cvw7gj_04roz5d-5355090859891/
  881. https://www.newlifepentecostal.org/wp-content/uploads/2019/LLC/LLC/p3k5n42wjwi68vvbjo0aqpqlf7qr62_ul9b8-95646978580162/
  882. https://www.ryblevka.com.ua/wp-content/qrBRyjUmVghuaTLERuZmjEJABTKadT/
  883. https://www.steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/
  884. https://www.steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/sites/nANIISuFCOTmhNmZ/
  885. https://www.thermalswitchfactory.com/99jxom2/LLC/bmUEVnPQSwwGnQMrQhVpSwmHLk/
  886. https://zun.pl/wp-includes/lm/y2ibzky42_16mnd-407455180/
  887.  
  888. ```
  889. #### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
  890. ```
  891.  
  892. Creation Time 2019-05-06 20:00 (From ZIP - JS Based - Fake Error)
  893. SHA256:
  894. f0a0ff72ef478cc0b4d54d407d34861db197338f4bb87a906a8eaccb9a577981
  895.  
  896. http://larissapharma.com/wp-admin/7nwg2/
  897. http://brnathpaischool.com/wp-content/k2hfdu5149/
  898. https://freewallpaperdesktop.com/wp-includes/mg9f6a926/
  899. http://sulfurvacations.com/crdservices/mwm32628/
  900. http://andreahumphrey.com/aorvuye/2s0yye7505/
  901.  
  902.  
  903. Creation Time 2019-05-06 13:52:00 (DOC Based - ENG - 365 Blue Box)
  904. SHA256:
  905. 37e110f030243700bbcc20a357507829ecdc2c0b52e55c5593b4073c7ff295eb
  906. e5e8948a51d53acdb368f7fc4c7f78109d1a9d6454379c6e4c4ebc60e23094cb
  907. 6c63c15d17e6293e0383d3e9f541d24a5eb0f475dff79be7c40d59f15211b034
  908. 200c0fecd0fbbaba4e4590f1bc1c0e3d890e87b2d6995f67cefadc63ea5266ac
  909. 0ad7ef046baf8eedd9a8aa0e7e58281c3f58d6dde569907e2b61057a6a3b9dc1
  910. a30b3b9f9c59d1fdae4370a14ec760d464a46b737146fd6e956215c50dfe9e60
  911. 531ae2ac07fe5c76b8a4545de97d4d24037952346edf2b77499fcd1d556e77da
  912. 439c357d6580f7ecdb803aa68fdc2ecb49ebc22c3a47b44cc86d7d3fc731dbba
  913. fcf4576f7f349baf0fa6b44c3038228d522ae47703f5ef704a73ac5883b6b0b7
  914. 91d2b1fdefa2b92e12f6a29b983ff7bfae96407016bf7852989518306cee1d13
  915. b4bda97091fd2d25f95d93d49b3dd2c4954fee2d30761e60cc947e10bb95600f
  916. d8e3cc0b24065941fd4e9ff01c67bdb04b6ca5d3f95221af6b183a2022781c53
  917. 835fa905bb21753489f3ab5ef72b7d309b752a8bf0d3b78560484b09e5ae54fb
  918. dfd0298087f839b3ca87291dfd52e60e32fd787ee80220abfa35f33bb4d2d243
  919. 70cb7639e2472dae47adb048b001c37b5607398eabde61e928ada080a525389b
  920. 38dc0d28418e58044c11b145114d79474356f862ffbeee3fc8a236fddf79ecd8
  921. 644162f3bcc13b06ab153dea3649e4c2c7db4fe3236e96f139d341a91d39dcb1
  922. 88bd4e527a7ce0e367cc56a9c490b803273960a3cf0fc17e5ce8447ab2eede88
  923. f13b6d9e53bb9bb275aa55fd2a5911ea26b563695c8b53e5accc7ed98d8537ff
  924. a79e5319a719728eaad5e3a5dc9a260c6d8cfe22b0464fe167b0bfc1bb78a1a9
  925. 881dac6ea2829a9ba3441c4792ae7ea1ab7f1d86a39f203bb3323d89cdf6f0e6
  926. 702083a3c878292d8fa8dfab659b3701ceacaa6e6c4b4d99b96e6f60ebb4f17a
  927. 66fbaf545ab458fe412d2bd5259f4ec7bb252ccf63744f87f16b4e206bd9b88f
  928. ff701a4950f2a97842e269dd6ab4fc9a1dbd026f04ad08934384b69b76e9bc06
  929. e7163b770e50088a1f410dc7f70c41c162ed500b41e9c63308c6377df046949c
  930. 67b9f487faa6195315d2c3ba1d6f0cc150afbf30a3eeba33cfc9e26f99b8da87
  931. 837b614d822f72169e306b96e42ccc57cde081de831929365844ab8092bb948d
  932. 845ab4a4f0d5de4878c625312b025da5c44631b8e3473a7720b0bcc84701bb08
  933. 1736a5fec55fcbff7c34aaea508d3cbc7d84d25bfeb2326b4d87e21fdea9555b
  934. 94b2fe11aa2a2eb7b1018dee22a9fc141dbfcb80d4dbe15c7228549abebbfb8d
  935. 08319dc5c79f69f999c43bda399edfe337698a0bf28a60c1307d6160977330dd
  936. 5b004a681b921a503c2933012b4a819e86ac5f0c8eb08480255fa8c9c109001c
  937. 0f09442f4dcf353025773b25fd92464bfdbf2cec229af27be584e20415ce87dc
  938. 1b8ca19255213755e98e097564583d548bbbfcc77460ca9368ffe7fef819c6b4
  939. 5eab5cb4fb133b10a3499097e2cfa6c7d7077323040e45ed6e9132aaadd713d7
  940. 3bd6b6dcfe161342538c025db4d89970f535a1c13f2b948b7c421dba54be1dc5
  941. 55b50a5fb2d944444c82e2e79319c211a7febd56b2c8c68a7aa66741c2adb155
  942. e834927d6d99ef29246f793c85cd7211fff5f17427c8967f6c7b53babef17523
  943. 7367f03df611383d249e10f6b90d3a2ff4a95c14ddb03564961e8f87a63ec2be
  944. fe6dc97be807db1304c5b4c65004296c025ae17194bb4dfee4da015895e042a6
  945. fab553ad3e67792c49dd743538e8eb15fb889b5ea3163ea441590a9bd9feb6b2
  946. 52069c3d00babbd932506c680d4b05bb7c868af558ffde8d6f3edd12239239d2
  947. 49c47926fca894b6de21bd9fc823ea037c33b0caa32ed56a0781505be40e3eaa
  948. 5415ec582a337a38edbac0b18f834862e55535d762f8e0d940f2ab7b7b272ec9
  949. c5cc7e91909df140bf2bd01d78e6ea7cf88b8d504fcea395c6e5296336f1a741
  950. 9e656927b5a7e1130cfaaa3c49106b70840afaf795d9dcb992481e61728ea931
  951. 16afdd560c3beacbb5218052354cc99388409971f2457c366e63ba2b2d718474
  952. 7bafff94116e800445de614e67aae74ac83c45a61b7fef4aabe4863ba0d66f91
  953. 6214a5a90f19c3293325d5003c547ef4e6c35c44f9d9fa06101a7ce930eb896e
  954. 7a8dc7eb9de5085cce063231238529a8fe07cf3d696972aa34aff766050ff612
  955.  
  956. http://academy.appspatrols.com/wp-admin/lknq2ph1495/
  957. http://aiglemovies.com/wp-content/j23732/
  958. https://www.jiancepai.com/wp-includes/j31/
  959. http://adspromosyon.com/public_html/9q365/
  960. http://blog.ploytrip.com/z9cr/j51617/
  961.  
  962. Creation Time 2019-05-06 07:38:00 (DOC Based - ENG - 365 Blue Box)
  963. SHA256:
  964. efba61ea3d63a1535ea3d46a0131ce9359ec22d1304fbf5a3abc43786783adbd
  965. a462dddf978d17ed864edf4e25514e9198898961687636c081345862daac3bd3
  966. 29493db2fcf2c08ae9de7a261783ef588735e6429aa925dd765d67126e012ccb
  967. eaed3b4424222aa5d90937bed45ac5f41504ff6f6ccf608643fec1c03fe1e361
  968. 92b4900e64441e7170f926c86f62433064a8615ccc60e6df5b93b84d6b718e14
  969. b7598ab7eb525811bb10d9b666eb2afc34dbf663a6f69790e511abcc2c9de2a7
  970. c4a2709fb5a3cb439645b51cb5d185a99a128aa498baa2c5b4ff6bed08b58225
  971. a7868cf60294144aa99126e4178625804a1b8aeec5977c711f219144621b042f
  972. 311e0e6e791ef0ad7f4363ae34842151c8ad5b4f5be32256685a9f6c5bf6382e
  973. 59d88550133280cbaa67febae6bf60a02b7715636adaf171e3e223cfc9ff38cf
  974. b538eb4460b2193db1d98ef32ced5090415aa3134d8414668b99aafa7c9f85ce
  975. bc6d84632fb6505c591e886b4317bb4d959d5fe8343c33b3145e432025b04ea9
  976. dcb5f0712aef6d2eceb3038f672f530f1c46aaa32b8aa09bd58cd303fc1c32cc
  977.  
  978. http://duanlocphatresidence.com/wp-admin/f350/
  979. http://momentsbynatali.com/wp-admin/tvdt421480/
  980. http://merodeshonline.com/wp/af133599/
  981. http://nguyenminhhoang.xyz/wordpress/ip21979/
  982. http://inpolpe.com/stock/zjgv6686843/
  983.  
  984. Creation Time 2019-05-03 18:25 (From ZIP - JS Based - Fake Error)
  985. SHA256:
  986. 9d322774893c0f550caaebfda131701c8ad4c81c95979003ee6620e564721eea
  987.  
  988. http://sandeepceramics.com/wp-admin/43/
  989. http://blog.wexiami.com/wp-content/uploads/jo2yr0b8/
  990. http://agengarcinia5000.com/wp-admin/c8lbx8i47134/
  991. http://simpleasis.com/wordpress/zb86/
  992. http://agelessengineering.com/cgi-bin/q68/
  993.  
  994. Creation Time 2019-05-03 16:05 (From ZIP - JS Based - Fake Error)
  995. SHA256:
  996. ba818a3e50dfc2840d643a637a7ca635b2091a4ba809ee4c4918fed4cf086d7f
  997.  
  998. http://pranazfinance.com/wp-admin/jhcrku6822/
  999. http://eismangolfacademy.com/wp-admin/pz47/
  1000. http://mlx8.com/wp-includes.F0F6/js/crop/vuzw12992/
  1001. http://sliceoflimedesigns.com/journal/p661lp25156/
  1002. http://terebi.com/best/eb9g1/
  1003.  
