Emotet Malware IoCs 2019/03/13

## Emotet Malware Document links/IOCs for 03/13/19 as of 03/14/19 03:00 EDT ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 03/13/19 ####
```

http://104.42.214.105.xip.io/wp-content/sendincsecure/legale/nachpr/de_DE/032019/
http://13.127.80.82/ClvW8ZSqo0icX_OiB6Mv8/trust.myacc.send.com/
http://140.143.240.91/yfwta7q/sec.accounts.docs.net/
http://142.93.56.178/wp-includes/company/RD/Operations/EcsH-wrV6b_nCPVA-uI/
http://159.203.169.147/yhpbh7i/sendinc/support/Nachprufung/de_DE/201903/
http://167.99.197.172/utou2km/sendincencrypt/service/Nachprufung/de_DE/201903/
http://222.106.217.37/wordpress/trust.myacc.resourses.com/
http://35.196.203.110/wp-content/sendinc/support/sichern/de_DE/032019/
http://35.226.136.239/US_us/verif.myacc.send.net/
http://3gksa.com/temp/sec.myacc.docs.net/
http://78.207.210.11/@eaDir/secure.myacc.resourses.com/
http://accurateadvisors.in/nh3gezc/sendincverif/nachrichten/Nachprufung/de_DE/03-2019/
http://affordablephpdeveloper.com/blog/sendincverif/legale/nachpr/DE_de/201903/
http://ahiyangrup.com.tr/wp-admin/sendincencrypt/nachrichten/Nachprufung/DE/03-2019/
http://alannonce.fr/cgi-bin/h09h-mf54ru-bfqde.view/
http://almutanafisoon.com/42mldks/sec.myacc.send.net/
http://anandbrothers.co.in/wp-admin/RDEB/61373497/pmMmx-avZy_dhpyF-7vPo/
http://anorimoi.com/wp-includes/sec.accs.send.com/
http://apollo360group.com/5dcipv1/trust.myaccount.send.com/
http://ardali.eu/picture_library/sendincsecure/support/Nachprufung/De/2019-03/
http://atelierap.cz/administrace/6vhs-8yr9lt-mdaf.view/
http://auliyarahman.com/wmli/Intuit_EN/llc/RDEB/faq/DwhU-48cg_HWKGP-g7k3/
http://ayodhyatrade.com/ww4w/verif.myacc.send.net/
http://barbieblackmore.com/wp-includes/secure.accounts.resourses.net/
http://beflaire.eazy.sk/wp-includes/q8t9-msip7-xwdom.view/
http://blog.altinkayalar.net/wp-admin/48sot-l4lei5-sxhvn.view/
http://blog.apdev.cc/blogs/trust.accs.send.net/
http://blog.esati.net/wp-admin/sendincverif/legale/Frage/De/201903/
http://blog.powersoft.net.ec/wp-includes/sendincsecure/service/Frage/DE_de/032019/
http://bridgearchitects.com/Library/trust.myacc.docs.biz/
http://brunerpreschool.co.uk/blogs/Intuit_US_CA/llc/terms/rzrV-ZmK_MoVec-tRKK/
http://cantinhodobaby.com.br/img/Intuit_EN/download/Redebit_operation/xQxo-ssFW_xl-ysx/
http://cedrocapital.xvision.co/vckej2kgj/secure.accs.docs.biz/
http://chigusa-yukiko.com/blog/e0ud-2s36gp-vcnxq.view/
http://chigusa-yukiko.com/blog/trust.accounts.docs.net/
http://comrepbuchten.com/prestashop1.7/sendincverif/support/Nachprufung/DE/032019/
http://concourse.live/content/sendincsecure/legale/Frage/De_de/2019-03/
http://crawsrus.com/css/sendincsec/support/sich/DE/03-2019/
http://cyzic.co.kr/widgets/trust.myacc.resourses.com/
http://dagda.es/cache/Intuit_US_CA/corporation/Redebit_Transactions/Transactions/DGbK-3W_Zr-VOt/
http://decospirit.com/sec.myaccount.docs.biz/
http://demopn.com/lab/components/Intuit_Transactions/info/RDEB/terms/UNMrD-Mzdv7_qcGz-ubj/
http://dkw-engineering.net/purchase_order_2018/verif.myaccount.resourses.biz/
http://efigen.com.co/wp/c6s0-f6xgvv-okhr.view/
http://elko.ge/elkt/wp-content/uploads/Intuit_EN/company/Instructions/LRPcB-1Zh_TvOR-pB3c/
http://elmatemati.co/wp-includes/US_CA/info/Redebit_Transactions/Instructions/3512692/IsTNB-bcmb_n-2iFQ/
http://elzinhaeogarfo.com.br/aguarde/Intuit_US_CA/RD/Redebit_op/50672474/xaDV-Fe1_UxQlU-on7/
http://emona.lt/wp-admin/corporation/Notice/FFMPG-ZQj_SKT-SM/
http://en.gilanmetal.com/wp-admin/pm97j-lrlee-daeei.view/
http://entec.vn/zdiks2j/Redebit_operation/faq/745272118/pxiB-k1_EmAAl-pf9/
http://eventpho.com/wp-content/sendinc/legale/nachpr/DE/03-2019/
http://fa.ilotousgroup.com/xfietvb/sendincsecure/service/vertrauen/DE/2019-03/
http://felixschaffert.ch/font/company/Redebit_operation/Operations/cMOj-21aC_CYv-5dp/
http://fidarsi.net/ww4w/US_CA/company/Redebit_operation/Redebit_op/boqhb-92z_udW-mA/
http://filfak-online.su/wp-content/uploads/trust.myacc.docs.biz/
http://firemode.com.br/1021blindagens/wp-admin/sec.accounts.resourses.biz/
http://fmaltd.co.uk/dist/Intuit_EN/faq/42712438/Qinj-10LI3_dr-c8/
http://fortgrand.com/wp-content/uploads/Intuit_Transactions/Instructions/uLPNW-WnMA_jsIZ-x3n0/
http://frankcahill.com/wp-admin/Intuit/llc/Redebit_Transactions/jadCs-eSSV_UTVcl-h4/
http://further.tv/trust.myaccount.docs.biz/Intuit_US_CA/files/Redebit_operation/71119396/NiKXr-1HB_kf-yQ5i/
http://fusiongrade.com/wp-content/files/Redebit_operation/Notice/iuwLk-SUHW_FECNc-GFPj/
http://g20digital.com.br/SN/Intuit_US_CA/company/Redebit_Transactions/terms/VQnk-MZ_e-GW/
http://garo.org.tr/form/cwd7-tm4cs-bwjru.view/
http://gavinvestments.com/yoffiwurt/sendincsec/nachrichten/sichern/De/032019/
http://geologia.geoss.pt/wp-content/Intuit/Redebit_operation/Operations/BHWP-uUm_gMpVtb-ov/
http://getdripfit.com/wp-content/sendincsecure/nachrichten/sich/De_de/03-2019/
http://giftscrazy.in/wp-admin/Intuit_Transactions/company/RDEB/Redebit_op/DIBKU-Twzb_wUJ-U2/
http://gilhb.com/jhb/US_CA/scan/Redebit_Transactions/terms/4369744647/bYcd-Jo_TcQlm-pMv1/
http://gosmi.net/Cart/download/RDEB/Notice/06018413/IWRmK-fz_EYU-gv/
http://grownix.com.pk/h00rgmq/US_CA/doc/RD/Notice/MyNye-oP5zY_Pe-4sI/
http://gvpmacademy.co.za/css/sec.myaccount.send.net/
http://hackdunyasi.tech/cgi-bin/sec.myacc.send.com/
http://halalpro.com/kmg5cgf/sendinc/legale/sich/DE_de/201903/
http://haru1ban.net/files/Intuit_EN/document/Redebit_operation/faq/ukgve-M9Z_oyL-HSN/
http://hdfilmseyretmeli.com/wp-content/sendincencrypt/support/Frage/de_DE/201903/
http://healthandfitnesstraining.shop/test/sendinc/nachrichten/sichern/De_de/201903/
http://healthwiseonline.com.au/wp-admin/Intuit_US_CA/doc/RDEB/MIJa-L5fyv_pfF-O3c/
http://hepsiburadasilivri.com/wmxm8d7/secure.accounts.resourses.net/
http://hidaka.com.br/cris/US_CA/llc/Redebit_Transactions/terms/8273954677/woACd-ysP7_vR-Eu/
http://hille-company.de/wp-admin/US_CA/doc/Redebit_Transactions/Transactions/237337107/MSlGo-JtHKz_Wp-9R2T/
http://himappa.feb.unpad.ac.id/images/trust.accs.docs.com/
http://hitme.ga/cgi-bin/secure.myaccount.docs.biz/
http://hopex.com.co/cgi-bin/5cq0y-1sea6a-yjibk.view/5cq0y-1sea6a-yjibk.view/
http://husainrahim.com/v1/Intuit/document/RDEB/Redebit_op/8014356/faTqH-WVPmv_RYoyUH-W4/
http://iappco.ir/royesh1/Intuit/document/Redebit_Transactions/Redebit_op/0841139664/SaFA-lUMIh_jsR-motD/
http://industriasrofo.com/Connections/files/RDEB/Notice/5666424/udBCB-EMfF2_C-fo/
http://inf.ibiruba.ifrs.edu.br/teampass/sendincverif/support/Nachprufung/De_de/201903/
http://informacjezkraju.pl/zoh1cdr/verif.accounts.docs.net/
http://invertilo.com/yrfygy6/Intuit_EN/company/Redebit_operation/Redebit_op/0890188662/HgMv-pt9cm_LUlu-ty/
http://iransbc.ir/wp-includes-old/doc/Redebit_operation/Redebit_op/knrw-xfegB_mdM-zg/
http://irantourism.tk/wp-includes/sendincverif/support/sichern/De_de/032019/
http://irismal.com/ecsmFileTransfer/Intuit_Transactions/corporation/Redebit_operation/Notice/907451825/exhYq-5hM8_Nl-NA/
http://isn.hk/cgi-bin/Intuit_EN/files/Redebit_Transactions/faq/411520272/UAUHn-xltA_he-oF9i/
http://jargongeneration.com/Gambia/Intuit_Transactions/corporation/Redebit_operation/Transactions/ZwKCi-js044_jsNdQ-xqTH/
http://jensnet.se/wp-admin/Intuit_EN/scan/Redebit_op/9889612330/dDOc-eFj_Jupye-Ck/
http://jenthornton.co.uk/wp-includes/Intuit/corporation/Transactions/vXSF-VIe_Rm-wmIK/
http://jerryshomes.com/vendor/US_CA/info/RD/UifUK-Z38jO_YZRyw-LWk/
http://jobnest.in/awstatsicons/US_CA/Redebit_operation/faq/109536014/QoEoY-ipki_IScD-QcG/
http://kannada.awgp.org/wp-content/uploads/Intuit_US_CA/doc/RD/Redebit_op/kfYj-3Uc_qQPWL-mmx/
http://keyi888.com.tw/wp-admin/sendincsec/legale/sich/De/032019/
http://kkk-3728.com/wp-content/sendincencrypt/legale/Frage/De_de/201903/
http://korneragro.com.ua/wp-admin/secure.myaccount.resourses.biz/
http://kotel-patriot.com.ua/2rbqqvd/sendincsec/nachrichten/nachpr/De/2019-03/
http://kowil.com.vn/wp-admin/Intuit_US_CA/info/Redebit_Transactions/Notice/lDiGI-OB41P_d-n3/
http://lastmilecdn.net/wp-includes/Intuit/info/terms/Tmzru-ybtZ_elsf-4Dr/
http://leonpickett.com/con7ext_sym/r0bo-v8e4q-jylv.view/
http://levana.com.vn/wp-admin/Intuit/RD/DqPsX-7qEvW_wBB-Jkf/
http://lopxe.itvina.co/wp-content/uploads/Intuit/scan/RD/faq/gUnLI-Hjuuo_SOtVB-MCs/
http://maerea.com/blog/wp-content/y8hz-k9kbg-ndech.view/
http://maymarproperties.com.au/wp-content/Intuit_EN/llc/Transactions/LQWZG-UB_tqxxGI-2gnb/
http://miris.in/wp-includes/dn09-upnt3-gypas.view/
http://mistcinemas.com/cgi-bin/sec.accs.send.net/
http://pefi.sjtu.edu.cn/wp-content/Intuit/llc/RD/Operations/8060122705/HCnO-Wf_PTUH-2q/
http://pji.co.id/iug1iha/sec.accs.send.com/
http://pufferfiz.net/spikyfishgames/sec.myaccount.send.com/
http://raeburnresidential.co.uk/cgi-bin/verif.accs.resourses.net/
http://ragnar.net/cgi-bin/sendinc/service/nachpr/De_de/03-2019/
http://rebuildkerala.info/wp-content/files/RD/terms/qvhQ-cdc_ZKXAKz-i4/
http://redmiris.com/wp-admin/Intuit_US_CA/corporation/RDEB/PhrJ-h8cHm_Jx-M4F/
http://rouze-aurelien.com/wp-content/uploads/sendinc/nachrichten/nachpr/DE_de/032019/
http://rychlapreprava.sk/css/secure.accounts.resourses.com/
http://shop.dreamstyle.cl/__MACOSX/sendinc/legale/sich/de_DE/032019/
http://sidtest.site/cgi-bin/verif.myacc.docs.biz/
http://soil-stabilization.ir/wp-admin/sec.myacc.docs.com/
http://studyosahra.com/css/secure.myaccount.resourses.com/
http://teknotown.com/wp-admin/secure.accs.resourses.net/
http://telovox.com/log/sendinc/support/Frage/DE_de/03-2019/
http://textilkopruch.com.br/wp-includes/sec.myaccount.send.net/
http://thetourland.com/wordpress/sec.accs.docs.biz/
http://trident-design.net/wp-content/sendincsec/nachrichten/Frage/de_DE/201903/
http://umakara.com.ua/icon/US_CA/RD/Notice/bodo-cF_sLXwuI-G8/
http://vetah.net/signature/9ivx-p59hu-quup.view/
http://vitalacessorios.com.br/cgi-bin/sec.myacc.send.biz/
http://waterhousecleaning.co.uk/dir/secure.myaccount.docs.net/
http://wessexchemicalfactors.co.uk/css/secure.myaccount.send.net/
http://wheenk.com/lib/company/Notice/7372081/jpfGt-WaoC_j-v9iO/
http://www.cbmagency.com/wp-content/trust.accs.docs.com/
http://www.cortijoguerra.es/wp-snapshots/91fsn-fh5mr-bsive.view/
http://www.encut.us/wp-content/uploads/company/Notice/sbkVf-Hrstf_Nia-sln/
http://www.fabinterio.co.in/wp-admin/sendincsec/service/Nachprufung/DE/03-2019/
http://www.grameenshoppers.com/old-site/US_CA/Redebit_Transactions/Instructions/rnxLR-K48_oUp-qnr/
http://www.graphicsbygabby.com/wp-content/US_CA/company/RDEB/Redebit_op/hSUta-8OZ_W-ram/
http://www.heldermachado.com/wp-content/sendincverif/service/nachpr/DE/032019/
http://www.kelaskuliner.com/tyoinvur/sendinc/legale/Frage/De/201903/
http://www.la-reparation-galaxy.fr/wp-admin/Intuit_EN/document/Redebit_operation/faq/346178436/aDTP-Uhktd_wHV-Hr/
http://www.localbizz.in/wp-admin/Intuit_EN/doc/terms/TwlY-Omkd_WSS-Fi7/
http://www.majoristanbul.com/cgi-bin/trust.myacc.send.net/
http://www.nhadatquan2.xyz/wjf85ri/sec.myaccount.send.com/
http://www.ninepoweraudio.com/cgi-bin/Intuit_EN/company/Notice/sFVxJ-tg_M-FBsQ/
http://www.zhanxiantech.com/google_cache/secure.accs.send.com/
http://xn--jos-mrio-correia-jmb5l.pt/js/trust.accounts.docs.net/
http://zaferhavuz.com/wp-content/sendincsecure/support/sichern/de_DE/03-2019/
https://anandbrothers.co.in/wp-admin/RDEB/61373497/pmMmx-avZy_dhpyF-7vPo/
https://arinidentalcare.com/files/trust.accs.resourses.biz/
https://asociatiaumanism.ro/wp/secure.myaccount.resourses.com/
https://e-cart-solutions.com/ff0osxw/llc/dUXBn-TT_qQ-NX5/
https://elmatemati.co/wp-includes/US_CA/info/Redebit_Transactions/Instructions/3512692/IsTNB-bcmb_n-2iFQ/
https://entec.vn/zdiks2j/Redebit_operation/faq/745272118/pxiB-k1_EmAAl-pf9/
https://eptq.kz/blogs/secure.accs.docs.com/
https://esfahanargon.com/wp-content/sendincsec/nachrichten/vertrauen/DE_de/201903/
https://eventpho.com/wp-content/sendinc/legale/nachpr/DE/03-2019/
https://expresstattoosupply.com/wp-content/sendinc/legale/vertrauen/DE/2019-03/
https://fbufz.xyz/sendincverif/support/vertrauen/DE/032019/
https://firemode.com.br/1021blindagens/wp-admin/sec.accounts.resourses.biz/
https://fk.unud.ac.id/wp-includes/sendincencrypt/support/Frage/de_DE/201903/
https://flintfin.com/wp-includes/scan/RDEB/terms/daaMn-gDhPs_y-oF/
https://fxqrg.xyz/sendincsecure/legale/nachpr/DE/201903/
https://gbazar.com.br/aas6fdp/sendincencrypt/support/Nachprufung/DE_de/03-2019/
https://getdripfit.com/wp-content/sendincsecure/nachrichten/sich/De_de/03-2019/
https://gitbim.com/braz/secure.accounts.send.com/
https://gskr.kz/wp-content/sendincencrypt/nachrichten/Frage/De/201903/
https://gvpmacademy.co.za/css/sec.myaccount.send.net/
https://hille-company.de/wp-admin/US_CA/doc/Redebit_Transactions/Transactions/237337107/MSlGo-JtHKz_Wp-9R2T/
https://hotelmysurupalace.com/wp-admin/document/Redebit_Transactions/Operations/NhFRB-8Ev_RzGTe-lZhG/
https://huskennemerland.nl/wp-content/Intuit_US_CA/llc/Redebit_Transactions/Operations/jWPSM-cjbW_pUb-9kk2/
https://inclusao.enap.gov.br/wp-content/Intuit/company/RDEB/Operations/ansh-WkZ6p_dFs-qSn/
https://informacjezkraju.pl/zoh1cdr/verif.accounts.docs.net/
https://informapp.in/xvyf69e/sendincsec/nachrichten/nachpr/DE_de/03-2019/
https://jerryshomes.com/vendor/US_CA/info/RD/UifUK-Z38jO_YZRyw-LWk/
https://kcxe.net/wp-admin/verif.accs.resourses.biz/
https://kkk-3728.com/wp-content/sendincencrypt/legale/Frage/De_de/201903/
https://kkk-3873.com/wp-content/sendincsecure/service/sichern/DE_de/03-2019/
https://kkk-7681.com/wp-content/sendincsecure/support/Nachprufung/de_DE/032019/
https://leonpickett.com/con7ext_sym/r0bo-v8e4q-jylv.view/
https://longmiaplus.com/sendincsecure/trust.myacc.send.biz/
https://nhathongminhsp.vn/sendincencrypt/verif.myaccount.send.com/
https://oxyfi.in/mmcv/trust.myaccount.resourses.biz/
https://pefi.sjtu.edu.cn/wp-content/Intuit/llc/RD/Operations/8060122705/HCnO-Wf_PTUH-2q/
https://pji.co.id/iug1iha/sec.accs.send.com/
https://rebuildkerala.info/wp-content/files/RD/terms/qvhQ-cdc_ZKXAKz-i4/
https://sagrathi.com/sendincverif/sendincsecure/nachrichten/vertrauen/de_DE/2019-03/
https://studiomarceloteixeira.com.br/wp-includes/sec.accounts.send.com/
https://sundarbonit.com/wp-includes/secure.myaccount.docs.biz/
https://tokokacaaluminiummurahjakarta.com/cgi-bin/verif.accs.send.net/
https://tokokacaaluminiummurahjakarta.com/cwflfmf/sec.accs.send.biz/
https://vinhomesgoldenriver.info/tyoinvur/verif.myacc.send.com/
https://webinar.cloudsds.com/js/trust.accs.resourses.com/
https://www.3d-designcenter.com/img/k9ad-34z7d-ungd.view/
https://www.atadisticaret.com.tr/wp-content/sendincencrypt/service/sich/DE/2019-03/
https://www.brunerpreschool.co.uk/blogs/Intuit_US_CA/llc/terms/rzrV-ZmK_MoVec-tRKK/
https://www.esteticabiobel.es/wp-admin/sendincencrypt/legale/nachpr/de_DE/03-2019/
https://www.gokmengok.com/wp-admin/sec.myaccount.send.com/
https://www.grameenshoppers.com/old-site/US_CA/Redebit_Transactions/Instructions/rnxLR-K48_oUp-qnr/
https://www.hanviewpacific.com/test/sendincsec/legale/Frage/de_DE/201903/
https://www.heldermachado.com/wp-content/sendincverif/service/nachpr/DE/032019/
https://www.hk026.com/2zsjmbk/sendinc/legale/vertrauen/DE/03-2019/
https://www.kelaskuliner.com/tyoinvur/sendinc/legale/Frage/De/201903/
https://www.lagucover.xyz/8agtetk/Intuit_US_CA/files/terms/piRm-X0_GK-NpBv/
https://www.la-reparation-galaxy.fr/wp-admin/Intuit_EN/document/Redebit_operation/faq/346178436/aDTP-Uhktd_wHV-Hr/
https://www.lnkjdx.xin/wp-admin/sec.accounts.resourses.com/
https://www.localbizz.in/wp-admin/Intuit_EN/doc/terms/TwlY-Omkd_WSS-Fi7/
https://www.ninepoweraudio.com/cgi-bin/Intuit_EN/company/Notice/sFVxJ-tg_M-FBsQ/
https://www.yildirimlarholding.com.tr/wp-admin/secure.myaccount.send.com/
https://www.zhanxiantech.com/google_cache/secure.accs.send.com/

