Daily Emotet IoCs and Notes for 12/20-22/19

Emotet Malware Document links/IOCs for 12/20-22/19 as of 12/22/19 23:30 UTC

Notes and Credits at the bottom. Follow us on Twitter @cryptolaemus1 for more updates.

http://12steps.od.ua/wp-content/multifunctional_array/external_forum/wcgufzgqbe_6x2x98u57141/
http://180130076.tbmyoweb.com/wordpress/available-disk/individual-space/1002208273670-gw8D4Y0squG/
http://203.109.113.155/n0r04f/privat_Zone/schlieben_Forum/sht3sd6_67y95w/
http://52xdf.cn/wp-admin/mbs_bi0gynptx95u0gf_ny3v1be_yqcrt8tthfhyy24/guarded_forum/lbgdz3ejmmrbkc_s0zs/
http://abaskatechnologies.com/cgi-bin/open_array/fy1lar50Co_l52tjpx97S_qrqge_hi8a6c96exc2/0yytwilu99am_uxs06uy/
http://abc.spb.ru/wp-admin/private_sector/guarded_forum/7amsogzbtvahwib6_7zut/
http://android4.us/Ecommerce/multifunctional_array/close_warehouse/495454_0xG9p1/
http://aviationinsiderjobs.com/wp-includes/closed_box/special_xFQQ_dQzrQmiGy6/95090475_FxxBPYQzPwe2dH1/
http://az-dizayn.az/wp-admin/common_zone/individual_portal/f5jGFgXFOcm_plodKl2g/
http://balacinemas.com/cgi-bin/common_zone/guarded_portal/6426060154_H52ZLL/
http://blog.armoksdigital.com/wp-admin/personlich_7eu5e1p4h5qeq_zpmign/innen_Lager/mMWRRHOxV_eo7bh0nu/
http://btoyota.stcb.bt/wp-content/sHnnMZE-do4kpBCMAu-disk/interior-Dx3X-PCKXomygQ521R/BZUU1s66u-unjdkz49pw/Christmas-eCard/
http://campus.meidling.vhs.at/php15/wordpress/common_section/8904485092_n8BsqAd1vRKLF_cloud/vctvdn8src5o_t3uy17u6/ChristmasCard/
http://caterwheel.com/wp-content/open-4q-lw2wz8j/test-cloud/610541218-PZn9g/Christmas_Greeting_Card/
http://cepc.ir/wp-content/closed-ouj6Tj-vxoCnsP/verifiable-forum/Qc8n4XVH8p1q-eogvlvei05Kpz3/
http://charonik.com/po/multifunctional_zone/additional_337639692558_6n5D7Sf5U/tw7s91_u154vutx/Christmas_ecard/
http://cooklawyerllc.com/DB/XygG68105/
http://creoebs.com/vivarea-demo/wp-content/plugins/5HTgiZT_SrRg6gGoULqVe1_module/test_warehouse/gyyJ6_ltwz3uHK2yzvp/
http://dooch.vn/wp-content/protected-sector/individual-area/19vep9kxuyz-w48693u98wyz/
http://eliminatetinnitus.com/wp-includes/personal_8JrkzHJEl_GWucUW2g/individual_portal/k4c9r1jhjraul53g_6zs8392/
http://elmayoreoenamecameca.com/calendar/NfYD7ms_DIbsq25JH86h9ub_disk/VZnO_KGPajjjaPXPYQ5_profile/449687_NcJkqJ6WG/
http://fa.hepcomm.com/wp-admin/3310765_csQpOO8aAgSbHcfP_Datentrager/innen_Raum/1718974130_sRKkyhrddE/
http://folhadonortejornal.com.br/ESW/common-box/corporate-profile/nqRxPJHDeQQb-L8pMuzot7HKgJh/
http://fordphamvandong.com.vn/wp-includes/geschutzt_Ressource/zusatzlich_Lager/9219906700093_DF3UIFKHzThEJ33/
http://formelev3.srphoto.fr/wp-admin/offen_iKIymvBk_VKmbbAJ2NR/zusatzlich_Profil/Qy0uRy3M21_6kNcM03i/
http://forming-a.com/mysql/0s53/
http://gemapower.com/wp-content/geschutzt-Zone/xe25r3zuyrj-pafzglnxg1-Raum/SsGSo6t-h8Hfxk4h/
http://gindnetsoft.com/o/open-box/6q0e5gh11nhimjb-wc8imy42g-forum/8kOKi85TepJY-yuH1KgKGrx/
http://gindnetsoft.com/o/open-resource/guarded-cloud/hh50dcc2eutevdf-5zy8vxy71yw3/
http://globalwindcouriers.com/cgi-bin/common-resource/6074788-h2LwKccIKNq-4DwQ-M13qvSiT/6nwu-066uu7w0/
http://gomitra.com/aspnet_client/xkwsJj/
http://governessfilms.com/cgi-bin/gnbw2/
http://hanserefelektrik.com/wp-content/o0zEZ17669/
http://harbour-springs.webonlinepro.com/cgi-bin/pdviP01/
http://huahinbridge.com/wp-includes/common-zone/additional-space/524780978-P5iIJjo9mypCE/
http://intermove.com.mk/language/private_module/test_cloud/72373948946419_VeYXS6X8M8/
http://jay360.ca/wp-content/common_section/security_portal/bV335SWB_mhfssb7kd1/
http://lienhenhadat.com/wp-content/multifunctional_zone/verifiable_703252286029_PJylRWbj9jDBIJ/c2qeb9w697_62w5s7s850s/
http://lit-it.ru/js/634379453735-CO7vcjv1nSggNf-zone/guarded-area/4Gr8o-iiJvxo0xt/
http://magic-in-china.com/wovltk23ld/f9aH1153/
http://matthieubroquardfilm.com/wp-admin/private-546619780-RwhX6mJMQ/additional-lfte72d-r7y12kwrf8rgnl/k8Ts5-gu3z3Mgy/
http://mausha.ru/bin/protected_section/guarded_space/55231512111297_xncBK2/
http://medreg.uz/Docs/verfugbar_cGDVb7x_hjvOMphaw/corporate_Wolke/wcvx7fgnbu_0y4vu93/
http://nangngucau-hybrid.vn/vzai6q/open_fn3wbjei_wziq42p2qdx/special_profile/T7F6y_wq6KlIeblbecjm/
http://nieuw.wijzerassurantien.nl/test/open_resource/test_hf56q86i_pqchfhb5uzij/OwKDYAz_NsHfuwgxkf9N8N/
http://peikeshargh.com/wp-admin/HXU15i/
http://polandpresents.info/libraries/personal-651994924-X7V6myRRAG/corporate-737079-fKT1mrk/pYnBz5M-n1dNzvbmG8mzjo/
http://radheenterpriseonline.com/wp/255100344617-DXmznK4HbgGr-Zone/auben-Profil/806306634810-Q3DIOkQ/
http://shreeharisales.org/ubkskw29clek/closed-zone/68yoz8p569fy3gh-4jp4z8vt-5na1kj610d-s1ocyu/dhxd7ku63jdpn-s22689s8/
http://ventosdosulenergia.com.br/informacoesfinanceiras/available-box/additional-forum/5YAbUg0O-fKt2plgyGo/
http://vikisa.com/administrator/common_array/open_cloud/46301603_gVATTuL2kqnB4/
http://wegol.ir/dup-installer/closed-1483350582-4nakWfPv6Z9AmQi0/interior-space/lukm1sszp1l8-17zwws5/
http://wp.hby23.com/b5pvcpp/common_array/special_warehouse/9143087037828_x2tZRI1GsT6S5BuJ/
http://www.abeafrique.org/-/private-2304594731902-nr0wnClgtu/guarded-area/qxnys3G7eRtU-uGzGeyIJp/
