Daily Emotet IoCs and Notes for 11/12/19

Emotet Malware Document links/IOCs for 11/12/19 as of 11/12/19 23:00 EST

Notes and Credits at the bottom. Follow us on Twitter @cryptolaemus1 for more updates.

Document Downloader Links

Epoch 1 Document/Downloader links

<none>

Epoch 2 Document/Downloader links

<none>

Epoch 3 Document/Downloader links

<none>

Payloads per Epoch by Document

Epoch 1 Payloads by Document SHA256 - All Times UTC

Creation Time	2019:11:12 21:04:00		(Attachment Only - Doc based - Office 365 Light Blue)
SHA256:
01d3a64359e6114b5158ad22547576ebced98161e16458e1361feeb26f401ca1
09520944f1e8976dcdefd6260d97c2bbb3a6871c32a71632ca1078a7bfd78afa
140461cc34113b28097bdf3c33eb28cefbd55b471239059acc76e87b9ce48194
26037c07d4aa9e075b780f50eec8cfa1fd226533265f474b4e36f29a7c4dd64c
342c1d311f9f829c305e3ebc2a3ae5b51f86f7d257b54a1eb90202a8c5da1a76
3b60c77fcf0ca403092996b469c6a81f756d273955f371db4f188907f47896b2
4264e752db538c298fcf31ca09c5321a47d5cd5ee53e22f62d80e5fa201991d8
44f3524bb64b2101202377c7fac67b870cb0e977898d121047e4f55c23fedae5
5fb20dee6a03daff9bb0709166100df3497d4eeff757fe6d4aed22ff3a3f2709
7395494a857b46f827710b887d0e1fa0d6a8a6570449fb15f0b5f1376227ad19
788386236972cce8e9f8532f6910211fba48a403d7f56367e445cbe8bba8fa64
82a796f322548ddae527675414c7e0d1353a541ac95dee5ca079253f2c908373
8bce576f07dbac830163b07ecf8d51877fff6d2fab36b2a1f30b00d1dc439c80
d75126c113d659ab323f503dacb81ea532ad38f67b2971dfb8eacb004ec68336
fdb9a90c0f2c66ac391ee7cb22258b7dda00afa720dc8503281657f99b7f76ad

https://www.yoursupin.com/wp-admin/5xeco43/
https://peacock.dating/wp-includes/p8l1n15624/
https://www.jiance.wang/wp-content/hjrop080/
https://subbieapps.com/TrkFR/uvf253/
https://meetrobgenius.com/9c69/psqclq02200/

Creation Time	2019:11:12 14:18:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
00ec918078b1d9978fdf0f78c872fdfe2e2dc9fead59a9d1ef01e8760f297832
0161b8137fd207841c46d32fd1f39cfb8149bfb966f9d290b2b4c8ca30f32380
058da8354c8071ab506901fc8f16b94cac7db5fd655f8d28e7dc278cf8daba84
0764f43c9d460972480cdce68ecb9947e9e3cb4c99042efe63606aea1ef06e08
08373c365d3b0179c7165b3c5dbac3ca4a5ce08b6c734e2bebccdddcfcffb549
09e8d382c753c871a208b0de78a0e5703f8e295a0d3de41450a520d6586b4390
0c6aa7269215fd014b483d93d1a5db0990b8195cf92c4b7d905c36787e0afec6
11fe2ed8f2befa3bd78cb9320d01165f9c326db027d8d9503576c60e9233a888
12324e396307f2de563644f717a76c595fa36812ca45d5eb12ab35f45d596b32
1260ae9146043b092b8c39c93993dca037f5077a01d6d0e852766422170b1042
127a5552cf739c6fa77bbc6a1b1db08176902d4eb81ed39efb275dadef2cddf9
1cbea479d7449f57bb641095c138988156e48b705bf93d96843f023fc50429e8
1d3fce38cf185b2b834653f084ba35be6a4087785a5f6825f40bf1ab3f83ef8d
26471b9c8543db56231db4aae1879ec967eac87470921a3777649da20bad0cde
2809793cfb06e7b57438b289442cf7575c026e1d3da49bb21d045199fd106404
294ff3e1496a580926317408af48fe604e955675112ceca2273bf871206521ba
2bd2fca30d24fdb4d1de287ed5c9abd1f5bb417bc2401767ee646385ee3e4806
2dfa5bcf43d5a417df4b11debe55ebdbb077229a8a22c463ff463ae8ca2af917
2ee12d1a505616aad9105591d99aa540570a7191a0aeb1bda3f17dd24c7c41b3
2ef3a78d850112fd4935ddb2daf575ed6931d497ca42f733352957aa5b596c92
308bad99015f128e5da33282ece2e9a1d67a413bc372e1ba290b63664e2423aa
33622d98a15f5e6c63fbda9001664e6c911a6865378128e3bd9387cdfd66d09e
36f902b0230778f85ce51c8e2bd26bc0d7144ea8c1236ea0f1bb2fe4c615b339
3c99153766d65c87c6ccc814f1078b2957ec7ddd1901a24ab3d5c6ffdc6887be
3e14e62093b0b89ee175bd7d32c23fb625a2bdf0dd326e487091847888c4940c
3e6ca34a9f41f1ae90c5b4b7dc29daf527174d16fcf64fcafb26185cb8dbde87
40a54e5fd2bca0807d70bce368c1301455bd21356a43ce65d08df61af3b9fe34
418d6e6658c578eb76e79e8ed5d5a3fbf9289ae88518483cf9208b97c986d468
4732ce54b2f5c612fb816f5e085ad1029c99d590d1910f402d945c5c501dad66
47b955350212b1aaec7f3db31d291b0fdfdf89524133b939e1fb235c29a39a47
4bdad60d1daaf2e58cf6f09005806c60451588b9ac29387a4677473c90bcab7f
4d141834ab989217d50e26402fb6ac76502a4797474289f0fc8fea4624c88a3b
4d5dd63fe45e0d7724d9204f65eb7f0dc4ee7c141ad50d60ae6070ecf83341f3
4decc5397d97353e58f6d877a49f0a83011a8d2db73c8816ad65c799b0964246
4e2d338d1fb5bc312ca6a0377d5ddcd7f64babc52041be79f78a52d865b944e1
4e8c8d656e8d7f5ed22c09f0afca432ffaa128e0ce4b8d49a424d36cf58342c2
4f12f5a2154479b013e841675d2fd2ef598665b867b57582f8cbd227c5d407f4
4f5bd54fb4cf2eeb88aedfc928d33b5f6ed8e29382edf7e3431034ffa653fce8
51e6d31d17bc2139982f578527cef7fc947362e74aecf50c74315c0b77a7cb7d
56a4f74b2ca70839ad6abb10abc636cc2a0832531d014b16cf0dfc2a3f6c75b4
570ba33cfb2b0176b8313a6fe746595d05b5806e810924eb489e0a3797ac7032
5b3c1ace8295dc0d82f5342387ae4f8f62ec89d40ecdfad7bda0becb8238cf58
5c6fa4ab3d596028171a8525cf39e971ed76deacc86f40b8b1b26db13cb26670
6111c5385b7ab6386b769d2a624df1fca698a4c0a96682a96ce8be548f470942
65ae55f7e2cca72fea70933b08067af4aad80cd54844e613c9a469ab32e0a294
6c318c1b6a1a6b3a38a13f21e1c917338d3907fbf872364a2559fa82a73ac9c4
6c8a2af1290ad40989368dd7e2e1f0705399ff655fba28445cf6e794eaefb441
721847c15fe901805521d141204d9f7567fa503abc308bc107652340a7302f7f
72d6ff87a4838ac4257d1fa3ab309d707fa5527c1aa8958c16ae1ee432b5ec99
74c8e9b5d4bf389b90e71cd8e254eaeeac0fc050250126a298b051b4c261a897
767368282938601731911626679f69d729109b8163897351cf388d4ae11983ba
81631380cddb4be527d397bc7ed873b00d8e9510dc315c18f1ac1118960c0574
87486f8e907edb275caf9f0399731b99459d947ddb48a2510ea3c6db8a3c4f32
8ed2b9dfa8b242b9817f3dbf533448d2c3d5facd255388cfe5e5e2ea2041a1f7
90dda1ef32cedae6511e8d4eb098660af40eb3dec0996ae1055ec9bd097f5a6c
9554f1f79ac99e117888c4a09e5dd4419bc08d7b5ae6c22108a9c6409da67477
9cbcbb35dab52594a859deff439ac96916c1fab37a45da28d942aff6125b4e09
9efa018b0f7a28819d7dfaf480143c15ba2671ee681fb3fe7c5cc529d30c3340
a02889d120069fe45b197fb3701a19359564ff9e934d2ef9bcdb9efb576f013c
a87e067bea4594d75c701a4359124338555685ceb4f4a58c23c51c9a7b4a0883
a89589573afe12f988178b7bf3e47fde00bc0b8d7b6668f9a8c9c539c31c242d
ad106d006970a95499d3db7df85020a2a3fcfa5d637bcd8e83891691ce4d2b1c
b09705c64996499bde9c4f92e0c7478e28e1586947132b095cff60a19ca5fe24
b1ddb24aef56407213505d40c752bd402bfefbf13d5efd136b595489b2a685a7
b3ec588d65d79c8d3958583ba572c7b941beb2ca8bc8e8e9477f226fd8050c17
b42f2afd500bd9658ef87499d0656736a3841183908665ebb0d900463764f42e
b54feba9d247e36d4fe5b45cd62604cce23861bb8454272712776925b5c62f53
b578bce7b0aef4245f73dd9d51f300c7db489af291c2abe82f8a563a75abefb4
b759c89efb6003cbb8a4fbe2634d2f9625862f1786801d08b91c374066f9d7c3
b9582efe086d9b816c05ae6dfa6e62f8098bb98d7fe20f92cfdcd064d0ee50dd
c1e2d7dd3f4fd85b7408738a8ff95ce8612e3e6b8d8052a84db03a4c538a9433
c82cd792f65373148dd8fd805581c6f8b643aad5eb3be1180fb7f319323ec66d
ca4f9bfb66bf7f0c27276309f6eb7b329310633ed41baed7f81f75bb3ae1fc2f
d07ee5ef34b5a5b8377490d8e65c97bd5a94258bd9cc6b933d6ac0fcdb23362f
d38a198bd9360b28e207a4ac91774328e422ba1dbf4183abf5f59122f195c479
d49b9a6f743d3e55821e315730aaf01e0ddbc45ce6b9a333a233fc708106c915
d4e0097d63bce3134fea87febf0ab8170ddbef5f895b040454e2d3696631aabb
d638f3c996b6e12859ee5349590763acc803731e5e59ab122e6b2d224d638ad2
da3a0183b7886e9dc034477d1a6920e2d7c0d5bc1d9717c256cd363fb53378c6
db495b009a110ea7b8077ccbf1dede3a4c8afc14b00a4f63c0db708437221f40
e41af3e80da49f0fdbce90662b8a5281627a452f914231d2f3622a6b75d5e30c
e47aef453b836d6a89d0df9e590106c373498309c2c2bea9a8026a744f72e92d
e679d8ead9ebefdb00bcd59cf10c329a2698030852a47109bd4da2dac53da9de
e6aa2af22f94ebab2f53d0db5840f7b6e2c10e8f9b2c87c325aca2bced999490
ec6e8649015b56f92c8dc667832a3abd9a6e08f2efa4250fcd720334ac709600
ed3b64770b37f771a8a8ba81bf08de555e20d04c7acdc48422205a677e2081f8
f6171c07e6245850702933446199708f283a922f88bb3607b57c09ab3be1b111
f6aae167a878369f40c94edaca4b79e8a9ce97f85af7c4fda6c36a31fbf3adc8
f8805ffa2c96d8c7ef817736d7a8f5ae363e5d6266cfebc8132c98c47ed58d2f
f9b1d0d1ec6199bc0e33bd4c3d01159d5fcee47765f1b2e26e170d1a92f7510a
fb694c1c11edb2dee1f62039052bd1e8b60856c69f59b9165f560e9ad3c4b063
fc4416a4b217399e47787eb968d806cc01e84aa72e4dcb19853e970795b07a8d

http://swisspixstore.com/blogs/p15t149975/
https://dacinpro.com/wp-includes/lkm26/
https://news.omumusic.net/wp-content/plugins/entry-views/kfmon472/
https://learnbester.com/default_page_assets/xk5a28539/
http://ctbiblesociety.org/wp-content/bncrg839024/

Creation Time	2019:11:12 12:34:00		(Attachment Only - Doc based - Office 365 Light Blue)
SHA256:
0659d55b65fe52211cc805ac0298bd88513cd00cc05ffe5dfb48269dd8154faf
0da74237e71e105e2bc4a0d92ce2654277adcb307450c3eb9188fbbe24ee600d
20f7d15dc29422b388d80b4d36f29ba7bdb94a0f48225055c13680e67aafc33c
25daf52d995fad7294b491345989aede576599e6f5fb59b2d9d3324b8bf1864e
2ab1009aa22b66c379ac14e4a8e7051ddf7ab9ffe59e4bfcaac3263a29d8f299
2bb97987de0ef6d2d75c9c7a6a88313e6d030802c05c65d20bd646d208a6b293
2c1c0765fee03358ea5c9bb2b7d0bd4d9c68426d22b5980163a0a3e162ba01ea
3965a5a7315ff13ad03f1062488a413c3dd72e7f56752c6aef2cb109c07f90ed
3e5a3f70fdfef70ffa88ffb90835a947f33bd1ac2f2af8495d8f81435e963753
4ccafdf17d26105323d6e96e55d1b727a2729eb2907ad3c840fa1d0614125f93
535a25768d0c8bd7a850589731319e6f49508b011f64b096b9ee81eab18438c8
59c1f756344c235c7f5c7c5fd006843eab1981744b7ad35469d5f15a03c4b1f5
5d09767d73b846fc4292353414de056c64b661e68d703b1dc54c6d44f186e3f1
73f02a8cfb668cc973360d070d8777049a8c055fb5d8c43d97b428cb6764d30d
87732a35b2e3d1552a3de248a79b876d8c9cc28b6662f830a01a8c7bd014872e
88c68235b389910dacd6500758c15b56f7110225d1dcf76569587234147f39f9
8c399a3052fcdb1130377e5269b309eb510773ce38fb2423f50d0863312486f2
95040384d3e11023290319a4634aa1e40cc1e96226bd7f1e7b7009d33868acb6
9d5545f25e9078b5f2b8b3d424772dc402d7537a5036a725b325c2218dae3876
a31d7de3967740fd5abeda3b23dafd4e6b75ca9468c3a64bf8323d17aee42e1f
a6a1cb0f1c5eebc72cad3f15653db780913c98538416992b06b0ab2ee46bc050
abf22e3498c404a4a9c1dabc9fc3cfd19851162b33c10030025d7875c58d2099
bab47220d9e7f693016a09faf161b70e59883776f4246442fec5937e925a5d56
bcd269b5f4313ae29193d1a07780dc745658adc020f6380222954105bcb615bd
daac21755357b47a9350120fb60b05ba241d46d4247f543393ccff6525602960

https://print.wedbox.com/sv9a50v/l57lp91863/
https://designsbykarenpolack.com/wp-includes/pin8/
https://deartomorrow.bentangpustaka.com/2u1cp8y/jxj9/
http://www.zhoujiwei.com/wp-admin/54668/
http://prosaweb.duckdns.org/wp-content/fetc5215315/

Creation Time	2019:11:12 09:58:00		(Attachment Only - Doc based - Office 365 Light Blue)
SHA256:
006e79284754041d46a54946482318d93ed2ef6e3a5984048d35f0b3a67a897c
084eda08be3c1a7065a7ccaed31c466b47a569f3959c51e91c14888bbacf62d0
0c66369f1d93e6c6df185725f6f5a0510047196adf39e50313291465a152f38b
186e78efd9c0e5c92b8e6958a13ff7f6c3cd7c40195ff904068fbc39d39c6127
1bd96f7c18cf1f4f006cccfa6d4c59cf89c4a3c31b7839c4d1559f1328b86789
212f2c63dec718049e31b170c2ed111ef0e6e515b1eb517b6ee834fccfe6f6de
23f6e32627484c5415c3d2a29855d8a187ee67a51d51358b1a794b8c75333e14
25acbaac423bad940d3bf023bdefa02851bee0800499f6311053b2bb7be6fd54
2c9250b1e792bc3f4565507da2582733748215c3cc7bff957077c608257ac506
34d790918d76452699b726720fb325f8fc4954106df237740082d83d37b01e34
4248867963e82255d4642994885be43c5afc60e01f98a5d0a85c127278f0cc1e
424a5cc99b57524b9086c3180609cc813d961ba92828ffccdbc860cab7532338
438e9d9a5cb39b04a4fd8f82e1b6018648d8c174d4b3c7875e2590e1c93211ff
4a47d2c4d61a8621eaae6cd9da2d1ce6981621847d429595d01c5b08a1c83cfb
4b1515838cbfa56da07395b11c4ee3172cea5ff66694ca021381e307dea03657
4c66d407af9e633f203ec37fb1c96f745b11e3b51c696f04d4b47d57087c16ec
55e84fd632d8ddabed2794876bce0b03d35cf8f3f6a6dcecf8ac45f10a872c4c
5e8d02f3c55aa011c88a7098cfeda1b7893f05b1b5d3d435eb0436815ff43fba
5e8d1372a70fabceacfaae0fe076a23c43b65f0d2dab326c4859acf6bb44532d
60c1bb31d41b417f4c7e105750e0e83fe840097ead86e6ef88e4641bd017feae
65ac8faadc49a089a350eaff83b0c029e6f6ef0174a8161384abf64cd672f9ee
6e68ae552eefb3a62680ea5e8a4dea97d945f6c8a9451991830715dee8b9fe5e
70f2a3e0215028eeb01b17fe16e3e72093c76ab809aa295650d0428613bef55d
774ce5d6234d26334ae38626d40d048be1d70334dae69b2bcb3ea8cc158035fd
92f3dc88ec2ca11e091d3869bfee54e50fa089bb33f162f4958ccd9a7dc09120
9531002451c123f0b038eb84a9ebc507fb8f3e701804932d2aa27c4979544a08
994e398eeea05416fe889b3ecfdc699d99bb98170778009509246f0004527899
ab28d086313fc817d56eae4c487db7de4634bb9f8c5ae9bcf54ee15485bf3808
bf3319c65d33047ea2d374dcd78dad86d73fe5c7f89582c8cae74b248a9ca0ce
c0a70b378b644278e1b7da5b30536db837a2196f6a5cbf3dd31e7e3d71cf70eb
c25c440ec8f90bd63b5963ef6907d4547e112a0fca08e3583dce515b6575b482
cf4c170b35c36914686176d2d014e86aff60ee4f858240337a6c6950990242f7
de25eceb2859a274bf500aa6f68ba6f734d62d7162073d7a81fdeec68b462f91
f31b6b89efb1ff3ff3b7b6b0d9fa4cc28146f8844cd048d023e582288a496872
f658af21384efddc3a5dba1bd455e1e6659df6784b3d177640ba811d61aaac9d
f95da1e87e658b53de38f30246b3b18a8945627e9381d8249263a8d9ebbd3785
fb1b77b45ade3cf6526c2cb4a5119c4a147fd18b19780af8fc7ca2e0fb463ad0

http://bigprintsport.com/wp-admin/f09897/
http://www.mitlipin.com/wp-content/zm2808288/
https://fishstore.qa/wp-includes/8brnvgr8626/
https://sukkargrp.com/img/9se6981/
http://blog.thewebcake.com/wp-content/4w4p3/

Creation Time	2019:11:12 03:53:00		(Attachment Only - Doc based - Office 365 Light Blue)
SHA256:
013778d23e9892b208ccfa9c5fada34c3bccf1935c201e337367aa3da7a16cb0
047fd05e7ae1cdb492206078ba4f691ef8f650ca2fd8339b3fb6d2fd0534e433
09342ce3525d79d28a7f619c5a3ede2c2f1595ed950fc6a32f2eb214fe003c5d
0a6104e3480adc3362813589505fa220c6e3ec4d24207de0189b5845c68d38f2
0c22eb134dad01eea006442e828067ecf92e7a40603a7ce7dafe5f8d0166b5e5
0c51b8aa6806a58155fdfc572ab23c82ae9242b393369e383e17d1aff7a02ab2
0d8a571f5896d295e96e83558b571814be12cf189fcfaf11045549c06da4a2dd
12ffe1de5075b20f758213f00f686824ff815613d7adc41b931b4d3d5958c17e
146ad62d4181b69b2695fe63b496d4c28f69e7b24ec0bfc62db5ac521393c684
1d445853835cf352caf406c2e4183464a2b8ed7c1007e1b0f425c6c2d0e81340
1dac36985edbc5d79a1b51dd2165b3aac00e8420d24178becc43a2dcc2b9be48
2359f2b5490498d87535c52d2449ba9f6e805863af5ea452f21d78d675765910
23955059eb60279e6a558f0a73a981ac6735cb7e2972d06d5789837a141ccaca
302d3891d4b62a28e437f229abcc1ca56665cf9c29eb90587cf176d8ac43e44e
31faa2bdefb3c19a469bae9949c9404a8efef2778c1be6cf340f88339510c7cf
3486a9c49da52a12ad62287341a504fa0617e09a10e8adfc0a030cac35122ec1
36b480813c2f60a24527933fb67ca25f9ef47865c15a3fb5ac7c6d0381e45b1b
40826e5ad57240d6366558a8bdaf66fb6e14b66c6e00e38acb78bc9da7d7689a
4a7c3c67f1149fe10fa6a4956c8b3cf0121226d331776e81e6b9d437de7d1ce1
4f23b7187f56838ceef797b4b31bf3d561a71cab02b34b17c0058db53c4b1720
53a8e8294dc8af0761162bb843391a02115c9b5fd503b7bd9aa43f3f29e242b6
542ff5fb7c3ba9de7c3b446ac63e22f1ceaf4758a46b8c45ebb228892015b9ef
5561ac251c3402f7b527a0ae223fa19aeea34b323f6607bb9a5ea9fa266f8ec4
57548f98f8a83d472e60db1f421e28aa97b2384a39b1731f83ebddaa91b46f3f
59c2ed1a4fb199020812fb87d435919201c1bc146939a3fe5e82d508e178e215
5cd012385b888cac9c2c57baa60e17ee5246e3640b3a4b9c415fdd5378bd8560
642a06516947e59fb1196ad2ef19f7a8796ca9b5128c3acd9dfb3d78a3fc80da
661a45652099d4c38eabb6dcdd1d5faceb2fda7931276bb7ceb6a45df322e948
6692e86d5f1d38a37b8e6cf6dbec97b0a8aa1efe02ae3aba1de2a5356d94eb60
7228ab838722012894b419b03c87fd622e6eb216be0b8ef384e0c00dd85e555a
7cd49229b83459ab749671ca4523451fcf17b92e0c0e59604125f3e8a462db43
7e3b3fddeae8267a5b898fa6c2038dbd1aa54284aafb89c188c593ce797b89f2
7fbee05fb705cd2cfe57fef29c3d74b48068d56661cbadebec2490730d1037bb
8ba73609163ab1e64eb349ab37a1988981825d089e54c7b716d3a74899861d32
8be17afce1789f050f72fef95f977b83f37d57730c28ea78a9f072336d484a90
8ee7d569e856bed381133574cb643c9c0f1a8427b89d20c64de5e734489059ad
92110267580412795568ca1e80e52d8689948901735cc2ae4088ce956b15db26
95224f2240462be2b589bde09e06c3ade5666984b9e7e7c7d153495929712d4f
95a6b1d7f2236b2526964912df69a8e353db4335f7764a2c2eb10bde84cf1437
9834c4e5a5b13167fdb7cd04401e14688937ffb469951c43a2c44ceac43921a5
9e22432ffcbcf44466ff38da64f1d4b0e0a3ea7e1a51276a08d998220b82ecf3
9e2690a85d65c16f7a414da35156d51d79558638fd09a4cae841aee322aa1d4b
a01622c08753b7ce6aacbf7be2fdbc26e7b1a167af2ceb2e9c9d5e1e0b2e1f39
ab8a947632f8753fbb03ee0f54b56a4c3ae9a97fda7760f3a884f1953d078b63
ad4754502d76dab3ab5cae0220db91b31a9d468a34bc470b7585b39fb6e58b9e
b0443fc9adf0d4355cefc6e0bf26819c9499cb444ad60e525d5d1b58d66d3e45
b6c3ccf424789a282e2c06ab315c72bb11f8e87925d992c8351277b6afdb352d
ba3658efe7243e8512bbb30b159e5cf57617b12444046fd4ba81ee8cb1b160e0
baa09d1cfaf8dd935f5c11909e8b04a8a94a962b2e0c2f30fdef19db9eb3957c
bab44acfd941b9177f39f25d126d6fa93734b1d0f009138bd884a6664f8ca72d
bb85ee16ba35e4c644e2ee6b6b7a83cba9ceea07595d3490f00ad35e5e5f7cf2
bc2d709e1393d969a2367f608f6e6333dd184dc1d461dfa4c3394c38d1040534
c4637767981c205355b46907b2b01b1345ebae7d0eac72ed2d9e59fd69dcf857
caedebcba2691320b37dd80034d3faa673c2e8e50307e2925242bf4f6cbd42ec
cdcc227de243575a37ad8a8ccc1a84122fa5afabd0a0eeb369db6b9f65add418
cf3428db035e21ca071918307c304209ea42264558d44d5ff31b1fbd59a94d7d
cf7a6d5a08d5047566e9f310a2f2c32b3d0b5081661a5d184edf96ed63730990
d6adb5bbccda30b19aeabb92e8dd40cd09f167c74cc3a7b9476fe9c58da930f4
dc8993ea61ccb12824642900702f8f604ace5036ee82e875c3301d9ab3224510
e6fc0784ca7d3a25e00ea323dba9debf46ef8cfb7ca1a32a992db7d35f98510b
e96952276549b608d9d1c92dcc567229abebc9762cbdd62fcf9341b6bf8eccfb
eb3a696892c40beddd8360d057737088304adb22307689a168f4509e3a731d02
eda4974f4247eed7c04ba513208242ec1644c64356e956b0e899cff8ac9a928e
fe5ba107af5fcc77a8ea7409f8e39871dabcaf5fbd4c34df5b1eb39342422195

http://aminaelmahdy.com/wp-content/w5im0q172/
http://belt2008.com/wp-includes/vd8h940/
http://potterspots.com/cgi-bin/2ch4a60/
https://hacqable.com/backup-7.16.2019_10-56-03_hacqable/dsv8923/
https://living.elevatevisual.com/wp-includes/pkw91254/