```
#### Epoch 2 Document/Downloader links seen for 03/13/19 ####
```

http://104.155.134.95/verif.myacc.docs.net/s3uz6-lqqzt5-rnqphv/
http://109.97.216.141/@eaDir/y7y7-s6p8as-auqzvlfb/
http://114.115.215.99/wp-includes/6ymw-hzj8t-yziswqr/
http://118.126.111.163/q1j4pt0/vffk-h65jg3-pffz/
http://118.24.117.137/iolfcmx/d5xxauc-qa19o-lnsyqia/
http://128.199.68.155/wp-content/uploads/5q73-5aggn8-agovfen/
http://12pm.strannayaskazka.ru/wp-content/ay2pd-8w3h7o-smomp/
http://13.209.31.54/wp-content/j56ie-q4pr7-hyskte/
http://140.143.224.37/fb5sreu/tkiy-msnwm-ocmfz/
http://159.89.31.29/wp-content/bx6n-83qbbx-aejixm/
http://192.144.136.174/wp-content/ey8d5-0dglm-imizohy/
http://2bebright.net/a4inhdw/frsh-t8vphw-tlhak/
http://35.200.202.215/wp-content/uploads/k8iag-wulnvn-ahohpbt/
http://35.221.147.208/wp-includes/ss740-w5h1jg-tlcz/
http://35.221.42.220/wp-admin/tmft-2msnea3-hnzs/
http://3drendering.net/wp-content/bg4d-dxjqx-oler/
http://6connectdev.com/bots/pnlsj-rzti93-sapdcuvq/
http://79.137.39.145:8080/wordpress/wp-content/uploads/pj6e-2vdcd-kijjr/
http://84.28.185.76/wordpress/lv6rh-4i2k6c-rtnoiuzz/
http://94.191.48.164/hf9tasw/o983-cfbni-epxvp/
http://aasinfo.hu/images/euxo-jo6h1u-efos/
http://agtrade.hu/images/m6az-uc1m0-pfze.view/
http://akashicinsights.com/absolute_abundance_files/1mntv-bjae9-oxdaqbh/
http://akashicinsights.com/absolute_abundance_files/jzf7-vnq2h-jvkq.view/
http://alannonce.fr/cgi-bin/8b1m6-v5bbir-iycrvob/
http://alkadi.net/osama/qgv4-e389a-szzkeilmg/
http://altifort-smfi.com/wp-content/uploads/1dcrb-2fqwe7-pkhlbrku/
http://amigosdealdeanueva.com/mail/vqm8u-frm4ws0-pwjaa/
http://ammedieval.org/wp-includes/6x3r-lxpns1-itpef/
http://angelareklamy.pl/cgi-bin/5sea-qryp0b-xpkpzpepx/
http://annual.fph.tu.ac.th/wp-content/uploads/yuo3-k2nys3-hucb/
http://artecautomaten.com/wp-content/80g4z1-mtiz70k-mjta/
http://artmaui.com/wp-content/f3ug8-law6e-xfcqh.view/
http://atelierap.cz/administrace/2kzrm-u29hj-jlvrrgoee/
http://ayitilevanjil.com/wp-content/sbglcn-5kvu4n-uoyb/
http://barabooseniorhigh.com/En/bly1-g42zf-bsrqkaki/
http://beloa.cl/application/tests/q0ue-2vdud-wuxrgil/
http://bergdale.co.za/wp-admin/jejxy-dzb24-ljqqgzz/
http://bernardlawgroup.com/wp-admin/g51m1-4mdty5-vksht/
http://bernielandry.com/wp-includes/3qmtd-xmr7y8-vjwdmzk/
http://bernielandry.com/wp-includes/3qmtd-xmr7y8-vjwdmzk/)/
http://betonbrother.com/cuki/4e9sv-1ki9v-fzkt/
http://bhumikajyoti.com/css/vnjbt-m9ozd-jkukz/
http://biederman.net/leslie/7kth-xlspp-zwejfxp/
http://bitbuddybtc.com/btcbetpal.com/8ad91-oltcg9-cbon/
http://blockseal.com.br/pdf/9v87-70hvk-mrenqnqb/
http://blockseal.com.br/pdf/z4lug-bpbx8r-rkzeuyfl/
http://blog.atlastrade.biz/wp-includes/qxmsx-z9c7je-lqhvywa/
http://blog.clubedocapacete.com.br/wp-admin/2my9z-t8iwf-ckcey/
http://blog.marianemaikomatsuo.jp/ja9hnln/qxfv6-6lffk-lceqp.view/
http://bloodybits.com/edwinjefferson.com/lxxiw-nt5b63-hoirtvgsq/
http://blueheartfeed.com/jxpk/7r69y-i6eh4b-clzkkh/
http://bmserve.com/mobile/jqb4p-d55u4g-zdzeuwf/
http://brams.dothome.co.kr/wp-includes/2aao-80urg-pagaagzc/
http://browsers.dn.ua/wp-content/czac-nrzgo-hysdwy/
http://buckmoney.xyz/cgi-bin/g0wwk-kjrlcd-yayjxol/
http://businesswebintegrations.com.au/wp-admin/fg1i-4ka9d7-yvzau/
http://buybywe.com/invoiceplane/e33v-47lnw-hortestf/
http://californiamotors.com.br/site/ffsi-ckg5x-hqphz/
http://campustunisie.info/cgi-bin/zy3r-412rju-zhifdmrdt/
http://canacofactura.com.mx/factura_admin/fx27l-5dqbqv-wppohrnyn/
http://candyflossadvisor.com/oldsite/k75z-p81wz-vdteq/
http://carlosmaneta.pt/29hvno0/4pp8-pvxa3-zletb/
http://catamountcenter.org/cgi-bin/hgcw-r6i4j-qjjctshs/
http://ccontent.pro/psmc9yj/8x6u9-ak8gj-pyywgjplq/
http://cedrocapital.xvision.co/wp-includes/qiteq-rvg79-qewp.view/
http://chefadomiciliopadova.it/wp-includes/acu08-lfh69zc-amukgt/
http://chuyennhatietkiem.com/wp-content/c93as-7a7sutu-wesqqb/
http://click.senate.go.th/wp-content/uploads/2019/5kf9xg-1ew5g4j-ajij/
http://colbydix.com/simpleSiteBack/ty9fr-r5jsv-unllqudn/
http://colbydix.com/simpleSiteBack/ty9fr-r5jsv-unllqudn/)/
http://contabil-sef.creativsoft.md/css/7tj2-xp81h-iosiqna/
http://design.ftsummit.us/wp-includes/ya1w-nhg7bf-ljopsa/
http://designer.ge/wp-admin/ml0g-b4cnhs-jbxftzd/
http://dev15.inserito.me/almumtaz2/nkh6-ngcm8q-hxslwk/
http://dfydemos.com/chiropractor/o96z-wapmc-pahhmsk/
http://digitalprintshop.co.za/kgyhf1s/jg9iil2-dp5he-jixh/
http://dimeco.com.mx/factura/3nb3-hhzecy-ocjpluefz/
http://divacontrol.ro/images/var3-grecla-cfoqykg/
http://dogfood.gq/alfacgiapi/19zecs3-g0s5b-bkeydld/
http://dogtrainingtips.me.uk/YAHOO/i1dsjp0-efshv-javen/
http://dqbdesign.com/wp-admin/6qyv4-9tq8s-zzarro/
http://drszamitogep.hu/_BACKUP-20190208-HACKED/mz58-5k5jp-lxiv/
http://d-snpagentdirectory.com/hosvctb/gnbo7-2vzgm-licrkml/
http://dtk-ad.co.th/r20yp8t/speqs7y-mngn1yj-ugzcwuf/
http://duncaninstallation.com/images/yptss-ia6pha-mgohqoeep/
http://edtech.iae.edu.vn/wp-includes/4dj9-k6eyn-vhznya/
http://ekimkayadropshipping.com/ozan/5c5w7-gcoq7-atef/
http://ellajanelane.com/ejloffice/124s9-fm1qq-abgix/
http://embraercssguide.com/wp-admin/gpjk6-y3ql8w-imxxewr/
http://emporiodochefkaka.com.br/wp-content/6via-rgiz4-dxxmis/
http://e-n-g.ru/wp-admin/ct4w-993wbu-kolgphei/
http://erdelt.nl/administrator/jsk1-w41hwa-qskany/
http://esenlives.com/yyvmbi9/ear3t-r5slea-zbdvcqlb/
http://estatecondos.com/blogs/xy73ab-tuq3j2-vlbug/
http://e-techconnectivity.in/sitefiles/0ukwn-3p2242-yhyugo/
http://evaksgrup.com.tr/wp-admin/3o71jou-kc2h1oj-bvqqghv/
http://factoryoutlets.pk/wp/602kmrl-u9vqfy-xonjxs/
http://faisalera.sg/blogs/75vh0-4c3tl-gsqfe/
http://farstourism.ir/wp-admin/zybx3-ogcjh-yxcgfs/
http://fictionhouse.in/wp-content/v5v14-mcb8h-sfpd/
http://firma-malarska-poznan.pl/wp-includes/fqio168-q23pt1-kjzidv/
http://fisika.mipa.uns.ac.id/icopia/files/fyhwj8-sx526d-ngfto/
http://flyingmutts.com/stats/f06bn-kgh24-ncoviajp/
http://foresightastro.com/astro/bmykd-8efx9u0-ycjg/
http://fp.unived.ac.id/wp-content/uploads/90kg-bcsnns-qytzs.view/
http://fundmanagertalk.com/cgi/7f7y0-y6vnr-jjhzgbycu/
http://fuzzyconcepts.com/residential/vgf0-uy9ho-blimv/
http://gadgetzone.bh/store/x9jx-bu03m0y-dvtgpdj/
http://gamarepro.com/plugins/kmco-qr04fy-xtvulaut/
http://garo.org.tr/form/jv91g-is162-zqfypgt/
http://geoclimachillers.com/wp-includes/knyp-sfhcsha-hulqc/
http://gged.nl/geocaches/z2xp-g0vptp-rltpmf/
http://ginfo.lol/wp-gone/xebc-b1pswx-uxmk.view/
http://gourmetreats.in/zzse/x2j3-pcsurv-hcpdfg/
http://gourmetreats.in/zzse/zwjz-2yhdx-eldv.view/
http://grafit.co.rs/cgi-bin/2bshi-3eutih-rvwqf/
http://greenfenix.com.uy/blogs/jmtov-6hww10-njzzbgtd/
http://grupoweb.cl/wp-admin/bx5k-6wssps-byqzqqteq/
http://gunpoint.com.au/jqQB6bFC/qllom-cj8f2m-uphx/
http://halal-expo.my/wp-admin/g7wn-vqjivi-iaflnb/
http://hand.nl/ads/i84c-eb26hq-vncjkijf/
http://harmonygroup.ci/wp-admin/se4y8h-ckebn4h-mkmpss/
http://hbsparticipacoes.com.br/wp-includes/4nzh69-q3jbj2-liiz/
http://hds69.pl/ww4w/j5m48-5hz5w6-pwglab/
http://hep.dk/bobler/uf4op-691f1i-cydkgk/
http://herms.com/backupDBsup/j4e7-76x2f-lcced/
http://hillhousewriters.com/_notes/ti8c-u5jpix-zgipgrvz/
http://hoief.iq/59eskvt/fhn4my9-489jwhc-mevyk/
http://holosite.com/3d/wku1-5a74w-tcrfsmtub/
http://homeopharma.pt/wp-includes/prta-9oao9-utpa/
http://hopex.com.co/cgi-bin/9dt85-4v81pu-fwct/
http://horseshows.io/c2nkrlt/s72w-42ruwc-ggfgto/
http://hos.lwdev.nl/wp-includes/0h5v-fitc79-bwbiadf/
http://hostbox.ch/8hdu-cd7z4d-wwwh/
http://hottest-viral.com/tyoinvur/z3hl84-dhnqp-wqyl/
http://hpbio.com.br/logon/4b28-bals6-txsb/
http://humanointegral.cl/wp-admin/ozm7-aldl8z-qysat.view/
http://hussaintibbenabawi.com/blogs/x6x73-skouwnt-qxegd/
http://icpn.com/shawtroop342/873d-oo9v7-qnxh/
http://ifilo.com.tr/old/4uyga-bykhf-mlxikab/
http://i-genre.com/wp-admin/vlnk-0a28ky-gcxl/
http://iglecia.com/threelittlepigsgotoyoga/go16l-yg546-baojzny/
http://iheartflix.com/wp-content/2o10-v1ndx-aupxlnse/
http://ilcltd.net/eienbsu/p41rbi-h21yh-qenkt/
http://ilgcap.net/wp-includes/4gzh5-stgopw-sotgs/
http://implantis.kh.ua/wp-content/y1vyg-3zgcq8c-dnmnco/
http://impro.in/components/wtv92-h7574-etbff/
http://improfy.com/wp-admin/a0ur621-bwq0u-cgqptd/
http://infinitec.com/support/api/dauh-4edsat-piprrj/
http://ink-spot.gr/ww4w/ij38x-bn07q-mhtusp/
http://instituthypnos.com/1sxuh6w/mq4zg-lhprzn-yooemce/
http://internetport.com/wp-content/3s57f-jwrlh-rxazex/
http://ione.sk/isotope/fa9n-ilztc-raiydwlsg/
http://iribx.ir/gjhrs/uyhc-ast0o-qhmz/
http://itconsortium.net/images/qtkdo-xz1ps-jpgbdabng/
http://itecs.mx/wp-content/c2422-zqvc3a-qsgo/
http://itpractice.com.au/wp-content/6neg-zq2h5m-bsgeeo/
http://jabalnoor.sch.id/wp-content/60yhe2l-mn05v-jcojd/
http://janetjuullarsen.dk/ydcb7-9ftb6-beob/
http://jaspinformatica.com/boxcloud/re9tl-u4aic3-rkty/
http://javorsky.eu/knihy/7l10d-wchl8-wcdxui/
http://jbimpex.com/cgi-bin/okr2-bbqpd-pcqloy/
http://jeantetfamily.com/nbYKX-tuyPjfD9eJIDLdI_GSUQXuUwr-SJM/p0toi-wvvspg-pzauhekva/
http://jjsdesignandbuild.com/tw34yvw/3ymrs-jt8451r-wijgvjx/
http://jobsinholland.ro/szuh/j5rm-9cj8c-vtma/
http://junkmover.ca/wp-includes/yscl-n56pu-cnshz/
http://jupiter74.ru/bhwfper/mvhs-jjz361q-uvvkk/
http://justcarjewelry.com/awdtjmb/kpdh5fu-kuouvo6-leclagg/
http://kabmetodist.ru/wp-content/d3cwi-3kek1-kutsly/
http://kapis.com.tr/wp-admin/yaq59-ba9aw-rswkpxrzr/
http://kapporet-e-learningsolutions.com/wp-admin/dnbcu-is4koz4-ioaqtxk/
http://kemaster.kz/wp-admin/6rz2l2o-jbjb2nu-kvaml/
http://kevs.in/wp-content/uploads/fyrm-tila91-hjiqfkat/
http://khachsanrevungtau.com/f7wmgnw/c9kn-cl8djx-bzrlkuh/
http://kinomax.vn/wp-includes/vomwqab-syfcg-cgpw/
http://klasisgk.or.id/fonts/ad10-xbqpw-rxto/
http://koehler-cosmetic.de/wp-content/a244r-y9ohc4-mbbeo/
http://ksoncrossfit.com/rylawpc/7ys1-3pc4x1-lhezgcfmo/
http://kuy-ah.id/megabusbandung.com/7mbn-byibei-cuptgwv/
http://kysmsenivisual.my/wp-includes/8lcj-aq6gr-poomjlddr/
http://labsinitiative.com/wp-content/4wiv-w4ervw-gvsyeph/
http://laptrinhwebcoban.com/wp-content/90p7-9zd1h-chuah/
http://larissapharma.com/fobn/egvl-hwiww-sfcidhb/