http://www.bbd3.cn/calendar/ZJee4zyk4G_ENpp9EjiAx73E_sector/verified_forum/2ynzedd88_0w90tx49s/
http://www.gxqkc.com/calendar/closed-resource/verifiable-portal/PDaUMFEggFqI-NwgnvgL6idI/
http://www.gxqkc.com/calendar/personal-disk/KzJQxAWGW-icwOWnBm880AjJ-area/9pvy04p-61u95y16yt6zz8/
http://www.ikedi.info/wp-content/x4f7893/
http://www.jinanzhenggu.com/ubkskw29clek/available-array/TnllLYv-Rnf9JbEMPmW-profile/woEzctk-o0nqfIjNNsd9/
http://www.mexon.com.tr/komldk65kd/available_section/additional_cloud/jtgzsy_wsu6y/
http://www.nid1969.org/wp-content/uploads/2019/12/multifunctional_x9WfawsBVb_0InBccFuMWO/individual_portal/g8ne_184s431x420v/
http://www.nsfund.mn/wp-content/private-box/external-warehouse/019897-APyosFi8O63kiPFQ/
http://www.onion-mobile.com.tw/wp-admin/common-resource/test-portal/NCbKv5-fJq9Kj1l/
http://www.qingshansq.com/flrr/geschutzt-Sektor/inu5vvsd-g2glx0ghopyvq27-Forum/1fzcOfR5GHu-KfvK8plMqge6/
http://www.serkanmatbaa.com/alfasymlink/whb6f-Nly9E5F-sector/individual-area/905294-5pCYCm5isE4J7PS/
http://www.trangiabds.com/wp-admin/88IHJgsuqF/
http://www.ukukhanyakomhlaba.co.za/wp-content/open-module/5Xt8PC-jyIfJJbY-area/BX8bRBCkNkU-dxuHtI89jmNKp/
http://www.xunikapay.net/ubkskw29clek/available-zone/Gx8kL-YUO3eQ7BbNrYl4-epQnZ86rq-pfWMSE14bntd/EkIzL9P6IQ9-J6Lu6zxoLJ9v/
http://xirfad.com/personal_module/close_FCVhqFw_oNbZaUgRsT/2647308058_7EEOPaGuFnDDyC7z/
http://xspot.ir/wp-admin/942458_ouxH802cGvt4Y8_resource/verifiable_space/95ozd4jp0q_z78xsv5w318y/
http://zenrp.net/zenrp.net/closed-module/open_zone/interior_39158683_ic5PVJiMG/jfBcGKzAeo_n5eho2Mvs/
http://zno-garant.com.ua/wp-includes/multifunctional_disk/interior_cloud/zwow_31uw683w60u5/
https://azatea.com/pytosj2jd/e5X381802/
https://blog.devlion.co/wp-includes/common-sector/verifiable-forum/444901-lTilIztJlsTT4k/
https://bloomingbuds.edu.gh/wp-content/multifunctional-box/interior-25499098029-QOlEntNttA5/VZFXJm0Tr-id8g1ejcN/
https://chuandep.vn/wp-admin/open_sector/external_cGpG7ZYiUg_v3PYMsuj0nYD8/7d4734jz5021od_s42s95uuv4/
https://circuitbattle.audiotechpro.pl/wp-admin/protetta_allineamento/esterno_magazzino/s1s9bpi0w81cm_0wxuz315473xu/
https://darazoffer.com/wp-admin/63iT_dlDNTxOb_module/ufu_87l87n_cloud/KsnXoJML_om010y25psffGH/Greeting_Card/
https://fittness.gumbet.org/test/available-fvcw-dn3qs45txmb2t8b/individual-area/9gwlvlsra8h4h2-y72yv1v4v/
https://gloriapionproperties.com/wp-content/9k16/
https://hgklighting.com/wp-admin/V5i324/
https://kashifclothhouse.com/wp-admin/Pzv6563/
https://langkinhoto.com/wp-admin/available-sector/test-profile/8ux3xq-3y91y88y2y/
https://linaris.amazyne.com/tmp/available-section/t5BR-eav5IyBr-forum/3903116-B9cf8DEqLq/
https://lineprint.uz/wp-content/private_resource/verifiable_forum/kb453ojzuo_9w10u/
https://mobic.io/wp-content/ceJUSU7_0GUEPMA_sector/14703075_1xMtEXte_space/GcjSAf4nn6_1athHMof/
https://nangngucau-hybrid.vn/vzai6q/open_fn3wbjei_wziq42p2qdx/special_profile/T7F6y_wq6KlIeblbecjm/
https://reliancechauffeurs.com/cgi-bin/pfdm9xr90ku3rb8-xke9oi-sector/close-cloud/rhldil-v0902/
https://taichi-kim.com/wp-includes/private_section/open_7962204_m5DRKYbaZEzc6/7269224_z5Zmd9/
https://upkarjagat.co.in/calendar/x7u4lg15h87hykmz-i2ibg-zone/hM2vgCK-Mx9mbSPWIYDg-area/hSRJuzCR0fW-KLJi2urJM0M/
https://www.cpttm.cn/wp-content/personal-array/interior-forum/auvbdxj-86u2s3xwww8810/
https://www.ige.co.id/fonts/private-sector/security-736905-7osvLLdJVrES3h/17148827025566-2mxgRoXaZ/
https://www.itrc.gov.co/consultaexpediente/6Po4vAi-LWBIcI0-sector/security-621148-JJmkOih/19026667288759-SNCp95/
https://www.meditationmusic.shop/musicshop/MYatxrUp/
https://www.trangiabds.com/wp-admin/88IHJgsuqF/
https://www.womeninwealthinc.com/pwnml/closed-disk/external-cloud/v6Xlyxf8-fmM136NN/
https://zaometallosnab.ru/wp-content/private-array/verifiable-22q8itvxxxe-latt/k1ylgyk7eill-t5tw31730uvx9/

http://180130066.tbmyoweb.com/wordpress/eTrac/cng03de/6cua80-5518-437087-l3z7-ydjcha57fib7/
http://288vgz6w.com/calendar/sites/f4g2-52419-513008882-jnwr-dgg0p/
http://565645455454.tmweb.ru/wp-includes/DOC/
http://abuzz2016.cases.agencebuzz.com/cdq/parts_service/
http://acquaingenieros.com/wp-includes/LLC/3izq7v-8558487-945-gx3bs-se0qcbe6ec23/
http://alphainvesco-demo.azurewebsites.net/wp-admin/sites/pjomsyaxuqs3/7hsx6-21334668-02382-7l705xlcq-elnw37268fi/
http://angthong.nfe.go.th/0yj9uy/public/elsjoi88tf/
http://baccaosutritue.vn/wp-admin/statement/s46oj21/a-908-38532-ccqp0-dc2fon6usy/
http://basileiavideo.com/wp-includes/sites/tkp4wl3/
http://bendrivingschoolphilly.com/wp-admin/4OKY46Y/phazhl6cis/
http://blog.kpourkarite.com/et0a/ZnG6LPQDOd/
http://blog.leiloesonlinems.com.br/4di2cwm/Document/
http://bosforelektronik.com/download/docs/l40q0mgg61c3/
http://buyflatinpanvel.com/inoawi46jcs/statement/
http://cagnazzimoto.it/wp-content/LLC/
http://capstoneww.in/www/Reporting/j354xr/
http://careline.com.pk/wp-includes/DOC/
http://cgnchriskiller.com/wp-admin/parts_service/nmof5-39318171-7363-6hn0n74r4-uidf13dehxmt/
http://chaoquykhach.com/wp-snapshots/balance/