Creation Time	2019:11:11 06:31:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
042d184c0e47366ca3066ef772fd3a7ecd2865741541393b74b36eb69e059400
0502e41264ab7a51f06bc0e10746c3845d4c4d56a41074aba7447f6269dd2f15
0c61ea8d3f78890860f63bfc7525767adc6e3b1656211cee6f7a624d0f2c6151
0e393d742ebc659c689137a0e0cc6157df220286ec3c5aa03977d038a71fc16b
13ef3f7c0634962f63279a678fcd09df5530c703f7c0385e679295564f365428
14b0d9f2d45f6e79a6ad6f86c66d559fe2004acf7ecac1a6dabb55993afdd498
17c0bcf9e8593c340e4466602195224d2c9d42a8f18942ddee8bedb0cf947196
1a22707d34b96fea6b00656d1d898804f927d25335e44b9ed748b8d209255bf3
1bf89bc3e3449a5f5119854d43306cee06d48b590a4d54a234bb0b8cb0c57a84
1cd79b01b3ac5cb58572aa20f7b71e6274d8b472fa0b95d8ffb125fd13d9d072
1db7a42793015f66436e9152429dc68eb576d5a453faf5aab2cf0ee92f3f2b8c
1f4ee74b8a3457c3d5f656e7722a6a9c4892a42ed83423192cc859914531aa92
2524ff32ac24d785f3bb11ad87e3f970fabf8224af9bea111a61ad15c90490da
2d9776951344b011e747e1861ad70e59cc4ff5ade7cc7b59bcb9f7255f660f88
2fee9bf6fa8c15f0a3a9fb62f896a7906258cfbd55fabe8b5dbe780cb356e622
392f5309e626d13661c9b8d0967c463dc25c2e5c9df76a7e7627e7ab2a037426
3dbc9dd883e66e1ec6083b54f3941ab3990cfc9d66467e3996691906cb9da2b5
40cad7fd90c1ca8ebb2b221f1adf50ec63e8a0e1d02f2211c420c6a69086a135
44fd78366e94be76d00ac352287d675aead7ab9bfc4e750a4e40bd1ff2f7b4d9
4770e3e19b78ddc0ee724ce6b400dad498e58087f03c8581ae6e4d82bd0b881b
4afea9d2f2e43d43478e37c21768e590e45f32755c21666f14537d748e066da2
542b71221d7b7a33ac160df7ec88d64dae31bc7484dec507811007ada5b771d7
559232c722a82c1037aac822da878711ad766132fc60f269980a5f16edb73857
5656d06c45ef6f5ed08efe243e36c18b321332b3305fd9f177979880804e2f80
56ce12a8e5913dda3d9a7db69d4b0c680d24c20e4e686c92f14d370a13adb20d
5ba33c66b6bd32678bedd4c5f489dc58fea409fdc1b14e729880184d0d24ffd7
5ee9759e1bedcc33a07b2da865e21afbacaad8e55d59657bb090336a3e7c1712
604064e8733190ebdbd4c805c34eae515874f927bcc3b8d7cb83dc75bef60d63
6041ea76ab32911417c01e8c94a6e0c8224f4975fcfa2df4b93031a6f69e043a
66fe4bac9d731b8d2a585c0e2e5b9ea1c694859b2991e6ee4c593ad75f575f3c
68200ee9ef7ab087a3c0d3c5b54ffdf004f70869f054e8c9ebb387abe6045a29
6cdb7e95bd817b0fa0a6804fcd7a7d830db0ea5c8180798bf8b6212220cf2235
6fac18b7a350ebd606ace806e932de77d401e42616c09b771efd301a7578c897
701fef4f4bd4b0208ba6c19552429a695d668e37d17e85ec691aeec5debfc556
704541fcddb02c2e304944dc32c9143cd33c7bb0e83c621423d1c1d59fd7db03
72924d1070d11ab06c8dd550c8d6c1c2bc04b0fa645f1f2b5848bc44d7239095
72de79b05f4e84c1fc2bcb721be59f9fa9237e61b7501da67b0d82495d7b9e4c
7322d2978f2ca983653091e281fabb5f54dbf617040c207d73975f6002839b8c
75e9a36a127dc72df52ce1bf19c60abb02bc5738417c4fea2fc37cf5e6056ac0
77fc1c4bf6c1cd31ac5492a9041715a55d58621137e4bea3269828a81337a35f
86713fa640e9281e1297d5ffc77d25629362cf417aaaf8a972e1b0c3e5081643
8886e64d65b76acb4816b4f7c10730f6fb7c80a258fbf59e14642fcd18c6457d
8888d6ec3dfa661e52f8fae037999761fb3d67a6ea7f9a51e5b67c6825e7a789
8d3dc336e1c2f45ad71e615c2a85d15eb57cd7ac2a4a9643e090771f56ab366c
8e75b4c2175d474d91a13636b8ca1392cb4a7fc0909f2d34fd4e3c61c8f9623e
8ff43353647f35d889fc29412c543afc7169ff4002e71e8d7832d7a72e04173d
9367074a6124fbf42b229424235c945b566c1f2bc8619fb22de1c28a91e732e3
941a4ce8b5ac57089055cbdd1e1541ec93f35f5a33b1f72fb22bb1e7b0fe02f3
977695c7f0c1d637dfc418b0f31d0b1a9a67fc418de5f256c7206ba9277c6a6d
9790296d8db20979ad1a841a9f33a7f0b5745d86e1c6e7ce16d2ef1fb633dd96
9fef6b5540ace2dce24b0f8ab03f00fc0b7bb207095f7cea87c71e03b25002aa
a1e251de28a595e96019d1038aa800cf599053c2f8dd8369fe01447549a0a528
a24f8135757db53451d744186e13aeb0f1dc8579981b8729930d33850aef9f05
a28e9304221d8913cd24029dfa79950d5fe70e660b351175ffa05edc30168725
a3c02ef3327aa819a8695901fd16d785037de2c37b9aeef1c026b9bce3b4c5b3
a4e0c0a6164c0e21225d964e64a06ede815cc976d6a7adae51a50b8f452467d8
a515c47dfa04ca882333c17af4e4c491198022568c2092244b2dd4dc2757e973
a5389cfc5d0172ba75559debeb2f47534c2af241981b98a32f169ba38c5bf686
a559a5da85511c762763832ea015df51ebe7c480ae222fd4566f96cd443c5c11
a9701dd70d301ae73f57e75f68e34c2b0da89dffbdee1cfcc79974e89cf23e67
aa6ef73bf0015e75fba0c2d193f994926140a4e44c8db29128e14c48fe0a456e
ae432c7648a66603f6e0f9ee0389bc8d435621bef27bfd64a0a0ca1d89bd3702
af522468167672b6798851bf410c435e7ab106924a43e5dc58471f1a8da39527
b1deaf0e0538f5a84f0da2b0b0d2acbab573bf8b5000fccd5c16a5f4b614f7fb
b29ab6ee65d90334b03d6186faa958cc9edb6f817eaed47081e824537ea81533
b370d6146adb92cbad8edf11f03a04743639db6c00dcb32034816f72233a6378
b602655c1b39b137e3bbaa34a42d2dda0a053db021238590c2fc58682c8fcc9d
bab0bed3be4608ee673b92f0794991f3af8ff1ef2826366ca768bcf7e8e795f7
bdf340cb253710414dd457b96c79b6a6597b8a47708c4d4534489e338ede0536
bfd202139574b97395c6ea1b8fa61710235245fcda05162a141f6a81eb298528
c1d5c9214a5179007f19f788f0e67fcefd65bfdc95eb8facc6a839d647add0f4
c530ab8e437abd3ae0529f7257e51c8c3418fbbeac96d33b2208f91ac8b95115
c72bf04a5055263f57843cd7ef0886b443bd5ddbf9a4ae90a52f621c0b1147e7
c9026ba3fc7c4bae31628815ce6b5675376c2b6f0e26ac03d12064c723f9e581
cb8069e1673495079bed02e515af1c11ca550e5fc37c36ec96aca214521fc99f
cdb22624b29a452b29fd8bbe1e7dbfb7c095d7f177a8b03055114813a6bed0a4
cee90161ba24c06a64b2739ed26a1918ac6042f51c96d333d827cbe1757e178e
d201ec3bad4fb2387627ccea9fd816a9d6d5b7a1c70b55f8a8b7f646c6f47c12
d30ea0e477536b3e325fd2b7153a74dc79b47f210e7e93e761d14b2dcb20d231
d3fa6bff89d3ab17a2dea7c8dd58ee34dcfa103d3b8b45d92d9f04d738dedb3a
d7df2a5c4766635c8e4723fe2605e19854fddfc9f23104066b685a6f863a7ea6
d845483236610e388a0f8d7ba9b234b1096844300a32451a3b644dc9945dd636
da84f2569d9c0734f6eb2455da95278157f332b1d79f21b58d732a39910dba46
e2514fe262d314d7ac0b739b14dcc6863f4821b1bc9b7203429d4bc567e0954b
e3f0db94f884e2097ebde4adb35066ff3ab8308b3857062ac7f58c1f0243c825
e407dd54cfb6fc6aa7b898ec31f4a7ef70908384526f1e005960c82c7875e176
e86b003a09810d979573f274351108ee0522fd7eef30608e564b3667bd840bff
eeec325e518bffe160de7ba0b2ab77459a7b23a45d4bcbc8c6a0e0f17af3f86e
efa58a27f49fd682e6376c7c2ede7ee0d3902e0c27701a8f33b02aa37d1881a7
f619d5e4a62f1b9ffcd8d8a5bf9225270747a27c580b14e2c858a9eb20a9d5a3
f6cd43b7fc23d43bf9b3a5f6d74a05946988c65b3c2ef613a55acd2dc8e2d864
f9729f7a7434219e20d8f426c3a5d2fdb4b006f878e1ad80bb67e36f196e5788
fa15dbf50592d06bca2cacbbc929d2cd01596de644ae134d7d3b5f3ac92e4094
fa230dab8278c741ecb3432f69cc367f86ae2a4577e40643d0c5dfe3f80d1145
fbcc5333cc6c28f19bdfeee60b9c8ed7f8cbdd63d43290c719d4ac675ee551da
fce5b37efb7f137c6299b793481a2a087e062322efc90c4fb6fb69bcaec17dd0
fd06b45aac63290388d5baaa8e0580c53dfe6a5c7ba9cbbec35645e7eb378387
ff006d5131972d2993470a863085ab8fb44569809241cac01160976bafc4c5c6

http://suprcoolsupplies.com/wp-content/63689260/
https://real-deal.net/wp-admin/hb9wsr487/
https://mifreightbd.com/tignjh/pr5g399/
https://glkbio.com/promo/7ul9jr81/
https://lamartinewebradio.top/cgi-bin/sg6/

Epoch 1 Payload URLs From Unknown Document

none

SHA256s for Epoch 1 Payload EXEs

016922b72b25d1f06394d660455067611dfb2868fa55e075f5d7d44d44d2c629
016a523e13153ee24d75afad79f06ed2a30a50c522e66c9020e6c9f85ca98292
039a06114957fea148aae32cfc5e59c3f760dfd6b358c9bb85b0095a0d9d8f83
03a95b99662c8bb916a699a9dae68248d0fb96fc88b7fe8143c6365fc7909077
05e9701fab0c56d4815408d06794e1de5b37416d3bf21792fa041ed6abd397c8
0631d3dfa9c089371c45088c48151fde46a28f20e83cc4c65e07332c2f850a11
06493df6f54a1f7c89ef4eb5b1a9f3d54f742ed47241e390839d076b80740dd2
0766b08a037506e308e53f338f50dd181262b849cfcc7561aa1c412814852a8f
0806cd1da15dbf21c224b85a129b6647b9bdcbeaab934123444fcaa8db863306
093f8078119cb0c9acee45901920cc169cf6d19046ebee06f5a4fd53dd3ee8c5
0af91238304e6ae21933183cad0e1fec114f3133a12c26406895f53d37104c9c
0b73c1a07899e9486729984632731bd046426654d8df54c119f835fb5c9cf1d7
0dc4878840c059e3809c6c469fc068effc5c407e0eba9003a02f1b4fa4d3ee18
0f966a6b629bab40f9fdf1bc45a6fadfb3b1533ffed991761302922b68b53224
102325100b19856184f2c973c2a54e9a06f4dc1b977e09f5e1635c4221336938
1192b258368dd0ad18f66f8172636e4aea9a89721bbe4e3331e9a81516e9dec8
11a73b2ddc2210685a3c0fff39e2b9cc55196e4789287ccd03407d560e3c6406
11cf43163cb17749d7344573008d1236c30f91a34b833efc462b1b91de07bb9d
130683621f7edb8f08a3bcedb0826bf7bc2cf10156d3c0a56661a60179ab41a7
136ea21e100e4add33cee1daf04c86530894ac92e719cb585a2d3e5bf89eeb9d
13e1d12f8729bcc20a5b8c41e2621fd9222fe079e705dae329571e1523f47a12
13e24edf6842e11c83963742fb5eb347e433fcc6abefab0b2277d1587d8c34a5
146224494381ee8f141ae0cba3bd51b397badd7dfc362545641405460f06246b
14ae87c2765e52bd4885dadb3c169124c392acb23dd715fee73cc10361c7b6b6
186bc447e384faad4586046800841b0bc550ff975c489fb3a5d3f2c5494b9b59
190d2a2fca0a7e2fb6e86ac8088b064f45dba2e57593a89dd7c8c36ea707291a
1a08a6f2fa9ee2b2083d34d46c9cd9a7ebb337f485daac010603d62f28b0be3e
1b1fc52a31b407c85d53d6b1ce11f9f6aecbebbffda1c7cef6df85299818164b
1b94064649fc89cccbc5a4d212486ad342eb9bb9ac69bd687a37709cc12642da
1c5700a3783d06b5215b44c730e97148c172e4be353edd3af8944a04becbd9fc
1e678b8af08d88616d2c87628c971f4e0f60d7fa58094a6696537e4c7f06e7fd
1eb5b40b5d140f5c4afed269b930e809f8853d1e09e85c6cf5dd8a222c356678
1f98644b9f672f7571c362188db9dd4d853db5214ef51f0b66cb319a310084db
21e775d16a5beb9b9de028ec82f08422d92893af7b622dc3e3fa0f62dfad2900
24d0dc54021ad6eb451db87b5269a765732775da6d158a0bf2fa74ff51847205
26f30889bfe4be610c7b296d48fff4c72c5b344d8b9913d88addeb324caa0432
2d5a96b95cd95fcca80b1431450b59cc96ef562ce0e37ed4fd64929ce07b37da
2ddb9963e6f04f24f275289377897ccd5739bf3e3525971fab1300a122fb3cdb
3115c4e5ce05b52d72bdfb982f68e2bc2db560f84be0edc125e100f949e0cf0b
32bd2a4d784c1663ac1746d49b13aca39108590f507110021d6db05d200ed04c
34c14eece4b7d3aeab6230bd3594b1bcd2cd537a453116b1a4cb1c403b0b9317
35260eb1d6a6bda0f876a130e905d6a186238e7afa32c007a43488a9216ccd4e
3622bfb922450c42123a20e59a7f9551ef9330c58b862fef16d39d67d84dcd50
368e45d89314163a8341d619f176ca3f07cd3a90ee0891d51d3191a442032c5a
3776f21a194bc3a17befff16d33e166d9d8ec21706b93a853a0f7c87542f4063
3a1de52cbcc59bc0cb8cbb2aa4f21a22b3b254e3f3c10004a777fe943d7718cb
3cf323b4a4fedece47909d1a4a3a6fd238c0fce82d928e60ffaae2bab3ade547
3d95932058ccc78487996ad4f31231b52b39fab321cb76d578cbed742a572cd4
4003701ffc8bb640b08fd70d097de809af24d892d7792ed62ab35419f1b76753
40512e7cf05b1264372810a0f0263772441daf23591d24212e2d47b813e047e1
40e1dc963bc72e985c4b6ee4de57340d3d2a6bd0986466aaa008caddc858d3fa
41f4929af4197c6e949be033d649b220a005d0c48c5b954ab7b705e7ba9ff819
4207c421bda3070f3bb8f06a18bf0bbce91130afd11821819a19a54b6aafcba0
42635e79ef81de75fc70e86bf5449789593422984b65ff59c8aff37bfd3f1475
4291506c760896603dd832aaa722969b7df0c7151977a75cb5d26611fc152cf5
435beaa087b4515841c173fa7c4764dde15d76088b66bf2f0f2e574a7e887422
456ab9da40639ee7a8da48026262d186ef5099aa4e7e67c58a221923714bf97f
45e4569a8a88e74a94b11ec46980002e2ef4ef084ab8749217ce7e037729b00d
4675bd92073f501abfa4b4b7986632d0d8d1cf0cdc0d54e2f2b902476f023417
472669390161834b1ed11727e3b612722adf6ff618ebaeacd5ce75c60dff90fd
478dcb2e1554c38f14634306301ec43661228ca9b9caad05a12719426b76cb57
4a9398166f15fce899d9ad62ebff78193ea39c7ed2d85bc6caacc1b2f7cf8287
4b24aabba8dba4ce10e7c75cc23929e0272edd53e605753ccf0acb1244c6c477
4b9d005cd8b44809b1beaaeb57232033533af55f642e4fea919cb14af384b37b
4bc0351ba62543e0fe2d320607b7ac16eb255a7ba4c33fac0da49f83d439841d
4bf19a5db6f148dba432a9f24d7f53580abe2afd4f824fea38a8ffcaa278a928
4da0796c4f0af387693da5a4ab93bf82b16d2145997bccc97742517af19fae63
4ea69255b7308f6920faa9a1fc7d57253c424a3047e1ef1848ec6c47712ec74f
51cde5dbbf8ca051fb24ed193e8b26e74c19a0a992437a8420481b2d9b63d854
527d52a33f4b301d6b232cb7c7e440b527f8b3b4acf601b8a32d9d879eafb791
54d9dd3a0c6a360a0258e67cbc5d79c4eb7db352e5707a91d0ba606d99290479
54e3295c153629664d4e4435511cf6c14a49829ed42f61ad6c092aaf393c62fc
5681a0f4ffb0463c3f6aabaf2542ee0f774c3d52d49be31a1d28773178e18beb
56a4580edf6584a0c517a5d98e2318147e01e250ce5a2a68dbfba901bdc29e9b
57205402600c2afb081a579f625edb0e3d07da97cb2e4348189c69167aa7e8e2
57a79f8329752f02bede700555335257e10bc524a937c23b737d73d64e8b044a
5831ef6b48db8faaf4f28e21f710286a098a8fcaa2731261a9d32c810d3e1899
5b6aebe7fb86809a77bffbce3f885a1c5f878a2763d545dd53162aa00f3cc9cc
5c04e645673f95508cfc8dffac77efcf0a9116d458cb354105400fd3566cd2fe
5ce38e375f4d22a89b59829fe13aedb2a644aa868f757fc4062dbd9dbdf7ffb6
5d241a7ae993709c3e97d5a6984ce499db775080c1f1f2a4cca1c6fe65767396
5d4257091e2526ce7f1a037e36fd37fdc3c85087547779d0c1a693e58acac6d3
5f29c0d1a1385c0e497ba896f463cc2ad3f21b4ae2cab1b534830e30be76cb11
600345bb2bfa30957e3ed0bac0ddfdd955ae94ec85c06ae018da0e41196e08c5
6099d9543b1a2323a28870e715001dc3947f2f73932e596c7589ecea034b5709
62f6a2e49d3cd71b0ae23c1b0315ea55d1757a8f8ca668a6bb3db7de642d0b20
6321808024383264e45fe9f87209cea97fadbef47594f559450ed04de8fd31ef
645a6ddc2fe58a02f9ec052776fad5abd5bd6fea748fa661b983fc181e77934a
64a48b71f953e0df663c03d91445247163091f03a416efb996566ac859122160
64af7e0656d04f2eb950c5633375130be760649e670c39da723e5e4a44813b90
66b4ca63a9ae8f549a7ef410dec63a5e4235a2596a351f0cedbbed30708bd98d
67405367414736e7e16ec01d1f9f91a597e2ee1b11a50238e41bbba12e40829b
67e47ad96f9e22ff889a2a2e5cdd926addf086502462a04e8ad8b8af26c1a960
688a2bcec28cd31d24bcaf4ef5cb39d19d21219d5b6a07c3f92188b648e5cb04
691ac6c8a18db9f4ee92e583254e6c9a7c4c63b24cf3470a141938edb07dd430
695d88ae2e22c418c546eed1dcc9f02662cfb70bf5a420ff66c2850828baea3e
6a7e81ba9c74b1085b7eeeae884cfb46d964bac42cd7e214dd80a50af30d6d66
6b63471562f42be4d4b613580a989574c6f11fd3f3f7b0150f57936e6789801d
6d66f09a12b5ad11488927d0f431c21429ebf475d6f1207983ff3cd14aaeca06
6d8c4a80ce2f48089bb73d54ab84b033120d6b453ebb58a6d8c45a0514c4c4e3
6d8cb2a74504c563f470cb0c791e4364994768868c8c04f26f5f2afe50f5d1fe
6ed706e46d1ee78efc557b4b268aa0e4c3693914c01218bd444bcc2086686374
6f23a7caa3a3e0b0dfeea4809ec85ec838d705e40ead7dee5c7335304f1d1416
6fa00d7d16f2d10c87d80b9d7b19be8fe733fc3f00b545ab6398876330828b39
70e311ae11ae4ca06f5b6b6bb78dc5444e12ca5d0e1d284d8a2ce6ab9846cc76
71f8f7fc56b3af8e0e655a4accc817b4fc365442d19bfdb3b276846a1ab6a3f6
729868288fd28f49a96481dd2d4eaeaebd49f69e5254c95e24280fadaf8c0083
749a9d7b4e44375de493dbf366ade33581919fd912290c2b9cee8b57d32897df
7528080fcda0bffafa2c28cfbf3b7f5f1ab54249e295b6e032d55f720fae4a7f
762932a08765a2517e84f3fdc472f2ad6837f04f9c1e0804c9a87a83c4801c16
767bbcec119ab23be93e18af42c3653e269ae39a1707caa68150dad6163f632d
783f6d69b97bbf410e15ac9cd94a03fb808b120f910e5af3b002db45c148a987
786d1986e436ed67ffc39ebc0ad903a3066ac257f0b059ae83b6781e7da4f697
7a3af3983e55fa5909beab3b1c88dcaefd1f42b452e9c946f93b6dc45dcc1e57
7b09bb842e9c3ed36f3dcef44a4ed374f000eee824d0c9c1df9aa75eb6015436
7bb87da48c83c4a42f8348e3e601dadda9eacd42c67aed6a843cc694f2e06280
7bcd034f6d45f8c8493c5032523cb2fac0ef985e7e2869860c6d5d39e6d84e6f
7c14f10d1381d5b7e99f583ed6c31274081ed565bfd7a234d2f021d891a0a036
7e89162fa5a39e648020e96ba7387908fd5f1b4af949b7d21d2c8fa2b6cfcdb3
802bc0774755f11fbef1d646556052c44d51d8918f9cd66446c6f27830aa840a
857ad7bc28f223cd583f38986522e95f932b4ebd338a8e04793a8dcd4b7bd5ae
873e61656c278c6749158e680dab99a9c17ebfaef1f98cc10d188138ee46ffb6
89f430b3d270bd8f5cc6ba1a557e71a4463f132bcfc22b28503348b71d3e5cfa
8d5f60bbc7f32e9ba85caf406cdfd7f0d6658fc6d1620b72c43f10de74879805
8e17d91bcb91407b0fed637e2b7ab2de7beb88d000ca3865d2b0c2cd92241754
8e4a84ea79d3f5d778be3ce1538ae0c0d89ccf4a8442c8cee464721a1f0ed49b
90b1b063519d41e6750f21b7cf6fae8105534dc73040281f44427d78c7aed0f5
914438fb7cf629e8de18c8aa3ded5e21b7308e984fc4ee11816786c5450f744a
916cc89546bef26ac10738a8473f9fe41b54ef4d827645840d5e944594d09bec
923b95c5536df3bff10454c2c10c77c60f197515d4b2a12623e15d77af75e28a
94df1ea851d7a8b529fe88093bb6827535ec7b87132a801122cb9015de91de18
95597178a5931aebf57bb13527245e27f759c11655c6f9d5b0e7ba9e8ce75130
9581ae95304e50728168d7ace279b8276594e54fb8d8d13a44d04f40d8e3618b
95889b3ee79b68ae395a7cf63d2fa5d30fd8546c57afcdd371964d561be60d37
969ffab8e0606021b540c7b14037008511532ca430efaae675ddc6dfbeed4e88
96e7c3e73443f6ac891d8197782e4e0769cff02963c70f444b228dedf646ada9
9a857487aae1d9fb55d1edcb6befc95dd7a0f3fe5aad7e57b5c2f26ff732aac0
9aa7243ac728ddf9cd3a7fd661ae00651d04121898b41952db39c46676752320
9b6a0ada0ba5a1551ecf31c66171f8dabae223909231d4131f55712c61b6d064
9b725b6a737c1e0a1bc6b7b2ce7215743d79eeb3e2dc37b0305818eaa863a63b
9ed93b603e6747090298fa32c32ea543371f5482ae3af815c503444820af4c13
9eedf0447e5e8f45401fb61a77be3f14a88ea63a99796db18be79afdc3eda536
9f0b3741a78e91799da618aba85c5259701692a2388883214174c62f2ee985a3
9f72f3096dbf1d96f1331e854a66433195f187c1026c69bc7f30f13e7e2b5314
9ffbb1c7d832d72ca5904eaf9d467e5a84a4d30bbb0f89f0cd759d9f0452ecfc
a12b5f73cd61bd5c8f7075bf0b8817127c435db215c06dbf5cd436e321a0d5f7
a1eda8faccaa377dd58026fd4197840b833a721e17a40af6ed61a74ae4694aa9
a3819902468bdce605190b0e19b92700b86a0ab066a8cc0bcce291f7e9099200
a63a9609cfc65a8e301ac3bb9cddcc1850fb014bc95540100385c6babf6a3c2b
a7ff976077dd6e0085a5b4f8c4785a61e4738e84b92a528fb4d589f8d093d2de
a816883c02b688b0da5417d4d72bc1c254f601640b41c584db07d97bd7624518
a8aa83e8b09c52afb3834e9717b61448f93a4e17328ef6819ea8f10a76f84198
a9933876bbf48e20d6ee359022696c35f142b9d8d8fa1b9559d76956995bcda2
aa1ee47e386d3f660cfd9aa1d58fb63ac531932d1d2f281e876209ba13bf21fa
aba328ffd158ac90ed0365d1174cba0fd0d960e509bfc5fa69943ab10df98939
abcdacc93f1cafdff51d88a5037710d99bad94010cbdc5f426eef057a88947bb
ad0931fcb37674e8c2d419c29d847a13ae9f9945f2a4391282743ab1b4b13afe
ae3658c60f059906920b7a52f42e3c4b550b53415b8b615a8ce01f97be67cebd
ae90356a6a258d56450acd67f4cc20afe851c04f1c2a7fe94f0bd59704dcf1df
af222ed5429c7daed715138cb9a282341b92d5f326326155c727f4c63953d142
afffa3cb44cac8bd10c9a48b6645031a0ec63d38edd938355cf616b23a97aa49
b0773d47e52d9c37366bdb9b2f6c16bf0e8b6febd5089122e9e88a77616f30bc
b1e5fb32daecbc084a249c94e87c3f6eeaaa3773527a4ddb9092d14e34e511e1
b227e3f8a9ef8dfa8d6cf7561e408cbbb72d0103100e68cced17616e8a86e879
b23e05da278be6ec20d25d80159a7e830e1eee0a84540dff5f049cbd94aebc4f
b2a726a868dc768930e9506e7d0c0bd30ec2aeb6c456d6cd1337a00b73fc01e2
b3b801b9ce71e40642075df810b58285f9d77b7dd5aebbc1f73a0255a2ed4921
b3bf508449b72e6b8b7a8fc47e2529d6fbc16519c307be04755195306bcb2d31
b5cd623cc691ae3560bceff273266f81dd7bb152439076483ab89c19eb2191a1
b5fbce9c7db714a57da9c4cde8a257667ff29cb9d341f676c91324e75a6151f0
b60ee80ac67751f013def23e09cac46b1c079d05f51d1064d56299d68bd5add0
b7282c0ecc410a0afad27f760f554d3bca157429490db69b306927cbce1e2537
b74f3034c355e3af7986402ca36dbd71d441b08d35002286a50055118ff27195
b92e405429394cc2f22bdd3122e6d5082ddb05478bda75562eb65bf46d4da20b
b937d0ff95d15260dfdd0684629324357dc821667f95e23b7be4bd8defb8e14f
ba46ca6474b46f92e4b7dd733db4c7587d8f0674a5f16627b2852a57f8120a4e
bb4f9f588b65725ffa40cc426aa3e5b10d12b2379522164e1db3b63a9fdc7c85
bb8a48ff9a4668874280cf47f6fdd28bf2d1858a5d963d005cf36f4325636dc0
bdde6567502c06833359338cfe213bbdc44c89c94410f91897af93d1f275bfb4
be21bddadfea1c450279a6d28faa612867e642d50d4027fd6770f68e1122a958
be6b6fd0cd0ef589b8a3b84b915af6a77492eaaca31f8bff8d109b1e9035202c
bedece4a482bbfbd97e3af309cd3632b551850dd46ae6cf3d000c91e1fa9425e
c056b04ccf2c4469dcbcde339e5d2bc90de77d25410af9ae3118be62de2ee0ad
c10f43916196f2855717a65ac035e91c4029f997a1385a5a5b525f58da543fdc
c19186503deccbddf5fe13690e873a03ba346ec1fd7d594f3ba43c3560528de8
c2908779bb07ccb53c8aebb3784cdca55996b77606572a3213f5b1f10b044da3
c4bf9694a46f8b53ac3ea108353276a15ce6c06f17766bda0d0469ec8d1c654c
c50660703c1421e3c48cdb52d80d77d0b389cab74e841114846f5ab1d491747f
c57bedb768c73f39766ce9ee52faf80c232a124149fe5706015e2ac07da8e85f
c94d74de0aeabb7f4424e3e772177dd844335a0a01f23d54f3196e09df827c1e
c9571489fac54c7bca3377e8ef623119b1f24f768aa5aba3deb1d453655833bf
caba8bb82d60fb2899a82a0622d224085fd3ed65d8bcf25251540616f41406a9
cbfbb0733f130ef26835900b704b6aa86e79c9352f0fb7287752b4b4e5fe89f8
cc30da5b8c8fb58e19fc8dd82f37047a4835e539cb37f75def31f0de60e705b6
cd37cd49bd0334ff42a390bb7c589f39c3c79c1aac0533cceb4caf1ea401bacf
cd3e8ea12be66bdc90ec4f5fd04ba4d4ad870a5a36651979c6aaa58d18b1f753
cd68322eb56583bc492c207475eec3eb4346081f3752c5f86786976a4cb1409e
cf31f6aaca657a511bdec7e3e3d24d996ba21d882913baeb3c088bdfc72a720f
d036389d237438f6d5268ce5cfb17c6058ac472746bfd9e05244317dce00fc32
d1f886567dc83ba6030a8fb301ec6d15bdd258a34babf6f9255bd62b81a71ee8
d21c9b394334a161e78f462b945ad4dc8f569236a1ce57d9b90147f5f2cd82e1
d245c8d2631baf8f2aedfa79c269787b6514b9e632bb401e972bbb002eafe6e9
d461a4b081cafa1a6544e494f6b9e356b51ec6543bd6fb8832f284bddfb8359a
d4ad923986f283cff61a262c59ef19efdc8d59f575249767668b9259b1686e52
d54f9c59622b830409d05c4c55d9c8accf703e53a90e80d1d6535aa0690ad762
d86f07403d296b788f4d79e08ceab309d33d8f32264cb03e09623dfb0d3f4de7
dc022190d5186cd498d37e315218ce7c137252452653a5ea5ece65b99de553f2
dc72190d3de73e68da0fe44a8330bbc4cb0a2949254b411d6aa9c55ab2bb06e8
dc7ed1c3ecca22f0a337030383364c8eb63b820135ac8f00a0a484deb0535eac
e1970e2d14a9e129e880e1095aec4d4a4052efb15be3386dedd82eaf4fba1f77
e21fb88ba5a6f7ff5dd6837af423f1dc21537bffaf2781beef9f3269a8b90e50
e4138648090db291189337d5e508ed7e557f73985b3deb8a15efb9572cd5981e
e4bdb4628c806905fc78e4d1bbabac408fa762f5cee7d1c838f98b7ce243f3b8
e77f0bbada5be89fbc6ffe6b2a5c0ae34eece0b48dad98e789ceee04837a282d
e7ab7f64fc0a5fd949d8f046e899dde5c98aacf159fb621603d483e447095b91
e83642eb37ace104fceb34ffb4047ccd0bec739f881defb6c758777fd00ae33d
e8a8e0e8ebf2df8d6d880d6d4f32855f0e93dcace693ec1e85cbf543828f03be
e8fbbda4121c91452c43a022a487ed96aeb4efdff68734e7c64098706508f1cf
e9b9c553a133d64fd3c7be695c493cb510da2b6ae463e12f3622211f3453eb47
eb5d81b1dd954370d39285afdb272f579be7b8af3a84e8e053fc600fe96c6482
eb996575ccf93bb14665ef772d977bca8d5b1236c8a17b034f7eba4b782c6933
ec92736696e308b28cce286a78741b69027cbd87ed382a75611f5eceb1b70a39
edfcc6a5ee9c630e7132038c058b8bb38d4401d91327d77f1b1aef3e5133aca6
eece1271dd1b563e13bb5c576a0720b64559301c1d894523f43a2e807ce7a704
ef52bb6911587d9e49f2f7d4e677b6208eb7e75f2bed43b19df17a0c6a93177e
f30bcd010f61307ffb557bfebd7e1204f2b95c52ed563b4ea6066189c68678a3
f46dac362804706069ff484b2612e98c4fc91b0c0b79faead0a0fa7ce59a8ede
f56d82fcbba1b857cbe018406c18c047e5064d5f626f6515f3527b4dea7dfe19
f58d036a2f2ff31ca6a1765725330ba2ab32fd1e660222963a7c0789d0109153
f6e4afaf791df64fb6ee8c57d2292eae405d8afd14f03891e677b08dc9f654b6
f7d5f3ff4478c5d8dcb66bdd9538043f12c41381e9bca613b725652adfe08987
f80d161d630842ff241d36ee8f3ba0575fb67ff79a40b2bb83ec58f528a74116
f99df46f751aeb56d1ae4f2e328c5ee5af6c4f8847e33af09505b2ce9486966a
fa5ede02c400a453738ed5869cc6925e3df913ac519277e2fe78de2218691914
fa786c3d5b03bc2244c732cc344aea0c3682e0125a1e3502c7e2dd5c3bc960d1
faa80985f021b2bb7b406a3dbd114187764f6a704dbe23b9fa387cbefc3d58ec
fb9365a72e4df4d24110a9f8a67a861a529f379b4873cc26e249a267eaa25b89
fbf8f74adcee0d518ce3318d5f7ba90ea7245da370301150c5b3a65016c8daaf
fdcf579e447f9e458dd9f1c7804d2cad11265c427eb3d6cef0562138ef124acd
fe93a19d9d2bc319778a80d866a7710d04957a19898350649be9c6a7b67703a5
ff4336368e9d88e580855a6da4ca6a59e49753ca6e8bd0613dfdfb7ba1242cd2
ff7f591471316dd6bead27ce2974a7be61a3362727d14fd2cecc86e20eb26ff5
ffaf42f87c2c1429f984e6505983c7b3c1705b4b8fc1b8f9083a40ad1ece60b8