  1004. Creation Time 2019-05-03 12:46:00 (DOC Based - ENG - 365 Blue Box)
  1005. SHA256:
  1006. 1b64225c9472f4dc1a2bedecc8f0546f6f4f3cadba0fec645bb725ecde04e460
  1007. 3f4c99947e2c6cbf54cbd0af43c3954d5d7bc1d70ad438433860d85035944107
  1008. 89c6f56794507b9886261d08890dd94eb91de65eb67e3e03c3548d318df42ce0
  1009. 360c6363c1f6622a2354587443c064059d708b343853c654d76734221b90b9e6
  1010. acc62ec026cb44a5c3961add0a5a8b4c158ff4cb1245aef9fab8c771353637f7
  1011. 4f4555801e720272027a316c161222b2406e8de9b1f47b9dfb4b1a7a90158cde
  1012. 5c6328680ea4b4f29afe79115d99e1e26b814d18b2c06dbab46c85ef8ac744d1
  1013. ca6f15f7b6e3f9ccc958aeb6f5adb5b262b5fb1237c3f93d4b12bf102e413447
  1014. da6cb942c76732ced6539a0baa9bd728d0a42c182c1915efc8b775c429a8eaae
  1015. 778e9de55075c2419cb7406fa9ce74c0205ba9b2465fa7759ea2e8bc3916e14a
  1016. 591f288ce101a88295e3abca19f88bf3bd22c1b87e1bf924876d815830324bec
  1017. 7bf2c6b550916c07546c17717e20c264467047332772fee061be6e1fc499eb54
  1018. eb8f122206192485e482036ff59a454af71bd66eda5ae2ba2fccc593cce03cee
  1019. 20371e56c31cb730390fc2bd37b7e44cd3e1411d51604e9f4491e260148bfc2d
  1020. c0ef556d5f6fd532731338a97e452a68d90300ca2cb75a83e9512c355ca2f39c
  1021. c5211cba5f27e7183da7223b6030705179d406b7afe2a5fdabb6fdb3e554c06a
  1022. 3b117552ad3667949c83ca29dc2e44f901993fdbd3b437fb4bf2d124093883ca
  1023. 1e26f8660aea5766e24921c99b2b7cecc468627f5e629eaf316629d794ccae06
  1024. 5bb70d20710dfb8b956c9f3e1bc21a84f4e7cdd1a763396d925c3ab3714b6c50
  1025.  
  1026. http://tklglaw.com/wp-admin/yxq5487/
  1027. http://jacknaut.com/wp-content/mmcjd72/
  1028. http://todomuta.com/tm/00f7/
  1029. http://tokai-el.com/download/8val0640/
  1030. https://000359.xyz/b/vyf0603/
  1031.  
  1032. Creation Time 2019-05-03 07:54:00 (DOC Based - ENG - 365 Blue Box)
  1033. SHA256:
  1034. 1aa7932c2f2de279f71594449fccfac71b56250295cc3ba7ed8522b1f8e050ea
  1035. d79cc4f34b6ac9b5c9b65b3b83e57a37939488a82ddf6716c7f416171c066514
  1036. dd7d4846405047474ba6c0f9de262e797ad5bc835782cc95b8a41372f34940b2
  1037. 32e7a769fabafbd9ecf19678aadb044a9a6dd2160ab40958b28e902153bd9988
  1038. bf95e0d677aca5670e336bd800f591278b523bcef12e018038caa852c601a897
  1039. cb3827cc580a8a344da35e5e10662de89f57e78934eecabcc6fe485fd0c92058
  1040. 4393d372fae1640559afa2c2d2f0462128a0a80e18bed2232d980aa8506b50ba
  1041. fcbb0e1802f6398901e23df4e9e44f7c11af3c772690587bea61e97bc7bab31b
  1042. 4df2df8743fe6468bd0b15da2a012e26bc025f671965961bffb3cb1a93101ec9
  1043. aee3d47238f43325d1697f6f6fe799855e5911a36b6c4b7772b1e60f7961279f
  1044. b43a107340c5f6eb611f789f421d1ebd123eedc78ca75348c93120c9c5832c63
  1045. bf43461ae64276db901ac03b38cbe28de302db735cdeb8b6050508972cc21c29
  1046. 52c19198d41542931925dbb77b176d596ef7a21b339b55d55491d11c77cb1bb4
  1047. 4b507ec53d33911e9be00cf02be247f671c9faf254e77ddc795461ed6e36ebdf
  1048. b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
  1049. 2410269f1d7fdf5aa7a5a77ffd4f41e8a9b8cf1e505b04ef85780eb190879e0c
  1050. b77fd02db11b5c4edc18c27dfa1d71a2b51f4b603519ddcd5f509a5c71d0cbc7
  1051. cf9442b59244eda63c42dc742a2a3f5870ca8d461fa138fb70419005e3ea03e0
  1052. 532387fdb803b3eb14e9876dea7ffa36195ee028e636800748de95d4f85876cd
  1053. cf1bb62d13827094b60dcd365349c29cb111f43ed469279181404f874549a729
  1054. ad03906c163d9b68f08e023f0a4ed43ad5d33e1287c5defbd6e0f0c5d685cfca
  1055. 35e2ed0acce060d4b89b67fd932ee1108486cf67e03b802e16598af65a6ccd2e
  1056. 0e5366b89fa75014997e5d30a0c3af6e0f314a36916f6ca75fdce43ed7321dcf
  1057. 2aa2f2b609f64083b2aff56179b78a1bb33ce736fcd5481845df872ec2dd25f8
  1058. 4ae43a575cf9c40d490b0e82b0603022a7a6cc825d5ad37ca91383b4fc6143ee
  1059. 8ad263fa68196629abe4de4c4b4b61e3ab021935a1ac40569d57f3a1b2ec5f51
  1060. 911fca3557a0483d2641dd4c3738ffa6cea4321c7a2de982396e396533387639
  1061. 33275d798071759837c5a01a75c524e50d5ce2a3a7ddc4c58b50c087fc321e44
  1062.  
  1063. http://gscrow.com/wp-content/z768/
  1064. http://museubispodorosario.com/wp-includes/6r21947/
  1065. http://theunstoppablesummit.com/wp-admin/w4bsb1t03/
  1066. http://nusantaradatacenter.com/wp-content/upgrade/g2/
  1067. http://blog.nakiol.net/wp-content/f38/
  1068.  
  1069. Creation Time 2019-05-02 19:30 (From ZIP - JS Based - Fake Error)
  1070. SHA256:
  1071. ddba8ddfb7c42acb88fad6167a50fe635cdc0b0fff6cb60f5e3042521f2b178c
  1072.  
  1073. http://thecaramelsoldier.com/wp-includes/ihzn9vr858/
  1074. http://tucsonpsychiatry.com/wp-includes/pd70/
  1075. https://toyotadoanhthu3s.com/wp-admin/hf4zkre2/
  1076. http://trackledsystems.com/cgi-bin/jqywt14488/
  1077. http://uzmandisdoktoru.net/_wildcard_/c52633/
  1078.  
  1079. ```
  1080. #### SHA256s for Epoch 1 Payload EXEs seen on 05/03-06/19 ####
  1081. ```
  1082.  
  1083. a8844c582eee6f4d58fb6903c0a82e9d74b917083c9284ee7c28aa4755ae3e11
  1084. fa593a4fb3c16f2da01985de16f795b360224b898d4c0ac021dfa16d8d92b230
  1085. 65076d9d7d805863f299cd52ff42992204b9a1e6b85b1902bfae583d57989f7d
  1086. a735f0c8e04341ee3730dfdd4d2c3c8fadb01e5fca2a7565cf3adc7ca7b17e47
  1087. 6fe667d94eea4371e6a5c66edac08b6601226b6ce64a93c8cd36b9f9428e8a0d
  1088. babce4658c3f4d63288b76fdc7da26625d694c8351505cf85265d148992d35cd
  1089. ba5885e7e7293a51ade4a11fa261f60639901b6a16555023507fb0eb5e670f88
  1090. 2afa67df487a68a766cabf850090868320dc839ad68cd04c58d0a28578421932
  1091. 13920fead2fce80a0aba939188ddd0515e3cdd8a5b05982f75f26e5dfd8426d7
  1092. aaba331856ef07557371c39a7747084646d61be63aaf036ae21014602703f792
  1093. a95b732bc39e114fb799e5c1ba1a90088ee761e352e4e82a86c39c4a355a58c3
  1094. 5d70494e59a48558150b69d09fc941e64594939a0541e5f3ef99d22ef15a6d8d
  1095. 1c22632e5d0e7eeff84af51dce65d81a0cb812b418840ce18f5db5169cb5ecdc
  1096. b71d5d19eaddb350abe6d186f253d58f6833dddcdc491639555a5cc7fd90a5e1
  1097. 53104a13062fc35ba767db165c47f721f4f8a274a26b9f29f92da89123d04860
  1098. 7228b06b56ecdcea47500e1855f2724d561f23142a51ef9c4c43f946ae8d8654
  1099. 3f9ae557f1e1c9b87c8c4fc39b25278293c63fcf53d48148076f3bdceca91f4b
  1100. 6b9226b3c8e9ce6438bd8f8c004eabe1135281c3434bf131e2a75b3d856ca41b
  1101. b22c5dab4e2f09bd3455ae4b7ed8bb24d45c186d0c9efcf3180a0f39b956a9a4
  1102. c681eead40aa07529aa726681bd31b54c60e5e1131d3eb9181ad408f73f07cdd
  1103. 82e943e093e87bf53d3f9ea69a2de6d533afe25c7c9f0a2fb78ff312876456a0
  1104. 054ef70ae9edd8880db6184a3a838ed6a5031baceedf6895b3593f2a6fe4ddce
  1105. 58c56f419c6673dca5a0261786a6b040e25b3759a79f159e5ce1f5966c0bb9c2
  1106. 16f8f131f08c10085d4050e86d82a7e74110eecfda618b619e0ca9a5b562f6d4
  1107. 64ee3db10f0483d7f669299432878bd58ee179dd3e54412e9c5026bf71131633
  1108. e42d17d18761063022077db02aaf33a6916d0f0a5c7f3de449997f05075ad78e
  1109. da58313f4120bd28cfdc1f9c7a7746fcc8f4d10bc1f11076d8399587a10c2571
  1110. 3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16
  1111. aacfa30d7054ac46b10624320d5cebbe67188fbfac4205e635035fa453cc3470
  1112. 23dc61aea66537be8852ee61981c7561f82788fffab0e35a338805583cc7b60c
  1113. 31f6cdfde4ee1054fba9a90b0c2f2423fe3913706a1ae4c05524657c751f1367
  1114. e0743e395630cc035a7dfc418016cfc3a1006ae5cc55beae1e900b4f6b3e3899
  1115. 161ecb52e3cc9a5c9adc651152314cd58d376aed8b8dc1feccca6a140572542c
  1116. 49e92c6c178810e71a0aaac8d5bbb71d83f41029284ee9c68bdf48a4f8ad77bd
  1117. 32d743b223fde2f94683c32f248d4afde4bab2e73375103c08270568f3d9b4cf
  1118. fc380ed01f80f2af4815b19b82390537bcd20ab28430d1ffd9e3d7242815a700
  1119. 298e9b9ce2552af04b53f9e05ec0cc576debc96742917b4d5dc3ebf1dfdfd99b
  1120. ea20d3003f64f381a7d4b8cdbfbdf083806b642fe739029c86f8dab4b43f33de
  1121. 030e33195e3c5b1e74cea75e010d10cf77c6a2fc43ab43f0a679f16361a1cec6