http://claramohammedschoolstl.org/wp-content/uploads/payment/u-68928457-7158-7ucrc8u-y1hu/
http://clearancemonkeyusa.com/scraper_folder/swift/ede3tc-29201290-136142863-xpc7ffc-no72p/
http://cms.maybanksandbox.com/ubkskw29clek/invoice/
http://cn770662.sum.uno/mysqldb/INC/
http://create.ncu.edu.tw/calendar/Documentation/pxqqqu/
http://ctsic-usa.com/ubkskw29clek/docs/rcqbxvmcbj/
http://demo.rkinfotechindia.com/stockcms/lm/x1thkjus8/15-26920-60036804-c39fhce3s-zxff1/
http://dermahealth.kiev.ua/wp-content/DOC/
http://designers.hotcom-web.com/ubkskw29clek/qnpm1p/
http://diaspotv.info/wordpress/G/
http://digital.gemacipta.asia/wp-admin/9I2ZO2MFULSD/6g5ou27/42f-7854925558-538-niu9qxxudai-7tc4s8bsxjt/
http://discuzx.win/yao84b/INC/
http://diwafashions.com/wp-admin/mqau6/
http://dixartcontractors.com/cgi-bin/nnuv/
http://docosahexaenoic.cn/alexa/esp/
http://dunhuangcaihui.com/feed/wiytu/
http://easyvisaoverseas.com/cgi-bin/v/
http://eilonstrategy.florencesoftwares.com/wp-content/mu/
http://elevaodonto.com.br/lostpass/public/d4lrk5/hxcq0-2137403-77417450-8j8f1-yji87e72y/
http://elevatorbracket.com/cgi-bin/esp/8-81515061-644-0i1869x-zl2c6x/
http://embalageral.hospedagemdesites.ws/wp-snapshots/sites/gxagnw43b99/
http://en.daotaohatnhan.com.vn/wp-admin/FILE/nme1toyra/
http://endoaime.fr/wp-snapshots/4ka5koms6/3z473u-13767389-68356228-5p4i-dwju/
http://evodici.mi.sanu.ac.rs/vrnjackabanja/browse/xe2i6e/w6f-862-44079395-sw2x2k-5e0ys/
http://gameshashki.ru/tof/browse/synchc0eks/
http://gharapuripanchayatelephanta.com/wp-content/LLC/x752zi/3i-335764784-80371-hs0utf59-jvn695fe7/
http://gotrukz.com/wp-content/INC/xnmdt86cxz/ef-705607-89919256-bl52nzucu1c-uyeayvbgot/
http://gratitudedesign.com/gstore/kfe/
http://gxqkc.com/calendar/lm/bulw5zde4dq/
http://happygoatrestaurant.com.vn/wp-includes/Reporting/
http://hardmansystems.lt/calendar/DOC/n9syb-4897144877-0831-4o29r-vln6r/
http://herryjoa.mireene.com/wp-admin/Zv2k/
http://hg-treinamento04.com.br/otafny3/swift/ks3omfj7hk/4jqus-24471-1866267-kn6t8odbr7y-4ziqd4zudczb/
http://historygallery.chinesechamber.org.my/wp-admin/paclm/ztpp-9528-18777-igc7qbni28-sk9bj4ao/
http://homebay.vn/wp-includes/Text/report/vpylci4-068195118-898881930-lvep8141-c3llcskdow/
http://homologa3.prodemge.gov.br/ewem/payment/ni9bvis-105-952-98ph6kwie-nk9sra90maum/
http://hotel-le-relais-des-moulins.com/en/nbxA66tO/
http://houseinitaly.pskdev.com/wp-content/66yjjz8i/
http://htx08.com/z79za/invoice/wn-376098728-67745-d0a16m-ihwgig8kr9/
http://i340215.hera.fhict.nl/wp-admin/browse/2nqkvb-194-68807634-ad8ei2-yxwo/
http://ikahotel.com/wp-admin/nlc2c/
http://incerz.web.id/wp-admin/Y1U1DYIPZJP4JQ/
http://ipoteka-24.net/wp-content/uploads/v/
http://iranmohaseb.ir/wp-content/INC/
http://is-hp.com/Syllabus/payment/v-075715-201046462-455f-a8g4fgdvzm/
http://itsallinclusive.com/ar/Xd7OiT/
http://ivyfriend.com/ivypal/wp-includes/h20/
http://iz.poznan.pl/application/eTrac/zolmv12l6ne/
http://jak-stik.ac.id/sentik2019/user/proposal/paclm/
http://javierzegarra.com/ubkskw29clek/docs/
http://joinwithandy.co.business/wfa5/Reporting/
http://julianaweb.cordeldigital.com/wp-includes/0vu/
http://jurileg.fr/reconsole/OCT/lru03enn/6by-73644-77256-l44t-0fe25lv5/
http://kam.vladistart.art/wp-admin/swift/q9jgqtqz0e/
http://kenoradistricthomes.inteleck.com/wp-includes/OCT/
http://kerstinthunberg.se/wovltk23ld/balance/t47-807612500-5017690-7bhkkb3z-hzlj7hzaj3/
http://kingrenovations.com.au/BHEUNSKded33oq3/1odtpqq-1256-4464-679qynn36l2-3dida/
http://kolibristattoo.lt/wp-admin/LLC/o49ca5/
http://kroschu.rostdigital.com.ua/wp-content/lm/0vhzp-093387694-5350415-wfymxniqz-xociss95so68/
http://luckygenerators.co.in/wp-admin/XPLWE9YAIR2/6hvp35zo1/
http://macklens.com/wp-content/Scan/
http://makemoneyeasyway.com/wp-includes/paclm/
http://marebmandrini.it/wp-content/invoice/cgjzq-61478099-23673108-13erb2e66k-c9dbhxvdhh/
http://matthewhuntington.com/HomeAutomation/Scan/
http://maverickcardio.com/test/payment/rqyenw1t2mf/
http://mchs.zzz.com.ua/wp-includes/statement/gnx3tv2htu/8-8247-460-u0b2vsyc-0px54n7g0c0/
http://mha.ucddorcas.click/img/OCT/
http://mitrasoft.co.id/files/Overview/mr6mev/
http://mnvk.adr.com.ua/wp-includes/78380/
http://mnvk.adr.com.ua/wp-includes/qnd5huf8tcr/pj29-0203359-276765-9dusm4ooi29-t396jt40/
http://modernbooks.ir/wp-includes/8TGWRZX9P402LV/kwydvfqkk1n/
http://moeenkashisaz.ir/wp-snapshots/report/ts57s3j/00-358717400-44634-culwkyh4u6e-pioifpseag/
http://moonadoll.vn/wp-admin/DOC/emypv2mj/
http://mslandreoli.msl.pelhub.com.br/sql/payment/cesafn1om/
http://musclehustling.club/ubkskw29clek/DOC/x9hnmqliv9/
http://mychauffeur.co.za/onldk12jdksd/paclm/vpdbcbo-72791-33961978-b7do53-24zs363/
http://nakhlmarket.com/bhbl/eTrac/
http://nantlab.com/wp-admin/INC/w4mpkc9acw/0hl-713659-44431590-f6z8-5de7y0trp2a/
http://natidea.com/web/06105404/7kcwgy/xzua-6773833-488-i72b-q9abq8pa2/
http://newsite.modernformslights.com/wp-content/gj18fr/
http://nginxtest.kaisquare.com/wp-includes/VMAGRU355LYG/
http://odjeca.net/js/paclm/nndhwz-05596-5816-5kz5nx3e1k-eu3z3ni22/
http://openveda.mobi/calendar/LLC/0xcj-79720-2160-juxzvxjt19z-iw4j5/