http://legginsandtights.com/xgerdse/wbuwueo-u51po7-nphyyrb/
http://lemasc.hotrogoogleadwords.com/wp-includes/s69o-2a3o2-iifi/
http://lgubusiness.ph/wp-includes/2kc5-j9la5-rfra/
http://limblo.net/wp-content/pa6h-s8he0r-bvwfu/
http://locaflex.com.br/wp-includes/j30zkp6-d4uus-zrvj/
http://logologi.vn/xo4875d/v22ho-qlb8v-ihywq/
http://luacoffee.com/wp-content/uploads/hwqu-5dj22r-chrsl/
http://lydproduksjoner.no/wp-content/vabw3-m8xxm-rtbvks/
http://lymphaticyogaexpert.com/wp-content/mvuw-69ilwj-ahzzb/
http://mc.kalselprov.go.id/wp-content/kqep-4bgoas-vyfdpr/
http://modelsofmeerut.com/wp-admin/yoag3-iinsv-fkab.view/
http://muacangua.com/wp-admin/shes-u7pd1-uvlyle/
http://nanyangbaobao.com/wp-content/o0l5v-cqofge-msavm/
http://nguyenthituyet.org/wp-admin/nger-xhkcnz-dywfrio/
http://nowokay.shop/wp-admin/fjbza-zhv8tt-cuanbzsge/
http://oneadbiz.com/wp/wp-content/1qttp-xpjgn3-bieu.view/
http://pannewasch.de/Artetra/pf6f0-vlkuko-dcshgay/
http://pantone-iq.com/test3/bzk5-q6bt2o-thwi/
http://pasb.my/videos/v48pu-rg7di-llwdp/
http://petite-pop.com/wp-content/e35d-msulvg-bnquh/
http://pharmanecia.org/wp-admin/sn3c-awm1k-ttpxpk/
http://profitorg.kz/index.files_/5d0z-i3i1ds-hojyl/
http://project.hoangnq.com/tour/images/catalog/vuemiv-9rtmff-stfucv/
http://pueblosdecampoymar.cl/wp-admin/bj7t7w-6du67-pgzflw/
http://regiosano.mx/wp-admin/vqkjx-7k190-nswloca/
http://research.fph.tu.ac.th/wp-content/uploads/4qbxx-tvwu0-exphx/
http://rychlapreprava.sk/css/ilv6l-vtxj1-bmylx.view/
http://sahkocluk.com/css/mm3w-pog9i6-dbnn.view/
http://sannicoloimmobiliare.com/s5v4bzr/kg5em-8s0zg-wyrk/
http://sannicoloimmobiliare.com/s5v4bzr/stay-6vaz2k-gxplb.view/
http://scenography.om/dhl/s1w0v-2hdmi5-jfgv/
http://sevensites.es/D1J/cxxbg-0d5nwo-pjufq/
http://shawktech.com/shawktech.com/91nw-hd0kc8-ingjmpx/
http://shoppworld.com/migrar-wp/u9esy-5oz3f-jmvlvsw/
http://soil-stabilization.ir/wp-admin/im6p-txr1q6-bfzd.view/
http://spc-rdc.net/blogs/fr3l-p5snm-fhpmcysg/
http://speedcargomovers.net/assets/6lb0f-41p609-dufh.view/
http://stargellenterprise.com/home/id42uh-rmk38y-bjtkp/
http://switchandplug.co.ao/concrete5/kyam-j7xftq-rxuya/
http://taxi.seotm.pro/wp-admin/45kr-bp03x-bzgwb.view/
http://taxi.seotm.pro/wp-admin/d6l8-4oz3g-bvmagr/
http://technorash.com/howe3k5jf/5x1vy6-mkjsab-gpkel/
http://tecnologiacervecera.com/wp/fhxjtox-k9uqwvw-wdpjep/
http://teknotown.com/wp-admin/d96m-5kduyd-gmzsf.view/
http://tem2.belocal.today/beauty-house/1ja10-cuvei1-hvvjkdgrd/
http://temp4.com/polygon/d1nc-dnq36w-vvqs.view/
http://templatewordpresss.com/wp-includes/3lm8-ykcsag-ihjnv.view/
http://theta-energy.ir/1/zs6b-vuo29n-mvmk/
http://thientds1809a.dizito.me/wordpress/wcbrx2-vd4uq0-wsrjd/
http://todaysincome.com/wp-content/7h8nd5j-2ssh9-jcuyc/
http://tom11.com/images/8azg9-cyflvl-juspgb/
http://triratnayouth.org/wp-admin/1eer-0njhp-kenz/
http://triton.fi/trust.myaccount.resourses.net/smanw-aa2qk-rrqt/
http://ue.nz/wp-content/zkgk-th6a8s-qnzsm/
http://ulco.tv/1v7wu20/8ke0q-lxmwr-kwxn/
http://urbanelektro.no/wp-admin/llpb-c51b3-bvckp.view/
http://van-stratum.co.uk/www.haishabu.com/ix5g-x8m3l-fysyeubjn/
http://wdsonlobo.online/ddh9fua/oe5b-uvnthq-cwckmf/
http://weisbergweb.com/lxPU-3j60nDONL_Sy-66/gzlvc-m1nkv-naxyc/
http://wessexchemicalfactors.co.uk/css/rzyj-spr1lb-dyyo.view/
http://www.1080wallpapers.xyz/tvcgyma/klmi-malohv-prbqgs/
http://www.alrafahfire.com/images/h3ry4g-kbtfg-pvrm/
http://www.bilgiegitimonline.com/wp-admin/iovt-qv0vom-wcmvn/
http://www.breathenetwork.co.uk/tmp/c0hyf-k641oc-fvwe.view/
http://www.bstartware.com/wp-includes/2iwrje-tchjvs-lifj/
http://www.doblealturacasas.com/htaw38fovf/hu3j-uk77zc-dhbiixesz/
http://www.emporiodochefkaka.com.br/wp-content/6via-rgiz4-dxxmis/
http://www.flux.com.uy/fw2xzy5/thu2-4gtlj-semt/
http://www.gifftekstil.com/wp-admin/6gs5-tt5ah-hkeeb/
http://www.gorkemevdenevenakliyat.com/wordpress/m6vb-oiw2b-ourq.view/
http://www.gym.marvin.tech/css/zjseo-hdlmxw-chwelf/
http://www.hdtnet.cn/wp-includes/0g2cj-52x85-figojyex/
http://www.hotels-vercors.com/stats/97vgeb-78jzwj-oryjrz/
http://www.hurrican.sk/img/jau8x-rpk0t-htuqykyp/
http://www.i3program.org/wp-snapshots/e05o-2xz787-owuimq/
http://www.indufan.cl/cgi-bin/79xi-x5lp9-xvmc/
http://www.irqureshi.com/wordpress/wp-content/72ww5x-i3e1zf-uhjxwce/
http://www.jar5.com/wp-content/coz40-j9mm7c-hmogkdwx/
http://www.jazlan.ideaemas.com.my/wp-includes/aa2qgjm-ut6qkb-omrpk/
http://www.karaoke-honeybee.com/ztbr/d5bbc02-8tze05-dthg/
http://www.koehler-cosmetic.de/wp-content/a244r-y9ohc4-mbbeo/
http://www.lymphaticyogaexpert.com/wp-content/q4qj0-oupui-zklv.view/
http://www.mmcountrywidepages.com/cronkwq/z7sm6-gi5ab2v-dnfta/
http://www.nhadatquan2.xyz/wjf85ri/aut50-w4vz58-gqtgg.view/
http://www.sahafstandi.com/wc-logs/t84h5-iv2n0-rnuar.view/
http://www.sdhjesov.cz/wordpress/papcc-koe6n-lsric.view/
http://www.smilefy.com/it3fqqo/lcrsd-d2qpq-yixdwk/
http://www.tarakiriclusterfoundation.org/lbjjqctggh/7qm4-lbuy9a-tddag.view/
http://www.teknotown.com/wp-admin/d96m-5kduyd-gmzsf.view/
http://www.triratnayouth.org/wp-admin/1eer-0njhp-kenz/
http://xn--80ahduel7b5d.xn--p1ai/wp-includes/bc2db-cdkps4-vzwapi/
http://yallagul.com/wp-admin/t4l1-vq4xf-inxv/
https://0xff.pl/wp-content/oo0t-8gv3d4-rhfyaafqg/
https://1040mfs.com/wp-admin/8fd61-zjg0m-vkyo/
https://34.196.157.118/upgrade/dfpiw40-c24cn0-hhuwhea/
https://abi.com.vn/BaoMat/8bklf-t2r3z-bthqpzsyt/
https://amaiworks.com/wp/tn7a-opg7l-rstfub/
https://anhduongdetailing.vn/wp-content/0wy4-ygzxbc-djpiljgmb/
https://asis.co.th/cisco-sg300/8leo-kxoz2a8-msiq/
https://biddettes.com/xakgexg/m9og-gd2ka-rqicg.view/
https://blueheartfeed.com/jxpk/7r69y-i6eh4b-clzkkh/
https://boymockup.uteeni.com/nbrm/3hzxf1r-25x9y-mmkio/
https://ccontent.pro/psmc9yj/8x6u9-ak8gj-pyywgjplq/
https://chefadomiciliopadova.it/wp-includes/acu08-lfh69zc-amukgt/
https://click.senate.go.th/wp-content/uploads/2019/5kf9xg-1ew5g4j-ajij/
https://d-snpagentdirectory.com/hosvctb/gnbo7-2vzgm-licrkml/
https://elevituc.vn/old/csom-9kdwt-rvpgjwouo/
https://epcocbetongmb.com/h0s94dr/sy2uw-y1te5d-pdbibvva/
https://euforikoi.xyz/application/wzoo-k6txu-zyjfxokwc/
https://evytech.co.il/wp-admin/7u6y-7qmp0-edbhdoj/
https://ewoij.xyz/250iox-6ww52-uxrgzcd/
https://fanfanvod.com/css/jhyb6-8yql6-cthotb/
https://fedzbot.com/wp-admin/bf55r-s64sv4-xjgtevj/
https://fmmagalhaes.com/wp-admin/pxpx79-nzmh3ej-auih/
https://garibas.kz/wp-admin/ti5mczb-uvbsj-hhanmx/
https://goodjob-group.com/img/jnil-cfr9w8-iohlmogc/
https://growthsecret.in/wp-includes/gqr9-cvmtdx-jpquetzhc/
https://hangtrentroi.com/s/g5a1-4zuh28-emygdo/
https://healthandenvironmentonline.com/inpiv6s/tcw4-s7l0x95-ywzy/
https://hechizosdelcorazon.info/p1xemen/197l-ijzoo-verlrr/
https://hjemmesidevagten.dk/wp-admin/l73w7yt-w4yf6b-vtotlko/
https://horseshows.io/c2nkrlt/s72w-42ruwc-ggfgto/
https://hotmailsignuplogin.com/wp-content/glgrf-nwowrn-rqjitr/
https://hottest-viral.com/tyoinvur/z3hl84-dhnqp-wqyl/
https://ieatghana.com/nycm/lgv0-si28jw-jjxcis/
https://ilimler.net/wp-includes/t1n6-08oe8z-zaksvzr/
https://improfy.com/wp-admin/a0ur621-bwq0u-cgqptd/
https://indianvisa-online.com/css/shj5h-zgvph5-bhsxqdt/
https://internetport.com/wp-content/3s57f-jwrlh-rxazex/
https://intrinitymp.com/site/163qa5i-cw6oj-ngioh/
https://ispet.com.tr/wp-includes/7nnl7-u9kqn9-xudtrq/
https://itimius.com/wp-content/p8y8q-gf2lxv-llurzkr/
https://jobs.spyreporters.com/wp-includes/wg9m9-xc14x-cmnz/
https://jobsinholland.ro/szuh/j5rm-9cj8c-vtma/
https://jsonpop.cn/ddxwo0f/xi8xz-syxpq-zddhctvxt/
https://justkp.com/axzcmlb/apgw-tyix1m-rgiuahdc/
https://kanttum.com.br/blog/wp-content/uploads/hw1c-rmvsb-fqdwv/
https://kbpmnusantara.com/wp-includes/0x3275q-i39w2-cruqzjj/
https://kkk-2365.com/wp-content/i9m89-0hw6nf-hldmb/
https://kkk-5278.com/wp-content/xazlu-z6iu4f-ftnu/
https://k-kyouei.co.jp/peosqaa/a4i7b1-u5o45b-rcehr/
https://knsgrup.com/wp-admin/kjul-gu7et-wkmmfm/
https://kovar.sbdev.io/xhol/5a9nc-8lxsrp-ufyh/
https://ksoncrossfit.com/rylawpc/7ys1-3pc4x1-lhezgcfmo/
https://lab6.com.br/ekgxadc/lbv5-rhw5n-yhddb/
https://labsinitiative.com/wp-content/4wiv-w4ervw-gvsyeph/
https://lifestyle-mobil.de/e308wtq/4r8t5-8y37l4-tfeqejs/
https://like.com.vc/wp-content/hs9lx-y568i-nwzfkbdo/
https://lockedincareers.com/stats/pvif-3nktd4-ruhorzu/
https://lopd.nath.es/wp-admin/ce51-l9ucoh-qszsjy/
https://luxur.club/wp-content/25ke-t65cr-eczyfts/
https://madublackbee.id/wp-admin/9qgwb-px79p-givtffuw/
https://myphamthienthao.com/wp-admin/w91c-njm03-hrdflnasg/
https://nhuakythuatvaphugia.com/wp-includes/aq7f-1erdmq-oyrhluy/
https://noithatmt5c.com/wp-admin/vpfgn-rs81tm-zpob/
https://pbts.net.ph/wp-admin/wsr3-o90mn-lpwjgtfdt/
https://pharmanecia.org/wp-admin/sn3c-awm1k-ttpxpk/
https://phenieconsult.com/wp-includes/o5viy-gk8wj-lvrbwta/
https://qualityansweringservice.com/icon/c0y3-ozvypr-vardnqxi/
https://rename.kz/wp-admin/5seaw-yqkmhp-biktaqf/
https://rozhan-hse.com/wp-includes/deo7t-dcaum4-fykaarrdt/
https://sukmagedoan.com/files/0ef5-p22er-djded/
https://teacherlinx.com/uploads2/7vdv-1pm4cj3-kbhxtpi/
https://trendingoffers4you.com/wp-admin/571ft-teg5h-hejd/
https://trimkings.com.au/videos/k6qj-emjl3z-kdvxbzec/
https://tuivaytien.com/wp-admin/9en9-uldjeq5-tmppidy/
https://umrah2u.com/heyj/pt0s-gghpod-hoyveau/
https://unitboxes.com/wp-includes/52ckg-c0fbx-sljwk/
https://vinafruit.net/dckd4o0/4glcc-v7lx8-tugfjo/
https://vtr.kz/vir/h7tgk-jzsjb-hvmnmfvn/
https://whimerie.com/crop-image/pjt6g-p8gbr-jemsli/
https://www.acquavivahotel.com/wp-content/53460-0iqp3-tlgsvh/
https://www.doblealturacasas.com/htaw38fovf/hu3j-uk77zc-dhbiixesz/
https://www.dream-implementation.com/wp-includes/99b1-j2uez-ifzw/
https://www.ekimkayadropshipping.com/ozan/5c5w7-gcoq7-atef/
https://www.fictionhouse.in/wp-content/v5v14-mcb8h-sfpd/
https://www.hakkiefendi.de/btafobj/yyrzz51-3nse8-wqjljw/
https://www.homeopharma.pt/wp-includes/prta-9oao9-utpa/
https://www.homing.us/wp-content/1zha-7s86pey-vkegrux/
https://www.idealjackets.com/wp-admin/ylaa-ln6p6-gqhzgvapg/
https://www.kuy-ah.id/megabusbandung.com/7mbn-byibei-cuptgwv/