Epoch 2 Payloads by Document SHA256 - All Times UTC

Creation Time	2019:11:12 23:34:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
07195cbc2a656536d4b26a241302b20daecd965c4207ca36f63cf7aef161aff8
144b872a3357f8dcbae85f3e9693e6d56360380d01307b21b4c267de13b7a17d
1467543719fd8424749dcf83faf83fdea1bd04aa46d6d6af84dfe392f25adee0
20c8037545697118d09c4498060ed03b0f2802de67c9c0095c8ca7e20f09a530
24e78b50a84eebdcb5956ac5f1360a72c32c355a18921fa522751a34c645581b
34c56b6a6873a9cc1b473710fee23e1a81de9193022292f50ded535e55e8cc23
35967f37f31b7d46c8c4b0973949aba676422219ba48fefdc5a61115269b32e2
4bd11d5c2cfae87db300f66d141fe39ebae6800b844b525a9b39b0f226e2242f
45d0a99fbefb6cda419f87e367ed1dd145ce8db0b2fc67eb422e661df6eecdd8
4969d7e23571b1b781adbe76ad1223336c4e5091cf35803ae320eddaab3bb92e
550affb00f04052bc709fc802d20abda0295df11a4eaf1006a15ef54eeac24aa
577312ff40ffb3a5defdff5d5857f193555a3b2656708e1106a94e1c926acb3e
6208be73294eb3254483b4f3348110ca7dac58a71238b19c2ea9b1122b54da91
66530ee0a2d86b9e647641a1238cbd01e3f30d2c5909919a400ee50ad6a0953f
7340bf5b906821c0415e02bdbdb4a97a2d69ade0919b066429ac5022e99f835c
8fd8b09b7efe0e4f213f7e4034e446ed5d8b27aa1909379c32f006366bb8131d
939a1170a8d094000ece3691d0366a73abf553c3600681203e3725fd33bab9dd
952def73e32188d9463e23f2e74b69eb543a03820c2b49394905932e3bfeea70
a16bd5df18476df602607d9e17b2869d5bd0277c4070c35252fbcc5be84b245d
a4397002062ae74b949094323b80c03ac42e74432bb5fbaf4a2261531c6fdfa6
b6003ba4e9e68ee08c784ccf042d2db5dca734aa11638cd04722049ee4dcdff9
c9a02852d3c8278d99a9680da27330429b49194c506d70adc833c4ef2b97b1c6
d2907aa4b814fc0c269b2e8464d15f12593f43e7bd754c5710d7bb9bf7afbc3a
d77c9f735843207c7caf7f1ca6f629de1aece5fd4efe1de2dd5a4d0f8cf9d6c6
e739010e8780333a0a380df1a8d7624e17c7da5b81c401505d3998abf33dd52d
e852cea4b7568f4db3cd87dd6701d9f632e12b6681921d11eb7dbb1ecf280548
fa005f62b3b2c639ebd5171401bd41820bf49d15750a074beafd67d24f6d254a

http://ngaustore.com/wp-content/jgp5/
https://aimbiscuits.com/wp-includes/w/
https://shaggypup.com/nzg5c3/hg6/
https://vrslighting.com/wp-includes/tR8CGju3/
http://drinkgusto.sg/wp-content/8gc69/

Creation Time	2019:11:12 21:49:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
00775f349cbc982f05d829721773a8cf9a530f8613ed7b5b80a8ef4e8bf8f07e
08d5be32cc7e04ffade4d48ff322f9e0529fd0301a8b180ac42dc0b7b8150c36
0d234c02d6023d93c201c5f5ca93e76ebba111cf4cdb7d0c829e3eefc26b98e7
1581a2884bb8b4ed37820711fd240f97dcab85f92400590e90f0f74e0236421b
376785357e910c3385543e1e88132bc163f5572769f4e614a2389e61ac48d6fd
43f823f56b457417928dac12ec72ad68a2f76d003ad988d8ce0a94d4405d989d
46a0c6629729bd5be2e5a480ed8204d12f6ee8fa7f93bee74ac4c66e76d6b94f
495ffc150dfe5d18a1099743ce5f922ee6f39d5e51ae1896544469b0a230ca40
49e0ceca2af7495069d67bf094ccc09fe91f5041261d1b860724b25af3ee71f8
4b5c35083cbc796586dc14168d2a6c781ad8db2a303234583eb3d137b00e75dc
65a8a4e9f99562d20533a231e403e3e084961d4e11e787bdd845014f9b677e50
71abbbd8433414ac6164b24ca5fedef756ac4520fb952a23ccfa59ebb7e162c4
82d740bf7cbdae1aaa9a932dae3f6294f964eae6954cddb98a75b5300955be4f
8fcc8ee1b954ea0086e6f26b2ce7220d1706bc37e02b4f733ad01b42d77ead85
a924e213f8bde7b812439ae7899a58d79693f6cc918623c0a8cc9d09dee68e2f
aa048c76a88e166a6540e51e1d30f8e09d6b8646ba674829ba607d2b34a5704b
aefdc0368e468ce869d3c18a926806c9d35c5d29a95df75a632c2a3e06bf4886
c16ee6220c66b4308b2476d7d17a1821d4ae76b246fb2c0bff2042791190ac0d
dd61e067b2a852eed1942bb45dcb928246036a5b80c0acdea843f2921f9f69c2
de38b7d80786cc7729ae41bc11709e9bdc727825e204c2328d4a12d20827159b
ee8f7461e98aa1721681e7ed7f2dc7a27d3a6da31474fc2aca628a8e5f083fee

https://bomfinanceiro.com/wp-admin/z/
http://eraone.xyz/css/2cpz/
http://kikastudio.pl/wp-includes/Requests/1ltq/
http://amaziris.com/wp-content/uploads/8vlx/
http://ferramentariamorais.com.br/wp-includes/n0J/

Creation Time	2019:11:12 17:31:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
00bf3784f0b1c2a97f6f5f7249e17e9be13939850d9321c400cfee3ae423eeb7
052850a78008d69d36e4acdecc2e8fe5da95e2f68a7ea413afaa445d4fbef95f
0666107834ed65dd3a75ffffd4542e4a620742517616e487399823c8cbda7ee4
0eaca00e28ec3ef3bae42fb0009b32bae11bdd0a132175ddfeb4286ba9056d6a
0eef54946285bbee45eef76d45d59b2353b14fed8af705ddf96851c5106c54ac
11688466f9a2c579f8aab075fb17efdc84dfd0c989bf75e4534e07ab7568c893
1da1533903f3437162ebaac2057752c87453d472766b2f0bcf9484f8df720a9a
241f6baa0fca1ccffb01b654dca44ea4af6d0c567202f8f4a848522df88292c9
26a85303f316af84ff099b874e08a6274b2e3d728c0487c94f168f3f42d16f0a
28098909db069819fcc1183487bcebd79ec42f0eeb7b387f967bb1d3b6245948
31d7a2d35b205e78d62b050ed110f853fd6a9dec095b0d3ccceda530ec0b7f6f
32270e6e1adea87ac5c8b1218358297c074d0b7373a6f5e24f277b96a1deca16
3285479c06c2988ef815aca79262521777b9caec4f2368f08dafc784deb7c665
33fd5adff21c98e806667e2fe9fd531038dc5db3c2424bf071e0081b0f6d9443
356aea541eac742b2202d011aef0c9b5b5dca9c2d75af3460203d0a9bc268b76
39710bd1464f52c6f240237cf1a8c31374a7458da516860348a6898381ecd057
3bae3e98ab797b95f873468c247fc2897bb9511c529c61d2b97885b87f4fb325
3eb47081bcb4180a5d2c8fa2efcd708faac2ac6e1c88df4925eefe3d06fab6aa
3f9768310277fb8bcc27ab2029ef2c8ac39f6b00e8f48fe8ea076708a7bbd70a
46fb21a86df93b7e9a19bb4a1885021c79ed840d5ffc91971d16a14404d1c4bb
49379d5a96298263656a2e5db40e0ce6d237b020c990a4f5437a66dd1f958e77
4a66abb0b767b78a362c37afd9494d83e87314dc4cbd5fab357692c352bd802c
4aef2f01b19150a57bd8dffbd5fd2e48071798bea4d2ea4f0b7ca21af036e228
4fb66ccc435e40815b5b44b4c1674cc3f0107c4486a015be339068e492d6b9e3
4fbb09aec2bc5e94580ab192b6c63117e48d0b9d86a47287cdcf5d06f45f6357
519d840d259f9d71245836a4911c9a98ba39e6078fb9fcb9c35a676532571b27
530c476216b9b8646ed0b337ba3e09794c9745ac61798ef28e7a161c21e35a58
56994969fe85e28b5d9d9a8d0b3cf20f0fb29c408361cb1fa606d5b9ff7ab758
5738753105bf628fbda131837d17b0a5d28e46488c76bbc8bbb7fc7c53aa7e2d
5773d3ab30a4574fc469506f4e1a692397650542facf1498242c08c3459f0a7f
597032c3c19754d7b11229ca05653a134c70cfda43baebef2dcd55d9fd75c39e
5ead87ef017db9613785142f488566841c613dd12a613371761681a421d47d61
6201808fecf857bdb9f4fa7abab8c301219407983c099c60d885b208576888f1
65a54141d1898f36ebf767f730156a94a1d983567d4bc430523be5ee6bcc6ea3
66b351be50ce8709f6fd123aabe2a0f6afe2788e78e43b08f245d7c19d2164d1
6848a9c37f3a27a9ddbea515fd288546a1151ccc354f559032925026a812fd69
69229faa0ca3ca0e707b8f3a73b8d99ffae99313b18715125c4c3623ded8d314
6a555e1127050eab53ec3091772ff9e15d66d4447a425c263f9e7dea32924fce
6fd6a832759661a8a2493de73a6fc0cd8d960ad574f9fd5599fb8356f86f2aba
72f0e4ec90a96eebe0a22350d8af7537b44b1208b36e25669fd67be274c715b3
7330c396d872bf64ca5cc0470cef669ce0881e06682113c57de6cfa3194d5b21
73409ee300e6b34fae435f1bbbfb50f0d92f4049a81bce59f468463c85cc88b8
7511770cacadc00183368c4090ac97d69ba374fec167e3f2d3dcef3e0ac5c8b1
7675e468dd51d0c50322c6bca8be9c0d789d31cee89c09b89bbd53c968de2607
7b2353bea8430bf76259ae1e02458c62e996cff110bf14a91ffaeec74f3a5307
7ee47113d5784b1dd753edb5815237ac64249faeb594b863deb8fa87cf17db91
8996bfbc93b63458485b5cc0405c34cd4de05464442a0c5e89717f7e5688cd99
8d09d7dfae981c4d78545402d7e25c253223eae5f3bc809704335a9c9cb9877f
8e4053a12fb1ead9228f17f60d1848a4bb16fc65a250b427254545dee4fb4206
94d03b1cdd4981cd6d740700528f19874eab51a7278209ec64f644395aa14935
9859c7929f05afc6c080b5da000992b6546c1bfb96d84e6ff46be8510c707e96
9d2c062c9827e4708a89612f367593ef23a278adbdc7377785d0d68d189d9a82
a0a352c4f47efacfe7b62493db57c2935558d67d82a938700bdaa8e9e824ae4f
a110a667047eacbc970e08b5f75324a2ccdb40f32ee7e721987c0c190c3eae70
a5c31ecda974927b7e20b03e12703ee4dc6cf93f8e74f1b30c09ec46a8a98ae4
a5f91c39b08bef466a1367b675bb5b2a6317debe4007d1505b31860ebe22fbd0
ac3d048faa58a995bf1733c04b8ad39c2d8d92eeec4484d8224c660824382042
ac8470ef42d1a1f12f2fa6b559407e588f890bc2469decb0644e58c3930e99d7
acdb7222f5c530ba14be1fd3bf773e84a9a265e1476d868787be48b93689624e
af0c5bd298baa240f5954bfc21ea2306dc024fc557746d5095f3992610fd4002
b95fa16036efd46a9bd9b23bc65faeedbc233e1d43783b03a0b937646c983e09
b9c8734f477bcaf7dee642cf06125d79bfc53bff0c4db87c03cc4ac7cef8e95b
ba892dca264f036bfbeeb36d68a679a7a7daddbfc4e0dcaf632ab681f3d8c186
bea928feebe1c1ee62ee4d360586370964cc5281ef314800c7086e5c01729a0d
c2601f017cd8317d545e4bfb022ebef1f8c0cc3c7cf64c080a7dff42bcdadf5b
c7a8c8d8655280387093eed0605ee277786451f2b3ca198f8509ade290a7ee0a
c8dfbe87381ab6067ed9aaf9eab7dcb25067c41fee8fe5b2567908f9bf650933
c9c9f75bbdacbe0a052ac2f250363376a8bd16744c9903be116e5eb65f1d0616
ca862baa37e76987926cd293c5c715a835b03a01d5510539036317e60baf8c01
cca86a7f34374a084d3b80f26621e0cfa3a1c89c39015671dea17777d42b3107
d38a5ffac28a2135068cea21e03d9f4b6e7ecaf114ed3b36232aa465232f3596
d6db09cb796589f85a06d82d60008b3d7b9f4e53e62b1f93755347c89495e844
d7667e1901fd08cb578b39a666c5cafa1dc42f9265db52d3b80ae630b591f397
d8d2e6bdc8658beab00227b288e90399eb05a8da585defea890bf1cba99a810f
defbf9443cf052fd4741376631a461fd5b406c139203bae582054f7e3a509ce3
e11269d3f4a7f2985926d7e9d59bff05b8a79282c36d1e2071c530f05f358cb9
e1964fdf0bfc80d234e655fba90d6e2bf8bd074a572bc260e928494e6ab6babf
e1b1faf9b89b2b3da832d36bb2431eddacfcab515d3f2b3b991bbd30c6c14e98
e3e607601ddadcd413b12dd502184f64b31281737c16987fdaf37af8d1124c4b
e82134dbc4a954bb131561593854ba5a5aa0de5b7f053e99a81972d959e76307
e9bd54f14a389acd0b71dd61d4c655292011af06e73ba2adcf02568ccaee74a5
eaf825810f50e17020eba7a3565e96e0eef83d0e129ab15261bc78ec2f69278c
f12a6e92e65cfc8b91e14b6a7b3da5d6a79dff660d298a2d70e4d447b358c021
f491932d06a05d3d5f24a5368bd4ef16cbb2afa4b7061a0571c444cc0a3489f9
fe46a939d3c9a9a141a7aed5312ff5138446cf1450a12d3ae72c55b9ceba444b

http://knoksystem.com/wp-content/uploads/v1q/
http://wordpress.cointopay.com/jvlzs/j1/
http://caplem.com/mkbbl/krz50/
https://portal.brumadinho.mg.gov.br/cgi-bin/sjm/
https://unique-visa.com/wp-admin/mdiYHRBKO/