http://orbibakuriani.ge/wp-admin/paclm/pupz3fu5x/wfe-8738923-9016687-v87u734q-m4f76dny3f/
http://pakiskemenagntb.com/wp-content/4k/
http://prayagmilk.in/wp-admin/Overview/
http://showlifeyatcilik.com/m3on/report/e76n6r002xf/jwr-8281-145507231-ceqc48sq7l5-1wvadph/
http://sukids.com.vn/wp-admin/Reporting/eei81i9xt/
http://tajshop.pk/wp-admin/OCT/z1uezx/3gv448-413955739-39075-xgaj-otiu9uzqel1/
http://talkmeupdev.us-west-2.elasticbeanstalk.com/wp-admin/Scan/gk6ghrfovmgg/
http://testmyserver.dk/wp-content/FILE/detw2r5n/
http://ultimatestrengthandconditioning.com/config.newspaper/parts_service/2o96xr9f1hu2/
http://urvashianand.com/blogs/eTrac/csl1xveho/ubm-46136-393378769-9xypf0j-zffmrx/
http://whatisnewtoday.com/ajs/attachments/gyixk6t3ttv/03g-375341-44-3udk-dx2jm7f/
http://winwordpress.tri-core.net/ubkskw29clek/Document/cnzthx/
http://witportfolio.in/club16/esp/8yqucof-144798-85988850-dx29-e20embj0b5/
http://womans-blog.000webhostapp.com/wp-content/Overview/zmd9woofe/wqa-509-7321-mcij-w3cdzf17h9/
http://wpsync.marketingmindz.com/wp-content/Scan/n5lxn9o/
http://wptest.demo-whiterabbit.it/wp-includes/invoice/6x88rmhhbw/7v6v6p-330287-267949862-l4tkbyb-8uktn42mremy/
http://www.01tech.hk/ubkskw29clek/eTrac/99aa8aq/map-5179633987-06129-hwyj-sx5zw8cq9/
http://www.24security.ro/cgi-bin/statement/2dncw-85469-244837907-psvm73ov-sk8kiwatd/
http://www.7daysllc.com/1ut/JC8QJHQZEP2A/
http://www.admobs.in/calendar/report/3nw1qwb4ulk/
http://www.advisio.ro/payment/my694v1mu/se3rjs-645643779-262875964-0iuhvimw-4y9og1xk9s/
http://www.aisbaran.org/anslam/7250147736077/l5trmw/
http://www.alan93.vip/0oyzcm/attachments/o9fs12wxu/axjff-001914-8402-4vm6un99-9pex6j4d/
http://www.al-falaq.com/calendar/attachments/134ei3bm/
http://www.allenmarks.se/wp-content/Documentation/
http://www.alsivir.biz/wp-admin/paclm/lpd8fyv22i/
http://www.arjasa.com/wp-content/6839456083860273/eb0h-161656209-56-dr06kg6d6m-7c2lp7yadrg/
http://www.atlantic-news.org/banner/payment/pvppwlz/b5k-5263-75180-a2ob11fj8lc-q9hwe/
http://www.aziocorporation.com/wp-includes/swift/wjvwatb6/jgoqnep-449657205-5787-4yyqicu4-to36ofm2m69n/
http://www.bdforum.us/wp-admin/sites/vnbxm7fm/ng1-9215980-35404-o2k446szin-3iebwbz/
http://www.biggojourney.com/wp-content/FILE/w1fxfw623/
http://www.caspianseabezel.com/wp-content/sites/
http://www.chambre-hotes-solignac.fr/wp-content/Document/qbozhp3g3m9o/8n1hd-745-788996558-289uqx3e-2yfpjry8p/
http://www.cinemamente.com/rjw/invoice/yr4p9b4a/
http://www.cocoon-services.com/wp-content/Overview/bot52m6b6x/1zarm-536572-82824228-56um0-11vbal3nkz8f/
http://www.coroasx.com/wp-admin/sites/
http://www.cvcbangkok.org/cgi-bin/Reporting/q-4279968461-4914-ao4wdl-w5zi2wq1x/
http://www.daftarpokerkita.com/wp-includes/Reporting/86til9yuy/3dduuh-4051-99207-vn9vu-iozijb0c5i/
http://www.danmaw.com/wp-includes/payment/uqpcjp/y-42846356-69615963-ozle6p98c-9cng03d/
http://www.darksexblog.com/cgi-bin/browse/a-33700892-7813-avvwj2omu-c3kblkkdz/
http://www.datsun.be/wp-content/Document/ijrsmgf5bbqa/
http://www.delicious-pcannuts.xyz/wp-includes/eTrac/y-7668-08484721-pi4x6x-wj24im853a45/
http://www.dnq2020.com/wp-admin/invoice/rieglb/s0wng5-802-24-ox0w4toru-e4a6s2c/
http://www.drrekhas.co.in/blogs/INC/
http://www.elmotsan.com.tr/w6gwf/esp/hx2bpsnby/4-910931753-14420757-i4d3-uuls0xj5qq/
http://www.emrahadakli.com/wp-admin/93016/
http://www.etsikiallios.gr/wp-content/invoice/
http://www.everskyline.com/aspnet_client/FILE/2jhob9/f0vvap-20347304-0012326-q69ruxym5-aw61w2fb9nv/
http://www.everskyline.com/aspnet_client/Scan/ro6jd2oa/
http://www.fcpro.pt/wp-admin/Overview/feu-7222-67415-n0ham-8m3l8/
http://www.finevision.in/bmqeb/Documentation/x-75611434-100-od6v7-hulmv8t8x/
http://www.flagscom.in/Admin/parts_service/
http://www.fnem.org/wp-content/OCT/
http://www.geckus.com/AXALADAROME2017/browse/l1vy724-4767-0428020-f7nkz-5szwzcmigmy/
http://www.haringeystopandsearch.co.uk/dev/swift/tsca-5817810571-7964489-8cxi9ed5t-agi1vyl9k/
http://www.harkemaseboys.nl/httpdocs/dgl7hreodewn/
http://www.harkemaseboys.nl/httpdocs/Document/3yb2omhz114b/6-0491412-93783540-d3om79lgii-x7868ini/
http://www.haunter.xyz/ubkskw29clek/invoice/jckisf-915483-115933-gq1lnh7aby-0o3asmiucp1/
http://www.hbbhw.com.cn/wp-includes/payment/
http://www.hchsf.net/wp-admin/swift/74kt-5249660-94460498-5woii4-ncgt7ah5r5y/
http://www.impactboltandnut.co.za/Backup/attachments/ppqxcn708ykm/46-70518-17261182-em416z406bk-ku8o6u/
http://www.indorajawali.com/amz/DOC/khpkl7ua6x/
http://www.iqinternational.in/wp-content/Scan/7fbjcgkk/
http://www.jaykhodiyarengg.com/old_site/browse/
http://www.jiyatechnology.com/blogs/sites/5l2ppa71yd/9lc4x-604472-716998990-fnfr-02mep9/
http://www.jkui.top/wp-admin/paclm/c76p2eykrqm/r73iv-735230092-52270-3i6ou0zzih-7ovp/
http://www.justmaha.com/wp-content/INC/deb04u/zshiu-63573585-0615268-co79m-2kbvq/
http://www.landingpage.losatech.it/wp-admin/paclm/1a16t3geva2y/g2ch-80791988-475-8rx2femm4z2-1wu3fu6p/
http://www.lurenzhuang.cn/wp-admin/paclm/
http://www.luxuriafloorfaridabad.com/wp-content/DOC/j3ysc-60517-50-yho8nz9c8ai-8fmjkozsqrj5/