https://www.sanarflix.com.br/portal/wp-content/uploads/d3tq5-yw5fd-avymywn/
https://yallagul.com/wp-admin/t4l1-vq4xf-inxv/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```


Creation Time	2019-03-13 20:55:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
8481adc2004a97bbc07bbc47f6601a7e7639b6e037e797686dd1a8d159264b2d
78d791edc7d71e6fc275a9bc93e66a58934f4cd2ad6b5468cb021d1fbd0d13c7
dc87d93d01f22c38de94079e6eb4fe5e97001b37753be5a5c503fcf36ad4f528
312ffe5cf618e82bbe2ab1a4425b6c2927319b52c0d440721a97f3eda519f145
8f03a01f8f47e53607f1a6a9297a246e336df4ea26d62a8560652bae569a3fb6
c4bad470544e10dd6cced30cd7401a15d69dafb03d07c65cc08f4d20d4b5bf58
2e93e7c34ebf56a7df68553db3978fe84969e0689f6df6fd66f04209d2a6efa8
04e5044ec07d08ddfcf21f295befc3a633824c74a62aa8ab701a8a1928e95cd2
a51704c674881ecea35f356a5752d350beb4fd262fd2d497d12632c7e966681b
0d5981ea8f3a35516b953b2a7388228ecc2f89da80fec3ac5b13dba11145edac
42a2583e3e1d624482f525e388ca5aa9a13f7f9759c10712879280a105b0f47d
17afdf7759ed22dab50bc59c3577df7d3ede2098f7d1cfeda4d52a34b6b0b00a
1de033897656da4d0da38e639e78de54d3a98a93d3439787fe2eea65024cd960
baa05ce9d41917c1998e4d992ade31e001f94bbbeebd941c8d0f4b9b37176f8b

https://webalanadi.com/u2go5i4/HIoJ3/
https://heritagemaritimeservices.com/wp/pKKS9/
https://webspeedtech.com/i1kk0xi/lv2/
https://pjk3indotraining.com/sendinc/vDRz/
http://turkmega.net/wp-content/8po6/


Creation Time	2019-03-13 16:35:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
d3b83219e9d0b536ebf678843e2f58ee30cfa9496ce391ebead925e0d1e4bb6e
be0c3609eaf16a3be0029364ff4ff8ade035332b134e5a0768e7b8cacc210262
f6ad8975fffe05390e74f611fe5a6c3c1e06b390aee11e7c1c52b742235adbeb
f68c7456e421ffda8dfee45a8ba0949ec875ed4fd934dab089ad102e96368a45
c215620d5042541ca6333af0bda5d949d9bf4474a576ef376646fa99349b1a55
9d704e49a7679713cf5e3c7e2f0624fdbc8bdf9ba1ba9e1ee9a8c11d70cc72c8
88407184a92e100b6b4870b5580c59acfbebc9ab735de3e3772b9e31b217a6e3
eb3eadec34e340d1980fec06f0b010a2c85262d487d238b497925d083fe80f5b
03b839a583518851cfa649ba42889c759b56f6fd21ead9235e60ce0be5a5156d
77f87389b50a69463262576c6dbab4326564433d83a2aeba21d953ceba2d3a8f
2da5f4d10f7fae3b1145933206f31e270c87bc21e53ee00937b2cd6b803518d8
d5806ed71265c2d88ec5dafaada469e8de62285ca344b4e2829e5c616f16e58d
295a025435e80b275f02237dcd8762a3d5f5bc8e2392c7d4b9a00e1837325d07
278852c85a959736504168dadce542dc8f083510e7dc31e65273dfe4cd3c1b5a
814842d9361d9fad65a2f5f05c09a1fcab4f7d5828eb74856129d3c67ef7cb0d
75929072a2be789fd9d4f977fd05a552f075f85fa0c71f094d0a4355a10afe0b
0d52d02c62742631761157105eba7976eee8c7acaa703761c8813f0d05e3028b
efcdfcad79c1de0c00d2a9307aa7f13ef7a9a64a9dbd996e29615cc99e80d7c6
c8644f90df79d4b5820438b383391b37b11c56795c6ae4ebff807586a9382692
dcf1c680fefbc1188a607f99e3d6a427025e227cf3cf80bd6671713d6d02e54e
05c3b84310d870eb0acd511c1ec7b338718cafd6c953fcba40a15e9a2a7e7126
ac452f895ebdb6662b96035b019afb4746e4d3b6ec22ad46184cc80a06118bf4

https://inovatips.com/9yorcan/Cz0lHV/
https://hechizosyconjurodeamor.info/wp-includes/oH1/
http://www.tarakiriclusterfoundation.org/lbjjqctggh/2avk/
http://hiphopbrasil.com.br/wp-content/uploads/Y81LP/
http://www.fabiennebakker.nl/wp-content/uploads/1rW0P/

Creation Time	2019-03-13 13:15:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
006b2cd4c2c02412fe0dd8a9cf7e611ad5c6fa460a4b567c1dcc20894111b40d
55724f81733d6c4da965a6a0cf488219263a5b7365b0781ef1b38398aee66742
ea799ce1d76161be37c5525785ea0b345016bdfe84f42c1b114a3ab60dbd5cb5
d426bb335d11917363958e30f898ca53fa988e0a2602cb051b3d8a2c586e0099
44754da26847905082c85e6be8907c5512e7afb35e1936b3afc8cc3ae4cee412
5504a099f5ff7ac92643c19098ad366629549a5fcdf880e0924a66845f7b7a64
02db0b0060c650cd0e10af4377eae0a76452eeb99d30c3a636ab0be2933b654a
97dbe3c733157d66bf760766b3655740179c5374515578650b71d0b09f031214
b4c7a89c1e188964e091ad9889aced80e1aff662c4a6f0baaf6aee9639e9c132
c6af372f360f24ee7df4606f1e7c97e3ec50a224eaa0a137981f98629f9af6d5
b81f2a6ee7fe7f23ff3d6b05cf4505843c8f1ff3fa0c0652c0855e668f5cd205
71dd9d4f7b07f04bf0394a425c77e6834a991529f0044ca34553bf37ebbb117c
6e61af278952468fe43dbd3da7576a945ee69245c9003e1b50db67038cd8ea41
6e61af278952468fe43dbd3da7576a945ee69245c9003e1b50db67038cd8ea41
e65037694bb149bfc29e1f2925377e7160be6eebe1667dfb018310ec28c448a8
e988fb7108fbf9d6ac2cd8ef821272437dca3c97572ea8d43cc8ca1b001a31d7
7b0aeb1fafd01c1ff8a60bf60943f927b682a0a63596e222b87c824fff7b1913
c750fbae7c0e21fd16048169b3cd224b2daa36da53614c786672d46c6994d54c
7465cde86ed61dbf839d1bc110216c6457a8342abd181c3fa91053bbe34e9e3b
d7e33a6c9faf1d74c674132651d74a7a6816fb98c135fd0966cea6bfad79798e

https://sisitel.com/wp-admin/crO5h/
https://www.oppa-casino.com/wp-includes/ev09CT/
http://alpinaemlak.com/wp-contents/qubF/
http://basr.sunrisetheme.com/database/Yz/
http://india24x7.zeecdn.com/bq1yj4a/v8J/

Creation Time	2019-03-13 06:33:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
21588dfc9f03ec5f0b9b93b7f4df6b6f7f451d0ee83f0c9b5d2b7360fa4727cd
99828606abf0fea099576f550192ee67621fa4dca310a0108adac5be96bcf84c
2a083b74b963d4cf26db34ee675f3142a7be535da19ddcc1caee23f192bfdda0
6769276aba59cb97262830af74100fa072254feaf1639a5474080492e5ec8849
4970fbdc821b4e7777b49abae8bdb7829f929f3068cfa38d3aa61361a2eb1095
da052ab5e595f10a7d847f39f33deca3b9a23103d73e57f3cadd69a08810eea3
3eedcefa0e9b7bc764508ba86d5d83169f1d910c258623993012349cd886dcd7
17ea3b98b9c14e26840d9c4817ef44934d1e0bf820560e365caf66719c440640
c535878524e6b0d722ef8bf5585f62b545879ffc600c1618b7917b55cb9f2a63
ad85cc216d004051b26a5ec7ecc6955435f6dfb50a2a44ba481e9f33ab493cd4
b3725804dc49d1defc2001030259bdbdc0aea2a75d9b9b30a86e25488feff80c
9b0eb35b785a275c51a5cbf8f761dd321fde2919597401a9a766ba09652024fd
8b944eb452495b51a88ba872bce0f8f0f0108b5ea77ae04e3f5874bfeab0a65f
58203f5f7a6ab49eb06d017d1228249d2757c2ac1acc1b554207c1092d4f8a96
43035af2818fced7c6f61cf72a4e1040f7072ecc58f154802f8a866d48480239
deb5fd68208b44044f6d6c48fe635a65aefb71a8bcc2a4d14f2b1df436807ae7
a326ef41dd5c17ea3948b8a24f25d1134c6f00d77af3f01ad43143c90a19900c
231b5b04de5eabbf5c806d3b49b65777f71c63e85c52a08f421d34252625525d
d7258b9426eba5b4d12c0c3ee5606c3e9e7a32089a040a795cdf5c7ae5df16ba
d653d670a42ab6346be9beacef5cd371185f09fa1a495331194317da4d721df3
01146cd6a40d4d55312f40b728590463303ce8fa73e46ca83e9f71fc66baf9c1
59bc63a32ff342b65e90e7ee7f976b4d2876c75f08fa77af832f43de96fdc5bb
aad4f9881e9d46f8e14dc0241d6cd0d1e1e821cdc176670ac953f5326d998393
67f0f39a3ab851a27fcbac32f968abb61fc02537bc1c8b6a35537faa96475b68
14d4efc93586ef405c2ae570d1ab4d80be97b33c01816b6a920d76b9578d862b
72abcf1d50b1cbb7aba4cb49119c4bbb52bc0e9bef9b377c4f829c5ccedf5063
545adf14ffa66e5315dc39d8fbd92857f73c328519df5fbad7a54c05e2305126
1defd5695f2e471f07cca2434198f391a6e17a8b75acd85054a3bd8337801f02
f19d03e679ddb5282fe74013d83d7918c9061eecf818232c8e026543345cc0f2
a8c8515e31237286f648b81c37c76199cdac21b1230398028633b6c0b7cf2625
8032dba523f7e585897f5de4e18844376b88888215bdc3c2132038f60a297ef8
e9ba1950c0cba787afceb3c933f1875b6bd6d4c98e5f6922e3e556513daeb379
61d6d3d852d8d8dabc04ad8b14374546125467ffd1519c30e81f04ede7c3ad9f

https://gamesuk.com/nlapwof34k/6Cf2M/
https://nralegal.com/wp-content/HcOEPe/
https://quizological.com/wp-admin/IBXm/
http://18.188.117.134/wp-content/nFDn/
https://bai.alphaomedia.org/8fkjkyl/aTi7/

Creation Time	2019-03-12 21:40:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
f3d7d9b36113ffc6aa4388f4d2f3f52349a3ba0984f9adc696b1a6d9db4108e0
2ed65e9a1e796862f97eeebdf46152caf4f7f4204b801287bafe5b11e948ee1b
4c9295e6906108f3dc926a9591a148e4e2636a893d4d2505b35a0d030635462a
d818fd24d2ee5426ca535b7c966021cafbe7bcbb68b9d6ce420b9006859f2df0
bf0ee1f25309aea8e27968f5d927fe8d05a66437cb86102d367305e61ec9f5d6
563991d43d484069890ca97745c1d7267c918afc260d31a52ec5bfc899a30c94
848b0b2455cb049ec8dfa798592de326b67abe036ae7a637c8aa3ab9e91f5cb7
c9bdfb2d6ac9e493bc391b2f64b48d8d5cde10645ea921951b23112e6d73545c
a42af575f713389ca1b0cd0156dceb753c1728cfe7c0e7a6036c53aef2d2d3fc
f832543e87f24eaa23f85c8976b79d7e49d1b4899f5358ba54a71b7c5f803e2d
6cc050dadebd893bfeff98d848d2da02c9905dfb84b45b4a7004c784572e86fc
75338c1551c3b7e1747e374d2d1e048eda3301e788bed120f976394a82197a70
7ace18922dc77927af28d05164d4354e2ea1cc56292dc0780a137e888bb13f05
888d9d4fc7fe06f42588d50edf544c1e4d94c76409e426b98747c947ba2964b0
376ce4e82d96e1b20146e94bb7d595c2d36670c77d9971a2b05cb1d4894831eb
a91af6020eba6ce116b4a6f31da99ab28b94cffab38283b01f6efe7d3bb002f3
a06d630f62bc13cb49c794bf934a4a3dbe8cf63f352304e71c056199a065958f
ab99f14070a1880146bf32846020ba5145087e7690d50ccf8c0b38d09af5de48
149fda501c9b22d7a769c06c3ab012903178e468405a6bd9cb7668a1ecd68c02
3d06cca2fa9525c544d9afcbdb407df1ac94c225dbb7db55f8a2cfd6d3164aec
938728fb61a1e0c5a5346e779b2d079d5e61b406c5888d724849830184ed25e1
45239ba48e3bfce88487f1580b8966812bb1ce03c695a6a82f77a5545d2fc330
e6edef78f5e2f0aede80d62fb6c216721e8f26433fde5b37430738e22ba1f7e6
c60eb3d68445ab0471aceef71bf75182d9d2f92e3ef3ab4fb148d8852dd2c5d0
adaf3f62905f7f759c99478fc76a33c952ed41a1a0379ce0ac85e029a600f96b
1f0a0b3801a3419a73b62daef965701107b30021db356d2c456de134fb35afac
ef77abec1d367990842b4cfe39a40724c696827f221f0582e3490aa0a9c26242
b9f83bd5eebbdabf1cc5ff8587ca2f12a91f4905538e65587b35bd8bf1132e9c
778f3e4a81d385672da53104120943cb8b38458538aa9fb7da63b69043d6a29e
37464b00b1c560cc0c45c400392040247176d700350e3464ba6df504789fd0e4
f05c9254634215a7d41caabfa7c59414c9be03d2876478e9c86022390df6ba9d
d8a23a26c477426b0a0d61191a036bc03e38f5811a600571f4f573b47d25fbe7
f6e3f5662d6950e77041dde2a384b25e4fe1fd94dfbd103a816c52f087f4b0ba
907ee123931eaa562f4fc2f2942ff0f2161408a667e53b84d1b702c004a13359
52a7dedd13c877665987b4b48254653445827bee819390dcb0989a0729e85bf0
92412b4e4586736f6956dec8799274280f58be69d01dcb32ac4efa776dc2724e
51f492b97688d8bd1f8b2ccb4e5a52f4e779df474243c79d462f0a8e5f352010
f68b9d8f5f8c0746a021934e42dd0944e77cc79a6bbb3129bb115e2b9240c197

http://emseenerji.com/wp-content/RRKu/
https://hacosgems.com/wp-admin/1114/
https://www.handbuiltapps.com/wp-content/w3tc-config/1b/
http://www.ryanprest.com/cgi-bin/jmEoN/
https://servifive.com/wp-content/wRvN/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 03/13/19 ####
```