  1122. 13b19ad9ca89df2907d1abddbab77cac5d375deccf338bc597e7fdff3ff4c96d
  1123. 58f5fc039e9bfe941b00a764a9e80a45e9620932ef4a9d5f7812f05fff8f2556
  1124. 002b8b97dd6603dcd5c0fa09c368375d80c9bb8f4da7610f91e0d7b1a253277b
  1125. cea9f9818c78f2ac4c93c2a8031bc28c0246885bf90dee9eeb444680a971556e
  1126. f241cf5e46d3297068c912e494c24da89027214f0304e931b4264f2842f39f65
  1127. 21145645cac74e0b590813eafd257a2c4af6c6be0bc86d873ad0e6c005c0911d
  1128. 2c9b8ed7cb7ce9b49579453283292ddf478c6ab2953b66c27aac8dfc84c6fb2b
  1129. 9951185e475ab303b91c189543e84067574a1b1cbf5b94e6ce6e1f38d47d2260
  1130. 0ba0daf5e3f4827061d73409e21586dc045391e78577715c28ab200dcd9735b4
  1131. 6df158bd187001358c0093576daf4b08d14698ff4541cf592cac1ea9e3dde8f4
  1132. cc5c338f0bc1c1bf813d372a0d303fa7df96ae6f8cd6c0d28afc5b229e1fd3aa
  1133. 49073b0baf56385745627e6a811a13f2a3ba583f562887f71e5dca02ef171088
  1134. dd74b9b830ca71320398698bb464d32af964376e966daff7521c73d7693481b1
  1135. da4b1fb3370e167261ff2587c46c89fc40e2c70da32dddc4c660aaa8446b766c
  1136. 54bdfc80ab5effd452795116c691351730f5d77b6ec9f9af8245b0c2161def08
  1137. b075f4b02ecf1c98e40346a4f3467225a2ff14bca3ea6a69a7393f95517301fa
  1138. 992d5cf55cf20373cec0dc30e580d36eea398222a83e7795a33408638aea1352
  1139. 7c278ed299c0dd5224aecf84a4a327e73e14c2cd13bb74f319fe5f2562a50baa
  1140. ea63926681a2d16721667a129c94ee2b23cb2f3fd955059441416516cd7b0b5a
  1141. 5c27cc58d849ac45b08a74a6eeb0c3cff841cd0c47d50ed5035361e18facd7bc
  1142. 4e4f9411522231673592553cf411ad259df71315f6cea558de651e96a6f79e92
  1143. fc0a8aa5f01c539d6fb522b1d2ee443238eb09ecccc161895a8caa8f09380d66
  1144. a9d7040a3c956410eae08b3062dc8b61df20cf3596503f2decae7727389a3dd9
  1145. a8767f4f400a57a871c4d33f041127693473ce3fa7ea0ef2f47f917cd2081b69
  1146. 58758c6332283a94cf30d675646e5b3348f97233c2f651b191d1d5a4d1b685a1
  1147. 0537727df1752f4975690851f5508f469f94a5a9c79bb56dfd2d0c51eb1f2a23
  1148. 0afb10e74c5c41e6f75cf6216161e62af1a74cc821f53310811794907064b2a6
  1149. c252492592d76c73515411407c2deb9724a0d23bc9ed9e2195ab73cb2c7d57f2
  1150. 38617dc95406d5afe4c3fb498be29149dd30582110de6489d2e811e537d781d2
  1151. 0bdc1600f065d87142c482b27f974a4ab015013b7a3812be086a9e72f791e8a7
  1152. 45adf1011e977c78638e37a5287194e7301fa868e0b803a7c812fe363d05e817
  1153. 3c60a4f27654e2c960b48e8763ab39511983c9e83cd788aeb289c458c4a4a344
  1154. 2ccb29523f4e91779df87fc1cd2ae2c97bc6af5b7c306d976cfe56d30db200aa
  1155. ab6d4e57fd1c41c341684ec9b0d351e8b4022021ae1a128b7acd59f39f60810d
  1156. 475000a1d0fcfee351463b4f6225c113baccabe9f6e341a936bd2590ba5a2875
  1157. 524595e8058c627c9706c8b9d7dbea10a3efbb019364c943c39e790bbe4ab34d
  1158. 7749c4b6eb61d1c9bb0f1700c4229151f2ea4e9f4d275e87779d55836cbbaa9a
  1159. f555a7f464a82d1e953faaab7262577d04a024233c3ad4fa8b10cf7673ad6a8c
  1160. 92fc4a7de7e15ba5464a2a20794f894b6fcd1fc721780af9caf2a0e946d4f515
  1161. a60c100a278338bff389a02be7b70f00b63e8da6be08246a8a775c6e9aa4a09b
  1162. 9ba42c3008cdaef574f1a336868e1104be04b4e3d63b045d82531cc4ee5d525a
  1163. c4cdf05b0abb069f6521b4b1ee767bff247481768ccf50181c59f40d8c9db1f9
  1164. dcdae45723e0425a87fb09c218a9a0179d3c386ae29a9767aed0c74d446b9eb7
  1165. 8cdf908dea2509c7b5688e4d76bed0287717ab6d8c2b0f7ad97c2848ddf6b5ca
  1166. d034f46bff3a6ce2d6d1f9289f4c8ab2fd2449875c9d5a039227063f3deaa956
  1167. d98a469a80b75103f87e6984d0e3f8e0bdba74fd17e2dcbc49587e2b5c48699a
  1168. 1c04c243ae9ffc5ec8f624cd4279abe0328e542dbd2e439a4962d38df54ea8ae
  1169. 095d61dc49341cdbb30d3f20d37ae9e98edb011e7dbe52d2eac54b3102d4311e
  1170. a5bceba5ea336ba98164a941924b1c043c495a2a84c1091905d0ea6425299b0f
  1171. 04f38a4b742b88b501a3ed1949023ba9c92619dad4bb293c5903142f90fe9700
  1172.  
  1173.  
  1174. ```
  1175. #### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
  1176. ```
  1177.  
  1178. Creation Time 2019-05-06 17:48:00 (DOC Based - ENG - 365 Blue Box)
  1179. SHA256:
  1180. ea5bc88cfbb5d264ce5618d10691dc17d9363ee80775446c88aa7024bd9bf5d5
  1181. 266374b39c83ed9eeb277a9f22a7a0ec71faf22e6ee34fb0ee3feac601a7880e
  1182. 1ebc995bd0203de608ba84c57f8a98077f5cb558d9a256587641ac370763fec0
  1183. 52aad4bfb55e81033f2b2e0717328fc6f3b14a8fc06fac721fe4846c1641bea3
  1184. 7b375d52b0f5e99fad9ce9fabe68547e1e9610a1e73b48f70b54e950ddc0e280
  1185. f78feba2b9e7a108ed86d4dff3b5ceae1236c77e6283f16fde97a9ddd75a2e18
  1186. d0e9b634e86c44bee55a45da2ae75889d6e01bffd4d3f5beb2d279308e1e06c7
  1187. db2682ac87baf8bf0fce33057ccbcbda5863c92f93289c220c933f3963ada679
  1188. 05516ecea548f83b5ceb14ab7237a40f8c54e39ed0b5c1e9a94edcb9a5e581dd
  1189. f4462174444fb64df624fbdfa78d5ca9e0fd70844c67c5a0fd99701c16588053
  1190. 06d2330ed64e6e66028dee94db00e8f5f24bbb120f271990ae8f1da444b6d056
  1191. 0fa9d4896df9e87c4eb4b76eb95672d804783705810fd229e114859bb7dcc370
  1192. 89dc7cdb288773512c86d6b0acf246b477307da0b6e34d0c1093012164148657
  1193. 4fd1747775fd8cbcbb31b992465675bccb1362cc53c78e54500760c79c642827
  1194. 7b9b7f3bfa0043c5ea76738b4c0e2dcde263853183c970f6c778dcd6b14c3db7
  1195. 50913fde5c989b2abda49269d9cc1872ef9f7ce9fe42391b08126415eb5e51b8
  1196. 387114fce49ee47743b63b37080024be3e553eea3dcf811ccd35054fef5964d9
  1197. 2fc9e7ed95a4fa997ee307b0a3ec315161023c63036060f0a9da1b38fc152953
  1198. d66ca93c5ac2b6e3dcba2e5494830b5faa2f737522b41a996cb40f565b31b95d
  1199. cb5d61dbb577162397d82eb7353fa47e3e4ccdb4a852405c497b365c45fab88a
  1200. 453dfb404901f133717a9bfcd40832dbbe9ed7a24622cde124065b7367479388
  1201. 2773e131c32935089f8b0d98dd82a7b3f0660f14756ab4a084606b8048454e56
  1202. 81a459d380755575753cbbf2f67801affa3f89093015df85d01b83dda00e40b0
  1203. 26b4ba9fce4653c52725f4d90a104e68f4c065a0457c6c842f0983575174ef15
  1204. 886f83dbcc94ad45b0fe8ba79844e9a6d251cb0f717000f9037ff48ac0e6292f
  1205. 49502af62972b3d73a981c7ee270e3e82db44d7cbff3bcba0c2032b3d005f3e9
  1206. 4e4a1205fbf5a1fd85009df8475be2d2e8db957ba0c71b6793c9f11118165d22
  1207. 9396cf290e7b79f1e799f9cb82b6f336659e6caec9c6de6ea42b3e9edcd5fab7
  1208. f0497dd5ae50bb5773cd4796e1314942072157247d3e6dbbeb6b7d7e6f5fa3df
  1209. 4ad58d06638a399c4b1ea742585e6d555722ce89a94ae63ac657e77b34688f9c
  1210. c6ee8ad5ce8b28b0dfd9e19cb8ccb5523475401b0f3f1c5edd404ac067abaa16
  1211. 68b3864bbcbd4924fcd3db09289872d596444fb2c5dcade44b384826bb302b20
  1212. 460ffaec8cdf1f413f27207aa67a23d6a9df7fe56a33cace268c2eda6dbd3d52
  1213. 7d01b3eac8a7eef6e57bcd509c6dc5fdd09b9306b07cfe668bf47a060c064e8f
  1214. bd21e6f1da5dd385350a8631c49b13197c82ef4331a7da2710d7a38d85d7c4bd
  1215. 0fd28c1c1389d0808c099e0fe02964b67c5be5eec969872c42a0dbca1ad83de5
  1216. e9b4a303c1572b9aa9374b4ec654f02c4508b2b0f7c4ab52e77bc6c0b8a4c411
  1217. 6308befd52f631348a0c565c25c0683627e7d6f34b949d9b51a1c0fda18533d8
  1218. 27fb62ff0cd2cdaa537a04ead101edd04af3283d0378ffa1d5595f11a9718533
  1219. 0a57c20e61e5c6c464bf1eb6e32ba65f762d015b07544790e57e8ca0fcace92c
  1220. 9d5ed168c0677bce6b3c358df29001a1288389bd011739b71b6e648f8b2e6f43
  1221. 001e5decf6f1525650509a7fec1ea5c823c3b9f8787956ba776c91ce187bdcde
  1222. 14e2c112179900b4a24259af0f459268113ff941cd93d5dde161d0db48e34bb9
  1223. 929b081d15d4a2d80697dec99fac8ae10a11b7d16ce7130c1fdb672ea22d9b4b
  1224. e84c97dcdda71f0e269f7e930de22349063e99d66b2a2e1eccb0e9fa6e48ab91
  1225. 0397702cb6aa2280fc7200248972194bf1c12c9463b1ed41e163b7e1a4e65532
  1226. 268a180b6c5dc8a4e70e883ba6bae41b38aabd07c9e2551d15d2973cbabd6cae
  1227. 6e5270340473f53e7d2cfe7c88dd460998e5b2ba3b5088693cfa71f763a5f628
  1228. 839f026d52cd2ec6843219d4625ff5a84df28cacc95926e8a94112b49efd7369
  1229. 58ca8f02048fdffac59a3311a9391f92fa7c29965fd81ab9c21bc9ab89a15b97
  1230.  