Creation Time	2019:11:12 14:07:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
00de5f6b2402c518a40f49e8c3546a16cfa4c773932ba6d1d9229dd61de2c367
046b10bf086e28a484181c9dba1f76dc702d3cb3a3267a2c87f9fcbffe492e01
0a1a35694e6987ea8566f61f960acd85ce93401f603df1c0ef36eda05bfd1ea7
0a9927ba5a3249a2dc1f7adb536aebdcf4edc7eb4528b7b4a64436b52b341a17
1509d6437e1d9155cbb675ac7fc4b890d2525756a4af71b4cfb2fe7f625aabae
1863fbee0c5123ff8f0630dbad214ca2cdfc26bc5a0153ee30f494864c6789f3
19e4b08ccf6e7f4f7dc873e144a226253e2d800f6abfa8945bad848983320ee8
1cfeefe9ad8da9c4f9be088f739cc866ceabf102e6ff71740150e09150bdc2c2
274a466c59ecd0d193068232b6ef3b56412e1362e91d0f0f8a8936fe9ed6ce27
295ffc1bfd522efe418c5731b17b35bfca5d60ab58e8e4d49ad07090bcca8d83
2d8df9926dbf868f5a54ce5dcc11a0db952939d6f19a11813872fbcf947f4796
2ffa0612ee11f9d9d94493ed6a8a0bc382c88920323ae2d3b48630993669c20d
37fdb2b48ad1165959d0d1477ae20ece97fba90b1d42215445a7b9fe5f73dae2
3dcc33b7125b05f455bce528080d6f6d09bf59899adf15f48feb33c9cc921d85
4163ca7bf9502f0d68fd340a08b3e520b037011ab602ab013d78ce9bc2bdca0a
465d255174a5ada850a6b06863543219acb88354e61ef6a62672786be4f02106
4d64a71a136a242e682b55a62e6e67288dee21f64ad608c0172b8ee5a655acfe
53abeefe6302c22bad941d2c2ec881016ec91cae5f010db08d053ae0bfd04180
59c60fdc2452400a3fd4ad891bd0dec736cefe9c1e832eb9fa023afdd48f9a96
60086d9e844d9a389a36f7d8ebcf3ab7b422b7f7b298d5282052cb9c760caa73
66de804f46b229128859f1b2d834c5347b7e356c567c321c8cfbb2c9edc4caa9
7619f1a35da9fa938f0e9e0a1f46f2850c9a0e161b2638625efb6c11cb47da7e
7a96f0274199f5e6b2658be4598e3b03ee4c4377de8a6fcd8642f7c7da8a4ce3
866d11822102777d14d20c63bba3049e06eb6f5dc894fa791d2d421a4619e98d
87919c64bfb9cb5025e13bc90d8a70d3be56bb3f4005e1fcdbad6ee7d53d5be0
8a7ed04c091f619004b0385b4b4c724e3b13a645ddd8c9c498dcac2ca21ae04a
92ae1a1abefcb84967dfb5c2a45a552143e1dd28236530d4e43bda2afe7c81fe
93ea51b21e77cd91aa2a0edbd203a00b7462425e9713f7dada1bc5998c43038f
99aac7fa65025f48cd10d8905304187afd65af36ba3e83bd74e7f3f63dce1f17
9b4c27501afb713097f6c16bf9b9f4c8a40f890677045dbbbb911fd8e87856a6
9e6a188b359e8795eee1c0b7dc6dadb5811f8805efd7e16d65780fba0936d6a4
a203430ca7a442cf41b64083d3e94e2a18960e462aedb4b568e977e4376ff19d
ac8fd857561fc074c3870f0a4b013b7ee5e85f230ba7e5f4167380b166ce0954
adbd6251aa4aceff5b6f18147011e3b4ff9720022f8acd1812d927cef90001f6
ae931c2c9626de2f919fa1a24849a26d9726c5ad6b0bfd581347913236306b71
bb90741db7c98e7e9b58a87d41b131411f679a5fa76f3e66bd27d26c87b0be1e
c1dcd39fc0028ee7d7cebe827f85acd2e957ccaa123d6c62c9495fc809d1159d
d9b6400c59b9d50fae627015e7a23fc87ca2a649a3f0122cb4528f9a2c2db7f9
de8607256fbead10489f2e85ef3e1b947bdbe056f3aadb2f6ba5029dd57ed297
e1caa0881089d2b7425d761cb142e4322d283edd3dba20a23165a3b9d70a251e
e8887979e3d047dab62321d4a83a08904bbfcb53696b0be1f4a7d339aa9f3470
eecbab0bd65e39ea7b0313b48a22769e21087fbcdb8e86957d9fffeaacf2766a
f3d8697c9d8823d61dd488e13949f76be8f72888661e453788037038a0006694
f537295647b4378bff5dfaa57f6d5cccbc5aa8d51d88e22ae3d49368783222e1
f67dd26c30bc022e27c6c5f5954afac30f17806d7b0779c36fb8b2f4e6886f6a
f750c66df236816644a299077ef16cb1909eea0b822e0039e344e8267d1f22fe
f79cdc47a8fbc7ed78a2b9df11ae025aab64316dcf1c34421a3f003401ddad2a
fb7d684317cad40f07fb43a458c74ba2ad50f9f68ab0fec1a0e4518f3dc2a620

http://dazhuzuo.com/zmnvs/7rr4il/
https://pro.potsdeco.com/ldugf/IsfAWAkF/
https://sojasojastudio.com/wp-content/VAeD/
http://wandsdecoration.com/cgi-bin/6ifwua/
https://www.supadom.fr/wp-content/714/

Creation Time	2019:11:12 09:30:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
04a0ac7f2bf210141131c3883fe6442eab8ad8c05b60d54dbc5f51e097b8e469
09e69712b932507a0b55d06375da58edde7ccb70c9472462f6735946c0de676a
0bb3557ffa1744c6f2e872d424794e0293e427cd26f20a73d572a18eb1113454
0cdd605ab5110874edbaa78bc37f6738d56359de77a98c9a8a64de8c030a4b7b
16cf239b6b8950d49921fd13540aa44f87d51eed8de8c3892ba5398b56ba4636
17441252830a8fcbc8aa20d0cb07c425d047a0a7c96c1ebd90991c7b7af7df9f
1d4c5dcd6cb222758908a0064399e5a0dcc99937ba97d13a205f367078104b18
1ff6d8ee1c9a0455c06fef3e2bc0cdb1fddd3046dd173d39299570587f9a7718
241c31f34b85c30db12586def012fbdcc70e86780e204182317c11212266bcc3
28d1da9d9a6d037931e25021c4a7f0d4eb5908a6564cacf72b8ea2d38df841d7
3189e13fa6931b32069558e35713e2ec082f40b56c385e73849a0ad31fcf5f7a
33586397cfc41193d9d359d6e90f866167e5a2c2cb2d5fd671c3762d897b17e3
3d7e75c8903fac52c27cc8424d6a87fb3c24caf54aceaabc57d61ba860f15be5
3fc58aabaf4c44563ab1a8e039f6dc2d46d090e9a991dca9cfe0792d1e9d158d
496226f032bc396a32beb4eb3584ac82941aefd6596a7fbdc4c94ae4210d5ba5
49d90ebbb4210fb27f5c28324343ab1c6c9c2d8615ae79cad2cf139a3a14aa50
4d4c6fd28144cec1b23cbbd2b701099fddba5e1d2df5cfbe81ae83936ece0b98
4f00653f7436225c756d23a52c3a2e62cc8ba8f4d7bd2bd7b8bd51a0d795cbbc
4fa814eff4316074b8597c671cd7b4c774f8a8847c8004d21e514c7ba2a95075
4fe99f21d1748d5fce8979104faff7bf04046432d77a52dd27af99853a5c9e0c
52eb18a67260a5f9ef2279fcaeb358c1f296d2ef170dee87d6c07b1a0af9778c
5c85025f8b1d3e6d564f25cf908152db6d3f0e3b7786ea5e52dc78e4e54632f5
5dbc8a38be8f713c7a2447be2a08995ed83ab90b7762253732c75df0b1bc9dcb
65d25478df7019dfd71672fa7a1ea75736e061968768ca17b50a0b9e3338f9f6
66064257f75802370716d721c7e493148d8043e635ca81a5eb89431ee8f1ee7b
6815ef86469a18250ced2221128475dd9ad51ca990de1518d46df5301e08b721
6a835b2f478501b5e47661a1aa2f7d96cb85cb7f12eb4990623667903ae38eb9
735276384a09119f31b117f83dc1cd8e964b96901c14e1f362627ffecf676cd7
75a124181d8769cfa1d94056566eb011bf1fe845686784346cab2cf884f3816d
763bd5fe546883a9726c63a3e85cd31d8ae8674e5e9627846a052b74ca58f5a4
7da72cc02a6fecf23462d7ec16cfc127e308bb9d43027e85066f732621939e9b
8538d9e23a5a36785e4d29d4aac9651ef6b09a0ab5ff958a45aa0dd3b8259a6f
8595026bfae7ac440cd1e5357807afef2e30188120ec223fb66978a2b5efdb8b
88f58278439bd48b41e3b6ee7869297f48746897159759d3141501b0efdbad0f
8b7d61f1d07ae28610bac1d9faedb25d37f7ea0e5fc9e4eb0f28e4e9c3fbb006
8c14f5709cfbb02e8d81f757ccfc2be51a67ba95e11d37151635a6999bb62dcb
8f7bcb8a5e4a2aff3ffd0cdbe7f576190c62db58bf9bd376246bc8693b3db4cd
91860a1f0c5bac690d79487a17f2f99aa41e331996b867e4e5b514242246cbdc
92248e4f662b04a05cea14231f1942d2e1c12491174b3313799e1b64653c15e5
9abc1a6a83daaa972899946da81b21c9b7ace448dea1e3dc7b9e8c78aaccf729
a01bcb2612770329c76876be0f407e05e8131eefd6c700004950ce1bd98c879a
a0c4f15005be8d0420f0db7f781482cd1e211c047c1c36bb9aa6b1df7d9ae643
a43cce4e051896d9074bc1735b9ba1a1df1bc980db19f7f7787ce2e7eb9fa2b2
aa36e47d2441968930204b965a42f661c339a67e4546ea45ade7af40e1321b63
b74a52ca48405c0624946470b297917e787a3a65c1ea6d60cf903a8028a74ccb
bb63fbbd4f06d25364f431107bff867aa19011bcc362786e62bfbee9fd27e636
bdde45a51d22df09d14d537400501237c16ae4090254fdcec4571c912eeda139
c1546904725cdec716c592d560f679e38d11de369706dfed123e0484d1b9cc3a
c93ff28c41a3378c00d6a23fe4b512e1df07c935730a2c82148ec88b01b488b5
ca05b4537253ca97f38ff3d760a3442b6519f06f073f4805aa2a8d776e52923c
ca26c3c3b92d5eadd2b8ca5aa4434d060dd54278f135ffb6e11c3b73666505e8
d24c09c58105993cefd26e9ea30caa473fa802783e625f5ec435650760b6b52d
d69ca687ddb4820d53541988b03945e342f4e0b6ed6dcc17bcf6193eb0c57d7f
d825ec2d5e193711026589844cbc67845e739e0bd29f40f66ea5369f9cc0b528
dd21af14cb9b99a4b26395329ed5dc9f91ffda1dc031ab9e6a716751e35e5200
e3daf4af16598c1f10db33105a3d095a33b096b2d63dd23b3051bffbe7d281de
e9e2853dd50de50830fc8a61984f12464c198977921566b053d9f3c459c325de
e9ee1d5119cc8ecb443ea8a1bd869fa4d6fdf40b0f2cce3a6e450831168c0399
ea67c6bea0bdaedfe9b3bc2dbf222939277c22219ec0ca78be204ca1ada45334
fb165a472130e95c8bc4c63ca9fef37922eccbbfab92a2f72105890db2272f41

http://eduardoconill.blog.br/wp-admin/ruFjpx/
http://ifuts.com/wp-content/EakI05sO0/
https://tripleksign.com/wp-content/0/
http://tededsport.com/99wx0h/l7c/
https://www.amarantahotel.com/wp-content/uploads/x3ve3w5/

Creation Time	2019:11:12 07:53:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
0a4339fbdcc916b81a1f5199b37bf448e878d00e493a7081fd0cd40adb908072
0ce0623244c0e80475850caf3715183d394c9f86e4ace81e0e24d87f1f2bde02
10d3c98b74638a4de5fda4fdee2fbe1279f4cd6c1c971ca168d5b51926e86b4d
2cf0a801c5ea3df43188a8010153c10dc2c86ab33b588cd01f43fd5d2e75e876
3956068287c903119db20dd1e9dd5dde192775cad21621d5d346cf9b0f6523d7
3f142778186bd2a46750d753d9ddee6a4c50138bfbb9e8c667e9469d6e9f84ef
4c85ba300aaba3202f26c63b0c137b67f207e5d0f1737601c47c4d69e9474782
6f237ab5dc2a91bf0ef28a5f3714ca386fb50f0dba7f99168766d35459a6d742
73d9364b1288b02282498535220c78be6410ba840ee98f9c4582b1172d95c8bd
8b8f87de226faffd07ac457de21468054e8ad050e4251bf389cabd11ba4c11d3
97d03b4bea54a53b381d422ef8f4b458dd5f62a0c30dfbc9155842f466a76478
a01f65554b1a2f42b700f727003eeaf46f09f6826b2f7e72edf531d3f681fcd1
ab607897ac0c59d5f86202af811b5db93a6288e052cea90a83a6e3616d155e83
ac9a7f1a8907e935109e52a882d868440f70b4db27ab2eb84f714475f01ea2df
ad71fce4b6b9732cceda98fe3e74c534e2928e9bd585e32857427af1fbfc41e0
c0977e5cd7d428f609422ba0c021bd6abc8cb4eef68178d031abff64d93a7648
c1609541c067d3c0d316c51c1890857eb0e9bdb042e982a6f898907b0cdabfec
c8383973e038543a5d1b0bc2ff899944af345c0ef7296df4040c80987e0e2595
d018cc4fde6a46ce4b8d129b0c50e715b1fd1334f6489056dca5e66579a4c9a9
d20892bc841da72025203995bff91706f3a50fa2513fbc9007b015556c2e62aa
f29cac2e4c56ef59fcda4db2e043b220ed9e5d3b85be3933389e5c43feb74064
f5ae01f1700a557057ea4942c714511b517da659be5d47c49dc9da59251ea031
f6f33631bea799241a7f7c4cb56976ca9b19ba449234349501b1b21e8b3eb48b
fd21f496635242ae41b97941a1e9eb087df68b046004ac70e790fd520151c442
fea82a9d282e160b8013b7f030117ff39ec876b5d36dfb8a9eb9c5dc495ecb23

https://www.medifastarizona.com/weightlossclinicsinphoenix.com/ris6uyCZG/
https://totosdatete.org/cgi-bin/7asi/
http://tuttoutu.com/wp-content/75NPQbXpwO/
https://etincelleclub.com/locydw/n2kt/
http://bmmotorspares.com/calendar/NB505/

Creation Time	2019:11:11 06:21:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
00004777aaaea3c5c634ea4e5ec095c1fc4851fa6928d8791744428dcd8f31c5
02c8fe03f74895f9d6355abe0858ced23a8977413e8da2aac59c0ae78e4edf56
062dd56d1d898dd31019644753cc0c9792540eeca916fe560c55ccd2ccdfcf61
07a4865fcedf2ddd23a76898c197400138c17de22384437bab81a6b6e1e67321
07e90ef564b7553c204c2bae8a72a3f9f0d0bfd1e3485b77f0372f93ae040464
08877555d7ec8248dead2071d55d9e166580555bdf90a6aa71dcf4b5bf653dd5
0b9695301303c390c20e71799b10f740489013f67390f6b4954fdeed1b870b61
14845c2d7616a6acdfd468b717b41badcb2f1d6126c4cf0e54cb80306c80d09f
16ad150ffe17f87d7cd6732f561d890883393316206d79afb64cb69703b99059
1d12baa2f3aecae36283bbcfa5e3d0dbdfdabcd1366b49d22b3b3f0bf1a16656
1f2b5487f420a93420f8769b4a8a47b662dcd20c1c2ebc3f3238ecd5df65be58
23440ff41f79060c47e9585093f4c5fcee1b476d9c7d307b479b6d119e444a20
27671acf5f1a995256fc4c4b8fd50b06af5a69ca9ce35416119cbaf1dbb77d22
28d97a86e5c2dd05dec3a79de7209e74eb364846939e0f4d862e037d5b9774d9
28fb9da7a0a5533c14319f8bef41c9ab18a34edab83a372ca99c89f1c1bf2856
2a48d187f84228829338ff2e4fb9387eba45e0dc7db3051eb3cd12d4acc7975f
2a71abfeb4739dd40c01076bf44c6ac4a97b5e8f42f625547857677d29f1544c
2de759e246e01a22e19e93a4405119e462f70676cd2e11d828fc5c5188e917e4
2f3c356a6f714deab5fb79d85a81a9c3245199ef71fa6e5a7a6cc5c39b552494
3221944ed4e133939626fe8fcbf05b26888878f6e37f286127311be786c7b000
33d19b51734fd8135441b5aae250a2122a9659be14b6176c2afe75c060d77c29
34008a75ff43ffa3b6dd8f0c2485e051928ab6a20a6dc3bc9aa0e6b847d5104b
34c9e181cfe1a29e3fcb1dfd9cd1f9bda4eb7c47ea2fd79969ad4582f3d8ea96
3910bf88adc9f99c74206796fcfb2ddf1e9918d38f9caf34264a10a07a7b9192
399a1d9f752d83b09c67eaacfe544838ea4c97f7312a4c3d1a47110016dbe7fa
39caaa4d0fce8a8ffb9888aba839edf57600c52147e95fd848ab78c72b2b48eb
3abbda55ca8e55952b6b218fab50205d2ed572ca2056005e891c7300cc59fba8
3c1fe45970177c1bd055c8a83af945880864c269f3bbfbb9bd640d4b158c14b1
449459db5e4e0e7df47908af76f37b6f715ae161c11086d8422b1d705f43a6e4
45332e3c53da75f5f5b39af9f3252dd3d091f3476610d729b5230426b39f2b53
4592be6fcc7731e27bf654b5345e394655c002ea609a456ac599b4d1de6828d3
4723f6df55a93bf57344cfcb76bf64027865d6e5d1afa049cefa819388444a0b
480557261101c4f4e336de968225fb1d89307f1b339b3972b0cc031554850bd8
4b94c1adeed767b66526d0ae81ca7682cd69188acb7dedbf41c6f33555079ea0
4ba72b036f5016827ac392d8b732071c76323b7eadf17b7bc53d412c93c4ca9d
4e258547ecc647c244c00000d9f42831ee11ce8eb21f7952dff957f6558bdea7
54e1f5b5b95a9b8a43f1e90d35b8935d4365e4922e9dc784ecd16b52e0ca290f
6299b448f057c560991be3b461951fd741ceae8f75f36db5ef14044f0f1e60d0
638e49e9d4360a66af6ca9aac0b2993720323e59613faea89d1896cdd26afe97
6854acce662862cb760440ab01c1721f9ad42e966c677075b5420b72c697a90a
6f03d49024eac6312b9ca11dca0b7b64d3c8fa26dc564c853efb95d57ed50059
70e1f9dde4a4e2f9013c8b26c482fdc6aae8fce5b7d9926bdce69db3f3fe4fe7
71e5f78d2fb5a63cca8b34a871cdca77063927fa663991311bbcbc374245a5e4
7318c13d23721feb5ed6f12fd0ff2e3029c4404a1303bbe3707043e88e47e0f7
732d6e859c63bdf15c3ae374a4224eb7be67ae3b7f63a10f749ad4ebd037ca78
73f12a331735ab4cb348cb264b84127ab3c4e6b9e0fdb8e04b1bc8300c798952
76b1f046c9441d2a5bc16efe6bd90481b2db7230e079e17568b2f733eb4d9123
7a771e76df34406ccfca6b2c775ccb3d9582d67c18fe4c2a086d5a8282b39bf6
7f021359595415d740a8112fa0d6504b05b1b360336913343729861f9b973ece
854673e3442eb90a4275bc64b6b9cdbc31a6a47b7ff3a2cdb1568c11b0a0a795
87df3aa32e5942fd05f5cae92ea3dd917c3448936bc32bf12db57e6a313b98e9
8bcbc5c017d456feb56cdd4534061cded7b98f0ecf682ac4cbea40d15d12b910
8eb161606210eb1b3a3441dc93bbe8862bb7cff01dd98c2b8a5666265e5a4a85
8ee70d07547013afe450d0c89699800c250cdadd0cb685ceef819ac602f76102
94636b1834b458e85a4ab684a912a6ef6f78bcf1cf714c4d73f9dc799bfe716a
95c5efaa769aa01ff3739f4696f8900c78bbde5b3fec8a4b4cc334a6acd33c82
aad6b77d74faf39254c05b849e1b67ccb48b8ecdf5995290ea43240b7f27e994
adaaf86a370f9e56ee69a30e372e85d2fd969f3a1c844651b3ff6fd72ebd1429
ae6fd419f3ad8daadc11c4c10ad45f30fe12d46270fe09122402e45fd886b9b8
aefb4f253d0963f6fd846f224f738be16e2bb708c0768eddbb60659eb5a06f28
b3598132c18ac80408c8eda418b564abad2106657868be208eed2d928d6c125e
b67c4d26bb83a8358af27f6637afa8414a7b6e5e1622ce197b721716a5bab038
b6934533248c98c4824546bf76a28e90e0a646c009b4cce991af3c20eea8c31c
b874ff77f2e6637e10cf7e55d009726b615a8ba5fef52534f312e4c9a7803028
bb1f8728db3c7efa4bf5b720e61c31a61d1f43d101ad173a4ba454a5fd768ad0
bf9d788c16a0286618655056701b11ba2116223c29e9fa2f2d01ec8340f3eaae
c2e9333ab5cf706f3fcfe03ed5094c1cb3bbc90477a947886012a454a49794f9
c3a8a671883f0d4414cfcbbec464c7de375095b8770ab82c9a1c63a8af8e86f9
c4c8f697f5a4460224f03f14b265c7892e90f29a3f0382b637c58d8d1c44d66e
c53de0442a0b5f50d7a127953258c2e0f9d2636b829bb56dbf6266f1eae6ae8e
c6e9b2c103652d8797cbccde8b8b32e76cfb01e5333d21838a950a6a3aabfeef
ca3d45ae93a674fd6ce84bcfb342e36bc1d698419ac562cbb8d2d1fe9fb62bfb
cf2f59fccf9b693189a1c1c0cc5da33b3c373c4ce9618555c7ba6440e2487fd3
dfd10946e9bbb1ebe90174f7e38438476d59be75255e53bfd3d134f3fdf20e75
e0a0bd12af1b90ad3fb39de398209dbe141f25cbcfccc67774485f04d327008c
e41b78df92b111db580e1d87dabfef10bf4cd821cac44b6a471b274e2f8bde67
e770b81d24b19ee16f7aca7c723e0bd4e413a4073c406284e409499b221345d0
ec05a1778008ca413f4bfc1e6221cfe5fced50243e284c077c094a9a7e4c0fce
ec5aa397a1891a68dbe9b1ce746898d51b31ea547b3927965bab06dae827f719
f2c68438b34ba17994a4c5523d427058b75d2bd6ac0fb575cb37363d2602961d
f34efbbc547591ac02add48318bb283231cd182b8186756e90dff9155dbe80e5
f6c9c8b9f5b28ec59f0c5e610858c1e9ca048bd543ac5a3dc32e5e1b1aea8efe
faa76dfe081465a712cbd212e2e0d2873d518df5eaa457a4b7be9191d10a9ead
fcc2ee413e0064d7b9ebc3018af2ffebc1d3ed4c9c26b2a82c38eb76fbde2e1c
fda5546b04f5866ebafdf9f0b781e24e82e513be0b15507da9798e1894738322

http://biosystem1.com/wp-admin/wzkv/
https://www.talos-hr.com/wp-includes/NIwZerXG/
https://breja.net/wp-content/c57m/
https://36congresso.socerj.org.br/wp-includes/7g/
https://holapam.com/wp-admin/7w71/