0847501d8e8523051d54189afee8f4245bfb23b83bc5437e817a0924f22672f7
57fd2b8f603bd19a0c09f22f6d0ae6ed8f2c21b3bd83019c95ce4ea52f32abb9
a2bf96369f1e0977488440397fd7d42ef7bd5904fd646f13d732d86f339f506b
1adf937e8ce628c95b4fdb1f56a50e4ce424450645e2e99f0ea95539fd043193
92fa7634cfa43436077c7355cefa11e81368766de36b2430cdb909a908dd058d
8a546027d2a03e515abf89d820286c2c178b90640c82c97864b8f1a3a12e4ff1
3090950749d9c3342166805eb48cf03ff5d950e1abc01bfefd8dcd4dd41c0616
57505bd59bffbcb586121b11a634e6ddee9ebbbfd7416e6434c9c3bb83b636db
7aed5529bc0f798af1a1abf7a75eb4ddaf95206686e431eba9268280d7ca1293
1d4582d390718593502f0363c9a677506473280067ed2b5327c16a2c72ec31fb
7be9d704af50234848e797e40f63097f9b289d5a137cc4cde9097dca1e14ec98
d2b9cadb4c3cbabb12d3ad1f46a8b55375a93f3ba1477b9e02591bbe7ecdea95
92cdc90e15535dc1017a647c4cb1b7610bdb148cc2f4dcd16e3340899946a941
4e821c60e3f1b7c4824051a7743813a63b81edcb284a721589bed9147d917ac4
e5cb099e98bb2dd4ebdabc3a89f4e8306136525bd6049fa82e437cc0273b8c1a
5756493a4ca5209ebcde79feb918d211e6550fa643cd41e0eabdcb7571bec0d0
9f0103311f2e99de7a0ebb71fa4b6f110051ceb55119debfa5229b52de9d716e
f46fc8d5d17b2caf4a389e08bc740921d985818dd33eefc6227c25a6f03c943f
21955c092c1021b12546335bff90ea551c9a40e6a88a58c453a7286c112cd8eb
3951c94e521a2304c38dd3c72372013992f2217d3f716ee43d6f3ba9a3d051f6
633ce0bf5b83c1c7a2daf954fe59a1f9b49e67e1e065dd25068124b841e3ce35
5b21287a79c13a7d9ec29ab8c2b8989b9d8f71a51da41f4b548f6e846cdd0b0a
a0efba494e3e4238723b56269e9e9a167ae07e6f6c9642f2ff9bf3a8e4045c77
73d7c53956c84ab35cecb35bc80e07aab9cfdf648693b33dc63283053e0d7cc4
2f91d320cfa8e25120a98b70ab3e340715619583d0e275dacb432e547ea80952
6d55a42f7097019be3a1dfacba227c0b1f444c0dfd3ec343dd09ded83dc82562
306acd2d0fc4c82170d41d962bd8cd00ebd66f0882d42c56eb5f47154946110d
0b3d582d75820f270e27c9f092da60d5d5b0727d4efc7901c35df26506355d6f
abe90a6ed37e2ef60b52fbd69758687350b6a74990207ab05c280b29e142d1f5
267399396b805aea0199c25358776353ce095f19527fd4451a518afd33d77807
3259eabed6037a17e080f2f8dd3053350151cbadf98690e1c7539c5e68f5c5b5
e19b40958056093aa9143d508d17427345ba5fd3586fc6d709a8c19bf5590d48
19201e5c952a43646c6552123af6026c825ad8392a86f2489717e25ddf447d79
aae3baaf9ccc1b361a6194e5833ca923b5e825aeec3fe22a17e880cb91b5efa2
f3da1c3a520f5338c46be109a49c569ae1c4fc4b8085952c111edc2c1515cbed
5a769a4912df65b5129b7bbae2a05ca2f59ae6f15b45906ad74908fd80e4aaed
4b7aa07d9c121c9d049c2999623cfddaccc74be17453a640c86a1674fe358dba
9920d5120c8fd8f4fc1b42e380c44f58a818bd8a63de00217f606cd33132796d
45401694a56129749aaba0fbc0d8ade465a1c1cbb745a7daabfa12e704e05650
52bb9ffe1600566a488d6bf23a63ceba38f9c930f4018bddca57212ce3a55d32
99880eb0f9cafbf9db1b30f108d70e4b0a82fcd9f6bb74ba08641b7ed6735437
626b319eac3a5380fccc9a0dcb481e1e1d2d1dba7703f9515c9706d109ff6690
4db4bafe12f7ee2fda8a158c2e6665304a7f63370fbb3648a5ece5566d344339
00d2f4c09983e202112c9b415b02660d0ee88dfda55a504ce03c1788373360e2
7bb6ed0514a8a3372d5cc517e96a5fe4b35b9ee6d4dbf25a7b85d3491002c026
fe9d33c80dfb14b6dd7fa1dd3d8cb60a413ea257ad352b29b16c8f4ad9573d45
aef3bc8c71f3b3b2ee34c3db7187f6b073001400f25ede2b269c7156f348bf08
3cd063992fad8ba50de718ee8c8fcb760ed4721e9168c8af14c07a00e642580a
66da2b9856ec75c865d297f21f7ee3906a28a4ec66067e4ddb0cc7e8ae30a445
d8286a561fdeb369b413d650af22e180feaca06f990daa842d64e81aea462c2d
3234ee249f031b088e68052cf4afdc7fe683775d0aa5993f6191b364cec516bb
07a246ab4adf0899d2281e1695dccedfa6ade5ba2e64ea7083a368c5e53b5000
148896366873ef29b9b63bfb49755b885ada781f7f9e092b4ea2313b887c2e7c
7877832d2f3b4fc65acc8c9a5e180ca261e7912efe731a87869a4f44dde3d849
91574423e4a79182151148d8613d0dc1fd2892bec917e3c73608347fc44c6640
5f457ee713c728ad3fad78ffeeef48c7868a82761f79d058d575dc544eca0e7b
c9c2b10028cebfb974d33b9588d39f363a0d3f18ac9c8ba348d518112c060e7f
a0be46e1a84f0900b2309c3f34d46064f15c4de3d246839a43e83ec1af2e2b1f
89279bad065d1f296a02233dfd0cd7e71487113189a200b08dd935a00d4e3c4e
71fb53c5ba0c13c58e91db5fb92abc9d47d2f78062cc786250b462161bba3865
bb9c18085017ef1db2d78295d73f27cb7d913ba5b976670f1f90ac1f4c2a89af
770ac08c425dc70ec7b5f3e5b62331ee0b498ffaa28c96ed2b013686697880d4
0e0cb43552eba661563aa4cf5a293adfb37cc89667568f1543cc615fa2112f6e
f597cc53c34ec96cb531d687b454d590cdf35ec7983097293d3c1f6bb3a46f3f
44dc93a144aaaf5d18397a4bd5513f8ef030c120dec0447b5e143d1a0ff105d5
d19425ffbfa2eddc31b9e6c69db1bbb104b071c193741b417651d8d85c416407
55074137cdb98e5556cdddf362bce32ff2a95acd5b5e0716a19b7c07ea56902c
2cee5d4bcbe804c9897182a3b48e29fa09aba628293c60295b36612f1afc66df
23ddd7f95f44c19409f88d9590820d27956ed35cb6c9aaae1ffb614934e533a8
c03e30bdd31d8812fb5b6dfdafc4d441812bf1cf08901281dc6d481fe2ebba46
239e25e75c9a3a6f6b6cfaeb2965df4cfee05c81deda3f4276ff24c23d6b1fdf
5e1233772dad5b9572fd8ebaa1f982bc3bf5126b888dd81c6c1cacee76759a11
41277ea8c85413e1c33ed35ab0843d104e0b2fcafccb29dcacd14c97c21facc9
244659171986d91a38fcfbdbe34ff4b38b9e4e013e1fb579cd1186839b546e76
d3f35ace1556e67064e96dd0812bf4b9bcd5afb84704214defef3b4245fc3c2b
50726d27c10b617a8421032b4cceaa990a11892fb8dcc20259905d2b6ba5ba95
c71625bc3c3bd309c66fab8c2a354678d374228af5a01ad4920a4f31e43d1ff1
3fbb0f5f5756561bff4ba734bbf6df817d67fba612b9420e2a01a448c9e576d0
e055e069ed13887f20dbe249b787086a196a8b8c515848ba48625902be84ce37
32528c053e4824970817de753d900cf4071022c4e2617d507415f633a3497492
d8993b19e577ad0faa5db80ebb14fe790e837dea53560550a999ad307513fd56
8ef42dd0b9a05a5761f3131f6eb215e95f5163bdc8fd5bdd01552f3b23c101b3
320e474598c75521f6d84846fde887ed4ec5a952a6ea13f208ffb280431f2f7b
3ec3ab297d4d1134f1735ee5167cf8beb8f14a57df963527e33417f3c2ac434d
03a9465098c19a2a6910f0f26980b862b19db67630e8d5879d0f3cf0fb02b0ba
c0651af105df7bbad99c0faf285901c2271a4c027a0c2df64f1011ad2b7253cc
75332680f5b7cb6a3cf6189dc4b868fe65493ff923196f4cb6ca6ed99bafa961
92ef032904121434287222d92eace4a13821fc528432ca14d92154273e8032b4
b71a7eee111e96ab7fe09b3340af03242ec2c681460a37203f8d67d4e493b86a
eb8285ffeeb06f4c981c629c4719dcc7d7e5967ebabcc5ee5da67f0e1a9229d3
28d79a5b12a777c481ff971224ecd759d706f14e2b12943db1df6f47546c9685
b3952b06ad8895a7b2fe0ce5c0379249f4d6ed096336497bb1c6f25f356c2d54
147069abe6b7390d9500fed46cae22b06db5aa7887de65e1e9c27a99b4501bb9
ca2ca8187cf671320ad1fef4c970314c1d454b17672814bfd756f8cee62c5883
cb9b6ee3528c5f9538e5089cfe39b0aa04a3668a5f9b3e0dbd1b4a5fc6c8dd1b
2d814daecf5bb3564dd49eed374816eff56fa4c1cfb0b2d39e7ae318b4bdd452
467cc7354f957b4d54cc26d544a7f3a4b3f14d8c45f71407af4eae4ca99c4722
1e3ef051305e6292816186828f1087ce50f0d10568d61f8df7c9b06dae1765cb
d07b5cfe04303021f78ea1b282e8d63f89387000709ae1f06fe4ec9d6ce42ab5
f8fe6bcf2d8b9d072b2ada141aeedb4c0bee475351101054eb66c073517b400f
9effb9e39785342b07288a5167c4f57b16e7443845fedd1446cef0108cec134c
b62a6a557d2ddbe4e0c34768bb2dbd2806dbf550a3bb3dda5baec35d7636a181
1ecf66a8250ada3a01f7fbd027b08254d4747b07c1c35ccd4472455aaebb2563
6cac3b307508307a3a54b60b9c63d11b2bf2d4b96ab162f12b4beaef38ddd270
1bdf911bac795cbac8bac81595da23b91d8309cf01d3d2d288fcb2f8d666551e
95dff2d1bba48bdd20cfa266224e191a28f9aa84a208523e68941883327b8823
db8e8be72055e05560ba18703a8ecb38e578efcf367745f50feed7a2115523e3
96df3a5fe992006f83ce216d644aafc3883adf39b1e0eaa07ed162fd122d8d18
f6885254828fe0d341adf12a93f090f2877ee7eb99a9e27408c8fdd5121d3ecb
961a0d4b074626720c3430af724a519099810f89bbd23fb79a1e83e1d2d6831e
3ce1cea3192a82b0bbd9f65619042633dbd5d70e4f6426295f0960897fe1c6ce
a5ac1c6c19cbda0c73340724dc3e51947e201fc8998318b4d3ddb9ce32544c95
110d8aea4d0f360838010dc72ed0b2e8b09e8f2950bd2d3f38fa17452657cfd9
33611de2f350afd335f98ec2a0f08c4e0ba3051b433a668c72b9cb4fc54956dc
89c6ae21128f1b03d5c4bc8bc75f1672caea3f0a17741e9d80e036e4ba80519f
880dcc9d3be4b77f2fc4a7c664770442a1b668076fc9c644edf1b9d35ed212c7
023d53a311958769a4d34929a04eeb9fc07ae133600b63e1604755cd9b31b430
9a87b69c86104f6aa0c78d8da86de5e0a35013e05ea6c22255fc037bb269acc4
c129780ffedb8d33ea7f5c4862f67b146526cb4ca3284ca086b4dd454c11aa8e
94dc718b65fea9f80eb8f8aa454b648d1527c50b6e46a737fb5bbcf1e543e184
b5918af35c041b1084a218ea8add78e60bda28d2e00a9d19930411ec1329d6de
666c5700418811241dafdbb8a0dd2447cfd24f618f6cfcede16d1a9cab940f1f
bc13a2baf9353f8503a0e2a804f9694bd6e0f2070bf8e1d34e75f76e5d17ea2d
47f8b30111081957eb06a5b6833f2ff8c619ce74444bbb4b87e69ab91e6c7ebc
936589b51b63eeee50f38dc42654a1a3affae1173b08565757b3e294102d8779
8a9311f7b37cd744b421ca17de6b6e510b4a1838181955d0472601d1d18c22d6
e319ed37ab3bbcf53a97866c8a130efcca49b886d455372085abb7401d265767
f57fd13f5b72fd9e1766b73fc811aa0949727b60451509bbd47ce65206faf3ee
a3a9b866ff5ce76d84ce4fbd5a63d4490c64518222b5b1689429b66658ef7aec
73b2607d42c3d212a87ee9a3e87bec3f9250d029fb9ac47b0237ed0af34307bd
7800628f2457a989340f375d4265fb9bff77a39428adc5847ad46ca93ce1361c
a1d560412dbd98fa4862807c6e4667281cc724ea8bb9c871640bd337be92e2d2
7611e8f01391b3bad46ef1b5323ce640f15c2911c62948ff65886e1383569154
a6b7b6df0843219e1b011782b011b7f73397b907cc7f95ef584b46462c305ac9
984213af9bdc55735111cf3dfab491c4510be8ffa09c65ad30b272dc4d5ceb51
32ba7562b04aef4eaf0e8e0f4fd9f81b3eeb4765ff28ce9e7a615d213749e643
f144ec0229ced3ab9489ec5ca6ca0834c1b7a183dad22222741cb861e6e19813
702718728014a4523aa018b7ccae38bcbfc3f80a4dc3c47e2e83e63dcbc43709
702718728014a4523aa018b7ccae38bcbfc3f80a4dc3c47e2e83e63dcbc43709
780a0fa60c3e5c741f36bc3bdbc5019a902faba1ea68ef2404052029cbffa93b
3a28b1b94ba9d5829104738024ebc94fcc06b74cdf0e04262ac1bed5d370c4a4
e5650cc0ce09caf5c6258936f03e251443af954d682045fdbf0c80721c68735b
6a2baf0196daa619ba996118a3a2b9bb298b41a24d00baacd683a2320f712c59
5f93f4fe8e449618c25ab755c617507efbe1d974b2f0e0122778373f56309f16
79adf71cc11f34e2e30291ccde6d4f46a504d188a972bf5b30f6619d213f27d6
24c1e2ecacc56dd0481555d748d2b5779bc68f26118093213b714c789e5a61b1
5f53d08eae9b42959b9ca5b2bafbfbc8b7563b4e0b0b53b82e74f3ccadce586c
bdf8b7e04e8ac9a6a684e866a3607a5edfa822ba43b8c8996c68b5ed782cbef1
ac8ade03b5c629940a4f93cdf4201b9f4d33de64b717786e2b167b0b15af45f3
09a4b4eecb910ae8d86e3cb34c215b8fa2e0bc8d3cbd11117089556b77f1e520
2b1fd74b5dd1af6a665d2a0f4573c2ef240ebad7c5c13ba99dc3ddd3fbabb8e2
34483e2be620542fdbc754632fc665e039084b6f11b25be3334179b47cd57d35
d39ef61e46deaaa88c15692c52b357358001ba0663920c3ec48a721eda54eb5f
646d27d5e2d703d199898ae5474c78f6c3ef98ce11cace71bb657ccc4093eb39
8c71224476257305f0ec794b44b5cfeb9ab310b65cb69406bd5bab4d3459c2e9
c9c6b2aa3fd6ba06ef4d59050a864931b663337d753ae9aaacfebfaa67c56af3
89efeb02d166bab71bc91c4e3a9ab4e79b42682f0a605430b7a3a13eb1a9da3c
3d9c842cddec5621a9b0ce6b74419f97f2f39361f0a35ea032a073687e155562
423b248e186ad02bb6110070d4abd8effc9e00ed74ed47c5413a6fa5eaff9b53
ce6f0c7e7b3e92a5b8241f5490985ebb402b5625fd87dcc6c7f17f9abbc46daa
b9b7b059e197372a8a1af3755a3604ff0bbe3339dbf435e198dfc82557cde9a8
ffb44c5928861a41412017596cbe59326ffaca7ffe89cd0cd98c40f4fc5f8f48
254066aca4e5234cdcd399a96b2a111f78f0e013476d12b3aba8b1335d8f0fee
1a1da325d42d1d096d69d9fe4e973f65a7eafc84d7e57f4feaf0a92e6bd4d62a
81de1948bfe39a0a9dda4ac16cfad7932125f7b005af543c814c36eac214f95e
0d23b88389a44399cb2b5f85c369d7292e0a54ac5893faa2c3411e9a40c5f72a
0a91815a052c823c85b9f28e0fad530299a77e97efca848bce5e6830d88a5712
049a73457b1e7cf35470393ef21909eab2feef93d01e4760913e501e66162adc
56177ca0ca39f7c8f11684839c968113ad6ec47c3b4ae5b918ffff4d85a49909
69813855655f02c0581bbeab893bd301c16bd9272b0642530724518c6a6704cb
583eb1e96657811a66683aba460ddb88ca04cc362cfbdbdd20238f99b7db78b2
500e7b4093d48d4557078b99f0f37e3c6ae93b843affbc3953cdf8938ad2112c
5df25f7c17f84ddbf3a6e557199c65a2f4a6a51dd080611f4e4bbd4980eb0a7b
7752737fe141cbf8d71a544b1352b7819ba7c727733eb5cd559dd81744a240d9