  1231. http://arbatourism.com/wp-admin/pcCTGvayRk/
  1232. http://dev.skatys.com/wp-content/vMkSvhXRdc/
  1233. http://www.academy.appspatrols.com/wp-admin/rnzwrqdbv_lv2u1-933066886/
  1234. http://demo2.infozapp.com/wp-includes/wzw2rxd5x_176v7j2gy-166493198/
  1235. http://www.chiro.lead-tracker.com/cgi-bin/YzPwHmifA/
  1236.  
  1237. Creation Time 2019-05-06 13:37:00 (DOC Based - ENG - 365 Blue Box)
  1238. SHA256:
  1239. 3a5184bc92df457e98b04059df4a9710f418da8507cd0d22c853d1fa2743f059
  1240. 44748067e3a571d6495d3a0503ed18f7a7e0f8671bbf5d20342570ac180f00cb
  1241. 1767745f40800107e4fd7494fbe9c9b05f2657cda915859a180fe81c1204a155
  1242. 4ebdaec9718e829577fbf6a8738280c8c998990749669bc64c115e3942b8a0ca
  1243. f2434cbe02eeb7cb5de506e90b4e04f3f33be30f8cdb96248d6b290e2ca13cd7
  1244. d48b53aa14b44eebbca25c37da3139d48fa4b28e01ad9c32d592618f7f2dfce8
  1245. 6d013eef8414007bb1b025c4ea5cd688a27fe561748089c7f70994eb2de2b990
  1246. dafd1297acef1713ea7e471e33bdd0ea5d5c764b2e0569385d82e5b34f91d5fe
  1247. eea95bd823fb174c71e3f70a9d625bd51f0b30fc77d2d76d651eed945c7295e1
  1248. d4b793480192bc7a390c18b615702507257927b51f6425105ffb148a6844a7d2
  1249. 7ffa2f7030bc10a3fd3dd2976b4fc9ce594ce813d9e8bdd0c10cfa1fe7d2a3f9
  1250. 1dadd763f1ed5132de6c4bb9963d4e58e7054c56f232b8dfdd3d6853294861e5
  1251. 138419c1de41767d1e11fdf2588c61c2768ca576ba17bf80989d625815332cb0
  1252. 242ed851ce446cd9277cab80cb6a9a30af117cf4eab6fede6aefa47c50d14bda
  1253. f6e3cb2c724a7ce01351f437a9d07d5aa82cd3002671fd1644e1d858a38a9e81
  1254. 6392934e41ae2f40f51d103a91d43ad0b29695726c9b019eacccc15a918a6ac2
  1255. 5b39e1427931db751cb90e5df73733a0ce85a362f67782cefcfe5c101fb6eda5
  1256. dfa0b590e472b2ce178087e821128f1be6ca24fcfaef4dac7959792defa71019
  1257. e171567cc806ea47d2532e4421626143f68bb455b4886518b1007052428c9e2c
  1258. cec5c446695643355f24d074e42f004566b33662dab7713103d60c09a7548b1b
  1259. f3dde4325035e0c9ddabb27fe8245085da083e91aba51d6e38f80cfd3e396ee0
  1260. 968e4ec02fb4cf8ad16e44c32c7ee9699b22ad957506093f398301958dd8c04c
  1261. 98c00ee8ad22dd45efc6a1a755a17732742b316ee2fdcab3b4b5193146ca9e3c
  1262. 44f2e0866bf35fd497dc99d78088dd491c6cc298d5811d8f8b11684812e63cce
  1263. c080b72087bcd69c50f677f76f82fcc2389aacaea0dc649ef1bcc8156cb419dc
  1264.  
  1265. http://classificados.cassiopinheiro.com/wp-includes/g8lvt2pa_zlpcx36qz6-449935/
  1266. http://dominicanblog.com/chat.lvinversionesrd/oBTHupYKhG/
  1267. http://demo.rakinshafqat.com/wp-content/5s3qd208_grbfgm0m-12/
  1268. http://www.demo.lesys.com/wp-includes/xiowwe_acl3j5b-8/
  1269. http://www.cristian.capacitacionicei.com/wp-admin/WoXyqeMk/
  1270.  
  1271. Creation Time 2019-05-06 08:18:00 (DOC Based - ENG - 365 Blue Box)
  1272. SHA256:
  1273. b696acec3d27a5a7d4d5c8eaf93c4ae348ab17f78fadf6bf591a194047c742d1
  1274. 5383c48588aa153847a965a888c25e05c5e8647a70b4491f7613c3942a24b389
  1275. 257ee7fbbb316f61014c4c83196299d811c6219023bbecf754618af830490799
  1276. 1ec6b430b85fd71c4fead74d564406ea31ae01d429a4f4353a94bc7ca13d8f72
  1277. 6132d29490e21530443556dfc88a5b6d1360584594bc71d99a9b5a4e9c1c12bc
  1278. e3d4267e4acd308ca9cffa1218b1b4e66fa57e0184864bcccb77aabc62ee6398
  1279. 7762b0bdaa11ff32c89856c16ab3dfcdd37eb4491603ad05714e8f5ec7eabbfa
  1280. 959da9350fd31a6530eb98780e3e6b3e38be4b738656fca54065874271893532
  1281. 5906bf1a3bed4ff7f9ca6095e233702e201e0d5e705512f866ee022e6b1503c2
  1282. 4551e1753d1cb47d04f510d14023fc9d375353e0096e7d52c0e6be9b16443d9d
  1283. 1d126d6ff475c988058c3a1abf0010bbf3dc54a73fcc1ad8cc5433eb996091d3
  1284. b4ea8fce9f428c002b96de242ea812c9d116a8402d83062d8eb21711689b8efe
  1285. ab75715c26fbf12dc10460dd719871341530fad6658df693ff358c9ce36f1c99
  1286. fcab278ed141ec2f1a58f74c8d3991332b3f4c05e64dbf56ab20bbbc103d630f
  1287. b3ca1468e09bcd172eadca81538aedeb4c164faa5b048b50c8939014b58d9ab3
  1288. 6132d29490e21530443556dfc88a5b6d1360584594bc71d99a9b5a4e9c1c12bc
  1289. 2ab7912aa8434e14ba164425441693e7fff85f96e2d80b520d8cc9ef55bac979
  1290. 71cdd13b7a58ce65018ee1262dcd6ed87649869b77da2c9fc83fac5ea46da9e2
  1291.  
  1292. http://eadhm.com/public_html/FJCDSzUfm/
  1293. http://www.cat-school.ru/us/710yf0n_ua7x4j-7479994/
  1294. http://www.ahoraseguro.dmcintl.com/wp-admin/VyzfDUJD/
  1295. http://www.candasyapi.com/cgi-bin/kbd3o6aik_n6gtdbv-55/
  1296. http://domuswealth.kayakodev.com/wp-content/uploads/rLDcCyAubM/
  1297.  
  1298.  