Epoch 2 Payload URLs From Unknown Document

none

SHA256s for Epoch 2 Payload EXEs

00f1a40d028cf8b7ad7b0c278bff59df1b4974e81d20af5ed4c7c6ad21fe876d
01ad82427b54bb7351499996981d3be8fe6a1dfe47aa441f43cec39d0e3a2bfb
01ded251a6e25c1a8f57bc73b60fc9e9ea39ed6dcd3c557430f5aa3b01dc8b5e
025aeedc883de8583d9ea54471e85ad8363cacde8abe29a79200dc12d2f4cb82
031fd121543087f4873835a0e41bc37c456a917211de2eecf21913bdfb4e5ca1
04475845e2c075c12fd3e4e0828fc576cde6bcc658de361f3fe1e393c0317b11
06096d9ef95cd3cea253c9e01806b4310fd99f88327b34848a01a7aba6b5ce77
07418b704a36f886f19d406bd827e753ac133ff01d05d57129ba5a2e52bf5e30
09aa44f8d59d8437c2c41fffef35d1b312d42df5b6ba97c5f7ad4e9a897a268f
09c31ad61ea8dd80d400caae4ba50fb048a2f7a919da032347be1af41e667ef1
0a3aa1dd492480361ce138974f64312673c09761d3790cd63e6cc830c55b5a01
0b12b307b9e0682592190e7b986f72404bdb3d448f714b42d677719f81df2558
0d3f8e28e42a4d034e9f9ee076c410c12ac3302792904b54fe0975a3e894a291
0dd39ad9f4cc756fda61694d6473fa9bbdce46a2da30a4e64a1e9fd27c997388
0e123d19112ae1fbb6d137f43ea9f24f44bbd348e3ff06c92623c91d6c53d7db
0e881907161e7b8ab76c2caeeb43e11170cf2beba83b1a7e4af9a761faa40478
0f944adede26714a483b744596e6942aa6c932174d6bc37e05812e6c73db29c0
10eb6e6edb486cf6f73671135aaf988ec69dae3414984ff013711f4272e536c6
11fdec6b521462594e9ce0dc46e09513654e44c7b9133602539972b2dd4dd63b
12de347dab937688ddb6cf4c1a05a36f5bde9cf4a352832f93574293c50126b1
12f5d6d2ed01addd4e057b2ac8a333942362dba8949123a48c96fa08ea7e1a66
13698debee288dd7676c841a20324e0c720c7109fed451d89175ee2fbca6f209
149b7cfbdc17d60962f47b50b3f2b775d87381e57ca206468a326517e42fa810
14d6ba07a3000bb48e61628a79a0743322fb474041db75f7e3b569718c752b4d
1503f81e38449cfc224b1f46021d8c71b9b71fbbaa02ac2a27497f6c1fdc5967
155a4e8be58257b4b6760c293755cae86e8777410c293373aca7750c3939a18d
157363d667d3cba600c3cd9eef78a77ff7a38c588ecb44ae18eee7685196700a
16adbe5646584214cc0bd475649c83e886436de36984888e7ba516460751c033
186d6bcf332d5b27600045650e28317d8e28d19928086277ca94ee3e1a57c080
199c291133d2bbc2128fc8f138b82610c3389d6d3a5b6aea908ca27e27283ef7
1a4d438741d06f09dde616612038cac3c5a64bc33b2a0f2680cfec3089769baf
1a897ddede145fb98c5173dbedc9f5a4690b122d0494e10d2ca7ea5d00b491a5
1bad204aa1bebc403876eac312b816e77665f6ae7302ce5cd0a6261bceb847ef
1c0f933f8682a5feb675bab8e66d7a2328fce9dea22ebfdaeed4ea6f96ccdd38
1d271260d74c9412f41525f570caaf3bb830114b60f5162fb7a1f6a1ccc0a5ea
1f2aac2ca645f2c4d564230e66afc40a8b6eb276ce3b1798ef8d0671f0686207
1f2cf6226ea69a9a3a6f7e8815eaba3b746d3958d400b2943a37dc26d9530226
1f9e2d1f6a3e0165f1ae08f666a7603b2075c31c492d02a4277a885957642cd9
1fd6fca440c18c5a53eba90b83884536004d09b23f9f23ed8ca6c9a803379a70
22673f544c724850510c1671da5963a20271011b7f1e567015c89de9a4455794
22819fb55124901a128dda5a10a1740283be38f8707cc082f770983212b27cad
23fac318ffd75d3f12d936a3172c4cb2c29ea758ced96325a072a33591931250
243a87ac92c4ab7817b06a46b035e0ea643b30c670eb4897d051a77557a5ab7d
25811c029c488ae706cc31c13628a5aed074fb3f908da5ace921ea58175e92cb
25bbea594c0413ca2a06d64acfcfb6092c7ebf6e97b0f3087f67fa9c30481263
26402cc87733656f6aef34a534a8cfb8b55afcd94fb11ab5a693e7ef2688e4ab
278220d4324d3370657a46d5948d4ab5c7ac2c69c0c463c427baee872f1987bd
284ca2f66938dc749faab2ef678916252cc4a4ad9f8707ac14ea08deef223b04
2d077b61627b87b3af4ca79bc55a3964628569132a094bab313192e07333598f
2d2518a0f44ac5c3312c8412aec77314717d4b8cdebc2d2371edd084778626da
2fe31c11edd266cab969e06ffdd15b24ba6e85a7907cd21a24d31af2195291b9
31766a10892ee0210d55bb57f665d9bc92127df025269b4b4d2b3a871eba82e0
32f829a9e59eca22dee811130538056a79460e59ad537abc5c2047a0dec3cd1d
368479712cc990963ff03974f26b5155537b589dc3102f4abb657036e734aad0
393bee2c09469369791a7ac61250174925b69df6e815802e93f22951db426da7
3b00ccfaf2abdd0f5a2da284295a9a953967493b3203db6513c91b8443f9c206
3bcf43113b8b5a0348f602b77c2686fdf70156174a4c65f4cd39cf4e6785281b
3e3246311adc34abac5629d1e4eee2a032a14fe19b51f34ef3ca8d5637f52a8a
3e5da55c0b1cf2642007f4e7ee055f5496d0d36b2898b57be25819e4d9af80e5
403d1790815f1fe4eb81d89e9b74d2b34e08c9c677ecd13e30d8bf8e5464c968
40cdff44313ba39e63b3f413b09cf476ed645c0725385efb3fbfcf1ffbc29edd
4114d519f1b0986390a78f5656934472f1a58f89f299c6626f3dfe23fd3d058a
41f8d8a3c6ebb9715ac19d1e981b3be9270fdaf75a58aac82fcf475d23a35134
431ef66eb5d5f67ac329caa4614435ba47ababa8990ae2ba3c8e045424cff398
456a907ffa338e98db4edc86c8da5197eb696e9b69007589104028e8ede507d3
456e552ee68621ee688805b47a3437589699de2b0863503afd63e18b1bfecf4b
472275e4d318d0b71e16fc5eb8e0f20135b9636391a814f3cc5c9b742aaa86f4
47d1d475a5c4ad01cac8eb988564b4cca095c93322f47bfe9e10ae43911fd0d8
47f61de6db27ffaa87eab137807e7a7951727a1b0200f76a92a316d623b96e76
4892ccaffd72b33cc9035ba2e4db4a565bbc9a74a30086280a8af6d447fadc9a
4896c9430c3e10a0712a3a252e6a4113026539b663bded630e1eb86257e6533f
4bc7835795bb4834ca24ffb61e9040e9476e73ebeac33fa71a25e676efa65f6c
4bd2d2dcb457bb5a75d9b9024d599ef4f7b40e53d404b720064039b2a3c73652
4cb2bdb0de596cf0a0495f9c21d8e564acaeda37826dc7a8124be12f6186f615
4d9438626afc02758dcc26c84e03b182b79b1a8d8072b919cf3cda791dae9731
4eab1ba6278ffc9a503d8615b3bf7c55c5ad689652c0363cfb1adc4cd1038339
4ee90caa9d6db3cc676698c66f32ff6052e2735d695ef76aed4c5611580a5d93
4f2a2caa0ab4fa5a8fa87f736e98e50edeb9809b97610acff41b5b80a5809491
4f5c51b79d9100e89aeed9b7b157e0ec7bb0dc981a5f9222f86bd693cbe75d9b
50351c42f41da1f8fae2a0a5d42a584dc4d468d042d9baceb93bad44bfbab054
50aaf7478f211d4cf22960e65f4a9b9eb5016fb196f340647749a8c057f495a0
5347ca5373335186fdaf7df1599574a2cecfa5a828692a4cb41837c688dbd99b
539f759abf92380a67c4299c65ce312eea862d946d2999778671a9227583ae3a
53e1128f9fa542a47cfd1226ea449cdc2b6a5fca9239b970f545361a40db8ca7
54b5516cb5b61b5d8afe6510fb9acdecb741fac2d55c25763641b7b1ea6b64a7
5534870d7a3cefa1e172d3a86b9cd49fe43dbd913bd485b357477f29659f63ea
56fea27d43996e9c5995dc0c213a619ad2bd852ba8f51c2683e706c41c712274
58108062316e34a642eb940f9c423429ac19bd7e0756d99ce747f04667ea7bb5
586ba44101616192b54a98253507317ce252c0cb7a3eeae5de090fc5add3904d
5a91d76cae4bd8ea00577a39c901a8fbddf4b834e28da3fccf3d1a32750035af
5de7956b6c686abcf355c99a3375ab60cc15c740c6ecddb00a4c5f93882b8daf
650db3242311e0ede061f32bce3dbbb5c260d29ad0f0f598efda985ee29bdd70
653b687238d0b1a42a16dd0a47872643555cc60ba6008a3a5371990fe30c2ea9
65475acce8649083ca71f8f3e723569fec609903b64e96484fb5fbe7f4e7308f
66466c80412fcfd6725d318e07b269eb3236b266c1f88cb6fbb4abd9448f8b4f
6af2f80860a9bbb4b9bc5ad7f110684e3517b0aec6042c214494f61c0bf38aeb
6c1ee9be84baf6d91558f4a770c692a61d8ffd3df2809014d739b14d2c0eedb4
6d2cc5f02f3e57dfa8e635fa99c5e5a6fed17159329c2420f9f7743a828f4213
6e4604a2c929c31341b8ab7103c7c8f934f084636cbfaa4ca7de1eda96e5791e
6f6e3dad78ea5e1a493044564fda1a04da91419a1df45338f04834153414b1ec
6f7d16f46376b0e3a5393b7cf92b26c522f7cb4be67bed935a64e367a4b69f7d
703ce3779b0d907e1ed4c5bb8c4b6d5dfdff1c2f3934b96eb013fa7c015f1142
71730095142471c7b77bd8b5831ae024b8a3eb041cba5ecb0c577b825f7ba646
71967fac83bfc0ebf92410e6e3bec6ab6d049e1a09e9635badd2c39a7c726b2c
720cad0aedff6bb129c689cb84835a5b500a788a0f892e1452925d078b4e7704
749054c6aaff6ab3568c746bab613a6af1970c792da9b15bd81c4f5c5688f605
7493e6e4cb5d063d7ab55c04484c93d72422603f945894df9ca636166e2e70d1
74a9670be55a3d22e0a74556e9f7ce7ef7311f73f568a9966abdb6f5c11c0aa5
74f0abaa59cfe7910f203b106c859afe222480bcb7e83fef679212243c3fe597
750caeba420b1ce798a4746a06f1c21a86f0d17164555c43ffc50f439e5644a0
77ab62210c3587a030e60717552e0c10aad46184d0bc219d0ea609e5470a59b8
7a03318f3d4437bfc210a905b5416d3fba5902133fd5fa08f0873c5d73b6d070
7ad6a35715efd84583e73f547914990482e98e60cf5331113f53be8961ff6ad9
7d699501e1a199a2b8f3bcfebdafd95482c993f1e7df3bb12005330b1bec19ed
7e098ff4890b5fbffe449141b7166d583bf13b580f57dff4fbcfac9fe75378e7
7e3556cb34cc8a795076fc59cc51f0848cc7d96dade31e36aad26e2fda6ca87f
7f49e5cd5fb05c23e97611964c91172245380bae2c3b8f6fd2b3baf6c3e9c204
7f56bc715f0e327a58408dd676f2cd9a5a0b05b1a70e5758e8217d558ec4f027
8244e82fb282a12753c88740a461d1a6b7f0aa9afc7aee2b6bb4e9b241ece49a
825cd00ac05ad4ccd4812c819ae5b989d1963c39316a18ee9432fa89e55721b1
829c375b98dbf842edcce520617c527907e184a73237233de4a1147eb4160357
83530e2628f6513d9e1e38b47f2d1079ab45f17644558a90aed11bc9ca42a9c6
836ec5a6b84b258beb41e8fae00baaeb9b4e39a76f978d95d955136715cd0e4b
843ef438671168c1785e61f80de5ed1dba8daee6f8fca00da6c81fe898264f9f
866d1a50aed1ff402554b55ddbbaba74c8891c6fe2c646b989fa18bdcfbca34d
86f3e18a66b55898fe7c4b46a4ed6370c1ed3107128ada6787fbfa25ba0ca622
8a8716985c1701bc7b78561ff79380d4e4218f392e1b42b5accd8edee76ff9c9
8c243942e0d45c5b933e722eb9c105dedbc63a5ce39258f7cec5d587dd28e198
8c813e5d8f370ba812965c1cd1576fae39c5453b1bae3ec1a2d2c768dfe52196
8e5b6536ef6213b8cfd0bcf69be216f25fe440c18ef41418f5ec6d6a68a82de6
8ef92a33ce76da6b875bf0b467fb3f857b319b75331bba1fcc72784afacf2f40
8f28b07cc8579e80f2aaadf7374fdd1cd264415a80277f3b66fc8d2998da8e44
8faed34658ce398e4bb36ae1ed8e2cb7394209d92bd7981b4f0671319128d255
90cc01653640353c4010d04bc6c478e688bfcd196bbaa4dbf93b932794ba3865
91cd8c2a60b6f8c4b86d401cd9766b0720f6c766cbb23a82f754b0699199c6f9
9210a9bf7c191c023e5d0c8d0eff16a02a4188e5892ed6350408fdae47b38ca8
94a47e6b5de71f4df867657d4a381a3fd1d0d5bf1fe0edf12b2ef7b2c3772578
950995db447815268a99d9b614459e78c9465a23ed337b3f024fbad5ead07860
95ebd4cdf70de643a60d77e7aa7b4f54fb9a78fee252b697ec5b1fd4f278bf17
963d578c53cbf88ff9b80076da05b030722fbafcef3373db326d13b76df8efbf
97b6986b8846b981849057f18d11b924e65c977d87b494f991ca482b83628ed0
97f44f0f65ae860efece426bd8a8c670c4fcffa0be04713aa4f914d4c75a9440
982a0a98395f220c15d6089c6b1fce3ac8ee62c352a648d46eee277582692bf6
9ac098984cf96da89596b2cb8b37c3fbcc028ec6bbe8ed06f75bcf3956a7a4ba
9ba24efa3e2cd8b131038b601d8467df4d7a064c51607b60c56980ab224123c7
9b2bce8066ff5d5353c74fe5e4310f51667ec109e4e95bbc00a0e2893a5ad3b0
9c33cee0cb2dde28289db47cb888c4e2f16617c1fa9665e32621eb7432d048f6
9d25aeb09ddf4ba8ddcfe7cdce3c85d632ee346057b1bb973f06d2d083d1074f
a0fce85a1e968e71b5a0a91cc49b231fd7579a9e9e6c6a830fb3d5e60a430109
a1cb934b0f917cc4567b7bb1a7ca4af5f00fd7581c162e7ecb9dc6227007e9b7
a27f83d836308635a91958e35637ed8092e356f0766106d490c11e49a3acd0f1
a2ca5a1631a76550aac66b31d4b0e9b9557fb2f90cc78279a60940da296be3e8
a2d1bb8fc3f10c160a3aa3eb551ca0bc25e2393e56cab649a1391f249486f492
a3a06e01bcf6467bd08af9a34ad2fd057545d2035f8b135ae388ae002449fba7
a4a30232299715a29f5a162c226eeb877c6ca7043de86d374a8e630feea6daab
a6da3f699b144164206e508ea4af54e7a21da93284dfc9f9d4dd2f3052106a09
a7ba2734d697cbdfd8162e7acbac7b58525cc96fb956036a5f3a38983a515a1f
a84802ac117f5f52e54ee0d4c2c323e62a568639d8718b07cbf80a17777e2b99
a8574dfcec39cc9b7a61580d9aa24860224765094bf5792a922b6492a4076b6a
aa14d20c9a5c9b03bc6ce3d3b531b612c49c31728d34a379967220e3d14d4f16
aa5eeffa2e44ee9642090be625905484e8e6456dd4dd67e36302777d7dfad809
ab02fe222ced34daa13bf2c35f661420ab28f506096d92bca9cba0a7f017ed08
aba450cc4d39aa699f85559b0313501f2e1c997d4699ddfc4492d8c1060001ac
ad1a7fe2b14916ee7ec0dd3a432b8afe82212d33404e718f71473c5aeb3e8490
ade26e17fcce74895163f55d37a044964a3975d0b72354e3e336244b28098790
aec41ea174688e27f6e6d8c70218c4d7f70338ae793242440daa225aba4dbc7b
af4966e89e465a7594119e15c5ad2cfcf5fde4734351ffddf57eed6aa8bab262
af82e744e11ae282c72c9986650fdd108ef98acf94374805c3ff32faad664435
b177f585af83ca88de3683838590af4233baf937b46f57c55f209642179102f7
b1c71a75f20740f9e4c6670324a1b941b28fbc1207f50c438bf2f763d0756f06
b2f2766ff44e3cd06197944d37adec87b54ffe9c97a9bdc4c3a6f8919d2f84c5
b6382123fdd585faf36bcea684d72071d90da245887db1a2a0b2b41429a2d686
b74636cedb60f69cd6dfa879340a8d0844e38f2d3908f562853369b563ef7b65
b83b00175030b0978c570d63fbd7e100ad64dea5874cc0cb236d25ad7ede1617
b8e7e04538af9e8f29fbf17fc77d568763dc5609e38a7b45655da94a84539c53
b8f72bcb79c549cc6c75694fa89cd19947e1575a6684ce69ac3a52dbd09d1f7c
b9dbe3c833224867293069f99ebe7868e0ad499706d254290057e1f00eb97c8b
bb6443098069a85536cf6ce2b7a2c26ed7171fc163dbee91eb54c7ccded6eaab
bc395a09e422c898433656efdd0e2a8f34cbc1d6b9383a00456a26d856a9cede
bd0c96ada5701f0c86ac4d93b95df60b25564fdfa88814ce7171b08d9c9476d9
c07720f874ad9cdfd262ee04f7b47f7451a854e10b76f08b50f214a05471d58d
c126f10d2760221e449fd2f8fb94001718cc6508d0ad8c3ee83c6e49e8a8bb77
c2b585599555d77e6966e0aa9bd5ea75e2686bb2d7ebe48be51aed759ecd5716
c59af8d51f76d0a7564eb7bae661b4b8db394c93c0d9981ff050d12dda79c58b
c6fde028b87ebbeae530b1b7490febdd9fad5e40950b9e9991baff9c949ecff4
c73e848ed214ba051c93620ad19c771cd0dff3d26bc114f4ec2d12ff9568c0b8
c748ed87dcfe0abbfff19cdd500fe1f8bfe0ac4408b4587dd5aca853c1a9bce6
c8d72ac5d464c813072ce655afab50921e790a63ae1385b936ea66cd59e53ff8
c8eba95e9b72c60d25993b690bdce2d09ba5b7d04ff1a4d09e1060b41893abbe
c963e3c7899cd39d2245d4def6d88e53c4d25fa90f3cdaa4fe0d914db5cc0993
c9c8b57c2149f10eb620ca262f28db8652dd0055206916d11ba0dd52264f689a
ca7aa67503dfcf76212ae08c06cc94ed9b8c15c2f43177cae68954ed1b5177bf
cbad05b00d7cdea14387ecf05289fed0f1976b3639828924bd811ed1166cfce7
cca1bddb897505a9c8974866025ed7a85f1090c544e1cf726a45964597fe1730
cf840923bd65c9def9180b014ee36f383c05085d86a26ab4d5a9afd1c7adee20
d0e2707d86f5265564647923e2317796c5a1b81c583de988eed5575d1c332b75
d11bbd3ec7664f0717e4e5abde923c553e1df11e2128a27cc523ec4ce7c93688
d1b99abb33c3523f4def7e3bb81de54b9b2c0d6bac06c9d12f65311a75ef09d2
d35b152e6d0c043db3ae34b1a84161e094e45dba0706fdc8cab9a220fe4cc7d4
d429c20fe1e5c59e7c22c276e2678312388436b5a08565d68d19c63c4910d401
d4aa781f900608f0add9b6873380b4ee4dee99832dca16c628173b2a81a1c06c
d756ab3937d4ad3865992c7bd2328c346e15e569f3949ed2e7bff75a776b916e
d856a17ac4dff36ad0c9c1f3bef5ffaf4f2cbe2ca154ece2dcc3e9604bdc1899
d8c240ea62cc1f9d03552e62a47276d70e1ed561296f6afef4a3d4b78c0eefa5
d9b511d9240ca8107ae858060383501b696849c810c652a57aa76c461f5e53a3
dc201ed3358d59362ed98fcb2affeeb440624e9ea2dacb7f925dd288c314ecbe
dc2fe82136ea77bff8f162c68668dbb961a98a99a32f4c1f44c5eae2b58ce913
de20ff053319476627fd2904a05cff67bde11c554ca237e8fe375b2caa250c38
e08a21721e9a79da3c03020cc765ea33e6b1b0c10e76664842fe9c54a30c3689
e14752804425a6f350e8132a004abe8ed090e4d5fc962e1ff182369a37b7adb0
e1a657fe051c7a884affaf8e1c837316a884c8d2338964fce93c80d8eb8403f4
e1bcb328a1b4a4603123a789c700f1e7eab7fc38969ce677279205cbb055f4f2
e2513b68148487e3c277f180e567703f9258d6faf994a86bfb52293ed79d61bc
e281d367fa60972d04986925c5005b21c6cf27ae73654d799646c7528fd20594
e2ef381c1c9ac707bcea6a0a4e104176b413b6277ba09a856db2c4b5902d03d8
e377dd5bb6e4676810a91070fd7248323213c9e7c20f9874880785994a5b3750
e437949dacaa047850c4907dd3a1e56537c6e8c2550b506edb047d8dbca81841
e547c90cecdb25cb41a86a660cd30fbba2dcf08351cadef90fbb69af3935fd46
e5ff0299f2b748010b23dc875533de75284e75e9eb965763e5b0d3473e1f0da0
e705bc86af5b71c362afd9df84ddf927acd013d44c02303997d23127be782060
e786a024097346f1d67fa80884e92b36060b070de0108225d1d66e9fb6e13d42
ec5e0c68dfaa3d484b0e7ae7d0351b8bda93e68c85c30820132216a003cd4c16
ed3c95413ed6a0f70e8907e2ec092ae9541ae37cfa4f74cace9fa732adbcdc27
ee21121b9e4f05ee1d2fc67659c7b0a2f03f874d62980288e7ad4365284b1e25
ee733103aab5eee9b870891e7827f54472d93aec42feac624f33eb5b614e5714
ef12e36870183d39a2ba544f80e13a8b7526d0cd8ee23c93b104fe30c5a0f793
f165ba3b7ab102746c8f98dd23e45d19003f6914700f4c539cc9f513573219e1
f204a985d3fef4e6b2b9e179ebddae4a3661815787b72873a7a0b262fbb9a4fd
f2db219e190789cafd76746c3cfe8c5b969fa24d604893d4bd2011e3bb1f558c
f3822f3f5a515853b360bb89cffd35a264e1239e51cdfb688c3b5ae7f24f4130
f4c752f8c25ff0b2649f25dd2d1dc56d5742097fde045cf74d916c57a1a4159e
f6dc36e6c2e8455c5ebf62aa883c7da72fdba8a56195d776aadf30223a87f54f
f71cf351ca7f8080cda506d5842d0049442b8947c1d03bd00e97760a1bceaa89
f7544f4abb5a740a76626987b87187716163314d7983a2ce697726460e673e71
f7f5574bc9bc696642fae851ea2a6659dbc22d5ed6a2817118a9f6f4d62b7271
fa0d3c7bea6b8d78c02104d5eddac98553704a2451c95facb66f4a526dc09a41
fb399a4dd0913dbd9d2d6465c296e07705ac20811ea9a5b429abaecd718c52de
fb78a7cf37b3e7d4c213f066f9b2f9ca8e26b8064bdecc68aee82962f075d882
fcea53a131c6c8ea8c087e75e946b0000cb28c8f572d2ad0668a34f5a7d1353c