e79924138581dc47ef038d91313f4696ae1376aee5bf48cad45c3742ac125866
cd190b85b1a07d45b987b830b22a48e8eff62a7758d8f0ab3546dcfd588dba77
917343ae0e075fc373308461295a2635424095906ac231407050171feb1dafc7
34c0dd7158b361a47ee85134698bbd77d9b15e0402db81b67896530e104a2119
d4568d37f551873b92b54635ff794d43de50d18e723d700ac88b4a893c381094
3632b816a1fe4a4541ca1e1b42c832610f0cb0e048bc5ce50c5ac08c174da630
501df600ba6bb4cd1ae32d33b4abfb389ccb96f0f510166b584458aaf9be4d92
4f67f8c71fdf0f8e1f7bfc350b6455e67e058a0b9831abd9d32fae33eb21ee2b
22d25a64d4e36578a9e00d60cbcb46f6de6cfb2c45f8526f408ff7367de5676b
e7ba0e7123aaf3a3176b0224f0e374fac3ecde370eedf3c18ea7d68812eba112
f6c01fa219ea9a8d802fd0f97e6226045f08357b7768400c0502dbe94e4620d3
43e077fae73c849bbd1f51c6d5a3990277b047252aa6d71fca0afd064482ec6d
94731155bc37a2b6150a6e8d1f25f825fa3174857d7de65d3ebc2d4c381f6e11
68f4ae11a59bb05434c5157d657a55961292d3482c4818f9f65f46ad1f078498
86b1cb620be8d2354bf0d793a9de1519dba185f2649902062f15d4c507730fdf


```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-13 20:41:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
4980463e2b50f6fd5cfa08c9ff743e5f6878bea3a753f8b992818723baea9642
0366801927431f9bacb7f9fe7fb45c3060f20640f750b1c930bb6141be205990
70df1c010f3a153732b9d35608df974b997f0d0ade26a4c0ac10b901507bced2
0e0f87407e98baf9c5a00a2ef33319ded224cb30c352208cc00972a3931412ec
dc724e42ec75a11bb8303c163323cc54689a0d99950b5a912c7586d1255ae591
653d04b96f376ee2a1196bd42f741ce2cffb3fb82267a1b84ce8f94a8bf48fb2
5b336ddbad66d4990622940f95c0468875680ed223eb91da64b8f06787f62880
68dce955a6bc3d64ef8e4ec0c45fb667a41d01278b4b7f777b3a82f1065c407e
08aa80a6582dd6738d7afba27bb39ef88b0168d1a7ce656ec02863ca5f9d3474
bb98d6883a5d7169513f3b6016fe927ec6a44d1a5c0b661112175e66e554e719
c8ccd9bccc525a4ee561fcb42daca80c8c4b116579e4bde8197777d416b7e8bb
1228b439b723a9009e82cce1f7b50d99fc24e09a271d5afca9a758ac9fa4f7f8
84fe6397446dd37de37f0bbc598764d696cc11215bb0b99e3b01b1f514dc23c2
e8e0725c73c862428d35807060c04fc4100c753f6bedccbee71bf43953e6c90e
07195b1c470d44d02650b4eddca96698fc79cc91a50f5794cba66ebeb72ffaa8
b05b6104f9cf5885cd0e95d71086b75aa958c95ce56d62f49bc4b9820374acaa
7b6110adbe805d0d96997256f6f302079a2619542b8fb7e16a35c3f263dd2a98

https://www.theblackcadstudio.com/wp-includes/3T/
https://whyepicshop.com/wp-admin/1YD/
https://www.wl-interiors.co.uk/wp-admin/occ/
http://aliyev.org/ldfkbse54k/oX6/
https://interia.co/wp-includes/a4d/


Creation Time	2019-03-13 16:28:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
5a117fa2056db6e2722e04adf9ef66e9c190f390d57aee7f4213bac34bb85be7
0c8013e24c009372f522d5bc6394f69f9786a7418e68b802a65001439f9b0cd5
e05626027cf2f2c9238e783d5ccfe15b9a785aa068cd3ae615e2b94ae271d5a8
453ae71569c49be9931836de1975dbe6391f599db93ebf1d25dde287b6a7b4e0
885d450805b4533de239d8ad07d9a829ac95828f6e4efea60dd9660a547e6708
035ff77c196a9179e00d6767ac5c3ae754ce4876670144bcfe53fbf62ee11621
f4c1cb77cb4187b8d07590da7e54bde5b90f34bf9c0d6850ee9caddd7ba06b56
e7e02fb9ba249ba8bc0ea891684551c7aa141c7d49fe2efbb462f0c57779920b
2fd6fde0096dc8267c469772b413e930a025c94c92c581b01f82caee15f2c4bd
3ea8aefa60827908cf6349f97593905805f7a8e82bd717108e8a818fd2682595
5560ad1362c9e6f66b16e48a4ab157b48bc3c6a265832cb8cbf37793aeae96a9
a3bda6ae0782fdb40dd26ed33fb1168f05ae1b1e5c5d420a3dde5a1cf747b3f3
510cbceb74044f566c7bee69e4d187f0581c3eaad4739bca16a48bb8003e1f46
0b773b5e59c67e54c5df0c164f3114003029896abb569affe089ddd3635fba02
d58a028acda9657310f24c7f0cc597540b14729046c72323acc2e2a5150e681c
4e5f528dc971e4d928591fcb12617187c253ec93b5342287c94becd825754f2f
c4c1e78cc4bc1df1efbba653d4d79c1a63e7edf2205c4cfe01c09f0d3341c745
77cbe65661e22ec82b15e84af22596ba101a5008cd313fc52d269835cf46c4be
ba67ee187edf67affde3b109037e866e3754198de04fee3deec965cbbaa5f8ac
5bdef04d199d548f940201ad17a530ee2ff27a76c95ab4ab321a5b1e8d259fbc
f1fa3cf1282c2f630490ddfb88adb7c4c672cab80c78edab602d90d712f21704
d2005ac2c423a81d101e6ffc535e593b47c55aca7ee52aef03c591504e24bcfc
4dd0c2414e57ac8a5dbae791bca1911aa53a404b01c37b9ceba0961a35787991

https://kkk-3712.com/wp-content/aQjF/
https://financialdiscourse.com/gnh1bcv/waG7/
https://giangocngan.com/css/vK/
http://1lorawicz.pl/plan/lQFE/
http://zymogen.net/releases/zgl01/podcast/qpUY/

Creation Time	2019-03-13 14:14:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
4dd0c2414e57ac8a5dbae791bca1911aa53a404b01c37b9ceba0961a35787991
e79e52b33e81b6d039817aa3cf87726db6de496fcb36477f29483a5730dd2874
96ab8b7fc0b45cf2fc1277ad938ad4aabb1bcc157f0259e456b76f1684e4896e
cd75eda017abff329abfa5162be02c8042c86730dd948a6b423d3ebce5f5e3b8
f54ad758e4ee395a12956b665b611ad69b622e672d9f4086e8754f4b301cfb04
8ef79e33fc1ebf640f78cebe13485489f85caf08fbf4cee696aadb977f21d6e7
f679763abeea019bdfdc22e23d9be3159ca1f325453f34e94954bee50176664c
0a923af3433f18c4d3c317602c3a00ba8f0f49e87da469b06b69df428e7698b4
1157bbcfa2438b4142bc1dc163952714ef2e084cd27698f5c2f78193367f8033
c177de169b84382b1809efd361d8e5a6ee6eff262f479724856686d03c6bb6db
64732ab1f700b865a24a0fe06e94a54a40724568af5381afd126096b59f18606
e09474de88f323075c3ef4ba54c458e3275ee102b72a2bfc4894e79a9703c542
f256396752c6a4164b4097d493b202de43fb8f8d7bba372dcd7ba45ba3edfd16
3eaba85e842d0ed0489d430cb1bc37d1fca702845ba478a0e290115bebfd8827

http://indhrigroup.com/wp-content/uploads/BU/
https://lackify.com/wp-admin/N9/
https://financialdiscourse.com/gnh1bcv/waG7/
http://loris.al/wp-content/b89t/
http://fiberoptictestrentals.net/wp-admin/fs/

Creation Time	2019-03-13 06:48:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
6295b0ffde635729cc0aef53a06ded688f669bf3f6e613929ee22b5472152df7
e22b8402e2deef40b1d2f6e8f57744dba945fa04430c1c44b6e32127c143ff05
38621a8ae5316ff3ea50746e746c16c4df6a4d9df0ccda56332b450019461d75
47f3f87bc57341c15aaf9fc6736ed513185e8347dcd6bed30b3248a5bbec92ee
3b44f8ac63dff8be2361c9be9767bdcf8e58a35e4d985c5ed9625304e0211b50
b2f349451dd5ac198c12d4fffb265ca99f0d9325939b53570aa52ed6a94f56b4
7bc5adcbc4a6b78f2ac46e65a760ea4f1eb71a3e61a7e03542b300de351c582b
fde0cf9181d6806d3be77a08573104c0ad2b75857439ba42df309bbe1ce82927
5ddbf58f792b050f2451b4cc8658747da000c4ffa4cfba9b2b09acd649faab72
6767e37d28018d2258fdad24eab974537a5379a8ac23ca55c47eecaaffad8ccc
ea4513e22bf373d8dc75abb1db7f176816eda88750d38902d9cb27191c9dd20d
0ac845a32b3f6d9de16fb02bbbe80b278862610284abd0c5d711cabbd4046162
6a3d5393b867c0233e8099f31ee17936bb2f106dc49135cd3b7edcd28c8f1d3d
0c4646cd74ba4e2679effe7eac5501cc5652f7be7068a0e3b64029c622b84a09
31f414ea0c92a45c21bfff83ba56921c9e679d8e9536affeba5ef27a58372edf
7769b1c45fbc460c5b14a5b623d82dbdd22535b80a99d770933132253cbddc20
062080a241916c13988d1be4196e03855c473fcc3cb370bcf988643a84bf36c4
0d03625e351b5f1f91de3253bf7a85ec4c5d34166069e089bbb4f0b7e92dd85e
6504e47451130b175450a92454397f219d27bd39613050c6e2d90590f2763922
d0cc9d389ccc80a09d9f241ddfd4ebd0560667aed9d89f94d4deba3811f7232e
b2dc409576f5fb294aea1ee3ee9fa8d0bbb0221700d6aade1107d71f5bdd7bdd
e007aec492e7d715ef55ecddc00c4a5b1b08bbb6e97e558db02841489e09f0fe
97f1937fdb3e3352a8d543d9fa888f317342469159f447909a32fdcf12ef2375
97d756aa53ffafd6ee88e1e873d9476014bea132e6e8922e001eaeafde70d1a7
9d2104ed763c7cc7766366d95bd92c05a813881a42be0f44aa1fdf8496a652ce
bcde8c683c72ed70f903b6cb88b01976e2c37ea735b02719f4ad04a956780f1f
5f62b4e951270d74a32dea3a80caac1ea810b08475cea1e51dfc665a608922dc
54d8c502a0b6326dc098a1ff932662a1f394f28c8392f30143bd08084ae87add
ec36e27710133703ea0b27ea2b0f94fc48042895a13117058bf25e39507d0594
a07fd7d2cdae5fbf0001cae6c854480647bfdd147e82a79de54d0b142fd09a75
7d3089cb9930a9d0c0fdb7d4e5909ee4a9b470476cc9b99e57bb1eefba7cf7b7
f6f00c225c8825c2c44e826556fa0c9f099d9b25b5fe7eb0087396742b58c513
105adeff0a2090e95c400094a1f1ae53e4ff2b57677c771e5e10291e81b5d9bf
ca1dd75b2b289e24966828108846664b2a0c664ccf1a992f15edcadd73c11c34
f5e059691605cd8a750a84e35bb59acc2dfe50be4bebade07a61d5c66f3ce595
19bffbd1d63574f440e9ccd70a2a188558010d8a1f34fb175b1cef2f6f13e2a9
09155122612febf71e09c3e646831af62c6a3c15202b196ff378c363e9f09051
9035f9ec39078357560ee6c86e41c62fedcd755433235d0563dd91715d61371f

https://haicunoi.ro/cgi-bin/2TX/
https://crosscountrysupply.com/wp-includes/OpF/
https://akuntansi.widyakartika.ac.id/wp-content/uploads/tEEe/
https://giangocngan.com/css/vK/
http://ebe.dk/_borders/cZJi/

Creation Time	2019-03-12 22:05:00
SHA256:
dd8f42677463d31afea67c4849c85d1e6b44c47dbf6e6dd91d51bb5f8506712e
b1cc443013d6bb4f027d3a210d785eb0774da87a4a235379743b12899c366a31
67de982961e0e8302abdcedee42a267fec7ad634a91b8bfc61853cff8eb5110a
917136a08639a09992ae538ab96b6fed8f6d9b4b0b89c2701c98d1578554fc7c
95cd97d5bda4321e29652e558564261378177c32548759f84c219f7a979dddb3
33263e1db9f53ac685e18896142c4709b70b1aa8df205cdfd5cbddcdec615ada
9cdb4ad5d8c7e747143f793a24a23a62a990438ed88c00eb316170674b2eb8d4
34831397888c2264fa3dd379bbb2c4b536c73e886d973c1b23f4d3a0a255c026
15c590d30333f5849a124b6fb3d9a5050e98acb5a4d1f7012e1c95ee809a6500
17264bd694798a1487e8f996428ea3e22bfd75dc5b4ef3acfa16483944282dd5
f90063f685c1e7d8fb09bce10a46d8bb55f02456554a6ea9ecae519d65364f3c
9182694141ec79eac6fa2293f456eefd3c60102e8302d2c27c131af8750d2490
aa91b81aa51852d422acd478250b2723fabf678782c62ad5fb2e42f9a329c6b9
c56e776e3e401b58cbd6b718ed3a55fc9ea8f6a8285441cbe9d8536fa31f32a8
ced8afcc928741d9af968bb9792d764e0217e3a8588cf5e64261068429693c94
4008e847c3353217bee1a8e56338c60af43cb8deecd4381742bdda42c3b18518
bb2da6ffa17b63967a8b53f2587ade7242558133405ac27a0972518a37c82994
ec478fd4170182e11d933ad8c46ca467d2c23612325d1b3da2ae9f60950b0c21
f104ce56fa0105538b4a5292877792928fc1f0b940fd08a228c80e7b7d47355a
3286a649828564bed5dac4ae9abf61465499c02d45c162e1687e38052fa58b04
4266478e3971aa9fa7d63123f3de71a9858aeda034ccc1423985f62a1aa4280c
2cd981c0e17b6f2f863d7a31edde40e0d77a5aff9061faa0ff65e77d9b2fa559
1717f67f1c5e0575d090d5320228d92e085c7a1f1c151ef3b25dd4a64542801a
0fff0a9d7fc656ed51843a14cf70e9dbfff30b5bd6a87b68d64cdd83bb0d157f
a0bb6b4166562e4510aafdddba6efbaa48badbc6a64a4272fa71b94a59aa5e53
27a8842b69927746489d11a3d1c8370f79efd16181121b194281757237cf3598
ac32faf532410005c0b38b8cabc3b3cad397803188b67252c6ec9b277fad77c9
0403c2433da352b39fcc7c3841134f4f92d6da6728f7ccc0bceda895103af4f9
9de9635117421d4dfba8bc1859c7e97fdd31e36f7097b3f71263d83c0b3cb062
9de9635117421d4dfba8bc1859c7e97fdd31e36f7097b3f71263d83c0b3cb062
ebf0236016bd26bc51a3baf6c96dfa121b7687f2c8a4ec34387e3de37623ab9e
4146667bef94add4c7d2810b1b5b53812fb854c688294b8c04a25e3a82ecab46
4b4d8a990f406af35a4b75941a67f17415043a9891e996dbdb126eb4e6cf8b6d
9702da355c82aa7234cb83fdab133147447ce94b43d90b4ab584bd95ac436034
48a05e42c864732c48cc5c71a47697454252a527c23a0761e981ffc7f9637345
9b3c46584ad0db8612896a19c1c2a0ea2c45bf33445c852e15a04eb6701438be
2c23061c8d875a9ea799d2ea6d689967c947a82cf49a70ae7d2fdf6d4da0ec84
93ed81779f701882b3686a5a15d6f377c71b957c05bcbe410dc2068313a36b19
8a498dd1e1073f81097bc1216846eb6dc1123398c946e085a06be7e7ab64b626
31b9a179451f9110863376bbc0ab529adea834edfda8eaf667d73422b76ae19a
c759dbc70c2d11c0664b44d28a6ad48274d7576b84ec359ec45306f7d1eee5ea
9644e6dbdea52d13e5891a14696d32ffa08e4c7821b078858f7a981328389f72
c1f35be03eba8bd07474f8f2bc6040513edd11b9832d42b41d41b839d98cd353
263ebd30efccbab8eb6b80d41720f5797f6d8d3ee8eb045e1d6e6746d4265f47
5015ed9aa5bc208368bc38e20aed1071acb342ab4dfa61becbb14c124f07c55c

http://gastar-menos.com/wp-content/0x3/
http://globaliaespacios.com/wp-admin/R3G/
http://gisec.com.mx/expertos/J5f/
http://globus.pt/cgi-bin/0JB/
http://gocreatestudio.com/ibilling/wZL/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 03/13/19 ####
```