  1299. Creation Time 2019-05-03 21:55:00 (DOC Based - ENG - 365 Blue Box)
  1300. SHA256:
  1301. 9547c3f40f790fab370c5620245c7736282c4931b82100c519746d8f3b072bd8
  1302. 88c36ab19396d737dab7d187e74eba622f1cccd4eecae100a250101d261e6def
  1303. cf3d4fc7080d12f23a1a7718b0fdbcb958eef9121a01f094080652c4c5af354c
  1304. df4a1ac757ed8c6c3ed5d16d933c168b3f0093088545af5fb4abc3787e802dd1
  1305. 5074a2a1fe119e2dcdab495e1b354901002491d1ae06edda550154e6aafda37b
  1306. 6040a0700764792cd44f11118fa9b8069977d76d6c10e78efe386da890a0d1d7
  1307. b5943cddfd81d8e13ebc274ab01b43b892335e54df790fbf375dec25d70437a5
  1308. e46ab44563f129dfaae10e440d99832bcc0058052c2f8452d4e22f76a86619f9
  1309. 11c1c08a8e5d18d34366a0d06367b5f0b68230c838a478d6025368ae138cc449
  1310. 553f053f14aa2cf4d16ae146cf6fb4069ea9178e0a5946642a63ce6bd6a3d005
  1311. bdca54d6ba4545d7eb2356c15a4f021bd3dd10c3962813ea6082c070dc983f92
  1312. 3b7b28b3da34f41ddbd1a6ccfe94bb0726c1d50bb42ca83b48db7fb0ca542ce8
  1313. d58c1fce018c99965fb2c06ef7c4c3e92be7290f9338741e652b99394eaf8d19
  1314. 29fbe810f901708dac076960285cc4a1164efa16a4616e037e8d3096f2c54f4b
  1315. 3d27988d2bf5995fb39453cf9a94fd9ab6319ba0ffa17f3cb3b8e8583cf2327d
  1316. 57a5bbcdb5c82c0ec00aa7171455f15b71140821c09c757cc99cce411dbd3cff
  1317. 16dda94b6ed509e6779ee8358929dfe12a3ee370f7e08d616d50dc4f8b3b1b95
  1318. 736b783e1f786ababe8bd78a1680277923ba34908c536c6d4ccc2b6b9362765f
  1319. 771e765c0f54c7196194f088b279157ec2a858beefc68c91fe0edef9b662071d
  1320. 5354f08d420e5f3b9e57955862ebe8414beccf3871d49e4283ad1a37a5757f8d
  1321. e35c59d2dc2d98f655064a3efc2e7a994e4efe4628f60a06e84fc079d8c2fe91
  1322. 968849577d3aa285bda9e6252b4fa685f5c2650bd3b0d3f93a523f82e5a103ff
  1323. dcdeb1813c3385839624b24f703e174e5934e9510a32c50a01f59bae5fb06570
  1324. ab6d7afe37a7c302d8489b43da39d785a547b50d689feca2d57c26da17af6e73
  1325. 41455b1035cfa169e177dfc169342186b612047c266be25ba3e8d7475879f99f
  1326. 321e1dfdb20d4f1a378472a4b3055a9c98804173e5e0c362039c3a118ab8e24b
  1327. be4096666e2bdbc862039f18c587a199d00dc49951be0933a67ff09df03c1830
  1328. 62a855e0227babfb4bc434e97e7da15ecbef799c1f9914ae5eb92fa8161d8d6d
  1329. f29605f7da73e128b8c8a3b3c984b6d2fad00a690d29fe40e88712fa1cd4c943
  1330. 4892a2e03debcdba92a46545c49d13db8419286aeeb49776bf91e59ed04b7293
  1331. 4d0fa7c341993b9cb27f2d2adc6030427c63227d52d35f9c67aa28806392b5d1
  1332. f0160de6e608f33753cb1d6b18224e9501f0f82699d4d9c1dbcb61abd92b46f3
  1333. e0de872319d3b08cb7322884af7dac8f10632fec564862c9c6364ff2c01a07bd
  1334. 9511d101ba9bfcd30e531d25c00bbd8d0aa487645425398343c58574886ad427
  1335. 55b0a8433997eaea0fde21f7e8ec368552b2154ef94c7d88b5e026c6e9001820
  1336. 66fb937aa853e0ed2bae55e23c4177351a94e42d8368f1407973b69f7559f958
  1337. 953c247099818d7f8eb6e694a8b4513d61329b90afc651d75664df86837ca012
  1338. e308c87030596d6f208f7166d05482820d0218e2d2f2dcb4d2b95044022583d4
  1339. accfa4d42e2e8e492befa7c7e3ca9f268199e896ea641ddd8f0cd11b7f4710e4
  1340. 51882a8b2678b25374bee606d929479891fcf868550d9fe5af35f577ce15c41f
  1341. e5aa5b51397436303dc0f190a2c8ff026d99e7c36c728ed657cd284eb62c623c
  1342. d94ff5aadd33871bf10b2316e3d14e19520506724771f95749210248b7931eff
  1343. 210ead5be5a86802a7c5f3504a14737284e44ca8a5ed4478dfe0041848ca61d7
  1344. 23544cd78d845845c0170fd26d7c85639087cbeab45390eafd5d2456735e0ffc
  1345. ce0dd149d783089c8567d59c766017c31a84863a4bed4db476786851cf827943
  1346. 9134f010ba61c78c8dd064852b3d3245294c936e8a7c6c26577f24bbeb985971
  1347. 97e53b58d3fde8eae91ae42f2deb22ced43011933b20ba1e0595765996d91175
  1348. 669805bad6e947a0f184485e7de32596b7185570fb6e10e2ec3cd4198385afad
  1349. 0282a70dabec4f4b6cc1f477cab7a97e23558677a0b6d8bb55f329b9719deb5e
  1350. ee59a77366fe8ef478b14b5d71fa3037bf7179d849c2b797cb3b43d3a65ef8ad
  1351.  
  1352. http://crafformican-iop-milo.com/lvyh/GtiXiCAT/
  1353. http://abadancomplex.ir/_bk/WdZfezpxN/
  1354. http://muaxanh.com/wp-admin/PjlpyJPzD/
  1355. http://alvapropiedades.cl/wp-includes/XqngkzbS/
  1356. http://parquememorialjapi.com.br/df8idr3/5i5oqn_7rjae-3/
  1357.  
  1358.  
  1359. Creation Time 2019-05-03 16:05:00 (DOC Based - ENG - 365 Blue Box)
  1360. SHA256:
  1361. 651851628891f64bc92da959fcfa9d276427036cfdfcb69d559d7f47c23d8c5b
  1362. 9cc548d54d8ce280073128b424e3704c34c5051857340783005424a086433fd0
  1363. e81c064f16d2b6d4b1c6364a7df9ad2231320b2788eee3113d4ebf3c687d4ad6
  1364. eeec0046cd334722d51b9db31e8c18d1d6ace4246c790bbbc311d553c2f3ddd4
  1365. 06de24539ce5bd171500eb12756bfb9fc70c218145699aa30bd3ac8fad0509f0
  1366. ee8d49388b8b0d9eb86eddee1ac405caa2a678d8d21247f809ba10664e192410
  1367. 45f724d1bb4925ad2a7acfb5d35a1b9e6aa6ab549536982b3bbc39bfeed5ae07
  1368. 652704b888af5863f0257488f71983c3e23f71e3911227f79673a42bc0106331
  1369. 9f00e70566d4c513207f676149a70437674345f52f057b83af8553fb8b7ece4a
  1370. f35cde1b8619bb6a1c597a3ccd7965d4c24434bd0e02a8b215b75a69fd96f7d1
  1371. 622e5c9c1cee1e8bff781034db1b811d7a3e393fb14c0cf4efa094d2f6f6a4e1
  1372. 0731dac1d684fd9c6150d9d0c20e52073cdf8b9a8a2afbe06578f553c315bc86
  1373. 713731afc7b088f533618af3af16111a8d182496ab0fc2964a575fa5dd5152ef
  1374. 76f80bad47487df33344919491e6771706b12ad940b2fddf19181363887002d1
  1375. 89f70f1ea8bb56015eb8427c1900918320be4468fdd858cd59c410ff5f6fc1f2
  1376. db18c4598bbacd610a58daa6caae5b9cf0dee2994ab5a969e81ffb0dd5f5a3c7
  1377. f63659051f14381812967eefeb665056f94a457273cc24a5b22ac24bc336b65e
  1378. 929f7394cdf305770f35b58e1a403f22f73d147b37da83fba64511d068ae3fa1
  1379. dbb684828799a521b3cfb936edd56efe4ba6c11b198e3c8da8ea8dee68ec3884
  1380. 96973059c987c115d57614d9f730f3acf54956b3c502610929bca5221e635134
  1381. d357263af9dbbba4d29f2dfe47d9303c020b883f1cc7cdd24390e744c8d5c3ed
  1382. eced86aad030e270ce2f4eef6d81c98fa138029ec5bc30f90d9466120bc53cdc
  1383. 1024b110a1513eb5a64b0ebeb4e10acc08586e9c7255fe64a52681b92af7ee14
  1384. eae344e3a366bf381768a4bbcb9eed3e7165de9a509d7e6d77c4ff95cd1ddb85
  1385. 47ff1922c8bf5e9e4944d5d3703858836ae1acbb1387c2cf3280abfe1eb20632
  1386. e9e43ab26026d27b320558c640d84a267905da08b8b0ae46f170fdd6a8f52f68
  1387. 4221a9922d97fa329b3dbb27e37522448958cbfa186a6ef722e48d63f9753808
  1388. 01cf80ce05ac97b2e97ec401fa84b1f809b4c97b5040ce74eb114b781d54367c
  1389. 47d5b493497550fbfa7b76608e82b40b7432ec6fd0efd5b162d1901a189133f9
  1390. bd9b6ce1cae013cad0255aad9eff9d868cd16397eec708612695ffdf9fd4f277
  1391. 3d3dfcaf2c18e203d55cc7323ef7109afb223cf95f5a5622a60d203b927ccac3
  1392. f3b7ffe06885209783ca9db28c2256d194dc5cc09b6eb0d5a40bdfc43bfbe3e5
  1393. 44a9ec9139184e5516598903e348f4d7b01e982c020934dc2cc03d60e0f7f02f
  1394. 6acdb5b39fdd7d5976ee9480efb4121c18ad2eac2c99672e44f9b1ce729d0a5e
  1395. 46dddf743200acba21e4e2eadf9567769446002f19b405be24576832b3cd1888
  1396.  
  1397. http://duanlocphatresidence.com/wp-admin/b8oyf2_w724r5u-66253/
  1398. http://superwhite.com.au/wp-content/2t9x_bmoau88p-89600496/
  1399. http://pneumorek.ma/calendar/EckAzvvl/
  1400. http://pure-vapedistribution.be/p52r/js74mi_zk0p5orhwa-651/
  1401. http://nitincarcare.com/wp-content/BbayinbUK/
  1402.  
  1403. Creation Time 2019-05-03 12:26:00 (DOC Based - ENG - 365 Blue Box)
  1404. SHA256:
  1405. acbe2e9cf64678afab887d3ded26d82699d8674a65fcea1786fce64f8649bc3e
  1406. 84b3e186a522a0d0ccd28e31620ca28199fb3debba995f0bea929b5e9a4de8ac
  1407. 79b6f593af071528bec7bdf1e1dc916bb1fb622dee27050b56b399c55c654cf0
  1408. 44e69ac27a24bdb3f45157283fd3a77025c812103380a0612140c05ac7153882
  1409. fbe23aeeabd87a2aa051139a5935aab596a21902b8a0af9949b77e1af40721e8
  1410. 678b5fc437b1cd3e051dbc63130bdc93a77c4abc03ad2a337b7713648aa9ce78
  1411. d1c30d524c0e13638c93c5d6c708e318d8e0ccef1a50929c804da51efd3bbb8c
  1412. ccc16057cc5e99aa978df401236e747ba8da9fbf9bd0f635646ecc60083dbc72
  1413. b132ddd708f7849ba7f069312f983a44d1e30d74363f3c9ff2024c1e6491ba4a
  1414. 103a9a5a879c4c02ef7d59494306068c7e013d54d01c496c3034a5d49d665d95
  1415. f029880d606aa137ede992ecafc9cb518d5e0464266b497cba4d10ddc6a6925f
  1416. a723fc056dd820f611a481ae88519860de02e23eef0faabd54b111bc28411449
  1417. 5922168cdf7b976fcd6e1fe908785f3031cac25499d5198baef14047f9a36947
  1418. 1bf132ebe8eea75b5ae969ffe2791e58731566e6e497cebe5d8fbcbf8626f037
  1419. 5eab415d3c6dad4d5ddf19f49aafd0a4623a6abfa80950f2a021e73cbdef77e5
  1420. 6c03ef96d9933ed865c770135fa52fddc780e30d5cddff4c4caff56561b2387d
  1421. b777c0b12289551525d8af7efc380b5c1eb10920416a444f74b986f80920e3ac
  1422. 690623c6b21ef106a6acbeeafce0a2013d71625a6a2dc90fc0ada1fd76250d3b
  1423. f3058c1db83d73446065c2bbd696d77552fc69b6f9b3b61bc10163c963a6177b
  1424. c210dbd9324b5c7aac98391d73e4dba9b552ed32a7463c91f5ee2b2a0132ec4b
  1425. 9a5ad67c160aca1c9b0fb3dc364afaa82f109ac5867ae4448ad3e627d9cca0f0
  1426. 01e49b860afa88f8e09ea3f316aacbb01b2dc5611797a9032b1bfece6bdb2c33
  1427.  