Epoch 3 Payloads by Document SHA256 - All Times UTC

Creation Time	2019:11:12 14:15:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
0653255dd7d873cf9613d6d4ea6801eadb34153ba3159b5d98a06aa5fdec507f
0a0ebec56a3ac94ad0eadf3989adf04817f8b7f5366a2f3acdf15e0a3edc0591
0bb376c2d40d61805a25db8909718c2d67b3c0824a906940b218020637cad0cd
0f2682e7f1c7ec282dc93dc0ae8cb409cf90e5b26775ea8ec560e21955529b7f
0fe1b4f2a0e0f148de7869f68eddaa2fa6d7fc7ce3016db4b114cf4639bc41af
1226fa2c2f1f81377c87ad5bb0183dc1504c24b6f2a5dde5ded32c7486781f7f
15c029f3cbd1e22598b764509979ff852b128dc3a4131c79a984fefde086cb25
17056ed5802a5dade0ef0f8e636d2ada3c13941eb2d387e36bf433771de4ef52
1d34e372e36a2f9693e7226f3716146b52ddf0ae2c8fb0017a5acb96ad14218b
281c136b4338238b41e9d2f8d3726a235d9c0453b7e664be0cf4c86833f0a7ed
288454eac8eac87af03a54afe313d9e662d597fedf0778ef559bf4ca84670562
2b7c4c4acf60713a5e27ffd99a0ec06a04e8227932520bc53883ccf764723051
2c8df38db7715decae9ce3807c972495da81a0db4892ff466d78d1478af02b93
2ea03d230480c392fb243a0f8fc58837c74576cf202f31ec666fa7625916282c
3282fb8ac24880af4764bd02197d110c7adca54c173c69c72affd2aeedcf9b51
348b43e71947ae11c7b2c97929fed823b847ae87eff1fdbbf187529af73faaef
3abced14d12343ed6fb9da0ff9b8d1989180b003bd2c80a304c221b3bfaada6e
4046a302452d6964e425512827c280f233814e733fd494389a725966a94f4965
4064c8aa6ea39079c15e11d7a2fb809ae6f0fcbc8947bb3324fe79d4d5e35820
451c6cfb1975381f3fea040e24b64cc4e2e39cfd3e6adf5ef201e5ea6905e773
4a51d4dc7cb3ea12358803d96d94a048a958cd188d0bdc11ce5a7f8e614f466f
4bd66cae6264fb7d0c00516128faffd47e48b43880fd9d3e11b7a995e093c868
4c5e09cad86b968d9e9ac0cdcd0040ae87f7d9e61b287e663cbc2c986ac0070d
4d8af52465519cb77c52431903b082d37ee55fb8b523af4c145c64826ab300fc
50d982a935f2ffeeeb3e57d9c297e264b6067da53843128cdc2d07b43e2c6bdb
51713d7218b26b4d116c0594e31b0f70c9c3e8388433283952f714d67071befe
524cd0283208dfdf4b0d960388ea966dd86b013f681bb52f2a28675b20275128
53bb0dc065019204473a685495eef62a9e6021d7e921ee37a71a26817cc29b6f
544138832720a775cf22585d27a88a0a8989508ae1a71ed3d35749ba526aed95
569790a58da60528816a3a0eae5651e5a78bcdb499c2a91253f40d8454dbfb39
5a0fe0cb4af8fc5b4620614a06ff8b20926f692c59de0ec146852067a27fb2a4
5cc673236b7fb84d927990d348872e261452b1f6d4873cd4cab15fc41194cd50
5e9ad1e145a643900f289b157ff88b5d3c435f02af30b3cbd532227a3bfdd293
607c7b3fdd06165d6f03569811a69596558616f4055c89f92c725b7e27ef5c7a
63f51e178f37b98cf5a2a5c7869b9d2deaaeedc48c6a6c3ac69619b848984ba1
65408a97451e6fe9909691d6def5933748222faa4438b64d7e6a033e6c27d7cc
725f22e93a0f38d66ed075c7e6f225d412910abdd7e11917089e11113d95a0de
77682787b5f40beb0edc82f4e53e53e227baff5b897c1dd2019ed7b70f9ed66b
7835d2edaa888cd0098f5e8ab3c7515909431232749a7fa552c3415eccfa74dd
7cbd44bd31e783a7abce70d09c18e04a681483565f5f249e842246147baa90a5
81766ec87572fe84349e8257b2578d6a9a801ae9de09a0d30e2bdbd7441cc0c3
83e9f2ad40fa0e124f3a2916975a6ef7f2275388caa7a5c46f14a60cd4d29ee0
85e601a78eede4f18b6a998963ff8464924e6e56ae3754973c3f7cb18cba5b1c
8a172fd5a5b035e1eb7aef8a96ad0ebc0cee3893a796e40c8dfd17e38e00f57a
8aefc3e6b588ea685fb6c516c34d6f5ef89067f0ef481ae1890502fb33979a82
913864bc9b02a4fc87d2569e4fec21d6dd8ab737277ab415dbf7ce1f6d24f895
91c015ffe7f9b56befb305a783ad8943cfff0f8e0ed205b1ef54a8336472e912
91cd4b5bfae862d97725adc5b04f7755d69c4f4d8e6b7d56ad4f4e7fa36565f7
92bb40691d7fd72f052e4163683cee99d6c608c865b949307a6e6bd2fa2feada
965a5baaf29ada2b613b57472270f845bc65a1965f05830ec8c008547f95af74
99140afe1c64e2919219994a2c2822c56a290022f93f672a08201921764ec119
9a80c770d119c34a5fba38339127b2a5ec6ee67db74b6bd1d598c5001295f474
9cca852a5258dfffcbb2a29517e7e2955a181584f5e92d61bdced7ed6484c616
9cefb9ae8b625ca7a0276ccf12822014e8b1a6276f8d391d30773c394b0aadc7
9d03d51f399ffa8ec85e580b321527fba3f3a4432ca87930ce3f858b17f29538
a1f8bd257dc1d2ae0562cf6dfb03945e82a53b0334acd16934b4d64f93513b95
a451c6b24f0c06a808ec1469311e74f9888409cf61bb3c827a5c160316ae3bdc
a63ab7a2c7994e5605e8bc9a8ee867c6c5eee9c30ea768f80d53e1cc9092fc73
a8214bc3fe5a6af3e8c1b7c4b563eb50bdcfe716b4e38dc8718e2ea545f38340
af349ee6378cd858bc28fa5198b2bea3433aabaf4b5d17f10b4a28a5f82c2847
b3fb91b2fdcd7db827a834b1ce084193a0d74b2439e158d88f92d93cfaaca57e
ba415481bfa2782c35b2a60207aff8d312a0c120c2065bfca0b73e0cd9144e30
ba92b38a1c5fa1e5e04036a86ef441e29f08f1f937a86583e57d6319bcff2be3
bc86764032ec8e8af421658ca959b0872ec790780a2fe1c7a22c976fc3871e17
bde1d528d00c78b68395c4887b223049645637cbd3e37c7e080654db58512497
c410e3c9afdc9c15b302a42b4f334dad50e580125a7c4a3ca19119badb6997b1
c4c4282346618e71c1c2d9da58f6972d11b789b87863e689fe94f10997e36099
cdfde8ae74c442dba426fad02140f16aebcfbc6c055b0129ef25d4c4ea46f35c
d08556233eca6072929341e720dc5fa213d87bf69553914e05fea3a01412756d
d09e28d156721ea3f143ecc033e75fbad8ca24cfc79b1c32f633325e6b36f01e
d17878a50d57543c4dd145fd86449d8c7b08f70a0898e41616109b21e52c5be7
d1c92c4ed2d56698b1069f7d3cfcdada560aab6ffe7d14ecb101afde0c23963a
d774293a83cddf014f2efc5c50de50d9b7cb4a8d64270c96f74bde2a26dc5a83
d7a1b395b428eec7c0846c96042176f85044b1f819d167e8a10891737cfadd7a
da58d456a3301a78e1101c25512da157df3c1f769140ee1c7404566bf4739a87
dd34744d1d098eec605656d76b1b6c46fbb2b584bc5324cae2616fbc9619a6ef
dfffa9e81ec0caff8c39ad5cb9cea7ef15c596ed11bbd5f78b590b2105fc6eb5
e081f2ea394210587d939c5e39f7d7fa8685302850f4e78085b0d19d572944f8
e2835db319f79ab82b01a80e0508cd4405432a465d185f1a20863fae8f71d88f
e2ab026b0f8d4efb8fe45efaf7ac25fb70a4dc37d903e467e1022b8feba0f840
e2d6e076b612060ce646b81a7c7607df3fd31030a6b23ee299f21ce7631894a7
e3a72fce90bc5829addd671bb4a75763f045c011f0c77f67c566f300b2b3ff8f
e740e77c970041d098652ea611b524a72196f0423b35480a6c4601bf5cf4dd3a
e96f745f8a33294cd3ad5225dcc175932ae3eea6687ee12dbf0592b19aa69fd7
eabff79f8bb9823ccb7f3d16ea415fb84460322f358321676e79eb775014f0cd
ec2073694d1c14b2d0c8ef2c29a03d0138d06be99e7484e0e24ac61319887116
f01232aee4df0f00266d846a760ee6beffbf26456abfdd90a51f58ceac429cfb
f10557aa94b2591711b0e92c3ee9c2c83371c5aa7604b3a4ec9c063720bc5895
f2b5f473a1e93d8a395ada81bcc2ec329d7c250b0ae6be58ac84677e9941a480
f76039fdc096f10e10c0a3390bed13bc9a9820d429646dd4ff003b255beaff16
fe4828789967dc9a66015f02e1eb23a39c69444ded34028038219879a5b81d89

http://heroes-center.ru/wp-admin/lqh8gz8stq-7eyzk5xc-1556304278/
https://blog.urbanadventures.com/2dkh31r0/nUxsruLq/
https://docs.sunmi.com/wp-admin/0fbbn-863k-7618142/
https://capitalgroupp.000webhostapp.com/wp-admin/tEdZZnw/
https://zatokapomyslow.eu/rs05i/99sps-yvq-72812/

Creation Time	2019:11:12 11:28:00		(Attachment Only - Doc based - Office 365 Light Blue)
SHA256:
00e78ab9ce37079fb282b28831bcf23c994d8ac34dbdc96e7507642c5c328e2e
0b479e3ad5c85f6b9e681da0a6efbc00034aa4fcaed48686d72c509bdbdd39ff
0f0fb71f62277398a0bd6ff295b5778d23f93d6f04fcc8c9c1ce0b1ca77890ef
0fab3eded7f9c298d16f8a01eabf721cbc7d33a98ec9614b720202021ef626b4
100e2721a00b62778d41516cf3224ebbef40ebcde2db9d22146d36869008ddef
13b95f11b400d55e8f1635527760c0eaa6f36caba6b4ad5b484c73d343954d9f
17001f7be06b45995a2c80b0b305f3def94afa858042d431b2d81447125b4f10
17f98c5b6bdbf833b7409aaf6488dc1d27c915a4a08929db101761083e99f8fa
18f22575ef41030c892a97bbf96909464346cc11e00b3301c1e35493d55f08c4
1933df1571e66eac038688a28988802bcb57aecb98d996cec9a366260bc56e96
1ff0296876fe2ebffa85cb9569c5fa186fc416d6743d82ac791f03597f086561
26e08f9b7ef6de393b56619226173782be9000f03126e1ca2da85df5e7730058
2e62be735eb1068c0410df7d07512ecb08f6b8dda24953fba85a671a872488a1
2f7618dfc2e17bceb29acea6e4cd11c79c4b5cbd1be4d12504b7fab95480aff0
2fb9de0950db8c4102bd2b9d527ce40dea82911f4da1a78173160b4725bec7f9
37a64121abe1aadc712d5259dd508699e52f102ef4ba2985b2f7545589e55bd2
39066554ed0275679817812b1853dd1a5d030333212df9415e114dc2611b70fd
3ba792de9ff578c3a1d93cf275b9977177dc9df7f9638f85a0ef3dae447e5e88
3c175d3a008b66a64002a6a3f76917a2a78ba51d1453d21fda9840b83222ec74
40ae853413e9671cef954f212026e5951a4d1fe0c88810f51caec48b6832850e
40c3ef5ba36d6202abae14db2b8d8a8f88493a205701e53985df7ac09cb9b9b3
4ce9b65af7e59e6385270db0a9120971aa4dc61e6cb760620678172638638759
4f9fd0bed8cf4ea3e3d18c540950b8228c92e28477d9b9b086253bd28a95cb90
5106326e12fc7b14c0f949fef97c69ac5b0bf4d2d4fceb47c1ca4ac110edc438
5300212acd4b24310390a619ba84286910cdd2eaf9bf3cb0afe54d5bdeddf7d6
5706c85e24ae5a520af98d035d422f9b4c07e037ba8515aba94bb9fcfb403976
603e9fc115c0bbf526ba995baa0fd5d3df5c2932d0ec34e415d5ece6ba751861
65fc9eb2f1b05d768c20db901196e50a24ad384baf8af4e2195f20b68edef0b5
6bb56efcf139776444de96770ccf98af69a9dc20ae49bce6af2fecc6829a0f08
79508ba23122b061d01082b3288104eaa32e7984527e710508f3e078dd7fa6ef
7f341f9a2c514e32667f28c7ea11032937ae9b66437c65d8e6c364f93003204f
80f2203a3548e5d5b500fc33d293adcaa45e6ec481184261e64197b3673f03ba
814401804fef97a5d61b5670b0f3fc7b88b4efeacab3064bc66edcf5329b7d8c
8563247decf2f3936a8d47ea986513c0e16acac04bf99a4fa82675a59c6ba78b
8797fed160de051af98b7bae578638eab19b82852c65eb87c40d88420cbab9ff
9223de7b01ab736c23b3d8b8d920d7f28eb993020a373f2bf3f73a9d4c88ad0d
98d0fa8dc5488763b0e50f4e60432630507c0ba01dca6794432c65da6872560c
993df3e1640847bd6caf0284ef9a441d3d8316816540b1c218b366d10620a776
a677549b765eab24b54248b7aab3a3be3e63d685287c219190cff2ccce85fc7a
ac5b5827e577c7b4e00280f99c044e7bb4ba04a3eaa7879dcfdfaefcdd98bac3
b2f95590e8c211fcafe20d27267f736d3f8575fdc1d65a40997ea5e399d4edee
b46e50f0f939a60842f2b7dd9a7b216c3d698a926ade2498a372bda80757de19
b9a4c8c894f993a6b8b05533a89c20fc56daf0388d5d4dffa2d0135245916888
bf5bd723cf2378a6dcbbcea6c26ca019a324884d4dcb013d3bb4b840b24a554f
c48ef27aa9e21d5358d5044209c9e3e837bc32075a778db7bc72045e3592b8fb
d1d51b2a416ab30eb68136713e98c1ba05afb6bea767f6521ade861d5d4c1ff4
dd339de3eddbc0fdb18bef8b477bc8e029ce8799a159b45e5172518dfcb0dda0
df5192c7b7f4b2381e9187892cf3de49aa738c64387a70a110989ead330c9973
ef6ee0c82badaca97c9b5e07b5965f3eb13dac99f10314df6006c314ef51c631
f3ee31f31fb9b5bc62156a25a7ab29cf21dc98ca83b95c187dcaddf3807e1c25
f848a8a26e94d158836cad85d5f3642f6ac10fd7629f9a452860bf7313558119
f91f281f6761e26461c59bfdfb17c25652f938286c30c021f0fa02696fafe28b
f9f66c4e7e0961dce924713cc1868625b7f94d9330385176924ee65d4fbfbda2
fa4a79a7ab01a63ea7b7451fec2e2543008bb2780016fd4457ca3bd850d2c6b6
fd9162c227641626f652bcff675fd1e4212437c03e083d8b61da7e709823d46d

http://cw-233.xyz/wp-admin/0jd3-nnlsxc6-0339722/
https://www.gonglue1.com/wp-admin/b5zd-e4n2k8e69-6859983/
https://confidentum.lv/wp-admin/gg9-92kcu-7753/
https://www.streetkan.com/app/fcg8bi8esj-uoryiu-923561/
https://musthopanewbie.000webhostapp.com/wp-admin/sQJFLFFj/

Creation Time	2019:11:12 06:48:00		(Attachment Only - Doc based - Office 365 Light Blue)
SHA256:
01f28d7d2dba4557f1995070d0150fb4b4320cb6c2c4462c510af79075c0ae5a
06f888f3414adf90922ae4466cc1b44b36835550529d2e4f7f273022bf0c64a6
098ce230f8d19702a3f3b3975385d542f499a1362ebd4aba5dd1fa317c1b3c90
0dfe5eadeafeaf06f4de26da63be2285fd020fa2c2cf80768a4208136065ce7c
0eb2ff33121af80e2e5497c1ae01eb8811a49684e90e987b2097df8e702dc398
12f17b52f048f20ea06815266ad47b10065f59828dfa145d49bff74272be0701
1f0e95ee2b503cffab380fdbd124fc447908eb098b67d5564f17ab619372f1a7
2ef28a402177cfec70cf3007b1ff16c293fc528917abefbed33c5ce1a3bd8714
30f2845e0b24d630bbf6d7d367c4a57496eacb8ab011b07e3215514c3d0b0717
3432c84db4db4994fa56ab341ec0471080237e735d6a0f2774f9f5d067e35da3
35435299896055f3d5cbcc0ca3fb7ea998da39b89830f39afb4a9d10c3b31fb5
35ec7f30545ac7e15bc0329cbd339a6cacb8faaf963b8453f3a90498f39420aa
364d9590c98d346f63659356ecd6593159c338b21e4b02f41b3f43226c5dca71
38bcabc980d96c73fe34ffdcb3a13f42de42eb4b59b985965bb73abcfd696f34
3940a4f91d440224b84fe09422f72a63be32cdb8f9f2c3c8bdf47c1e3b0926cc
397163cd04b646db5e95911538e08178180d6e6efe86f2ec48b5f2cad2131f89
4dea530577d1b67ea115f90a2948d6e7860213eda42bc3fd5846500d5f462e5b
5099d800920c2f76f8af72ef685c3d3592c601b841c114cde586b5f47210f541
517d348afc2a823d1ee54fd433399877644232902dd5104bc08b85784d36b8d4
5233e6ce363b2df7236dffaef7f6b386a315854c8efb2578c5a512c7bd560e98
52c7e980016ff8f846df61e233ec0302151b4b082c1b4daff1151e3649922dff
57f44ae5d2155e6451b4603bf4d947c0ec673ff4bbc9d054abde0068077becda
59849fbd8551c0f8659c453f8a074ce079563d8a92419382c109be08014f5bbe
5e13f9a4c31da4737ab2fa1524167bb5fa1cd6254a2ba4d6dce560ab4ad06b2f
5e6f3afbe48973ab92258fdb808a34ec4e8d9e4372aa7b886a90f9d1106dafee
6072c40a5161a1e5ee5ad356268a7d6aa2837786903034e764b9466209f3c187
6a72ac446676751600b83f131bdc58ad8de7c79f78263ce573dd2fe3b1b54894
6d3330a9e73238f7ea6bc4b7c9cb3315a98cfb593080f8c68abc960ded7571e3
7139136a7c16ddce4dbd10dff8517a5db149e8f5a0ce203905e7132cda1f90c5
774cd2af22b191f2985393c0f0d23a3f2a2ef8fcf9d27d94b7a984832b7dc5a8
7c20eb486e4940c554f2ce36434dcd9af0410f912f39dc43b07640f2ac772b41
7ca9eb32aff7f1f1c37456d462fc369f434e37beccadb21c5e8ff31b81ec32c5
7d2d4aa06084c0d7ff14e225f441bded01119ec4b920453669b23abda5e224c8
7e267f0193d800862acb3bc3796ca8ad3a78aade8788cbdaa11fa96a5c1a9081
7eae9db814200e33a63acacccd0fd4c4418d54cbf6b3ed2a67ad9d692ac6a67b
80b7c0fafa7507ece1f34b7a212b8696abdd300a171a068d6ba488e525278e4f
84f77974014a06386fcd2982308c5d4e0b312372c533109ed7bbc29d83b25236
89e864a4c1a0ae32f5d4ec67a22f493f2e7eb28bb36dc6c8fd8361ddee0a40d4
8c0ce87ec12c005116a09e95f18347217e2bc4463929180de12fab08fa9e0582
8fb4ee97b56c765c064409eec99a026b79e682749e3b285e8381654fa530b1e9
94a75628911794ccfc1f2f5cc83cc07c3c628a088ef57a9b8a9289bd8a751c2d
983d2b7e6faaf8ab9ed9f8635d9ece7788e7aede1e91367b75e62c544a9df88a
9dce86e387b1664ed30a1f78ea5b75a9e390feb9adbc92f478e58d44c1f17d55
a4b0cbc3a2595d67551ae62510c4a2d0d2ac8be60a8b54a737c263a612c063e2
a67e1d5c7eed864c7ebd14ec667dfdd1ecd9d3e2d8900c2121ffdfc8234316a5
a703d6d51659f5edd83dcfba5c28dbd07ba6229f7634f1dc8274b32d44dce8aa
ad569ef96a6aa86265d9b0771556cb9fdabc6539ea11e6e7f17492fc868742e1
ba7822901872f1702be8c2b84f0d64c018bf69f2a19ad2a22b9a8adcfe3a5272
c1b8a766adda43a8ef73319e9c14d068152e8d35bdcf0769aea36f6394c9e408
c3da3df3b1f0e93b2759ea02905379a8a4fe5540c0ec393e8e17101bcd107b74
c4557dea3a010c26052a0d1f9b740a334cef9fe2108a1ec5b3058299d64a6c29
c69ebadab33d9ce7eebc515c6c8a2f8d365334e75365345c800109d2ea83d9a2
c7350c4e27da8fcb9ec25e94f947ddde064b18fb62901fc299c311f542ad4436
cd3c54861c9cf8e33d6623b3a7af3ea314a39e2d1e32d7bde6176f45b06f44dc
d1e213ce9ed48dc1ba61039d0f66316ba3483279e280ecdd434b786d5c1baa19
d22db7774f79dd70e2299dad2f0f3184f0128ad479d209eb492b17fd9e0d6849
d34ee209eec4fdc549ef7f7fa82e97aff4205a09ab0fa7c47d53f5c9dc67c36b
da03598e4e6a6e991d95f4e63019f0603bd29d90f2837862c3e0ce4610d09a9e
dc02dcee2285784574fa90eea81f90810ad826b6db2fdb01b5e844c01582e264
dea3e47bedfbce91b16b8067b5b30993594894bbe89fad86bd49f0d39a36e440
dfd2418f83048650445464a6e8711dc41fb63b9c362a70407f158c1184b8b9e3
dfdf5f5dba60f0947d05343b8c759c59c1e2097cf56468c9b7f309a2de45ee03
e34534aa111741b0aaf8a66ef666afac2b3c235df96e5237d728ab3600d90830
e5a0c0ef5697216ffac991176a1b47943371fafd16cc05f33d4250c3a51c66ad
f59a44e8519626ea5dbcc022bd8b4670221211470b190e4a40f94e76b55bdc97
f6f65223c1fd861d52e541e588d13f1d842771a14bd1a7e7bb5cf28b5ebcbc89
fe36708c3d8593d71829a94430db755c2aa903a8f464c16693608487a418dc23
fe58cae48337da88492b3d2d4d8e67b33079e98392c13b584dba1dbd82995f4d

http://videos.karaokelagramola.es/videos/yZktzZ/
https://gestcoop.milgestiones.es/wp-snapshots/kjb-h453j9-990472/
http://blog.aidhoo.com/m4e46dr/qIVhQJ/
https://camille-daher.com/wp-content/rnnChU/
https://gencturkiye.net/lcv/bshfFuSAY/

Creation Time	2019:11:11 17:42:00		(Attachment Only - Doc based - Enable Edition)
SHA256:
00c106816e34fab223f3a06e4da453b98a99d0eb00293f77e3a3208c1e050c0d
0212e9494a159d08f8f9d09df72110fc4c17252d275f034adc980abb30d8b801
03b8b5fdf9c4d8e7f2401399f0cb1ba03a70fac4936d6b67ae25a287d24ec942
05bcf7222178522438481b00128fc1ffa3a58dff86b20e78caa0a5d5dab0c95d
079affdc636760da8562949fb4bb46e43715610d20769880700b416c6edeae62
090500986ee13f0d45cac73e06c6ce263a3bb8ecdb662d9220f69ccca8a543a7
099f3fc294fb17b4b4a7c49d5de56b8848561743400f2b94bbc351d6d1be0d2f
0a1349e3d1ef34a6aa97296674452ed74a4c8d121da0129688af817c87f968c7
21fc9ff176bd1f11a78930764e7abfe2ec6526deca9bc563e63dd32e907155ba
22e3ef88af746121d07b74b7722e6cb396c1f787c2140f0c548488185dd397ed
23de42bf7e91f0448e4b84b369e259fc93f85d16a65d3a45ca6da2c8606932b9
248cb5555f59e7e91aab3ee3be1e359de012574e65077e656a358e172f22f8cc
34cc9327fe423b6bae0ec5d71c1101910330a095fbbed12aac135c9acee05aaf
3c9984e60c3d6dc3905512d9bccc5b1af194fcac28c91163f7de83b51a22fe79
3eaf23d102fb78575c43c6090c36ca5d5365dba7f2ae83da998223d809efc79c
410c137d722ffafac4ea71fffe59f9605652057b5932c3f3e106cddd64212a64
41b73bac55830a5611ad9fc87898e20c6ff283afbe8f6e71585dd7adff443699
438e41e073d56e5c5568c457d8199da06561da5248416ace58d73c5c8d46ff7d
44477191aacebf93c4a1d03c24819ee962a9ab31c0ac2570fe1d152ac0e54cdc
44caf44f37909a47c3ece5004b46e845d3006c950dc9d4a7e042bbf229de321e
45dccaf331f175121fa6ada55c35f0ba1a1a7e10043590a3711bf4957eb520e5
49117c5796a2f2b9917d1629af40a308d4348ad39d2fdf079f841b00a35a5705
4937c9ada54861d11585f74077fe237274576b9806de39145586eee02bb9d951
4b54384255e1ee8af70ed7610404c322275eca4ba035b644519bf47c89590966
4de245ea2758ca31c3d6271f2975d154d577463e8ad2b558ccee382ec8ab9a1d
516aaa35f105330147d3a8ab204734e1ba66738c56a0b44b4185689379ba5b14
52069fec5ce8f260d15e90bf6b6cf68e1652e5b23fa6a217f10cefc9b61622e5
52fba817b573a6e7817fe34ca8bd683c675df5b717e02325bcd5018426826ec4
56dee55c84ee8889ab0b22dd4f52727fd3f4a9fc507cc589aff489a58614f377
58169f6e794c040bf50360dd34216056f531324525ca7ce5324833200b6f32bd
5af902010baa8a3a407b8ddd24042540ff1cf38a968a9ce32b9b0141be15ef74
5f10c29452040add3f8f84b02b9574d28bf601eab4ec5783709a62477e8f8281
5f8102694fa0cf8b0ea1283520efee7d8004c3e11b625c3d4bd4bdb4300b658b
651eadb987cff8f34751d2f17de8bb1724500261f53d1159fde4ccb61c2d4bce
6644a214e7e117aab8c6eaa57ba9de55e19ab0aca56d54e257f43a9d383ab1fd
6f3585ce4dc948cb2baf331d0b818c6fd2abb91d734d611298de43fcf17e1f28
6f74065825fed72252c891e43701cc6f94ff69b9492f440160b2bd518c85fdc8
76e4723aaa20a3787bba815740510afb0f0d93925852f62fce126eff22123768
7a7982e7f2d24338d2ec103a348fb29ffd28abc28b5773c0cd99e90d608127aa
7cd9c1b00fa79d216875d7edc5db7be3aeedd7e91d37a2dea17ec8fdc6853174
8169868af14f44058d2ac798aff90cfc4cb84ff2a5e6589bed7c4aa278d7238c
83ed192272b0a1e2f11b6406d498858944e737223815dcbd68cceb501396ea1e
846e8f9dcb89ccab884a2159475e1abfa824993176da3487afa6572471fe83db
8630cc012997660269ed503cb77543f328ee46ac57a57e1ce673fb8947f66547
87e62a77a8ab451fb277467e5f29a80b4cb5e6124e0d5dde160352535d92263f
8891e93807c8b69d0f1ee932dd0d174916c30967e9d1aee5f062c32dc373b7fa
88eda2a165004b6ceeeee3a207a760825821827b942ab9c3f0839c167470fbf9
89c4e7782e48d162c9f3b7ff89bec07752bdec70ab1fa92e6da25c5e38a3ee60
8e7e3a6b01e3fcf2bc52f93763ca8e1fa04962e395883af56d23638e2e5805e5
8eedabcbbd4f2deead097f99649f18b68ca44beafffae501416b92a1cafafb21
954f9838cd98b764fd73449b2c5df44dc7bf66eefbb5e5cb6e069a288043baf9
969c7157285d9203526b06a8bd8d6240e05206a6f914a50669d3b37fb260fcaa
9ad5756dc73fea1446e7348f1416f96765ef2945a64d996a82f0011df2da86df
9d110923bc38f3e86edc2ac10e932f17cddd9a0f57377e180b0f4923c2a01206
9e2c4cd43ecf704055acef83b7b9f78fb15dc5414ece00d641e47482b803afc7
ab850b6327696db1401e65a414fd5c249f8830b12b577e23af3bea10a272b72d
ae43cff40d3d611b47251f5b8226118be17d5fd693c2a5a05b296a058e438a50
ae54e0bda246ae331595426ee2df64588a6dffd869597741ff0286bfaba8a8e8
b957490379335c8ffdf3323d6e624b98aeadb1f8eae0614455e6c289585f2cf3
c25c7e9ba15cbd85aca1593eff2dac75b9eb4fafa5c30e0ca117362555c98648
c5f63e3e8d996b27417b0a9a03fb928b4cf2a00a0d3917be1a057ac118e3e25c
c9c45f10cc9669e97f59d4e363b09d885d309bb46c112b4fe1e6e63580bf0c8f
cf359fed4aa0a5a748fe240b28c5eeb166d3d1ca70e291828750031be9df2649
d0c1aeff5bb4bab96536593f9c2f1a43d63cb2b12ccb649d50e4ae5fc06e3c5b
d3c0c2e7b0325f04590f80326e3ee44d65639fc6ad5ccd7e1a30c0c0645d6cfc
d4ca03de30c10370eb47c1ab41d42cc580363a788143490d5a87b1b01372025c
dd0db44aa95bdfeacdb0998ed641b5156b224a3078753fcaef1ef461bcfc87b3
e02bd6743bfcbe705218976f22e3906304501ba6198e199236df5017064bacb1
e46aa355a8d116482f9b88c8ad55205a79bb227914a50a2419a170dceb4ed178
e5f9b83ae8f63af6d43d62de57e558230517c20dc58159a10814b3b5f4bd6934
edfb6ca90eb48e747cea696d90c9e7ac2123836fc7e92ecbe27d9885098e0546
ee6e6ac3387769bdeb5efe4a7f6c9a25d83c2cd2d7f39bedefa9aa997d67fb4b
eed133d2cc9cba7778df1fca2d15b8b4538baf10eb66ae3a842e55a3662d6672
f0c3c782e52e3b40fbe5eb935e42d33fa19e6d23a2e06f6c4c81f332efa86e82
f2eb19a2bc53500e6a8eaa198b527c15b8c40ceb5fbba8799d300074ca0d1b53
f5cd5fb7829394f4eae828d0613431d5c80fc537faa1b2cd5f4d95e203fd1624
fe52cf0eadcd55f56d93252f6afcf0ddb1585c16f9ddd6d74c39b0835e20e133

https://wp.ellatech.net/wp/wpellatech/uSMDYJE/
https://randevuyapp.com/5fhbu55/vehzu82-kia5-39703/
http://tumcashturkiye.com/test/ssi/typo3_src-4/EAgswSzX/
http://terratacuara.com/ebldis/ao6i3fv26z-2uqx4p5p80-202/
http://webizytech.com/cgi-bin/f6uk8ie6-orsj6d170q-8480136699/