http://www.madhyamarg.com/calendar/Overview/mv1hnz/gl6w-94413-49-er3xt6-9jw0wds4/
http://www.maidpremium.com/wp-includes/518076508/1t0-0142871-53-zrqsm20j-acaegk7q/
http://www.maisenwenhua.cn/wp-includes/Documentation/
http://www.mhi.college/ubkskw29clek/Overview/olq003llqa4/
http://www.mihas.no/calendar/INC/lg-839448861-945770-11g72uum6-jbro1i8ty/
http://www.millbrookmemorials.co.uk/wp-includes/LLC/gqm3wmsn7j/zj0ix-6044691-0325236-z2vpinhd-ytbcfy/
http://www.mlsrn.com/wp-admin/Scan/mh4zf0vf99v/
http://www.moussaspartners.gr/wp-includes/public/mk-749405-9094-kjte2-tg8sxxpe5qjl/
http://www.nancymillercoaching.com/com/report/57c4drrbq/
http://www.newservicegold.com.mx/onmicrosoft/docs/jq7tee/
http://www.nurindo.co.id/ubkskw29clek/Document/ou6hr8lwgppg/cp-7055-95-8tqnz-pfmh4x42u/
http://www.nvgp.com.au/wp-admin/docs/pvvsmetfh/
http://www.nvrda.gov.ua/images/esp/iz3z2r9z/
http://www.octobre-paris.info/wp-admin/LLC/zdwecmu/tkd9-8018-23055465-x7l5u48f9i7-tsvtfcg/
http://www.oect.org.tn/ajax.googleapis.com/browse/azxgi62ztgm/
http://www.oscarorce.com/komldk65kd/DOC/a26im337/ip9prr-2212089369-4325167-03g8isrxr-6ps6/
http://www.reyramos.com/wp-admin/8U8ASSB7O/6yhnjxxt/0p8qi-008-15469-35irf4c0h5-m147f967fi/
http://www.samarialarabuffet.com.br/bkp/Reporting/c31w6-10248-644783-con5h-fjaw2iqn73/
http://www.svreventorss.com/wp-content/uploads/balance/ndcra7xi1ca/
http://www.sxwftool.com/6b0e6/DOC/3xdswn6902e/217-2261-859024-sbv33iy3-au7d6vgkse/
http://www.syztai666.com/calendar/30546739961/vvznzn/
http://www.tongdaotech.com.cn/wp-content/OCT/
http://www.ultimatemedia.co.za/backup/INC/arzgt8kg/3iyou3r-357-4688-831ao2frwo-uocbfj8h/
http://www.walsworthtg.org.uk/recommend/balance/314-216015-796-p6i4x1-djjd22k0o/
http://www.wangzonghang.cn/wp-content/balance/
http://www.wavesgroup.com/wavesgroup.com/lm/16yjmld688i5/0vxo5-38796-104081542-kxvspi-pctfnbvrzm5/
http://www.webinvestgroup.com.br/_errorpages/browse/
http://www.worldofinfo.ml/wp-admin/statement/9oao-31052-618415200-6nvi-1b7h/
http://www.zivaoutlet.com/ubkskw29clek/paclm/qwtq1imhd9/b5ftc-8364225-40-27fq864dl-pnfxwv9s/
http://www-dev.e4healthinc.com/wp-admin/public/knyy-8829485-075-t2ha9g-pgxxdok92zq/
http://xiaoyaoz.com/wp-includes/paclm/
http://xkldtanson.com/wp-snapshots/INC/uvatwx/ko8q7w9-93788918-206576-k0s5vy-i73tbb/
http://zaferaniyehcenter.com/wp-admin/d3k2c/
https://albacetecardiologia.com/web/LLC/d-905-0791193-nssn8lk-hudzi/
https://asight.com.au/wp-content/swift/yzs3bbxfdlw/zy1a-24206670-95267255-e6y3jzx-zvj2l/
https://boompe.com/js/LLC/x58kb-136-4933-oe64-a5lonu/
https://boukhris-freres.com/xmenial/invoice/d4nrta3o/1-2127-6129595-bb4nerj9m4z-j2a0hn3q/
https://com-unique.tn/xmenial/paclm/
https://dian.199530.com/goblawk2jds/Document/87xac-107-6179-607vo8k6lnw-m9i74ia8j/
https://elmorromid.com/wp-admin/lm/
https://en.whatsappgrupbul.com/cgi-bin/swift/7k5ax1/
https://evoliaevents.com/xmenial/OCT/ni-446-08377-fsc3ne-kiiurqjtv6vt/
https://gabanakrg.tn/modules/Document/cjaaquz95/d5k4w64-04091-0396438-buu84osv7yi-ytgjr6tftgs/
https://ghaem-electronic.com/ubkskw29clek/docs/ag3-487802-8206977-n98y-j8py/
https://hatro70.de/1/Documentation/b1k3s-4171-17569770-ua2g3ic8srh-uqu7r48/
https://hellothuoctot.com/wp-content/dw7e9/
https://hotelbeyazid.com/ubkskw29clek/browse/i-102156836-4721-99z1yx5cql-qhkclw83adt/
https://hotelbeyazid.com/ubkskw29clek/zzdvpqp/
https://hotellix.in/wp-includes/DOC/fit7ni/tkm-6154203-557-7am0n-j9xiu36/
https://jabtco.com/wp-admin/INC/8mhnem4m8fvl/
https://josesmexicanfoodinc.com/inquire/164921573099/myrw2-509-0251-t9ws-je68puw/
https://lttlgx.com/wp-admin/statement/xlgreljm37/ss1k-649704733-0406-3d2w8tgrm-qrtyqa/
https://mustakhalf.com/a5lgi/swift/cuk8iijky/
https://ppid.bandungbaratkab.go.id/wp-content/JDZHA6ZZ4E2/z8ad-23987-658512807-f529-di94joorkwt/
https://quynhoncar.vn/wp-admin/INC/6tn1ngt/gyg7ct-4524593-657962523-8y4n5-fiob/
https://test.hammerfestingen.no/ubkskw29clek/XGPJC7CE/aoce5lsu/
https://thienvuongphat.com/thienvuong/balance/7vrol9ejf/
https://www.advelox.com/wp-content/uploads/eTrac/sevfqr2i/
https://www.boxon.cn/wp-includes/esp/t8240ugq11k8/79-660-47391-gjwzfy-7ftnzp/
https://www.cui.im/wp-admin/eTrac/
https://www.evergreenlandscapingga.com/wp-content/report/74gan16vs/
https://www.jorpesa.com/uploads/zvzkuy/y8v-429-8322050-g6es-bl84p/
https://www.loraer.com/temp/DOC/8o-059-523-yu65epwiiz3-x7fm/
https://www.madeinitalybeach.it/wp-snapshots/FILE/z4yk0wp-39273369-453422-i6pjnvfecy-kbxk7aiz1ukv/
https://www.maidpremium.com/wp-includes/518076508/1t0-0142871-53-zrqsm20j-acaegk7q/
https://www.proqual.com.tn/xmenial/public/3ih022e/

http://16food.vn/calendar/apwkwv-ucx-90/
http://401group.com/tmp/uwni-s5-79373/
http://981775.com/5d1-d8a-40561/
http://agenciayb2.com.br/oldsite/iQyKhK/
http://aimeept.com/wp-includes/1ymdSGFF-Vk7PrEhA-38193/
http://aleaitsolutions.co.in/dotasq/ursnrm-aw-903/
http://angthong.nfe.go.th/0yj9uy/0jmme-n4-7880/
http://apartmentsinpanvel.com/banana/tyuu6-79-21149/
http://baeumlisberger.com/cgi-bin/EYOf-jF5BLi-50779/
http://bagfacts.ca/wp-content/updraft/oHPECmC0/
http://bahai.ph/cgi-bin/qMY/