0ed0bfbf99797e16ac9a608062338167313a27254118a5e187e20eb6ce5c9a7b
820539873f692489c469835ca41bff712ffa69799940f60c30e62550687f2858
ba9f20ec716b11e16f2dd26661152eb0cf50331141c57fdb5b013915b6248fb9
6884ff13688210b058fb8894bd91f4748f8f09b78db6f2cc7f378561a00ad826
d536c6f612cade3714bd0456ace828b62c7390b722d418df79ab36fd79727c36
812e722f6be52a36b5af6089ecd586371452262b31ed4ec8e33961efebf66855
ab9ce727fb8818edcfc4f54a7d4d581d131c31904ce8115b2474136c6007d182
a5aafa815d5251491d9368dbcbb854d574abaf3782c3653ab0b0cad0a2765b67
9628279a12ca771dcc8679d53b894e00a2cb0569c58093f8a8aa39b29a963114
c6ba81b030d76052a4f9fbcda9b6bf114a7d5f3a3d1e24c07c657bddfd705ba8
742125d223ab77c4d3bade31d3ce379089c6281384117005d6e0a35756ae7694
2536f9c4669cefac21f979076deffbac5108fbb0b0faee9c814ca30d97bd41bc
92e3a4d5dc8314a577e882b2f011b83b203b17a19e19a147b070347c887620f5
421d0c96ea2a5b8954e27d826898035b9e0376343e6e20f6dd13b733551d757f
1207d111b1a3fee8e966a4c4708ed91067cb34239f28332e8b057efc0bddebcb
3571cdcb2e9b1f2be7183317986ac828d08ec7a95beb3fa9d9b50a92a2ba9cfc
c5d54767a9a64c4432bf90c506cc65775e22ab46167bfd8f7c04ee8d7793d90d
3edf54504aae9be19a7fecbbf440a48b846dfc8dbc744627c60c427bdd04fa4f
c332c3dcb1ace184a42df009965e4a967cb8fc5a8912afd87e6459087f8b0748
cc8fc33f9267106da366c905deb9f1242bf016880db99ff881125c3958578282
fa594767ca7127f2bde87a738b814f71434a0118c617bc37373085a81b97216b
e7d2bd28f63ca557e6791d3bbf257ad789140fbb0fd7de5b6626513c050db09a
af1294b29e16ee39a179668a1b972dab0b11bae8414278dcd90f42343e2c411f
f2829d7441be5f7187686e2596814367b2170c15a5a0073b22772466550fdde3
dd999c0f7c78e7d40b71f614c97576e39d2a75fe30e3c5b8305e48454f856344
8af58441e3e74188b91d8fccf292ea6374354865e02ca3c0c6fcd82e75640b2c
f910f8b8a268b4b59e740b80d9c55e2ebf0b7598da58e6a976e7184166c8c056
a8fed238139b36cdffbe4578ed88a81a2bea257ddd4b347755dea04672be2f5a
b456f8fa32c18a98eea0b8b42f179f0ccea73df46b1bb690932182662752465f
44bd2981e3bb8af616283f73e06f1f9f7f1d7dfe5390dff6582807ac4245f3cd
b26866c05f2e93105388eb7a69b69a0d9d46788e1a12a6d349232b20da5e521b
760cbfca6d7baf1a513176c7346da30c279440f603cda2598ed888bcf54c33f3
d64650798e8539b904ebc95a4d9002b45592b271d4abbb12ca0f58a323057243
b7173e1cd0f4d4b4db41bab3de9719d951d9e2215927a5afca528c18a522bc09
76ad03894d3a64da8c9178880962c5137be66bf5e46bde781a7366da8d662deb
b386e118f00de9d6c91975028b84a8c4bff29e99c47a9441c7aa920940a0a078
85300199ac9d543514c85b8bb741be8e06de9486a141f865e01413d2dfcc4f8e
35a1eefc3bb59c73e24e68a7543f4fdd6780d90e0541b1b5b32ea58f5e937a8c
9d0652eeae46d88ddc5e202ce4b07d30203ed40687b45b4a013a3be5839927be
7e51817f294688879fc6c4eafbeda5643c4ddcaf336deaf174a2bd293424ca0d
24db4178f0f371713d09ec4fce4141af3801859cfce0494c6075c5ab87c0b694
deade7ed7e5da6e9f971493feb8e771e090428d957f45d2ac6722b7aa41e5c9f
859af573ff1bf0e72ee6d4a7facf19534496616f7d3472f3d75b5dbc08348da5
a7b8685be277962d51781c788dfcd13d1864a7fef5b6c4c7ff46a1799be5c318
a59a3a328a01a373f853af0139bcaccb2d309413cb3ac7a3b1558f9c7110b347
956c52b988227177e52ca753f39dfff28c45118e64a7c2f02004f8b7a217ae1e
1697f4033a4ad6077ebd851c84dc12c925e28fd13e64dfa8c3507b0992740147
1cc1e4ed40a46beb24c058bd607d3b894fe0d1bf04d816022a6d2781d01609f2
01be666907814ca80dac3bffd12fd0840490305caef8b2d7876aeb833c243173
c9d7102a43b8790d9e69764f819be9f1e25e3e3d65e544cbf5489b0b192c4af7
fec4a327a5cb565adab892e539d4dd9ae9cf9dffa9d5382e98b6ec3b89bfe16d
bf2bbc33060e5f72ca802ea23fe0e7b68d22022050ae8245e5027bf4076975cc
6ae02092ba1b5418ba6376835f4ef7952c658808c1a9689d50ffe92ec5019a9d
3867c0ce601c8447ad884b50b7d15ba89e7e75afaece1e7ffce4d24dfbfecaf2
0a9214dd0806b9ef9d09a7689d9c9359715a14a06144325be575b4e35a802593
4b7034cb33381cb37eb87dac8dabfebab8498314e6ad38817a8285832548d9a2
66140ed2f9c2941f768640f1fc5ca50e5d9d43a4cabd153f3f2bdfd800b791f0
ac2336ac9e7e2cb0f0ae8a5a8c9c59d0ab1cafa74a2bbd79e7f2ab72511c33a3
d4a5cf94744827a767a6e819d23d9adac732fc8b63f5077476f1b1a59b6ca0e0
c66f6b8ee8f09ffae12d88155533d7b9eab73682464541bb25918eff1e18c80d
afb9c9f210fa3ae2951910151a82b563bb2c30c982be5200c9c1b35bd4314918
8fc9b631cd01fe74bfb546e77d7d05d73dd6f924ade16365ecf1417544382fb2
49690a0f0eb65555b7fb165c1f352ff03c729cd6197ebfb59f0f74bd1bb9334e
57c6a5bce50001c3ef4cc3de4ec6e499454ce9de65558cc06d70860c27df0d87
e6f8a933bfffbb1adaec21ec605094772d812d1e9ab01a32c25835034c9f9e57
b3be65222eb4140a1e0f5bbd1d3961d7555bcc9f33f4b8745fd4aaa794d9cc79
5621c0a06ce938c120b27f738f1dd4c677d842fd054bfaafd757775c7cc5a7b9
d9fc849d42dc45cbab131391b183b6b89e7a5b46817c7eec75f14cc42afcbd82
83ba051c18304f76cdc9383ee95189c7e91f663a3e9b745891895581567272ac
ccf33b504b0ebe5716c85f153d9763852da2045b3b7ca7fc50152a79c4320a85
fed62c40b88c4383cf16ed5e555ef9589d3e8d03ccf7a1b1c23f0e078fd6b37e
580bfbeb8d211ce63e5e3e16a13809fd3cf69d8798c5113e95685e2deadd78c8
19da95a67f5ab66243e20349a9274c750ea04a556c9ddab8b7a7bd8e02c08ecb
e3987ed7977f1caae1da003f0e1ed8c7000af59616cd08eeb81fc09b7c46322d
ca662a0491557089261022f781868af09abe622ca04ca4f34cb3239fd68e9b38
077d2325246b9ac1cd026a41e2d0db3efedfb633c751b92132bf3d6b433dcaeb
e76062ed545e2539a4f36753222762b49424a4919d24eb342b634fc0318e7810
a2a43b1de3d14becc08020630d0ce5f9176b4d1c61cda61517581cfbcfcf4617
f9fac965ebac7f0341fb303a8880b4986d4dc79c1682a5b123f67b1d11bf1745
df033e4f7dcfee1a424e1285dd2463e9300c4037de0675a5a1984132f1c2f7a5
8445216d864015ca232ea42184c98fd9f62e5b8812ac042a415b55006b4e0073
484eceb2fdea1b211225dc212b4c13ecd75ae4b2b5b522ce8fac7e70eb663df0
44b15219b8662bc7860d0e6bf811ea977ed0584cf24c8eb66c28d101d5559443
399103b571e66a633d48388b7b16619da5e2e54e9bbd14fe5537cb79e60d09c4
fd85ad052d6f637a199757b6f6aa8a6374a6ac313a7fb1d9f4de25e74e03f62b
f9fc0fc08a0fa79099bc7ac8bc3b018cc404f6ecb2654c2ac3706ebe1110d907
e7a6ee2739375591cc319818c395d85c68cc88d92603a7aa6e86eb11d9353a34
9c6975000c3565232138e1dc55ac4cb6c51b15030f003bc710a4256e9b38f0df
798cf4ef78ae515ffa7f68d1720d88c4c333a0c53f53eb37520885c9c89dace9
ef300bce4e48428a9e3ba37e41a6c1c77f9f9228286400b1f1038cb051a7fcf9
2fbbc9024275c1b161667325e431db72f647fb92886f19998a98d4655836e093
313745a06e2fa0e76a8ecd467041edd33ed86d57068a0be46a8806927f1bcb30
f8af06e18cb168619036bb44cad6f3c9e3486cb46944dc1255505e040c3edf27
e71ff06f8fe94f825523cdc0b770b11fba0ac5b382bdc3828fc508073c667a61
cc9075068fac9fd6b893234a0e9964ca2777f7f74a9f4aaa9f2483c1a4c1d0e1
4903c60f723a37656b4492a6857906ba8accb479ca938e6f79bc7c43177413f4
6058018c80271f84c25d842617a7c07c506ff0e09625e48c5063b5dfd16625af
7d465fee5da87f02b7b021a24d02df2ed633beae6f5d5249565e3e85b8e525d4
23916a1002623f6cf79f63fde4a7b786a85fb86faa414eb10c19100e82a78dde
55100137c6a52b547cc782ce5b4991b35fa9acfb0ad970c17ff0d1b5b0ed1130
b2f8ee7266f14ba9bd737ae58e490224bc5ab1f479daf1f7f009d5c41263d3eb
c18b0959aaa201d11ee2ed671988d5cf6d48a0b1592682226b8d977c4262cbeb
2efb6fe07aa4f607dbdbd089009b1d1537c92208d2ad5f9f6624a8afee991e88
ad0ca54301c52499fac0e52729fcb567a594b253b85d6488ad55aa725a8542d9
9ba211f2ed6e05fccda3e08fc81242c74949f28b2c0cd4035bb25336b83fd26c
e52c2c77a676c315d7cd03ce507d214c590a063ac56119bdead10751c1efe50b
a09b1dc00f3fd5aa5cce718457db65134508b3e6b7f935c495b9e490e0390ea5
45817b4c5d5acdb60b90a30533bfd84c51195f4694cd00c3968e5427ddf7900f
036355bc9ee83e424ccd72330a25e9a832e5785b53ca19fc3225679829a13094
6ad33fdf75026d3353653083393a9dd7e77e8c24d7694104ec893246cc22a92c
76fb05776c3e2356ea3acbcef79f02cdaff063142a8149bd8ec9cbbeede5c00c
e59af5ce4ceec3a2b57cfc8249e3565e904b4b3bf74033ea1bd1689c97bf33fb
1ef50c9ce994097b0202f4c79ccd09548c4804b98dbf15f7c3bdd143a2b60526
859febb610799778b77675b6e7c3792b4e602b2697c8e28a9953d65e234c5bf9
56feb679f6955f18d7e3cbaa1891dc69c3f22b4ec5249a0e4ef19a2e5923bbea
c7856a2ef359cad498090773a5cc6cff32138482ba526441c8a03c515c448d4e
29cd2894d028ef0e76ad814f5ba9a621041191ea32cefc1ff7e714c848334301
642f3779f067a046fa97faccc29505a0ae6c4575ed14b97b74a1c2f1c9fef1d1
4d8ef6159c6c48fe0e98ea48657344f9f772391aa074e0b196916523e2e7b1b8
912aeac46d27f92467a8ae966224df14392db43552533bbcc41ddef8080bad84
3d2769f08b5e99151d505c5317fe1b64b063cb2e65897543e6911cb6ae01b19d
31f07160fbd1c16bd2111d2aee116771ac5e52e3ee708a597eb653e3658ab2d3
55af6accd3ff5524b2fca6c2ed07379b55095a9e7e7de5356f5864c4ffe7ee1a
d028675a9afea7b46d6124a0ea5195f1e7555c440b5747f4df51ec7a9d82809a
fde04a8ba4ad1f3255fed324242d654841ba2812736c879191da89942a67f2ba
b334ddb7042da7dd8aa706db6610adcec9cd13392230dab9b49e0541475d8057
af8565713404ccc0a20a9dbe3d76d9e8a1331ccb18ba2b4a39cd3334f4a6a714
e35278cc75439c3b61cf5807ede351f2c77387e24d6abf9e6b993f6668b0fcb4
c795c2596f351683c3908f91bc0590f7b33bb1dcbcb17843ce91d2e8f8e1f761
d0302ecd71eb2f0dd89305dbb563caea73e18aead7a232b9500c6e7a6a0efd71
1b96e06da49fa7b90d4229d769b927eeacacd6af2c6b2fdb93cc2b5272266858
a816d494ffa6396db37815dcbda575da8512193fcf188384cca250b786563834
81f9e438582ffb3937ff3f1fa8025f3f64768d42cf1c07d16016d53c34777922
cf0fd5544c94b0b45d7168ad5c2fcc28502eaeb0a7f89656eb726e9fa89e32e4
8d67b8a0a26574174b27c1db7514b21b7ef05e2f06f47766fce57f95feaacaef
53cdfb6e207925c80af6ecd301eaa6437ea32f2440e61e5720e47b6a16101443
4b954f0953a2384d3d7fea6d0423b395c385c2ad223430c764234b8d3399ee49
08a2dc21a34843dab5dcd225435c60308fe7075dbd25b95542d4a46c422f0938
738132eec4c8555377c96aff3ff38a3683f8694b35ed00ad99f709885545842c
dc0c6d0cd3a32f35fbeeec08956a70fddab87861cdfa6aa66696c7ed57930bf2
69627bdf4fe82861005b3a69997fc31416adadc92785faac49d37dd35b88e722
9ff76f7d71beed5e0285091b183810092207d0bcf414eae3eeb281bbc4ff583c
ef3ed678c82a1f16aac31583b9f195d936bfac51115d44ad35860aa9941eb238
5473115dc7bb881ea2c69d9a021e19b230588a20f81493111949d7947c0ca534
f156701a38bd748acace1aef13b65fa094b4fd728ba451028399b89376f3ece8
e55af426121f1a9d1acb075d64caa91fc8737dba9aa1be73cda083ddbd806e42
41f4a0910aa8db25c7598c6bc24ba66f8e711c4d06bdd1a32ac9b70d94e2a9dd
676bab1b557a7f8d00fa1ab790baef2177541fe886788b557f6b8daea0070e9e
5089ed0d61cbac0d7a1fcaf82864818d52147027b97dd5d3bf6053177c1a56fa
9e7f9055a6f406d43877053b5c2e6994fc7873847bd7cdce529bcea63cd53222
55399e24ec38c6d1f59ae4317b3fc87032a7d131290553bf1ed041d4c4566020
413702b4bb5957bac202d52d09cf5275cb2ea4b0fddbb75a5e9c7babb15da8be
6cb8ed827c1cc2cf8583c5ff990e4382063235f1977fb98c90d60176f0a422da
06ee98d84ae2f644c62b4666049ba37b023e0f5cf33e08d9c9bd3d603828484a
110de55bfa01a6dea69fa664c7c7bcbdb9fc68e89fa9dd7073adc9bff8ec81f9
ba58136d490006da47ba6d72e81fe7d0cb258494bcc67fd167390881e6fea4fc
2cbd1f062769a409fc15c891c8e7a8cb2ae03c9e3e2f05d23bae97c26cd9d26a
2b13f2f095436e31b8c1b4c90a37f26b22d10acff9f68ae311553d1443d68ab6
64a53fe71db5a177e1c183d8bb7b83309898beef88394d3a66124a8edce917e6
fec6473190546fe62cdd545bed8537eebd8f5a3b1faf2a2e8fc5350596e3c148
00ed0b59a3f048219291c5a90bf962c6a3ba329376dbb4033834810070eeb18e
5b20c60f83ddc5e6eb098ce6bcce9d99444c3e6eacf1eac8d30dc30833483b5a
0ed702cb04ab5343422719c2bf609b9134b86a1eed990c5e8d54e71dadd1fb98
c9a0770537f27905efa0338753cf00ae5e21e970fbe1d4c54def7031b7f707ae
d36885c0f1cdd72e8634fc4585412b8a76e79f41c1b846d2708861258efd5f2c
0d5f2e5aafadc985b98d10bc4f269b4f5d64768c24e28254713291792fa54665
1d455045494ac7a7e79a796371410d73d2b7b94bc30919d57f97683295ba87f8
6d1053db13c78eea6281d200e7d628637821eafc56514ca5756b6428bf5fd6d5
e3630a408cf246e49f162746a2fcde0a16f2e4c59aefa4d978e18c315abd8e9b
16553086a9b78035155eae8c047b887e0922a1b35429b8aa1bd1bb299f08bcbc
e0a6639e3fde963052d94e1511bb2dc7d97c75cc4cc19fb997ada05b08c40c0a
5ef947e1f77715bc2ba1c56f0e59793475b07ce28a8d3ef6611f0f4e6f758c92
29fc20599e848b53f00341900a5af198452c7a5edde89d7f5ec6aa0dddce64a3
5988c47c686382ee40f1248e28db1f4e6bb5d8ecca5006dbe523ec6cd445b41b
abf7fbb1230af26697e7c0f05662c594921d244b91866ab1cceac1f65dc07b92
9bf266822cd2ed5c1052c8a5bb2545b7b06d295fb04297001b9a8b2bcfd27b43
bd99d1665b216c16ea0f6035fea472fe8cec98da27a55ee5f8b73994fc536d71
70535986f9f0c2b1490a5ac2ddc33f42ce71b91d95508203e018af61b7c9185e
82bdcf9370f9b534061389e45c4780cab25485cb99e403a44cac6bc5a1fe717d
b38f2498d28e4f136cd8b206363df16b7e8690bebb360c6afeedb07680aa2ff7
a6ce95126397ba4e751295575cc9787d95fbc01ddf76325ef4f96ced2cd5b690
74e99830ec69c0e2596bc7e46492287fa450029a237312080aa32572a3ee954d
df838e8a0e7edf2be5c130a3ec13d5ad22fbc2dfe03f3c230c4bb88ad99b75c6
1022b338ec0b252d67e5af3e4b6ba77d110b0d9b1ead2693ef33a1332194137d
8ee466f190e3d9e40b4f93f0621ea7232eca353fa0ac498980e99e9e3fdf5d40
b080237318c91c1099eafd143e484273bc344abcf9c659eb651222582e4e8c06
57ef467d6bc2bf0235b5971369a89f651c81e7b2c4e7d7a718dc138fe89de09d
837891ad5d5a007f2671227600f9a3b29e9b38e1af89818acb44bce36755729a
4970db9cc33e814a48bb0560548f1fd08fa4c37fb644456ffbb40cb06fbab724
dde63bfa041eb1bf6830bdd91cc1b05d6d067e0fdee5ebab79cce886d91743ec
4d8bc6741d1298c270db6bb1bf4be550519398a3e82a5fc3f9ea91ff1f713e65
938fc7e926c0ab109006f9a9fc6ffb1f8d5e592e188ad92eb26b0a40ff3670d0
e445bcb988acee1d03a26ceb28a4a5914d840c85b183dcd22e034d9af5e8dc1e
fd4680b75be6918b12ced164b5085531f2fa30e01ce13fca5be286a6fa59ba2f
cdbf24c724fb434a768e82c7489e9340bf464bb2d213c6a410ec08beabc1d268
167f23eca7590228f8698458cdc0f7d59a583300d7c8acf2467f06abafd6f1ab
65accb7b18f8d96a3e8c0066614db0d82e201253045ff9c0c5fb6f8373afdd0f
d70c8ad30700599fc1b7386de043f5c84caef9e0ac97c30da167d0c2650433d1
a1ea01114067dcf5c5aca00c7d0b6f9d7b8db6a1ddb7b8afcaa20febae68cf9d
9402ac71b29d6908d323c1da1b4a64ceda7181970b06d7bda0c87dd068473cf1
cf2ef6d0e393dee7b85436358d85338a53538443aca99877f9f688ee63e31dc2
d9ee84c3273147c1b5133e6994f604c4320662cab74ea0a01ec6f0902eacda73
b86b7ccc6b1c52b58bc9b82cab9bab5f05970c6649d320b8efa16553f2c8912c
870e4bf793a72062718a2f7fd7ebda241bea17b8ef75cb7aaa7c5e359d0d8416
b3a5106672666ba12de02afe97dc0f366a818d4ed34000c57825e02e20dcd1b1
3cc1c0488799f6e1395e7376d7c94c90da011f63e9c1bfb26f462e4343e47100
0bfd87a16a52bed1867eb620f5974b4df738ef9d094e43c6b04f4bf85819f4ff
7354bf49865d1f002093230e94d34639c3f753874d0a843269c1cf15a027cf15
672b711e45d96f53f40dba846a5c535d05a5f59c104efcb37ad052b2db88e0f6
b174855acd6e116ba812144f8a4a78abf145a1ed43cab5dfa59257892c620be6
abe713420559250bb52789153798ee891d1a80e0034d1972f30c83110c2b40af
ed2d45772670fe68292d6a8a966c43fada9aec0c56ad3d3f6c822c27b548e863
d2dedb9521cee56e92fc807edee76b1f49bdb1b4b39bb6785da04d08bd049236
50e81ecb1bab96d5a889c1946367eb836c9bb706759ed7961610ab79198a6b95
647cc09960d412b8d13ab7edd956563535b15d3d9d553fabb7dd6cffd5fca46c
bfb66fb64707940301432f4139738f986f7e50ddc8e75c9eb01bf7661e77035d
d4dcb59181058a3c2acd7946b3d6c30c076a3a6b9049f73fcfa97f4aed83a9d7
d6b208e66e7d7d10dee604161a5ae837c84a339c2c6fe4a9e95d367cb5ad232b

```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
109.73.52.242:8080
138.68.139.199:443
139.59.19.157:80
144.76.117.247:8080
152.171.65.137:8090
159.65.76.245:443
165.227.213.173:8080
173.248.147.186:80
173.94.53.3:8080
178.78.64.80:8443
181.16.4.180:80
181.198.203.150:443
181.228.211.100:443
181.29.214.233:8080
181.40.122.122:8080
181.56.165.97:53
181.61.221.146:80
185.86.148.222:8080
186.137.133.132:8080
186.138.205.189:80
186.23.186.99:443
189.208.239.98:443
190.117.51.248:443
190.193.141.52:443
190.210.3.93:443
192.155.90.90:7080
192.163.199.254:8080
200.51.94.251:143
207.134.207.44:7080
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
213.107.110.253:143
219.94.254.93:8080
23.254.203.51:8080
41.60.202.26:22
5.9.128.163:8080
50.246.45.249:7080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.184.97.144:8443
70.28.22.105:8090
70.28.3.120:7080
71.11.157.249:80
72.47.248.48:8080
89.211.193.18:80
91.205.215.57:7080
92.48.118.27:8080