  1428. http://dzikibukiet.com/9qqml1k/gCSTLjePgq/
  1429. http://thronesenglishgame.com/cgi-bin/be91s_6q9sap4k-2611554/
  1430. http://salonprimavera.by/wp-includes/tgqgvud8p_1cbb7q-935213251/
  1431. http://myhealthyappshop.com/au13/fNxUUWSMj/
  1432. http://safariet-zarzis.com/wp-content/NxoUkHgEIf/
  1433.  
  1434. Creation Time 2019-05-03 08:24:00 (DOC Based - ENG - 365 Blue Box)
  1435. SHA256:
  1436. 41da75db734c7bd5648e09327cb47e15f32285be37ac2ab075c0be2f10c6ef44
  1437. 7dc4511c61552365a3c6e63b70fea2c85e8aade4bda6d843f7f788bb7ddf2b2e
  1438. 298763f2fab2614e6f2f2bf61810c1c535db108bf99e34213b4b2181a8a14881
  1439. 405e58903f88ee4859fc1ffd4d8449d2a8cb49ea316b6a7e98c6a0ca46239f24
  1440. 8dce88bc0f2ddaf9f466729edd7733d8927e8c69a9d9e302a55bbc24a54a1e04
  1441. 4b3a164eff70596ec631cdec906ad634e03d390979576a36ddd9511e9e74c251
  1442. 1d7539321e9bf6c9eea9678b1a9c391a361b871937e8cb526e160f153c7645f4
  1443. 09b5fbe3c1aa5b2ea45c3c3f385a049a0b791d9768c0cb93eb13d0e4f66cea2e
  1444. c8e8b66dc6ffec6967656987f6a3f563ce4d05ec39ed7b50553f014ec1c80e48
  1445. ad3710bcbfbca621f8f361781920c74e6ff21f6eec757a09961d2d7fefa8e20b
  1446. edbf2e8a79aed997530ad6a96488deddfe5e0d8346f36faf5cf7e1e1dcedaa8a
  1447. 7bba68ab02b42d9dea75497eacb1183e2ad6e6bd72969305dbaf8cd619ac2ce9
  1448. d2d2a455578a38b9a564aaa771c3f8464d8158ed7eb6f94cb692eda8ffc5eb66
  1449. 5e5e9d26ae18a691f4ad6da02aa7504ade4ce9d6f114f2421301513e91677de1
  1450. 71f426f59618efdfc3bfde0b48f005833955409d3cdffb4287bf3d983d34fc38
  1451. a6c39942b4368c8042b2966a36af70a0664404a62b92f59dcd574b258946db7d
  1452. ea463dfde8a57310c7b88c38c7ed0168db56e53605cc287be2286a45c78c8434
  1453. 014de2d4547c3a8c24104091bfc8c598cfefff22526d935115e5cfbaaab79116
  1454. c6a8efe2aa28b97c17e999cbba581c5d83b025a62e8b3b4e986f0056a6b2bb14
  1455. f2edf0529c5979c93a7402b1982ebbcbabb302f9496bb1f72ce8509682aa2258
  1456. 102c8717b67895eb8d47a5a6ab4101ada8a8f08dfac2ecac5c3dda691a03d3a0
  1457. dcca578d9c6b6b2a130fc9d21ed872258ff71901fe4e3566e2990f5151d94f78
  1458. e980f9ce99e7bc79d3f8db3b4c15fe91d2aba0660f8bd572ade5f1b86b857c87
  1459. 9385caa15579b8bdd151270a26165fc01079c9fd9d7eb6a0c010d3036891660a
  1460.  
  1461. http://postureevolution.com/wp-includes/qvsiVSAN/
  1462. http://maxcreativesolution.com/wp-content/XowIAeQnZg/
  1463. http://ozendustriyelservis.com/wp-content/FoRxgwKFHs/
  1464. http://phongthuylinhchi.com/wp-includes/odphtliiz_pd86srsc4h-730380/
  1465. http://vedicaadarshkulam.org/cgi-bin/0ceo40irou_j6y2k-96917475/
  1466.  
  1467. Creation Time 2019-05-02 16:38:00 (DOC Based - ENG - 365 Blue Box)
  1468. SHA256:
  1469. 990801c1de058647b506c19565ee7abf0c886af33defe87c185c91aa65f9b579
  1470. c775e0d5046bb333d8ec48ccee14f6b50a394d750836412c56c98f100efa3718
  1471. 8217083c9e4b5ff7f2e438a2e50d8fbc5f75cd170801dcbd6bf1592b4ee6e76e
  1472. 4146e3cf4f60248ab8855463ad47ac44eadfa77f85a93d219f31d7ee935d9da6
  1473. b9f18fa8392dd9be62fa5e88a7ce0d5e94998280d5e5021f073f6ba5bd3aa43f
  1474. 8d811bece1938911aa657dc5292eb1d12e09c27c1c53b0933cd390e1713fa25b
  1475. ca8b291d0dc68db57dcde7e61fa81d3da86f9c65c5006a6228e7fb80cd8ee651
  1476. f268669cf7822cdb42f9407a39e23549e79930c64deabf9fb45acb7c33aca728
  1477. aa801261e72e6b957bbe8aca839c416734b1739fb133a1890f59c191768d72f9
  1478. 15d6cb9824fffd568458004f7229d69b27e35d5832a06314821f924491c61f3b
  1479. f38d5609ce63487e3e63cdd748f198d3e2afff98ee43ed99880ccac6a883d3b6
  1480. 4f1f1458e0c5595d9643c0247bdffe0f225ccc61594a91c00ca039d989b946b7
  1481. 24f92e105f2203de4853e057f2ee4a32695a1d1cdf14d7d58e0e533d72e5d96f
  1482. aebc1103f9344e4926c8904a4f9a6eaa1edcae4a8eb2fcdf5c19d535737a0b57
  1483. e94720b4121c2f2d41e0ee3d754100229d76b7f7085c5700cc059ac806f0a59e
  1484. 61084b80fc69d146f8193be390def46f1f2098dd074a893154d32a5baaa2017e
  1485. ea4bcbe90240950b3246ac90b8c4dbf5c2f03b839328ea0583e893e0ad72ddb9
  1486. e3a103a9172dd50524b0c0964de06d03923e3570e35af57064955fbf000d459b
  1487. 354a0c17e9b347d1d27a3b8d605f7f1bf162d5ed17453430d9bd70ad026da3a2
  1488. 8349b412581a466e885158f9a83aee010856a203586fe21fb479d87fd23c2826
  1489. 8d2c0506d65c170fbc8989260a0f3a61ec6ca809c9d462fcb858cab170b6a92c
  1490. 279da8586939650e58af66d116101b17bc938c19bb18661aa9f44475bf1a5478
  1491. 4a4e5f7221b64a94e9ef4e6aa74464802d5156b0fed3258d36bc778233fbf8aa
  1492. 4f5f72888a2a10ba0715f11df129cff23d1ca9b1931a51e7d9fff93734f9fd92
  1493. ad7f8db9d25f63a5eb7a79a11d3a565cda0c31bdb3d6a4cd1fe72426f9fde0b5
  1494. 0971308893645e1e89941d0f1534015f97e2cb928d9109721c7cd7cd0ea1cac1
  1495. 6c1d9bbd9dcad8b950dcada8139a8b21e31036ae9d319050f7513d240ef31995
  1496. 63c779e66565a408efa9dbe3f38629a8b2e231eacfb78c1ea20f16d254eaa2a8
  1497. f3e6d361295086c6ba59367cd7509a310118f08c0d0324141b41b42dfbbc0657
  1498. a4439bd06300584d703127e8fd1d2261eb45b1a90ddcf65fcc8addd697a6a8b2
  1499. abc589d5ec63138ee0c588f744cb6c8ba59baed47e9316419c174ef6e6a7e393
  1500. 7b492a6aa0b683eb1c70b5363eb6649a63b0cf81cf23c8534546d71a762be37c
  1501. cd75e6f5d568dd055fc68f5d4fbd544dc851fb2423d08aae37d5b8243cd14e49
  1502. e13b9bf9d03d25fea984a5ec113277a7ee1b22941e392cc3614867c272dd3fc4
  1503. a0ebfc81ba0f08dae4cfdf68e03efa80addb7ce41083ecbf98370acd020459ff
  1504. 9412268f1f2c0eb9a06cc682d774e05495a3b4e468749c77e157a5a354c2c8d8
  1505. 77eb40705926158b5dc43657acd06acbd152a96b25ffa0c7570deb2d30f30a55
  1506. ddf9e67e5268bbcc69f0fc467ebf6dbf3a7a669e89ee9e24e4e40121a5546933
  1507. 5f4e455a7b03f049de3775140eec2cba95103b1cbb11acccd700533724bcffea
  1508. 48735c4ff3f7651891f927ad38236a63867ffcbd2a702e9a79daa03cd9c63420
  1509. 77097aa9879009420abd97243ad99b01d6f37aeb4a0f10db935af76d24071f60
  1510. d658d1c903a310720f251727c6671496fd6e83e4993c4646ec6bd48b2e3d6207
  1511. 0b1310aa7bb2e7465a222a04326079ef48b0c163b96e95a1860e79666b479b7c
  1512. 1ad6ccae75006eff67a6adefed9ab969eb30456f9bfa2badbf680767f36e4ad6
  1513. 5a065c412c5ca5029a12a0c5bb8fc9ea3fbe72f7b3a89fa7fbaede2f06ae8185
  1514. 0a0052896d023efd6db21fdb504e996474df83abcfe4ffb55b55bfd894125505
  1515. 0b7bd2da70c954088c58dbc28b9470dbb262ba21c13648eafd0a15b4814cf9d2
  1516. 0aba359f77ac576510a26b160b60e4b0bc470db5ec0341e64234681ec8c607c1
  1517. 592706d46283eeff5a73e3bc816333334ae78f9d1f8162cc5517f402646e8f71
  1518. e2ed5e816faac04190f6bbfeb09ed618a79bcc85d5a3ea6ace4a678cb715f4a2
  1519.  
  1520. http://pressuredspeech.com/dngn/cEmgNTByQ/
  1521. https://phoneringtones.info/wp-content/uploads/qx93_k68trw3j-15334/
  1522. https://freewallpaperdesktop.com/wp-includes/50lz_zkln03lbc-8209361/
  1523. http://safeservicesfze.com/wp-admin/ZmVYmAXv/
  1524. http://noingoaithatthanhnam.com/wp-admin/voytvHre/
  1525.  
  1526. ```
  1527. #### SHA256s for Epoch 2 Payload EXEs seen on 05/03-06/19 ####
  1528. ```
  1529.  