http://banhangship.com/setup......................../hKWFmHRg/
http://bapenda.pangkepkab.go.id/stats/i4n-ppr8r-7263/
http://blog.blackcab.ro/ubkskw29clek/nWtogZy/
http://blog1.abysse-sport.com/cgi-bin/7br6z-1n3i-53389/
http://bpnowicki.pl/wp-includes/7swk-2j2-75/
http://bravobird.com.br/baepi/ym1-kk-096/
http://btlocum.pl/wwvv2/9LfAxF-8NcPF-12/
http://dejavugroup.com/wp-content/JTjHLbr/
http://dev7.developmentviewer.com/wp-admin/SYSQOx/
http://dhb-logistics.com.vn/wp-admin/p0ui-rv-0046/
http://eloit.in/alfeenpublicschool.ac.in/J4bX/
http://explorer78.ru/wp-content/uploads/qBeKjMZ/
http://ferromet.ru/ubkskw29clek/vhu-7gKxW-7371812/
http://foozoop.com/wp-content/bom07-5m-7785/
http://gaoruicn.com/engl/EIdIDlR2870503/
http://gentlechirocenter.com/chiropractic/caJj0COC-0fB4XKxu-71/
http://goldseason.vn/apukia/gsfaTp/
http://haiwaicang.com.au/wp-content/kgh-q4-47375/
http://hassan-khalaj.ir/x4jqp8bg/I83-OGnzwyq-52/
http://haworth.s80clients.com/wp-includes/N7FjWWy-8Riw95-89164/
http://heta.org.in/siruvadieducationtimes.com/4l7no-nkrnk-438942/
http://hostcontrol.xyz/test/e2zxfg-uu2-967685/
http://hyadegari.ir/wp-includes/ipPrto8x/
http://igry-koshki.ru/wp-admin/VWry5z5bE6K/
http://inovamaxx.com.br/eng/getp0-hpb2p-9435/
http://intrades.in/old/scmi-8bm-55081/
http://iqracentre.org.uk/wordpress/b2lmx1-fnyuf-479883/
http://ivmist.lizahashim.com/cgi-bin/1s5-aee8-41/
http://jfedemo.dubondinfotech.com/update/Nt71708134/
http://joaoleobarbieri.adv.br/test/l4d6638v6l-fotnu5m-867027278/
http://joelazia.com/wp-admin/oZfolIm/
http://johnnydollar.dj/wp-includes/p7md-wd0-912/
http://kansaivn.com/wp-includes/hSxhoD/
http://kaplanforklift.com/web_map/PmTuIEQ/
http://khoahocgiaodichvien.dvh.edu.vn/wp-content/3ezjdh-fo-7810/
http://kkb.com.sg/wp-admin/9xxx-vf-96174/
http://kocurro.pl/wp-includes/68x/
http://krishna-graphics.com/wp-admin/11x12xd-nobh27two-82927918/
http://laboratoriosanfrancisco1988.com/9rlkyc/Ccvvezsv/
http://lanyuewp.com/electrician/ig9eu0g-4q1oml1qc1-749166/
http://lapetitemetallerie.fr/ubkskw29clek/GZGPQ/
http://lareserva.com.py/aloja/AOISroJmq/
http://launch.land/training/n1lpCV/
http://lijun77.com/wp-includes/vf7k6k-2dn-069/
http://littleturtle.com.sg/admin_imgmod/EppjAS/
http://livnaturalindia.com/cgi-bin/voljkl-m34z-819005/
http://londontravel.com.ar/brc/HsGpuPR/
http://maccubedholdings.co.za/wp-admin/ETlIAiIq87499868/
http://mahoorsamak.ir/wp-admin/ie8a2-gju0-22060/
http://mail.smkibkhalifahbangsa.sch.id/spam/4xr-v9-24/
http://manuel-gruen.at/wp-content/qmOZ/
http://martinil.aski.iktweb.no/cgi-bin/dute-f9-60/
http://medegbetv.com/wp-includes/mgmv-u0-17233/
http://megemanuelle.com.br/wp-admin/bv5ae-0y0x-184147/
http://metourist.club/wp-content/vvny1p-qne5g-19730/
http://metranbx.vn/wp-content/gFk/
http://montebasto.com/wp-admin/n8wj4-c3-179862/
http://msakaquariums.com/wp-admin/MYxTckF/
http://ms-sambuddha.com/wp-content/inzl-jrd-65092/
http://multi-plis.fr/wp-admin/dvl8f-olnu-25705/
http://mylegaltax.com/wp-content/uploads/mEgJByX/
http://nazzproductions.com/wp-admin/p5b/
http://new.wum.edu.pk/wp-content/txU/
http://newsletter.uclg-mewa.org/a11/kw3-hc66-43605/
http://newsus.xyz/wp-content/ufJ/
http://nextit.tn/topx/4uyzZ5uSViC/
http://oldschoolbar.by/ubkskw29clek/nmtbx-ov9a-57/
http://ozenisnakliyat.com/cgi-bin/or3rhj-9auvp-88/
http://pharmsol.dev.webcastle.in/wp-content/xMkinA/
http://sarir.botgostar.com/s94u3s/svAnD/
http://sdrc.org.vn/wp-admin/e2o5p-tlko-58541/
http://shopzen.vn/wp-content/YXpx/
http://social.scottsimard.com/act45v/cyceos-fg-46/
http://sosw.plonsk.pl/wp-admin/olmv9o-opoi-2261/
http://sparkinsports.com/wp-admin/OlzGn/
http://staging.jmarketing.agency/wp-includes/jovAws-GL-12/
http://talkmeupdev.us-west-2.elasticbeanstalk.com/wp-admin/aaH/
http://tedet.or.th/Register/btT8417587/
http://test.absurdu.net/wp-admin/22jS/
http://vcsolution.it/Blog/DNY/
http://vicotech.vn/wp-admin/aJO/
http://www.aai1.cn/calendar/3GQcfrJ-TAbbm9CW-5487561/
http://www.acgvideo.co/cache/rzvKsqUX/
http://www.armonynutrizionista.it/softaculous/iofp-xpzb8-7079/
http://www.billrothhospitals.com/wp-includes/bOjI/
http://www.cippe.com.cn/exeim/cippe2020bj/cippe2020en_bj_zhanghao.doc
http://www.cippe.com.cn/exeim/cippe2020bj/cippe2020en_bj_zhanghao.doc/
http://www.harkemaseboys.nl/httpdocs/2hkvft-mp1-6897/
http://www.mandiriinvestmentforum.id/cgi-bin/rzFOnX/
http://www.nba24x7.com/wp-admin/5za-yqs-21881/
http://www.smdelectro.com/alfacgiapi/fkq-lke7btj-80091/
http://www.todovampiros.site/wp-content/kOc/
http://www.wangjy1211.xyz/wp-includes/bmzb-f0vjim4w-5277909/
http://yojersey.ru/system/MCb99174856/
https://autoescuelas.vip/error-docs/dlpp-c07l-640/
https://blueclutch.com/8ib8a/46afy-2dlbs-3271/
https://codeproof.com/blog/wp-content/uploads/2019/b3qqpi-2e-738062/
https://coges-tn.com/xmenial/glov-7n0-694281/
https://fam.com.tn/xmenial/sKHY7fD6a2/
https://georginageronimo.com/votec_no/LJHM/
https://initiative-aachen.de/wp-admin/msg5i-rl6-661/
https://kronkoskyplace.org/stats/lpqh-r33r-34355/
https://leavenworthrental.com/calendar/aoo-ue7-653740/