```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
181.168.129.146:80
189.159.195.202:995
190.147.23.76:80
47.180.177.96:80
50.116.63.9:7080
70.44.163.160:443
73.14.76.77:20
81.168.92.58:443

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

103.39.131.88:80
108.188.116.179:80
133.242.156.30:7080
138.201.140.110:8080
147.135.210.39:8080
160.3.238.131:50000
167.114.210.191:8080
173.255.196.209:8080
173.255.250.241:443
178.62.37.188:443
185.94.252.3:443
186.113.255.229:22
186.4.234.27:443
187.142.0.234:22
187.189.195.208:8443
187.209.46.240:21
189.209.217.49:80
190.46.30.14:443
190.97.219.241:80
200.113.185.229:8080
200.50.185.54:80
201.192.156.113:8090
201.220.152.101:80
201.239.154.191:443
201.253.238.50:80
203.143.86.111:8080
208.78.100.202:8080
211.63.34.183:443
213.191.168.93:80
217.13.106.160:7080
24.243.101.134:80
45.123.3.54:443
45.33.49.124:443
45.36.20.17:8443
5.230.147.179:8080
50.31.0.160:8080
58.171.215.214:8080
59.103.164.174:80
62.151.17.5:8090
62.75.187.192:8080
64.13.225.150:8080
64.46.91.165:80
64.9.43.60:8080
67.205.149.117:443
67.209.208.130:8443
67.248.56.82:22
69.198.17.7:8080
71.182.128.166:80
76.168.149.66:8080
78.188.105.159:21
83.222.124.62:8080
85.104.59.244:20
86.239.117.57:8090
87.106.139.101:8080
87.106.210.123:80
90.219.97.38:80
94.76.200.114:8080


```
#### Epoch 2 - Spam/Stealer C2s ####
```

183.82.123.254:80
198.58.114.91:4143
213.136.86.219:7080
37.209.252.79:80
64.228.72.40:8090
67.202.178.142:443
78.149.210.211:22

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/07/2019)

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
time period.
Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any one time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
via C2 to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```
https://twitter.com/ps66uk/status/1105969256473202689 - @ps66uk
https://pastebin.com/cwtkEVqS - @pollo290987
https://twitter.com/malware_traffic/status/1105987176255229953 - @malware_traffic
https://otx.alienvault.com/pulse/5c89646294d89b72abcd032a/ - @SecSome

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch, @urlscanio
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Short on time today so quick notes. Still seeing more Intuit templates and eInovice templates.

Seems like a lot of URLs and Attachments are coming in lately. I received 144 malspams and the majority were all attachments today.

C2s changed for E1 and increased from 47 combos to 50 total.
C2s changed for E2 and increased from 53 combos to 57 total.

I am going to be back from my trip tomorrow and hope to do a better update the. Thanks to the members of the team for filling in. :)

```
#### Sandbox 03/13/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-03-14 at 00:00 UTC - https://cape.contextis.com/analysis/47831/

```

```

Epoch 2 C2 run on 2019-03-14 at 00:00 UTC - https://cape.contextis.com/analysis/47832/


```