  1530. 00e5526f45dddbbe8268b62e3dfb678bc0478d2aecdf010c3f58c78a4b77104e
  1531. 9b5904ea7cfa0984c9db9151aa868b8b182567d62b22c901f26475a22ba8f5a6
  1532. 84d572b0a2d7947a5ce05b2c1016f09357dc6c60649729380cfe0a5c46419c3a
  1533. fdbea19d24edd48535f3a6fd92d9c58fc96f15dd25ca3ca98f4892cf711592f2
  1534. a2dc20be40c0fa716130862e17e6977c563c9f1f31a2cea7f8a53b020d102741
  1535. fce53f998f1404c8f0a0c5e99bc9b43c9a97c340682830663237afa4aee225d3
  1536. 172bb6642059330e7d7f641d1f9992dda5be2a68c1076c900b9378410258ea07
  1537. 9e7b0b2acffbc2bbedc55553843ba6fb55bb715dd5fbc38e716d48fdbcf08aef
  1538. c38ee8c76e4ac4002052a0497c6229308dd04ddc5e594b91ece623cef891ed08
  1539. 732e5fdb0b2d36fc3c8666f995beeaf56c51016cf0098579565c75370ac37da3
  1540. 24148d8832a38211ed0d8e54f0f15cafae3c4b09fce55f63b3240cda1d6f16b7
  1541. bb916559e081c2e12bdbfc8c80ff12c8eaaa94390543e1c9956be2362a530db3
  1542. 537c82024ea1c28b73063312fcc2218ec989ca76da1269fbe90c7d607ee7e873
  1543. 0e28786d37377e01c350097545e26fbf5c015c779816033a38361e8b7c973dd6
  1544. 33f29c919632bad5315269a7ec6b4f8cf7239fe893dc07e7b9bfffa0745565c1
  1545. 16866fe926c14fbc9cde1cc74f6c8d1a2b67f9ee61dc608b6d24732140faab94
  1546. b1f76b5ef91417af91bebbccfd2efca1b27fb4427729e5359ee0d9c57472fb83
  1547. 38c997d4ba43be8df66599d0acbda2c1d5fac910fd961186da7b50df410fe83c
  1548. 9fe20a1cff6957f0633f7eea5b26918c1916d0e493abfe3c9125c8b528f88ff3
  1549. ba9e5bd533ab9f4defc0b3d283c36c4903e24c89e9474fd462954866333571cf
  1550. c9ef8c7ea3979f79af72d7d7ccecab451567540126a2aac049d3f96b89b0fac4
  1551. 982fe7e64a9293f07dabb5a60495515e79c39c80caf8fae259e50176d9a11633
  1552. 843d7fcfd1d124bcb6b836f9076f9fdf2ad388352e8ea9d98fd60813eb04f009
  1553. 10defadda0c44ad2b0fef085175c43aff68bd90d0f6d397582191ba9ece1e19d
  1554. 2bb4a684a67057526a969e2c381496af5c2dbd5d4476a9e2be73a9c97164683d
  1555. 643501f0aff3e08c9d46a0f56240f405967c301a48ff111d466cf46491aae164
  1556. 732c5a873aa89e0aeb97e976086d30fd25181b4b4cb50ee1048391f985bcf0d7
  1557. 27c74a915a15d4e31dc282783e181b198852ff4f6d186560c7b5280d782aeeee
  1558. cd1b9f5167ad477bb35699d3ae7fac7a2434823482c662926ac1d631672310c5
  1559. e4fbb7deaca45150bd78ce92749be49a91398eb78fed7bd3d2c3547b98c7a90c
  1560. 551837fabd7bf2343f92bf6bb1a889b2d89a1092a34800236a1e9b164ecfe1b0
  1561. 1c5f2d5e9174654319296dc3cb3b1aa989d8a4b462b202d0b700f49af4e801b7
  1562. 066495f8ce07574b7244d091c351e32d0b4ca3bf596da18941f0e8821403f269
  1563. 1afda02d6bcdce4ea43a60daa90f36ae82ea16d0b831305b22d004729e065c59
  1564. 660d37d8553f2dd356fa009358b25aac549dff8e5f65d21a8c043b5cf5e0e505
  1565. ab96d0e16d7fbd2ba1304aed7ba39411e2abd2ec92f39c0ca3a22f55588dea59
  1566. 4c488c64951eacf19b621e91fba3bc8a82c304120a215ea500b5faf96616caf0
  1567. 22f0aefc3e443cee32c77b2e7225fb5903efac06dc42c8a44681a25fd9358b81
  1568. 3ac5847636d0310834e87db3cf414c0a73657880fa5e8521b4a730e459cffe63
  1569. b4700e88eba03b50c384f13cb0022b0ba8aa8185667e2fd1b0fad891443c35cb
  1570. e9d40f47b9b5a43db0429416c932ec1f620156fefbdfcd0f58e0aea506d62be2
  1571. 988ce2a1539a5a502cff50a7947db4ecf66b4ff10c546addabae2c06b9d64b24
  1572. 725e1f5777cd97f7a6a86bbd16ffd086d1ad37e289638aea8fd98ec74927b979
  1573. 9fbf8c52f25cacb4c2b51345d14f0b07d57a79b6165c50e186f6599069a649db
  1574. 5bf1ac0c548cef57ac37ab161922e1b73511113347a09cf3c223d9e7f0691b7e
  1575. e9bbf3a8c0febc38a8c635624f5cebd5ea2142e637c532e8e194c2a6e8bf0882
  1576. ca8c0023470bbdea514f07dfdc83527037028978dcc108e9a76393688ee9b84c
  1577. 43460786abf812e8acf4c97a68eed81f67c947cebb42f2dd5b86afa985f6c3f9
  1578. 8b0c8c4bf56661260344f0575feb1cc19732aeea2d4e088ccba649fdbabaa176
  1579. 9abb341d819a1b33890600c13d19388970c4ccb2686bd43eff8a0c2d601903ed
  1580. e8324fe863ae072db85f0092424c291eab0f771ccca27e175f962bb4f96b8941
  1581. 2dcf9938c58ad32b5fe48f2ad07f52f85d8999aba87bed94746e716ca2dee77a
  1582. ae631d14769daac58441df09ccc8deabac643914437a3d36ab40f1f9208209d7
  1583. d636040d86eac6338c6848b32d440ac1583189dc8c517d789572dab7e91f358a
  1584. 03db0883eb0e6210f6ddf7cf51b3eb38bee2d40941b335fd41346fe2671d49ae
  1585. d318fc795b8985b05e860e8193afc52cb2eed51a5bbf0e11dddce329cbfc492d
  1586. 19e8eee5bef0032b48067ed36aa3d887cd05ede3780cf9a19a5b4c455b7c65a7
  1587. 745632b05bf4457e350bc98d9c5f6810e3927f3fd3678e8a4c266b1360042ca5
  1588. 53df8c4f61571328582ce3bfa0f9af5357a51eefa1a847f43d24e22880e849e3
  1589. 48cc469740b28d5e4743a98e985facc63ca0ef4ea83494f7f9df463206061bf3
  1590. cae9e197e2f7befb93229a75c02d363ca42fa1b61f1a732596c6f93917ddc0d5
  1591. 78e6bdd3b6f177bbb7f626352f0cd0065b20c48e96ed72569bca527d1248c047
  1592. 46deffc4922f344c977c7098558b298c961fcfc5e0ecf415ae19e3e4d292ab7f
  1593. 4eea56c616abde368c660572e2a27fb69c6afda35307b554d7ea679708d8ce47
  1594. 1e0196e281b77aa3855a3887154f193068fa9bc1dcbb26ee07ce43de2283e34e
  1595. 0139d5f3393114110523a0ea71b7b30d501be5c38f396cb942b71702bdad5dba
  1596. b92a484b17dd0e44b952822ef0820900b931f77480aad707f4e7d8af3f641694
  1597.  
  1598.  
  1599. ```
  1600. #### Epoch 1 C2s ####
  1601. ```
  1602.  
  1603. 103.201.150.209:80
  1604. 103.213.212.42:443
  1605. 107.159.94.183:8080
  1606. 109.104.79.48:8080
  1607. 109.73.52.242:8080
  1608. 111.67.12.221:8080
  1609. 115.132.227.247:443
  1610. 139.59.19.157:80
  1611. 144.76.117.247:8080
  1612. 159.69.211.211:8080
  1613. 165.227.213.173:8080
  1614. 175.107.200.27:443
  1615. 176.58.93.123:8080
  1616. 181.142.29.90:80
  1617. 181.199.151.19:80
  1618. 181.29.101.13:80
  1619. 181.30.126.66:80
  1620. 181.37.126.2:80
  1621. 185.86.148.222:8080
  1622. 185.94.252.27:443
  1623. 186.139.160.193:8080
  1624. 186.71.54.77:20
  1625. 187.188.166.192:80
  1626. 189.196.140.187:80
  1627. 189.205.185.71:465
  1628. 189.213.208.168:21
  1629. 190.117.206.153:443
  1630. 190.147.116.32:21
  1631. 190.171.230.41:80
  1632. 190.180.52.146:20
  1633. 190.85.206.228:80
  1634. 192.155.90.90:7080
  1635. 192.163.199.254:8080
  1636. 196.6.112.70:443
  1637. 200.107.105.16:465
  1638. 200.114.142.40:8080
  1639. 200.28.131.215:443
  1640. 200.45.57.96:143
  1641. 200.58.171.51:80
  1642. 201.203.99.129:8080
  1643. 213.172.88.13:80
  1644. 216.98.148.136:4143
  1645. 217.199.175.216:8080
  1646. 219.94.254.93:8080
  1647. 222.104.222.145:443
  1648. 23.254.203.51:8080
  1649. 24.150.44.53:80
  1650. 37.59.1.74:8080
  1651. 43.229.62.186:8080
  1652. 5.9.128.163:8080
  1653. 51.255.50.164:8080
  1654. 62.75.143.100:7080
  1655. 66.209.69.165:443
  1656. 66.228.45.129:8080
  1657. 69.163.33.82:8080
  1658. 72.47.248.48:8080
  1659. 77.82.85.35:8080
  1660. 81.3.6.78:7080
  1661. 82.226.163.9:80
  1662. 85.132.96.242:80
  1663. 91.205.215.57:7080
  1664.  
  1665.  
  1666. ```
  1667. #### Epoch 1 - Spam/Stealer C2s ####
  1668. ```
  1669.  
  1670. 61.92.159.208:8080
  1671. 104.236.185.25:8080
  1672. 50.116.63.9:7080
  1673.  
  1674. ```
  1675. #### Current Epoch 1 RSA Public Key ####
  1676. ```
  1677.  
  1678.  
  1679. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB
  1680.  
  1681. ```
  1682. #### Epoch 2 C2s ####
  1683. ```
  1684.  