Epoch 3 Payload URLs From Unknown Document

none

SHA256s for Epoch 3 Payload EXEs

001c52237424a767be95250cd09a80fc68e3cfbabda6b82720a7c7de98c535da
006f3c488d67432da73f4d98e0c42507b8073029166f3a16bf9b4a93563e795c
00de9896db3d47aeb09985f2bbd0a3a0664e695341753405a1ce58b9db9a9e6d
028b9aea6dd63d69c72781e20e51d5b3c003c2f0ed96b07c35c76441d778c16a
02d02811809a8d987618178fb9aef61561cc1935b74942a7eba5215c563b04d9
038abf6f1782443b629e92a29455c6f50d69851d68f01e55b11007827499b684
05b82cca05bfefaac5019ce7b4bd73ca02e1f9714c99b64b31f2ef8358a93e60
061946326588e2b83b0b26362cbfe55e474d8bd0753985ba1a51449565467291
07b04ddb7dd6e91deb73e500f05272d8ce188b30f4911aa8443d9232b7b4dfc0
0872221f623874a848d183b0bc44dd9e004c567a25cac572b27d5def46bd2e10
09f23fba3c1c24fa80847d9e3a0e88bea99e19af3a964487afd6807c597cd483
0cf4463263bce570694526f4610e69ed12498ecadae905f4a722480b11d078e2
0df00a7ffd30a0d1ccbffea42c71f34053b4d48656a1e861e29a2b3034991924
0fc9969206fbd0a1dc183e03b944c755cf58c35ba52143bd4a43b4bb0f8795c0
100521a150bf89cf0aa49dbcc6c1141c8f3fd98947df6b8ff6c44f9f4dcaffb0
100ce77546a4bb61479b405a8e5a73bcc2e170126106a701c0d0b34a108e101a
1076471c3132b111d2d91988f78b38aa3a63a2a249f37c4c4d5b27e930e5f876
10daaf65e646b9284933b9a5272e3bbeb1d2f472694cab64809028b883115af2
12cf2b8d3b197e6a1eb035cb9eb9b717119b9f69a06135849591e94fe4a80aeb
13234ab96155d5549d4d882e3ada46e9a49e892b8358e42719b07cab5b03a07d
14cc0cc173048b9ca36478fb93e8957750919862dca7c1c8e1dc4cc41da45b6a
1663538973dc7c6b7114bf199d44c6b40e134f2fc5fd905726dac3fe0fa37dfa
1854221af0eaf5eb0925bf42f88def4b6b3c46f6b09434e6f1af495eafd5e72f
1a236ca1092606231d29853c29a4fabf8c7d33887bb52aede533f335c68f4014
1ba35df7f116846cb4dcb2eb0cabab6baa8acbb23534d8d736e328e92dee75c7
1d3086f6c56e233b4d49423bca581b70b190e245e927e4771275ea3ce90f46e2
1d40f6796800feac8064e51c65073e6ccffdbd6261f1e1a22b71388d03c27fa1
1d466d1f10f25b51743cc1b83ce19571c141d645930526c1936d5c864bead39b
1dc3374ab830eda554d06cdf7426572821e3368352f144c7350665ab947221c4
1dcbf42c297de29a9a25b7546678619863beef75bb690c3d85f34c1c3dfddf95
1e4c9c78374cf0520c5721fcca5732b6935c2f1ce6e1aef6a3dd2a1a7548960e
1ea37c324b3229ab96cf39760c1d6f93da691cdf3b633f5339b83fdc16d90b30
1ea877c3581d9451636d162b645e075fc880290a28604caaea954fdc57ad52b1
2050265fbb7ef1fb2861a7e47b48f3fac2d3067cc52ea28092c43858b6b73dc0
2169b47b516d56f81ac43a92bd7fe91eed1a0a8656dcdebb703f1218ba5e0130
245e669ed0ddcf394005c6564cfe8ec9b7ff1d07f25c120aa98a83a339442884
2589450ca338e7f27a29ced73b42f40f7baa716020d44989f2a544fe147d0971
26eee2e3dd8baa6aa5659c1bf2d9ffc7fad84ed65d798e9f420ca41ed6a446dd
296820126d5f38fa08e007330183cb8c743bed38808fdbfad4260ba3f69bf228
29a05b02b9ae0627e1f003059688bca4b768b67c58838367770cde73d6d61e52
29ff88b026529135249aa60e5cff77cd7f9a4b2e58c03e9569fa69aa8fdd0b2d
2afbb6eab383d6fd6fca115c062e6ac5ae5e3992f8e48719a1b2d1c0b5765d97
2c0c90eb6e3311151c0a3649bba33bee4a5b5e09e8b6be64beba58702a1c79fb
2cffa693c06ee3d3e75a5cb85770ddbdc479800c1da570d1a302747516aea3c6
2d5a84b5b7fb1d707f63597d5b431eef163209c4db7e6e0f8adc69bff564c5e0
2db909e0583f77a1d88203b9066a6d3dcc807d5c44f7cede1de9d757b8b9eb70
324954047e1fa1e1c2cbb2b69ab2a3147a651ffc6425d67e8f0519f4e388ecc5
3291fbedc36146faa6a8175cf58fdb9775e4bcc6b6922ebca4ee89db36d64c8c
32c9093f62553753d00380ecfa2765118f66da5480162eb011987299b49949c1
33f8ccde3f4c20a3245670719ebe41f849f70274f33bbabaa4e282c138053971
358f615d8f4cce0e235dc9e82a391c47f1a40ef3bcbb715f101adc91756aa86b
35fa8484335d69b5bdd351e9ce27bd1b41d3fd893c6be4a0a92f207d4118c3f6
364618db69cc4ed3fbc193b9a9510bfd388355750783c81be125d62ec05a6d90
36929a09604d7ae3568ea6f3f1b30bbc13d51b856741a362224f6ddb25548453
3705b5e850a02f2606bb273aab14963fed2ff9e5fa21b8b1dd077e06db4fbd23
378ffe2d9bfe827a9af0923a18a6d65500e2f3baf68861a91fcd48a34638a52a
37b7b6bc3c1df56f496de48d43d07f00a37de94f73e00eccb69cae3d96c6f076
39cd712ae4c819b8045be9afa1e478d5e8d356e031fe38a4ff672c0ad45fb6b5
3b03b379c3836a38d73f5f1828a49ff051fec20df418ad8d80db9275d90be62f
3b2a5f3192bf5a2fcc32dfa9d0a422979c2e71b8b63c096c6a2a77995ffbe130
3cb7966311f1f7e9ab1b4870727809f6f0e1c5957ceeec5539f3598b8d4f99cd
3e2d50d71c40c32e713769aeb13777a22bd571f069093b367f1b8dbee375ff0f
3f3a54015b947c5bdb173bcd284c1fc54a6778539612eebe73c992c31312e8ee
3f4cf6917ecbbef15215a92ab6bc7773abc794d5bfddd731c31fd67ba1671b95
4098ff7b99d57725c7fffe0b9115dd65389bb04a37a392b166a2dd66414da925
40d96c7c8172727f0cfdfda250eea7a3380068ca3b7c379d5d95955da6717f0d
42c402eaa948c581bb18b3d4293eac931a047711cb66c8b9954befb9e5af4c6e
4307ca577380b5643e0247a6b729c4a937b322819f2be7ee54fc4cb295bd2679
4429fc4ebb078d1e18e2fd5fac3dd8b87431b48de1980e2832cbf65084d9512f
44dd086a670c1dd27e41427892bfbd28d9cc61d99656b2655ee997d278862797
4538e3cce13602d084f48bc7a2a6106874db36f46a0378860bb73baf4c8cf490
467c72fd7abe3aa4396a4365541149814b535099e99a8e3ed63b3048758b78ef
47b6c7a73c5b3e69ec98debceee40b269174a7101ec8c9ee84d8913348c688fa
488cd894b97b0f6acaa2bccfc2e3d98efbbff77229c356d85d2bbca9afa81290
4905c38e93ed0de2bb0c3a98399a8ae8c60099412873d4e2ecdc76689ef749ac
4a5ba02d6128dc0da807c90cf8460c9cec3530bcc4776ced156e08d4a59af7aa
4accb11db1188199633e74ff0e87b874cef406195734140f66a8f5964ccc1684
4b4650073ae761ff8308ec38670d9b7c662749e56f2f2a2773f9921c6789fed0
4bafde8e08f001798f4173d6d5fa0fdfde11b169e42f8a571453942990c4baa5
4c7dae1944701c75c704305bba9f815771ca237b960fc72893d0de55bb0b37cf
4d74f4746fcd52407df56d4208dc266bdc0f530a2d36f286dc2f72c74a2dc534
4dc238dc83d0e286b4744585785f3a466ae33ee9e5faa16d29d151f827f9995e
4faf462707f3dd5d2d4ba6097286dfca153d76a932fb45da1912bc275614cd99
51586e1a5895625a1c53387a7867d5f003a182c6321dd5229fda7ea7d3496790
52af66f25ca16f40a76560df92bfc596d46e19058cbb981efaa03477c4295efd
5308b356c43caf2f00f74062b3d7a23921e543e85df5aad5d9ed8487ac729282
543fcdd6bcda895e40cfd3cafa684673f9539c326ab6377ebf086951b4add02e
55c01d474e065d518080d68ab771852a3014c6868e8865b838920d7c4c3738eb
56a33fd553d7e3b99677e20636fadac0840c1942882960745977f9a90de7eaac
5793c15d28dfa0dd22610fce021eabbe3b656339698578b59c789e3f1d2b4e9f
58dd0b3c6cc0c3c2855f018b943baef3bf41cab540efab053ace6ca8699896df
5d80a2cb8917a8e9519c4227bbe853e1c88e73e6b8ce0aa8da1b77394fb03360
5de36025fc1581f7b65b2d91ab4440c0650bf85a2da8d4557ae01ed8eb91b1c2
5f9b0398591a4cfa7d63dd7f34ab5ea1d7a82b4f2ed51d548dd5464d81d7d93e
5facffe7e8d35c7c2f5f38c881e8baa5f62fbbd5eedba1cec45b57b7fa7ceb77
6241e4dec7c99e0a91f6c671c593e61a9dac4f085621149f6f946ff395c7e918
628d837720fd2afc3381f3fe89032ab1ede6079747784aecb6ef5f62c15d46bb
6312e83e8e82046e96ec5c64f74a8c746d09f091a377c42a0a89c5174919ec80
6410d6f05f0051e3a86e680047cbf91d51bdc24dffef9e474888bc646dc1fb1a
641d30e28c8aaf863c57aeb096a1acb16938d5e9658d8bb104e4cec3c93673fe
66002756c75d21813274d9cff1177fa34833f77c382729662d46a4938b524280
670669ab21963ed9d6980b367f60714d56c912b6881f71e33f32f06b9835c1fb
67ba8b09bd71052d9322ec219f4dd6eb5a0bd2df1ed7bf43e002e48630145df0
69006bbc49c8144f16a522874cf35c12c0abce0d3b8ccfa0aa32287f59ca26c9
6bffd45d750e6dfe09c4f4bc4d938168d02171e5ed33bebb2cc6cafd15fa39de
6d33a6e0183f2e3426c3340ad3ed6f7619ef004f1c36b13d31d0f00cb08795eb
6e2c04a375a9dbc3689b2c68d78bde5c8c8396866ce3564f5dcfa032601c2ee3
6ec16ff82583a66e64a87e3688920ea0cee0cac0b1c442187d0d0fb7f3be5580
6f06b9f6bf24c0c05926cc1eb0a7bd6c7b6bd0ae16ad17522d0663d058775e16
6febebe36b80cb70deab69823f90e73f39fa893ff315f8446a161fda1cb65911
7059df8513cce8176bb801d5c2ff463059b7ea3cc501b26c619dbab5beaf7dde
7119e9362d9ee777137ec60f9c64ed4f9cc0f0cbbfdabb3158c8f2f6b1b7c224
73c04dc2b04746893ac8f55358716f5f2d7b252a4012b820343dee54673680e8
749b0a497194247f0eda316bb9b8caf9bf21568e6f55fd5527df2fa061b89c0b
7600e6c7ca9e00c9d28f811db61098455ee9c17528662d7b09ffaa56eac148d3
7654e9f51197f73741e079624e74df444c061d4b1d3ec9f2f3cf8e2a824f7180
774308687f0913d779f64f7608d4bc87f6758f50d7aa481ab3059acdbce96472
78570ebeca9bf028f9a5bd613fd3e91386475d1b087a6a889f623bd1dd78818f
78b3d5eb4cf6fc09fb11909be7c27064281fa2af97c002ba3d15690ec62e4620
79b51f28c6b44539980672a801e22fb743dd0dc89e0292b6240c4962a4ec3581
7a3f8b0a43ea5f278edfba1682304e7cb833363f6fca6f54b7f24d6aaf933b7c
7aaea793e375d6c46fdb94e202e5a98e6c292c65784c893ef7014654d7e9d19b
7b02f5cca2072c52b6452a943b87902e836a8d184cca22eaa759896833bf903d
7da217d841f3d229a9579aaf07b80a24df30bd3b7b7449ad351fe4c584d9aa6d
7dacd0007d0854d192238bd974a627a60627eafd8d8cc2a2219821a29b7036d0
7f848f0560355b8040031cff64a2dec5bda4647d559bcfef04ff72e6a41344c4
81382abe9e186b70294cf35d80a794a2bace108661ba0998903e3b374f164370
84b91d4ae8362d70ae1f5b75a1728b0c55a0985fa4b675906f1d3acaa9e61951
8569d26cbcd092c5bea27ceedb873cbc9336c4a97ce8800a3f9369346f31db5b
859c58db491bc690e0dfc7812fe139d2d3e9f7eda49dea307ae5499b123f1541
86f81f2437b8cdd71f852647935ed33543333edaa71cc56df4420c12484e19a1
89f750b5868b5cc8a1e741415ca0d23054da804eb8efe6c2047453be13987db0
8a056e2a188005af9fc6aa645f63283265f491cdee6793d4d84be3c84496b565
8beb2a8969c6ebe699132e37e0710fe058ba98664b41a514833798c6c9cb64bb
8d15f9a762c845194924bf0caafe018bf58520b0c7953956de66af3ced0d5d0d
8e5f8aa338d2933925c4a4098bf22cccccf1e8f6a15679a4c0a8d65ff8c2389e
8f3f5a399686340c547643f011de4dfcfe147768effebd980f9994c20b4c40a8
8f6a522a20c507cac66ff751b488674be2eb84220668e131be933fec7b7a937a
9171ba1b4a046a5a0d66dba0881672f17371191b247fa86545ea3b69b4ed6461
9375273e7224999cfc94f15a26e34680f1d8564a5dbb3f71b6e0bc819fc4915b
93b596b618823e971cccd35af7d4c698111804623ab6604411406821e22f6cb3
94514d6c59d656b2bd2389330e34a0274a5054dd33851310645d9972ebe49204
984c74d9f8058db26fab9d9cdb1cf754288e1a2d148ed5a7d11be853db205c29
9a0a332c1b399a13103069c8d28fffb5c2760e27757ebc06836e180356be6d79
9af66f9c3b066250172c683dd18b2e9f14a8793c7d8d0804ced7fe2f4de00c38
9d455e748454fe74b8a8c03319886c040c4d7b0fbab06e31a5293978bc24ae4f
9f9b0eb935fe810845a077785cc524403616cbf8454f74dcc6e76ffaf9cd99a0
a12515213a2c022e726b544d655bbd435b2063198c3de5c0a0335f14981bc10e
a16760309db36893c21dc3379449508acb848c7c48e67eb26c60fc29d4decf43
a3045710bb22a0fdfbc522230e3a0b5e1e669db67fad3849a5eea0784f5526c5
a42058a344fe7438ba30487165947fc21e200e880210be8b3adf6985d4dc009a
a448dd0d878c06016f0dc89655f96f0d38155076bf107d92c855823394fac57a
a4bca0f5c0e25e35d43772e4cffb1d06587193a3b0b97f46e47d1962bbcaa2f6
a4d3cb88b1bfeac4525d4bda65c1782d9cc32a64e7e4a9527e69c22188703275
a881fb2725fff9284a56c6623a4c7ff63cc0b48b64fa855920ccf4a7bedf12c7
a9eeffacff1045997f801d7bb88d6197079e6aa7a05a630cf7ecbf82fd2065cb
aa4e81a1d6634cd4fda9f60735003e4daaa0218a57c6cd399052d603a55c3728
ac3df8aabded127e5efccfea5be41593c7f99d8132c0c6205953b34798663123
ac5dcdc1ace8a05bf8485bf0ea13b636d3435d5aeab162d5de54f03e1169c6a0
ace42ee43a75e1901e656babbc43dd858a593214215e10b132b445b8ef53b65d
adc3a6450484b77ebaec38f6ac4159631f39ef6f483c33ef6d92f5e14e260379
ae5ed936eef64e7ef4bc6b396be88820db19e105a51785e07614a2268186e193
aeb7beed6d1725fd438930884faf6cd3a1e446d2e2062d14d50534567190783f
af46b8842beda19f506129514c32400468d86077f739f29a391a7caa461da0e2
b037ca122cdf33ad638b0a8a5a3f06543b7d62ea058e96d3b37d7617ee5fe92a
b110cde257b26d8407317e20a895db4d410a76917ea81f89b2640d6a0515671f
b14658860570f23177018c868b120ddf9cc6f918941fdd8301ab9f04786e2491
b1fae5c6effef1e649e7eb9346637e4ec8e3b8efc0f911b91a9cd1bff4d55155
b3f6f96c2643209395949dd4382ce30bf8b554060060ddbe76c4fc1182f13622
b54d7a4e122c337da22db04c8575f6cd11cfe7d51500b34a948a52475d30d7cc
b6fd47b0370579b700bcd0f22141bb87d2278580e4e04d43e83e152154d750d5
b7d0b547478706f28ea7dcd221d84ba6e6398ff662f9d040490a5699e907ecf2
b884a54388c5c085f72a71deb4e5e251036f9ec231ef3f5f4f5c9653ca2da20d
badd7d526570f8d6febc89b6d97853aa1a14726f1e57ed364244aefdb5e36f89
bbbb7c2e3d31becf03d5b5226c548458310c799f6a1d753c7666ff5e20dedf7d
bc401e1cd0f0633c42b485bedef74286c58f138d8dfeb7677d6f1f33bbd81254
bd0a61292e7b87e6a38ddb45ba852c6e177b81ace653a88daacbdb43d4eefc52
bd38aeb65da0ee162510eda094fad6e2eca74a2a5b2c3c9741803778f5eb1138
bd98945d0391fe35489f52cc88b1c77a5d698dcbdea701468599a45c27a578a0
bddee031ede79473f4309e07c944fca63a87d4d333c19ee2ead2eb088536d3b3
be8d523196a8cc183ea22a80600162ec42ae5e52f0f725372a5ddcaf39eb7b7f
bf817f4af340c004d168a9e9a2e889924c0bfd81989dcdf4f6117c5eb02a543a
c02a455d56d981313c90857dacb78bef919c8625e3b16d28b77301a531ea7ccf
c20cb3d0f2f4266aa379b4460940628229e18dd4b5ed52f6217576e6c5d65e81
c2b1b20e64d93655cafc07fb0513ab68fe7b0b52eca6522cf59bfe1b506812bd
c39d7ea03e159e948380bf978215303e210b6a33caee8a9e0021275ea2c84abe
c3da2b0720984fc1a1f2e67eb63c77d3eae869dd970f4f8b3ad406c8f470edb5
c4850f5ed38ec5672648583da6f45f3fcd9fde257619717046d8f34f6599d260
c50d608aa6ccf85f189be70334cf94d23ed065b69abedb1aa326f277610853ba
c552cd2862a66c773392cbf87253683a185b4bca487bc24943a24e68270b1116
c6831bf6dc5c9c978c1aaa3ad4a08690f5f037bb8c904a72ccd28a75307abf79
c6e0b5327a8662c67c9a4f8b9196a87560b8c2b72b16f51973b966d392ecbc3d
c889577f1a8a8f64ba0a3dd4b76285df602e76958fe3f4ef8d046e1d0504b30b
c989a182bfbdcee7ce3e1d02a4c7023180440894881b66b5cb91213da85a0848
ca031e9dac208117a5c75209cf931c7e2a996cb6acd2ae9bdc3ea8993c374166
cbe28592082f199b9995b28b1051ffa05672d7e57adaee79dd24ccff8ced9928
cc5e1f4f7451284ecd11d350bf3629181dc0c7d7510d9a50b4dbc583da80e42c
cf6b59bdca7397c57d26adf0246027fedd7b3671771096065f5b213ad5657c13
cfb0bec9a731636a9d1b5caf5a4c9c252095ae9542c3c449cd0aa7b3d048db15
d1d711ffc988d742a8bb4e553d2418deab16b155b529fe860a65d16d16fd3aee
d2690c753be4a03101570cdb9da5a4aa9fba67278e0d4f2c0aa7f009b7df52c9
d3ef4d9ef5e40a9c0e8528efdff6a772da0252195ef4d1bf79c3982b14a4a21c
d74d0b72e8adbd548420adc0d6fca4b283b797a234683203142e1a236badb97e
d829f7603b2f0abd2c10647f10db7be292b4a2cfc4ab764e7542c2e45a580b27
d95ce18041eca76ac7731a5e37aaf759ceff6273c91f71dfc3d9a09fa40d86eb
d99e436869849066075113f97481c77edf47a4495421eb076295379cc19cdb3e
da2e41ffda16549bc315384a9b538a3bf17e38e2f7fae1e7e7ad95826f9016b9
dac36d85c6b2138f54400e4a26af8b640c4afc0752411b24916cec252ff9463f
dbed2636bbb485fc2dddd53c4d329cd89e2f98587e12e64028969dea12fb8121
dd5c9a876c28fc4acb1ded86a435ad472deb11f672e97b26c5234eb0ce40e2fe
ddabbcdbdad651c1e48b6278d78942f00a6a836adfb018965b36d91e037cc663
dde50720f395bf72516add0629729f1b06870512e020985596b0a901ffff8dab
de3832579476b0e6e04f0f622cc044ab451d8630090c87a31d910fef587ef4c5
de7dd1af5520dc80a90add721423e50a9d26d88af96e29e047cbf287a78ff1e0
e247b2042b3aeb3827c8693d4a4cadd13761f637a3b49c396c30f9f39fc88cf4
e326292b3e73d34db3c5a7c78168e2446de8badf0ea6425d5581e6200fc2908d
e39c100736e81d7568a287aa858afdbc2116084c60886dc342a7fbddaf3404a3
e76e91319c38324b991c847f7b574a32fc0d45e29ce6a0ad9412c5f4fdcb72a4
e91b4d144f859c63798f6c12b13dfe23f58d8788d823bc9a0c17d4645b59336c
ea469772ad056019fe2f7dcaae9631f6a40062e8dd6330052ca696d190740dc1
eac06a23bcc29c3a5f3243e65b343449be0cfa883d139924b2d267d8db54fd17
ebace6a97c828457eded22fd54af280b167ac7760b8e3741c95e9aa1600934e5
ed2a673edfc55eb9f4425a30fbc0726e5b1dac0d4febc158e82d097e90a9a93b
ed7a9442490ad4f812079cd1fcf9ab7b6e8e0fe38045fd17dc16a268fcacef55
ee395230e8927f9edb75dcab07ec572feb2ef5b861aee1c4189abfab4b71994a
ee86973bcf834eadcca15cefb0e92d27f52aa58e8b33d7002d29bf2ad17287a7
ef0aaeb392aa5aafea56e13121e0ff4a4cc91fb00f1a3082620bb0406b1877be
ef60c34e87aa882ff6621c52997de24a1e842da0917165401ad048c2bb4b4f2a
efb6dfc27af28d3243831645b2e304bdbff92181295f31bec67df199276cbb20
f097520c4e45288bf8bd732727f600fea4d1b5d66c39640f2e82a3d1c1672b3b
f16aa18dfed6358ff121c109f2e1bfd85aa717557689bf1ba76fb6985b3bf31b
f1df7e74b6b66c8b6fc5fe09f3ec2fce76a63ceed1fb8a4b593b017d282fdcb2
f6f10e3a2946b70dd5d46e6369ddf185f10a75a1c26c7e734feb2a948df3fa57
f71b2bf243e38dde367ef3bfeacddfbd1d75a97a49a8af5ab203b635ba1038dd
f7dab5c9cf991feef6e11db420c052d8fb8a6afe80a30a3c9146bb996a09e597
f8018ff652a8d0694df55e17d4236a20732ce8c5d94aec7722804abeb33952d4
f9e1ea86435e2f1fe3b5a0c4cb91058a603c040e6e46cb03f148e76371ca5424
fa0f391b3a48c3548a271f430fa35ed94555f8cd11006ee46da8c85b7e3e3139
fc5a837db69b191408d1356a473d5b6d76147d564a1358201086e4d427ac2e5f
fe1384cd5535b5076023becec84776668430fc64b17391779248cf895b16da72
fed555194d57660733063fecc91bcc4c01456f3190820795c860f8cdffc27b66