https://mirza.co.il/wp-content/485h-x4v8i-64332/
https://mirza.co.il/wp-content/ebNk/
https://nameyourring.com/old/0jb-07y-96003/
https://naturtierra.testcomunicamasa.com/getproductos/pc4gv-af-352709/
https://partyflix.net/slider_photos/lXMBVu/
https://reliancechauffeurs.com/cgi-bin/0aJSPotpT/
https://salvacodina.com/wp-admin/aag-u5eg-6640/
https://scorpiosys.com/cgi-bin/lzLlxrf81/
https://sella.ma/mtiwanabate/gMeOVCYhV5k/
https://staging-wavemaker.kinsta.cloud/wp-content/skgi0-cu-191149/
https://thechurchinplano.org/img/Nhy6I8Sn-Ebv-5604/
https://trifitkazar.000webhostapp.com/wp-content/u16l-e3w-05100/
https://www.air-pegasus.com/sips/ADcnKLXD/
https://www.compelconsultancy.com/2ic0/lNeMPamsg/
https://www.fidapeyzaj.com/wp-admin/SmGs/
https://www.noorehidayat.net/wp-content/TnFiduyN/
https://www.proqual.com.tn/xmenial/utrb/
https://www.silvesterinmailand.com/wp-content/uploads/rn7QJr/
https://www.vffa.org.au/_vti_bin/ojRWIAc-YWW-9327704/
https://www.zlink.ltd/wp-content/plugins/5n3rdc-x8z-741/
https://zappi.club/example/pqo6-ee5-56812/
https://zs.fjaj.org/wp-admin/jLg87/

Payloads per Epoch by Document

Epoch 1 Payloads by Document SHA256 - All Times UTC

Creation Time	2019:12:20 19:40:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
06e964cd2981bc6abea29dd680ea91ffff97629d97d557f306066da6c354c5c1
0a430db8f97c853692ab17929306a7a3ac9523448c878e51c0fe7a1665833f24
0ddd05f4a301e8919c22f9b5a404d93db3d5aa3e3dcd7b5b3e014e189b297b2d
0e2f92e673a24cd047d183ebcc0fdaca842dbd2d0f32b7ddf18eab3ce91a571a
100ef3eaa20f4e6bc17de7448e4352a84784d9d8ac61b930e401c587b13fcf60
129482488cd6f5983fca3393904f483081777f6493b9d11ea0975642c526c6a6
168dfc2763a87857945cdc0317b1c14c39090bf77bedbb1aecde817c9d72e153
16f805006e7ae7f2d0ef2a4b55bc1e7106416f4b33c89a9decb908d0ebeb8189
175631845206a9103b432204e030dd40305e601fbf9ef23c675d52e361bbeb33
19237a006e3daea29de2e14e4289e34436f5e731fbe4cc1094c875ea3868ee6d
1aadecae9e168d092eb93dbad3f0473f5c2c11233263ed2ace1269ae81743868
1f366cf4723a079ac74cffa0f2e010274381b61fbc3217bdc6f865f477851f68
23717bcb4841ea18fc5c0566d07674540c8b9aa2330bcdb27294639afa97f9ba
23c56af999385fcaf0093bdc6466413ddde04a22076aa7ed1fb7b2f5bf54f752
24efe50a46fe26d0fc87789c1a1537624b52e92ec912e7414708fca09f39a1dc
26817c08cb0275f3a5a51ca22f097e67bcde3e1b88136b7ade6c576641e5a736
2936678966418f44f27accb11b9b10a38706ccde02fb065e7d11e1c6db95cd56
2a8c8811c9e7ec2805e9f2e143e1251519e8e8a550a2ec90c011f6d67e4d4a1b
2fad5d26bf173a2b301a3de05c0d235bb2997ee63ef0e541419d9f69149e551e
2fcc520e5c6709038eac3db303d2f19039dd8bf5ed4f2ddf129750c80e3eba7a
2fd30699dc2532f9cbcf06c2c93b9f95b7d22eae3a48dff33edfe1ac0d43777c
327929a80874cc6758514c3440b5c21747a0677386574c470f8fa1265e796113
355e0aaa64854e7bfd948a00e3f12c5c7bce5667d902b1620ecd730dfc1bb49a
369da21e5f8b8452f9d214d233ccd13fa0027e64ebc8dbec41f48d8b6645f7ac
37aa7ca6a936d76db6e8f8060a5eb4c556339653d6a82c4b11667d28f81af587
385bd4e020a50611747ca89e66a0047f3f8eed5e68c0c53c8d21376d71ca57f1
399194bf5a65f66bf7d130c1b73d5c5fd4cac3743ceb388986e338a04725bcea
3db22fc8c084e6a87a3a652ea0857b8bd426e3f411655e9cea22049f36d6245d
4417c3cad1692fc55d52e9140cae0442c4dd39e890b28765a2cf163e1ed90f45
4472c7fe106faabb6ca6752e1b432701b8a4d2f7f54444be0eeb35628fc4c588
4843535e3194962ff409d66b0253c512ae59915aa096cabcb1b2566ee4e512c7
49beefe9dfc6c9b3ec74651bd2530380b99060b49b37054bf733598dc9730cf7
4aa0537d19e18f7f532a0c2bbfdd05180a91cb2e55a00d696a1b11103dfa6f12
4f3d263ad80f53f48ae5998616306f43e7694c970be3c50cef65a433bc3143aa
4f47a7ff10fa60252b8243a0df9ccdbe411584bef35bc1b8f64c065e599a3579
50dcf92edec81364ff441e3d4c79ec55117831cb15a924dfe96cf560fb018ba9
5856d01e49924a0e1b270f2113a1bbdecec91b51ff0ac817a82099b71f685092
5f8e1db286f45275923dc8c586f6b4f3a7d49046fce404612e08f9aa58c307a8
6531da720696ea38f4c210ad02a291f0d2e529a80c7d11a123e87f155931108a
6b5c1c3d08800af322067f827a12630cc26e7f65ef3727e1a221564bf4f9c024
707ee51bfd995a289eadd2fd6de0e10d27f09eba9c8c36abc54159f568138c66
748d8ee268690e367173ed6e5c87c53dcb2beac844dc1c8dc8056e6b7942687e
75bc12a92635bdd849b7e839dc99f941a15b789c297114f4d495a323f1826000
76f2c4ce954bae527c898aed21e3dce200792a97dde4f23d62d82d29ef282793
771f1eacdb0ef3997b649a6bfcff29bf7d5a0f111ded328e2e2d7a67e3028b10
7872f377f1cb094062a8d303fb35c5097e3678acf604bf9b94b31f29afd76d55
7c018bcf67b038d49191e307db7529bcfa066ea53e1363086aae335d75cfc708
7c1b37c35f2850b2e46138366121618fbb23d5222b11acd5d08b1e374e107192
7e1429bd23c6f89cf7970f458a4f73702555eb6c4ad99bbf1d3e358e2b12af78
81d4a33c97c626825755b1532738c952fcfdf969a7349e576572673022bc2699
82d9a06e74df7245bcd4c9a373e96b7551e3abe60cc213813000b85e4259ce09
8465c1ae1e1efd9b35e631873245f8cd88a15e884ace87b68eaa2d407dc3b6fd
8ebdccab840fd929381c8356d0a9297e1d1f006ce673b20dbb4a22dde5605c07
90e2956ae3d1d21a5e1eba0ee1d6c4d2705981b5a01e275714335f0612bf90c1
9226fee36b06ea8bc33b15edc46dbcf204b99b007ba7ab450124c4cc6819957c
967020e546056a6fbad4bccd2bf5343f8b4a4991afa275220cf4065524022540
978bf9bc1455d7a7eb309c0d7fd44663327bc85e9723aea49faaa46c10031282
9803986c724937dc2539586dad82439688bda6bbf4610caef7514be5ef978485
983aa1b8ff03cad2df091c2284cfced032b0b06c33a3cb34c82af9bc4ae599af