  1685. 103.255.150.84:80
  1686. 103.53.44.20:80
  1687. 119.155.153.14:21
  1688. 124.123.42.93:80
  1689. 133.242.156.30:7080
  1690. 136.243.117.85:8080
  1691. 138.201.140.110:8080
  1692. 144.202.9.18:8080
  1693. 147.135.210.39:8080
  1694. 149.167.86.174:990
  1695. 149.255.56.242:8080
  1696. 159.65.22.223:8080
  1697. 162.243.125.212:8080
  1698. 167.114.210.191:8080
  1699. 173.255.196.209:8080
  1700. 174.93.130.148:8443
  1701. 175.100.138.82:22
  1702. 176.63.173.71:995
  1703. 177.230.108.144:22
  1704. 177.242.202.30:8080
  1705. 177.242.214.30:80
  1706. 178.152.78.149:20
  1707. 178.62.37.188:443
  1708. 178.79.161.166:443
  1709. 179.14.2.75:21
  1710. 180.150.87.75:22
  1711. 181.39.51.243:993
  1712. 181.63.2.226:8080
  1713. 182.176.132.213:8090
  1714. 182.176.94.236:80
  1715. 182.188.47.206:990
  1716. 183.82.100.135:80
  1717. 183.82.110.170:53
  1718. 186.113.19.171:80
  1719. 186.4.167.166:80
  1720. 186.4.234.27:443
  1721. 187.189.195.208:8443
  1722. 188.138.91.26:7080
  1723. 189.183.234.170:50000
  1724. 189.209.217.49:80
  1725. 190.112.228.47:443
  1726. 190.145.67.134:8090
  1727. 190.25.255.98:443
  1728. 190.25.255.98:80
  1729. 190.97.219.241:80
  1730. 2.50.4.159:443
  1731. 2.50.52.255:20
  1732. 200.21.90.6:80
  1733. 201.199.89.223:8443
  1734. 201.220.152.101:80
  1735. 201.231.44.78:80
  1736. 208.78.100.202:8080
  1737. 211.63.71.72:8080
  1738. 212.22.215.140:80
  1739. 213.14.166.152:990
  1740. 216.98.148.156:8080
  1741. 217.13.106.160:7080
  1742. 217.199.175.217:8080
  1743. 24.139.205.186:8080
  1744. 41.169.20.147:143
  1745. 41.220.119.246:80
  1746. 45.123.3.54:443
  1747. 45.33.49.124:443
  1748. 5.230.147.179:8080
  1749. 50.31.0.160:8080
  1750. 50.99.132.7:465
  1751. 59.103.164.174:80
  1752. 62.75.187.192:8080
  1753. 64.13.225.150:8080
  1754. 67.205.149.117:8080
  1755. 69.45.19.145:8080
  1756. 69.45.19.252:8080
  1757. 73.49.109.200:443
  1758. 75.177.169.225:80
  1759. 77.56.253.112:80
  1760. 78.100.187.118:80
  1761. 78.186.5.109:443
  1762. 82.28.208.186:80
  1763. 84.241.10.111:53
  1764. 85.104.59.244:20
  1765. 86.122.149.86:8080
  1766. 87.106.139.101:8080
  1767. 87.106.23.241:8080
  1768. 91.205.215.66:8080
  1769. 92.154.101.154:50000
  1770. 94.130.35.140:443
  1771. 94.76.200.114:8080
  1772. 95.128.43.213:8080
  1773. 98.144.73.193:80
  1774.  
  1775. ```
  1776. #### Epoch 2 - Spam/Stealer C2s ####
  1777. ```
  1778.  
  1779. 198.58.114.91:4143
  1780. 213.136.86.219:7080
  1781. 91.205.215.10:7080
  1782.  
  1783. ```
  1784. #### Current Epoch 2 RSA Public Key ####
  1785. ```
  1786.  
  1787. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB
  1788.  
  1789. ```
  1790. #### Credits and Notes Section ####
  1791. ```
  1792.  
  1793. WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
  1794. is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
  1795. https://pastebin.com/u/jroosen
  1796.  
  1797. NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
  1798. I am providing them for your benefit in case you want to parse them to be sure.
  1799.  
  1800. ```
  1801. #### What is Epoch 1 and Epoch 2? ####
  1802. ```
  1803.  
  1804. What is Epoch 1 and Epoch 2? (updated 03/07/2019)
  1805.  
  1806. I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
  1807. payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
  1808. Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
  1809. rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
  1810. This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
  1811. to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
  1812. time period.
  1813. Here are some observations I have noted since I have been watching these botnets:
  1814.  
  1815. - Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
  1816. Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
  1817. being delivered in maldocs on Epoch 2 at any one time.
  1818. - Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
  1819. - Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
  1820. - On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
  1821. Monday morning/Sunday night.
  1822. - Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
  1823. Epoch 2 may have a document hosted on host.tld/B.
  1824. - The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
  1825. - Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
  1826. *- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
  1827. - Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
  1828. - C2s are never shared between Epochs/Botnets.
  1829. - Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
  1830. via C2 to stay ahead of AV defs.
  1831. - Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
  1832. - Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
  1833. - The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
  1834. easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
  1835. - Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
  1836. spam template, word template, document type and even payload.
  1837.  
  1838. If I think of anything else to add or if anyone else has any suggestions, I will add them here.
  1839.  
  1840. ```
  1841. #### Community Lists ####
  1842. ```
  1843.  
  1844. https://pastebin.com/mcBuPLUs - @ps66uk
  1845. https://pastebin.com/3fjV9B8S - @lazyactivist192 (C2 IPs)
  1846.  
  1847. ```
  1848. #### Credits ####
  1849. ```
  1850. (OC from @JRoosen and/or combination work of the following)
  1851.  
  1852. Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
  1853. @0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey,
  1854. @Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk
  1855.  
  1856. C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
  1857. @devnullnoop, @gorimpthon, @Racco42, @Jan0fficial, @lazyactivist192
  1858.  
  1859. Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
  1860. @pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
  1861. @papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman, @lazyactivist192, @TrendMicro
  1862.  
  1863. Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt
  1864.  
  1865. Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
  1866. helping out with this!
  1867.  
  1868. Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
  1869. @digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch,
  1870. @urlscanio, @TrendMicro and @Virustotal for providing services/software no charge to this cause!
  1871.  
  1872. ```
  1873. #### Daily Log 05-03_06-19 ####
  1874. ```
  1875.  
  1876. General News:
  1877. Was some issues with getting out the update on Friday night but @ps66uk spent some time on it and his work is now merged into this
  1878. summary for the 3rd until the 6th. :) I received about 15 attachment malspams from E1 today and Friday was a slow day with a couple
  1879. malspams.
  1880.  
  1881. In other news:
  1882.  
  1883. Not much to report here. More tomorrow.
  1884.  
  1885. Email Template Report:
  1886.  
  1887. All the templates I saw today(Monday) were generic ones for Invoice/Quote/Statements. All of them were attachment based from
  1888. E1. The templates were older and nothing very new. Most I showed as examples last week. @Ps66uk saw 5 link spams today
  1889. and 10 DOC attachments. His data is here:
  1890. https://twitter.com/ps66uk/status/1125529267847217152
  1891.  
  1892. Review:
  1893. What we know about the threaded templates/reply chain:(changes are marked with *)
  1894.  
  1895. - Emails are sourced from once (or still) compromised users all over the world.
  1896. - Emotet injects a reply into a real email conversation thread between the compromised party and another party that replied
  1897. to the compromised party on or before Nov 2018 until at least January 2019. (may be up to present) Also have seen emails going
  1898. back as far as June 2018.
  1899. - Now on E1 and E2.
  1900. - Now seeing German based templates that are essentially the same thing but in German.
  1901. *- The injected reply is usually prefaced with the following:
  1902. "Attached is your confidential docs."
  1903. "Attached please find the wire transfer form."
  1904. "Thank you for your help. Please see the attached."
  1905. *"Load instructions attached"
  1906. *"A printer friendly attachment is now included with each email."
  1907. *"Click on the attachment to open or save the printer friendly version of your report."
  1908. - Both attached and link based delivery of the maldocs/ZIP/JS have been observed.
  1909. - Attachments seem to be in the filename format of *_Month_DD_YYYY.doc/js so far.
  1910. - The link is customized for the display text of the link to show the real domain of the spoofed organization.
  1911. - These templates are pretty limited in run and not very numerous.
  1912.  
  1913. Link Regex Report:
  1914.  
  1915. Regex directory patterns - @ps66uk and I worked on these today. The following patterns were seen active from Friday until present.
  1916. * indicates updated or very active. Yes you want to take out the * in front because it doesnt belong in the actual Regex. :)
  1917.  
  1918. E1
  1919. *https?:\/\/.+?\/(trust(ed)?|sec|verif|public|secure|open|verif_seg)\.([DdEeGgNn]{2,3})\.(logged|signed|accounts|myacc|sign|anyone|myaccount|accs)\.(resourses|docs?|open_res|send|office|rep|public|sent)\.?(net|com|sec|biz)?\/
  1920. *\/(Frage|Nachprufung|nachpr|sich|sichern|vertrauen|([DdeEnN_]{2,5}))\/([0-59\-]){6,7}\/
  1921.  
  1922. E2
  1923. https?:\/\/.+?\/([A-Za-z0-9]{4,30})_([a-z0-9]{5,10})-([0-9]{8,15})\/
  1924. *https?:\/\/.+?\/(assets|blogs|cgi-bin|demo|direc|Document|DOC|esp|FILE|INC|LLC|lm|paclm|Pages|parts_service|phpmyadmin|Scan|sites|test|themes|uploads|WP2|wp-admin|wp-content|wp-includes)\/([A-Za-z0-9]{7,30})\/
  1925. *https?:\/\/.+?\/([a-z0-9]{4,7})-([a-z0-9]{5,7})-([a-z0-9]{4,7})\/
  1926.  
  1927. NOTE: If you get a lot of false positives, try adding (\"|\n) at the end of some of these after the last \/
  1928.  
  1929. These Regex patterns are to be used experimentally and at your own risk but they caught 90%+ of what I saw in link malspam.
  1930.  
  1931. Payloads Report:
  1932.  
  1933. Still seeing E1 and E2 going back and forth between the new and old loader.
  1934.  
  1935. More detail tomorrow.
  1936.  
  1937. C2 Report:
  1938.  
  1939. C2s DID change for E1 but it remained at 61 combos in total. - recorded above (added and subtracted the same number of IPs.)
  1940. C2s DID change for E2 and increased from 79 to 89 combos in total. - recorded above
  1941.  
  1942. Closing:
  1943.  
  1944. Been pretty busy lately but trying to still make these reports because I think people find them helpful.
  1945.  
  1946. TT
  1947.  
  1948. ```
  1949. #### Sandbox 05/03-06/19 ####
  1950. (all with fakenet and MITM unless spam/secondary infection)
  1951. ```
  1952.  
  1953. Epoch 1 C2 run on 2019-05-07 at 02:00 UTC - From @lazyactivist192's work here: https://pastebin.com/3fjV9B8S
  1954.  
  1955. ```
  1956.  
  1957. ```
  1958.  
  1959. Epoch 2 C2 run on 2019-05-07 at 02:00 UTC - From @lazyactivist192's work here: https://pastebin.com/3fjV9B8S
  1960.  
  1961. ```
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!