C2’s Per Epoch

Epoch 1 C2s

141.224.163:443
15.83.52:8080
212.220.251:443
130.31.177:8080
255.165.160:8080
120.227.206:8080
196.15.205:8080
42.166.147:80
113.106.18:80
169.86.13:8080
75.135.93:7080
93.114.137:8080
28.111.142:7080
172.40.218:7080
204.163.19:8090
190.4.92:443
69.29.42:80
163.74.202:443
79.163.131:8080
97.30.167:990
55.211.77:8080
119.233.65:80
198.203.45:443
188.124.145:443
28.51.143:8080
85.87.122:8080
190.133.235:8080
101.212.195:8080
188.166.192:80
79.95.107:443
59.124.163:8080
131.58.132:8080
245.101.134:8080
231.62.54:80
183.170.114:8080
62.173.247:8080
146.131.105:8080
139.158.155:80
177.183.28:8080
16.17.210:443
75.143.100:7080
199.160.224:8080
249.187.151:8080
203.204.126:8080
58.83.179:80
143.182.254:8080
196.35.138:7080
154.204.40:8080
79.228.89:443
106.77.40:7080
241.38.226:50000
29.183.211:8080
67.21.187:8080
75.160.178:8080
250.223.190:8080
160.93.230:80
15.8.192:8080
38.14.52:80
71.237.140:8080
82.97.25:80
183.71.206:7080
169.140.14:443
205.215.57:7080
123.101.90:80
41.151.103:8080
135.153.203:443
213.32.59:80
183.190.199:8080
68.106.4:7080
86.148.222:8080
23.132.93:990
210.184.138:995
163.33.84:8080
83.93.124:7080
4.50.26:80
173.113.67:443
5.237.27:443
1.41.111:443
25.159.3:8080

Epoch 1 - Spam C2s

37.187.5.82:8080
45.55.82.2:8080

Epoch 1 - Stealer C2s

254.218.210:8080
250.141.134:80
115.18.139:8080
127.72.18:8080

Current Epoch 1 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOmlscqbEIhLjVsj9r3eYacKi6C+Qrua
j5TlU+pn3zc0k06qCoahFXBBGnYMotHQc6OwfBKwHWm831LIVg29kEjT8UYxnN5v
fzNGgqXTe25QARf78CsQqqN/ImKdXo+GFwIDAQAB

Epoch 2 C2s

241.255.77:8080
208.125.192:443
227.156.155:443
239.175.211:8080
196.74.210:8080
139.247.220:80
189.98.125:8080
104.59.244:20
176.132.213:8090
187.2.199:443
101.153.86:990
226.44.20:21
81.213.192:8080
12.67.62:7080
128.43.213:8080
75.241.230:80
131.11.150:8080
105.131.87:80
89.236.214:8080
205.215.66:8080
160.182.191:8080
106.139.101:8080
131.44.150:8080
12.170.148:8080
71.234.16:8080
241.220.155:8080
210.51.222:8080
212.203.26:8080
205.247.10:80
39.131.88:80
102.238.69:465
129.24.79:8080
106.136.232:8080
103.164.174:80
157.194.134:443
71.10.37:8080
57.193.14:80
11.163.139:21
143.194.138:443
222.216.44:8080
239.182.217:8080
53.135.159:21
78.95.230:443
177.216.217:8080
33.49.124:443
172.240.91:8080
24.219.147:8080
211.207.11:443
243.177.26:8080
225.179.64:8080
75.187.192:8080
145.67.134:8090
22.221.170:80
71.148.138:8080
31.213.158:8080
4.172.5:443
202.153.252:8080
209.217.49:80
136.245.190:8080
63.71.72:8080
249.47.77:8080
201.140.110:8080
236.246.93:8080
65.25.128:8080
4.172.5:8080
230.19.21:8080
79.161.166:443
4.172.5:20
92.209.110:7080
31.200.130:8080
99.105.223:7080

Epoch 2 - Spam C2s

106.253.248:8080
121.27.119:8080
64.67.20:8080

Epoch 2 - Stealer C2s

162.183.41:443
207.234.18:8080
76.247.61:8080

Current Epoch 2 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAKl4M80uy0jcxUiFIaJJyxgHVVnFtCq6
bi6f2xXPh/XUZNyN8UXDe5HzhTc4kwon9MBZffNwFOIc61QfV3K3YzEI/ktcyNqK
LS67ONxsVep769QdiVQJXrIaFjMXKz6viwIDAQAB

Epoch 3 C2s

2.235.48:443
238.80.237:8080
249.187.150:7080
150.175.129:8080
120.227.206:8080
177.155.123:990
216.207.86:7080
154.130.167:443
220.235.237:8080
216.212.157:8080
34.144.138:8080
147.152.244:8080
169.32.143:8080
47.235.26:993
116.78.109:8080
177.253.126:80
38.134.203:8080
241.220.183:8080
217.1.149:80
104.70.207:8080
36.42.205:443
95.101.72:8080
189.148.98:8080
93.87.198:8080
169.33.157:8080
112.113.235:80
55.168.82:20
197.140.163:8080
229.116.130:80
58.93.123:80
45.30.28:80
205.177.229:80
196.15.79:990
57.217.170:8080
197.108.171:443
100.24.201:50000
109.5.28:8080
7.164.178:8081
198.203.45:443
162.185.116:443
150.175.133:80
245.13.50:8080
75.37.196:8080
70.88.55:8080
46.87.133:8080
226.25.78:80
218.243.150:443
128.222.14:80
105.131.68:8080
52.135.33:7080
17.6.116:8080
163.221.191:8080
253.207.142:8080

Epoch 3 - Spam C2s

41.185.29.128:8080
149.202.153.251:8080

Epoch 3 - Stealer C2s

63.78.150:8080
46.150.196:7080
32.255.133:443

Current Epoch 3 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMqZMACZDzcRXuSnj2OI8LeIYKrbUIXL
faUgIJPwYd305HnaBS2AfA0R+oPxT32r+3BbayI3KguqAn3E+rbwtLhqhOXOlTnY
7yvG4ufmwCCkRzc6Sq8baToxmd6y523AIQIDAQAB

Credits and Notes Section

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch 
because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, 
this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen
 
NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

What is Epoch 1, Epoch 2 and Epoch 3?

(09/17/19)
With the find of Epoch 3 that split from Epoch 1, this section will be rewritten to reflect these changes in time.

Community Lists/Samples

https://pastebin.com/rEgdgvFu - @Paladin3161
https://pastebin.com/upkN58Fp - @Paladin3161

(sorry if we miss anybody, make sure to send it to @cryptolaemus1 in your tweet and we will try to include it!)

Credits

Combination work of the Cryptolaemus Team - https://paste.cryptolaemus.com/about/ and/or specifically the following:

Doc DL URLs - @devnullnoop, @p5yb34m, @malware_traffic, @dms1899, @Paladin3161

C2 info/RSA Keys - @CapeSandbox, @unixronin, @devnullnoop, @MalwareTechBlog, @lazyactivist192, @papa_anniekey, @Paladin3161,
@executemalware, @luc4m, @SecSome

Payloads - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @p5yb34m, @malware_traffic, @Paladin3161, @ps66uk, 
@bomccss, @reecdeep, @CholeVallabh, @papa_anniekey, @JAMESWT_MHT, @executemalware, @SecSome, Anonymous :)

Spam Templates - @devnullnoop, @lazyactivist192, Anonymous :)

Special thanks to @lazyactivist192, @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/
infrastructure and helping out with this!

Very special thanks to @Binary_Defense, @lazyactivist192, @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project
https://github.com/decalage2/ViperMonkey, @digitalocean, @mploessel, @anyrun_app, @unixronin, @hurricanelabs, @MalwareTechBlog,
@KryptosLogic, @0xtadavie, @MsftSecIntel, @abuse_ch/urlhaus.abuse.ch, @urlscanio, @BlackLotusLabs, @TrendMicro and @Virustotal
for providing services/software at no charge to this cause!

Daily Log 11/12/19

This report was gathered by @ps66uk and @jroosen.

@JRoosen here, looks like Ivan was able to find some little blue pills for his distro problem, distro was up most of the day
with minor interruptions to switch loaders a few times. If I had to guess, Ivan and his team are switching in a new crypter 
source/server/etc. The new loaders that appeared just before the stroke of Midnight UTC are very small and poorly detected by AV
at least according to VirusTotal with many single digit detection rates after n nearly 3 hours after being released:

E1 https://www.virustotal.com/gui/file/ff4336368e9d88e580855a6da4ca6a59e49753ca6e8bd0613dfdfb7ba1242cd2/detection
E2 https://www.virustotal.com/gui/file/f6dc36e6c2e8455c5ebf62aa883c7da72fdba8a56195d776aadf30223a87f54f/detection
E3 https://www.virustotal.com/gui/file/4d74f4746fcd52407df56d4208dc266bdc0f530a2d36f286dc2f72c74a2dc534/detection

This must have been what they were up to yesterday and with some of the detection rates of the old loaders being so high, it makes
sense this was a priority.

On the other hand today I did not see any malspam from Emotet and others such as @executemalware reported the same. Spam was for
sure flowing though and it seemed like rates were moderate to heavy on all 3 botnets. Also, we saw a very robust schedule of 
doc payload quintets so it was clear Ivan pounded his fists on the table and waved his AK around to get the "nerds" to work 
harder to get things going again. 

General News

I always find it funny when I see Emotet replying to automated messages for reply chain malspam but this one takes the cake.
Emotet replied to one of those stupid Sextortion emails and added itself in the chain:
https://twitter.com/MBThreatIntel/status/1194365512324567042

@Jan0fficial posted his daily stats for Emotet and it clearly shows the problems that Ivan had yesterday:
https://twitter.com/Jan0fficial/status/1194182942236565504

@JayTHL - shows us how long Brazilian Government website was compromised today. Over 1 year ago it was compromised by the Xinox
Crew and now today hosting Emotet.  https://twitter.com/JayTHL/status/1194315084585197568

@CheckPointSW posted @_CPResearch_'s post for the most wanted malware of October, without much of a surprise both Emotet
and Trickbot are in the top 3. https://twitter.com/CheckPointSW/status/1194277670168584192

Drops Report


Today should have been Trickbot gtag mor42 if the pattern of late follows.

Email Template Report

The amount of reply chain spam that I see replying to spam itself is quite funny actually. It almost seems like every 
email that has come into the victim's email box is just replied to without any filter at times. Sometimes it gets lucky
and other times it is very funny. :) A good example was that @MBThreatIntel post above:
https://twitter.com/MBThreatIntel/status/1194365512324567042
 
Some notable things to possibly filter on with misspellings, grammatical errors and odd phrasing:
(I will keep adding to this over time)
"if order was not place, please contact us and obtain a proof of payment of who sign for order, dispute if necessary."
"Please be advised that the new problem has been appeared today."
"I have sent the new file in DOC format."
"Here all our documentation for our question."
"Here's another email below that i have to make a follow-up on request."
"I have finally been sent the new table-form, which is great. I forward it to you."
"Please sign, date, and email back as confirmation."
"Please find attached the check copy for payment."
"I have sent the new data in DOC format and the policy wording in DOC format to be even more professional than others :)"
"Is this one authorised? (Docs in attachment.)"
"Can you please look into this urgently and advise?"
"there is a older outstanding invoice, I have attached this invoice."
"I meant to send a doc before ,sorry."
"Thank you for your email. I have attached all the data."
"Please find attached the invoice and detailed charges for the month. If you have any questions please let me know."
"I have sent a request to add this information."

These are some old generic virus scanners that I think may no longer be valid:
"-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean."
"Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering."
"This email has been scanned by LANserve Email Defence. For more information please visit www.emergingit.com"

Paul's Boutique of Documents:

E1 CreateDate:	2019:11:12 03:53:00 aminaelmahdy.com            07:15   office365_light_blue
E2 CreateDate:	2019:11:12 07:53:00 www.medifastarizona.com     08:15   enable_edition
E3 CreateDate:	2019:11:12 06:48:00 videos.karaokelagramola.es  08:00   office365_light_blue

E1 CreateDate:	2019:11:12 09:58:00 bigprintsport.com           10:17   office365_light_blue
E2 CreateDate:	2019:11:12 09:30:00 eduardoconill.blog.br       10:00   enable_edition
E3 

E1 CreateDate:	2019:11:12 12:34:00 print.wedbox.com            12:48   office365_light_blue
E2 
E3 CreateDate:	2019:11:12 11:28:00 cw-233.xyz                  11:46   office365_light_blue

E1 CreateDate:	2019:11:12 14:18:00 swisspixstore.com           14:31   enable_edition
E2 CreateDate:	2019:11:12 14:07:00 dazhuzuo.com                14:46   enable_edition
E3 CreateDate:	2019:11:12 14:15:00 heroes-center.ru            14:47   enable_edition

E1 CreateDate:	2019:11:12 21:04:00 www.yoursupin.com           21:17   office365_light_blue
E2 CreateDate:	2019:11:12 21:49:00 bomfinanceiro.com           22:03   enable_edition
E3 

E1
E2 CreateDate:	2019:11:12 23:34:00 ngaustore.com				23:46	enable_edition
E3 

Link Regex Report

(These are experimental, use at your own risk.)

No document download links lately.

These were revived/updated:

These were not:
https?:\/\/.+?\/(administrator|academy|album_delete|alphabet|Apple\.secure|anywhereApi|articles|assets|backup|banners|beta|blogs|cache|calendar|cgi-bin|checkformats|cfm|clients|consultation|core|css|demo|discuss_lib|dhlupdate|direc|domains|emailstory|gallery|GoogleSpeech|health|hino|homepage|images|install.|.*\.init|js|lib|listselect|lm|menusa|newsletter\-.*|old|paclm|Pages|parts_service|phpmyadmin|pictures|popup_index|privacy-policy|public|rmareturns|rising_api|rssreader|sendlogin|shells|sites|sitemap|stats|test|trademark|themes|tmp|uploads|video|wc-logs|webalizer|wordpress|wp-admin|wp-content|wp-includes)\/([A-Za-z0-9|]{7,40})\/(\"|\n)
https?:\/\/.+?\/(AMAZON|Amazon)\/.+?\/([0-9\-_]{5,7})\/
https?:\/\/.+?\/([0-9a-z\-_]{3,11})\/([A-Z0-9]{7,32})\/([A-Za-z]{7,32})\/(\"|\n)
https?:\/\/.+?\/([A-Za-z0-9]{8,30})_([a-z0-9]{5,10})-([0-9]{8,15})\/
https?:\/\/.+?\/(Document|DOC|FILE|INC|LLC|Scan)\/([a-zA-Z0-9]{4,30})\/ 

Also keep in mind, your filter needs to look inside PDF files to find the URI to test against these above. Otherwise
this does not help.

Loader Report

Payloads and C2 report has been combined into this section and it is now known as the Loader Report.

---Reminder---
RSA keys changed on all 3 botnets at approximately 1930UTC 2019/11/08.
e1:
-----BEGIN PUBLIC KEY----- 
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOmlscqbEIhLjVsj9r3eYacKi6C+Qrua
j5TlU+pn3zc0k06qCoahFXBBGnYMotHQc6OwfBKwHWm831LIVg29kEjT8UYxnN5v
fzNGgqXTe25QARf78CsQqqN/ImKdXo+GFwIDAQAB
-----END PUBLIC KEY-----
e2:
-----BEGIN PUBLIC KEY-----
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAKl4M80uy0jcxUiFIaJJyxgHVVnFtCq6
bi6f2xXPh/XUZNyN8UXDe5HzhTc4kwon9MBZffNwFOIc61QfV3K3YzEI/ktcyNqK
LS67ONxsVep769QdiVQJXrIaFjMXKz6viwIDAQAB
-----END PUBLIC KEY-----
e3:
-----BEGIN PUBLIC KEY-----
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMqZMACZDzcRXuSnj2OI8LeIYKrbUIXL
faUgIJPwYd305HnaBS2AfA0R+oPxT32r+3BbayI3KguqAn3E+rbwtLhqhOXOlTnY
7yvG4ufmwCCkRzc6Sq8baToxmd6y523AIQIDAQAB
-----END PUBLIC KEY-----

At this time we noticed the EXE naming convention changed too. The new names will be 2 of any of the following list of words:
FileNames: "delete,band,ipsm,sspi,div,rdp,whole,dir,privacy,make,watched,pano,which,goto,wnd,rep,ceip,date,render,bag,vsc,vsa,mouse,
counter,tech,wheel,ranker,iterate,store,sum,package,timeout,idebug,junos,site,trc,url,coffee,poller,remote,gapa,changes,duck,ppl,
tlogcm,tlb,cube,hexa,vol,paint,star,nav,grp,avatar,center,cipher,brm,resize,markup,pausea,loan,emboss,vsperf,teal"
--------------

As previously mentioned in the general section, we saw a new loader generation released today. @lazyactivist192
took a look at them today and found them to be Trickbotish still.

As Ivan and the team were going back and forth between the new smaller Trickbotish loader and the old loader,
we actually saw C2 changes revert as noted below:

E1 now 79 combos, was 82 for a net -3
E2 now 71 combos, was 71 for a net nil
E3 now 53 combos, was 52 for a net +1

The C2 change at 14:30 reversed the change at 12:20.
The C2 change at 16:15 reversed the change at 14:30.

E1 - j (7595)
07:35 - 08:30   580kb   7606   c4bf9694a46f8b53ac3ea108353276a15ce6c06f17766bda0d0469ec8d1c654c
08:30 - 12:20   741kb   7610   f6e4afaf791df64fb6ee8c57d2292eae405d8afd14f03891e677b08dc9f654b6
<= C2 change
12:20 - 14:30   755kb   7616   fe93a19d9d2bc319778a80d866a7710d04957a19898350649be9c6a7b67703a5
<= C2 change
14:30 - 16:15   120kb   7628   57a79f8329752f02bede700555335257e10bc524a937c23b737d73d64e8b044a
<= C2 change
16:15 - 16:25   755kb   7642   5d241a7ae993709c3e97d5a6984ce499db775080c1f1f2a4cca1c6fe65767396
16:25 - 17:15   602kb   7644   ffaf42f87c2c1429f984e6505983c7b3c1705b4b8fc1b8f9083a40ad1ece60b8
17:15 - 19:20   120kb   7653   32bd2a4d784c1663ac1746d49b13aca39108590f507110021d6db05d200ed04c
19:20 - 23:40   136kb   7660   d461a4b081cafa1a6544e494f6b9e356b51ec6543bd6fb8832f284bddfb8359a
23:40 - 00:00   111kb   7666   b23e05da278be6ec20d25d80159a7e830e1eee0a84540dff5f049cbd94aebc4f

16:15
Old count: 82
New count: 79

Dropped:
45.56.79.249:443
60.52.64.122:80
79.127.57.43:80
81.213.215.216:50000
190.182.161.7:8080
190.96.118.15:443
187.131.128.238:50000

Added:
189.141.224.163:443
186.15.83.52:8080
173.212.220.251:443
181.198.203.45:443

--------

E2 - b (7594)
07:35 - 08:30   570kb   7605   aa5eeffa2e44ee9642090be625905484e8e6456dd4dd67e36302777d7dfad809
08:30 - 12:20   731kb   7609   c126f10d2760221e449fd2f8fb94001718cc6508d0ad8c3ee83c6e49e8a8bb77
<= C2 change
12:20 - 14:30   745kb   7614   22819fb55124901a128dda5a10a1740283be38f8707cc082f770983212b27cad
<= C2 change
14:30 - 16:15   120kb   7625   3152c09ec34910478ab760fa177e9bea8761f7748dcd742619007374282eba32
<= C2 change
16:15 - 16:25   745kb   7650   ef12e36870183d39a2ba544f80e13a8b7526d0cd8ee23c93b104fe30c5a0f793
16:25 - 17:15   588kb   7645   431ef66eb5d5f67ac329caa4614435ba47ababa8990ae2ba3c8e045424cff398
17:15 - 19:20   120kb   7652   0a3aa1dd492480361ce138974f64312673c09761d3790cd63e6cc830c55b5a01
19:20 - 23:40   126kb   7661   a6da3f699b144164206e508ea4af54e7a21da93284dfc9f9d4dd2f3052106a09
23:40 - 00:00   123kb   7667   11fdec6b521462594e9ce0dc46e09513654e44c7b9133602539972b2dd4dd63b

16:15
C2 count unchanged :71

Dropped:
47.41.213.2:22
105.228.98.115:443

Added:
192.241.255.77:8080
191.92.209.110:7080

--------

E3 - f (7598)
07:35 - 08:30   571kb   7604   b6fd47b0370579b700bcd0f22141bb87d2278580e4e04d43e83e152154d750d5
08:30 - 12:20   732kb   7608   be8d523196a8cc183ea22a80600162ec42ae5e52f0f725372a5ddcaf39eb7b7f
<= C2 change
12:20 - 14:30   746kb   7615   1dc3374ab830eda554d06cdf7426572821e3368352f144c7350665ab947221c4
<= C2 change
14:30 - 16:15   120kb   7627   a12515213a2c022e726b544d655bbd435b2063198c3de5c0a0335f14981bc10e
<= C2 change
16:15 - 16:25   746kb   7651   9375273e7224999cfc94f15a26e34680f1d8564a5dbb3f71b6e0bc819fc4915b
16:25 - 17:15   590kb   7643   81382abe9e186b70294cf35d80a794a2bace108661ba0998903e3b374f164370
17:15 - 19:20   120kb   7655   bd0a61292e7b87e6a38ddb45ba852c6e177b81ace653a88daacbdb43d4eefc52
19:20 - 23:40   127kb   7658   1d3086f6c56e233b4d49423bca581b70b190e245e927e4771275ea3ce90f46e2
23:40 - 00:00   99kb    7668   fa0f391b3a48c3548a271f430fa35ed94555f8cd11006ee46da8c85b7e3e3139

16:15
Old count: 52
New count: 53

Dropped:
211.110.229.161:443
74.208.173.91:8080
189.252.102.40:8080
144.76.62.10:8080
162.241.134.130:8080

Added:
81.2.235.48:443
104.238.80.237:8080
50.116.78.109:8080
172.245.13.50:8080
78.46.87.133:8080
46.17.6.116:8080

Closing

Well Ivan came back with a stronger showing today and looks to mean business. After talking to his cousin Vasily
at Trickbot HQ, he decided to go back to the better crypter that they have been using. I wonder how many BTC it cost him?
In all seriousness though, with these new loaders and the low detection rates, now is a good time to make sure you
watch for C2 traffic at your perimeter and either block the lists above outright or at least set a monitor and an 
alarm on it for review. Stay safe out there!

TT

Sandbox 11/12/19

E1 
https://capesandbox.com/analysis/7616/

E2
https://capesandbox.com/analysis/7614/

E3
https://capesandbox.com/analysis/7615/