9b7afc5748ad5942d87419139146cf70e42bf6906cfc42222b2bd2003071994d
9c4f434fb521202b67430dd1457693ba48ea05c364360467b455bbfe908049dd
9d67092d31104c89adc85e3b7a59cbce9e04d713f3c5e95c7097df03bcd8009e
9f6a5686150652b0bde439cf0703a45f0b103bf76cfc4b1a85500a9e9e8bd431
a2ab1399a497d800f72111fe243fc093b5b3001c522705371f6ed5daddda211c
a4670d435b42b2e9d9a91ac0a281e6a83c542c740ab5e8734f2449268ce46f80
a6444a59260964e77887be30d8179ebd5a1886062a353afdd333dae2c2aac3c6
a8a98e8f34e9c1dc60b579611f46539dc245fd602f1602ab0f642aee117b1773
aa598e5b1f6673c8109cc841632dc3982b7554ac9e4a6d6a37a3c906599eaa2d
ad97d47e1677a88bae94cca01a1937e50fe6c2f7b3bf01a367d49ce3437a4573
ade5bccd6afabfc5ed4a8731660fa2a03293f27e09c16072badcba832716d760
ae118ee5e816193ebe9dd673a6925c9d6b7cff12821bde00f33b3189c4a59958
ae838a9065866b815ea2cca92024ed6e1f20e75b43122691ddf6b02413acb2d4
b1484e49dea5ceaec77ea6f22bd8ec5f509b34996c0f42c346e4514cb978c19a
bbb3c35252340d9e1c20652fe6e77ce2b3c6841efef5ed4e410f28eb3cf3d903
bbf2293e299c008c895f944d9e93a9d8a0b9a8336b771454f839bf2c094ae23e
bd0c17923d93f5962cee987244cfd84bac8084177539e60e1939885b076e9e86
c2660b580ce36635a6c36520d418e4a436765d66d4235c12982c85f66a84f764
c65731a55c0d065b8de80f7ad11ab0682183cdf281f161945b02e56874d5d9ed
c84c3fe7ccc70552ea38537bd53bb307d9e87ff40887ff6a42225d9cb73d0e0b
c86261af537cffb5942f085148ba3bd4268abf8f34577846146433875f8f44a2
ccc1a4b996f1e552c0b86b78aaf29ddc59c4ef02b38e46e235eee7d339bef0b6
cda734c0f617fb5352fafc5df4f773058ba6a27b871006d36fe0052d274b4049
cfac2c119e2b3ecc8cd4f81f7cab7b96bc8d6a047a4fc7d54d310e9f647984eb
d13d0bb00681170f5c3be2690634f9d0551a48b35015074d803071d4be9f2bfd
d2991fc4edb1a667fa2dcaf28987c4c24b844331d705f9fda99ed82680e886de
d2fe9cff974df61d302310face5a23be32ac7d29b090043aae2e71981b73eccd
d8bf3f84bcf2d1b09bcb3b1126dfe7d291ead29065c761f9b0da2a9694a2e7be
db43102e7ee396331e1b8f67d34bab60b077904b172e463270d008547a4cec4f
dd5156d07e69c72ed17bd3f90f151e33b8444fe5e2c88ce6cf9151cbf18ddf79
de92b8c3e225e92dcbdd324c97bb4261de9077759146115fd221d5f8c0351bfe
e1bc8dbc1ed8ebb36f35bea22826d2da58d9618c9ffe2a87431455886d119e78
e35cd4dc211ffeb3d997026c0d7386a977b400081ad941f9759169f52eb5d893
ede14cd5bd7e74c0b6a23e650edcd8c2131ae2a6edc5561dcdd0d23aa6d1d1d6
f2fb2b3f6d0742465a9863ffc8ee243b9ecabae8538f3d60a84a5c6bcef9330d
f4739e3418100a3b5790f30cc5d4fa114ad61e74a148e582bfcdc30f550b8588
f7fd13cb45859219db5620e417e137b99ddeb61ad442e902ae0ec30e81dbc704
f81a73642a847aa3d1ea7156e57e94bb64645c4316a98f8414d66534cc1d0485
f8fb7f5a27c202c01cc7a59acceb7ef73ddad0d194b7fe63e2f0283eb1c80d21
fc98bcfcba17bfcde91e71833404836159c917c8fcac977b59665fc2e8c20784
ff34cf544133ee85f50b7de12710c5324c1e3b8d11f548695c874e13e1edb7f4

http://hanserefelektrik.com/wp-content/o0zEZ17669/
http://governessfilms.com/cgi-bin/gnbw2/
http://forming-a.com/mysql/0s53/
http://harbour-springs.webonlinepro.com/cgi-bin/pdviP01/
http://gomitra.com/aspnet_client/xkwsJj/


Creation Time	2019:12:20 12:36:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
04796f53de437820db3451bf79ef908d5bb2503bf54010581594bbf36cd8c3b2
09be3d2223400ea37f8a8c46182308a7ceaed44505aae6e9077efc108529d0b7
0a18ad8188361b26e86b37de7dc728c914dd5d3c11aaeadc0b9f3942e41a6c5d
109da0381499feaa9d9bfa202a146781bc1777476841f0c5847015f7a6fa92c5
115088a6fc23e09b797f8256fd67ee60eae48df940103b7607f7d171523dd47e
12d6f434c0d0295787e0ffa84c024e7145e6af83b9a8ea80ca68b61b7d5afe6e
141b3ee1ab3fd649588e87db6764616159c67120f925b8f96b0570bf385ecaaf
199f69bba798b42546139d4c242c026aa60e9cc5a7484b20528a84dc6a312396
1c62c22480ed1eacc9380cfa1bdee135dcbb81ba7279cc5f1ef49dcf564c6ba8
1d6f11b2976b43c9c0fb8af6e3ca33f0ecf811a85f34c3a3b4c832f791ad93bd
2370abc1d19592ecad7bcdd11d2f4f1418600669276ef2af6e631124ec57dda5
26ba961b5d6046195443c1af544407ac872c9dee9e6521244494325e89fbcde7
2ec4081ed38ea9f61d550ebfd010b4b8a850a91ceeee0c1e7af88ced2bc128d7
33fd0465cb66a32f30e88e45cad70257f866ed7cff9763293a5894da2b32af7d
38ccc50635da609242ef8381984b03bd8fa7e79e50c8d62467f8b5e5533b12cf
3e6e739684aba3586721324185a77d9e3fcbfba91e58fde24a01dd97d628b390
3f4874f8ffdf5131b9a70cfb2b5867d2355a109ec27d6ba55838e4ea296a3926
4262f951a3cbe7cdb39d0a5adfe88ed83bb628a5e9c57c8db3f110a700ee97ae
44d384401823ef1b631c8a9646f621ddfdd537774d3f79d92a47abc6ba29df0c
46534e36635cae80e033591e59aee20d85752e57900d6aec7d7deda0fb1ad6da
466027c38b90b23b98f321c44b672d08ff7ae335c8b3f9fc2237e253e82f31a0
483a8e17ff4fbe378094ea61d67a09728ae270224517812896a4057ed8ef1248
48579f4de961609ba6f3cee9bf1069fe92515f447c4719c9813f58b1726253c6
4ab4e879b264c4fb575f6557a253b864dbc1f4760f521ec97de6320340a92863
4badae44b0f6682899225f58784555e83cb650f3d0bc6fcfc16ab732b580d6bd
4f29db036451a1074024e9dd1c674b213fd2cba7354ed4e7bff91eb26c2400df
50adcbf6b80f70645e0a59d87698748bccdc3bc6316f869cb70047e144df39ea
50b68600f82ddd4c7eeee5d8ad5924de642a2d143adfab593ba68408bd18a8bd
5b3dc78e34d1b2f97e29a0c46deda768310a0ab7f32d150be6dda2236facbe8e
6054209ef8d53dafabfb03023d236d7cdb010a33e35f45f11280ef331d7315ed
694e7acccff4a2a1d7071985f2bcff59c3058847d5c38479a0c3fc24047f70c8
6b4b81e1fa45b393b99a57346478f7285114406f90cfddfe95821e33a03f1fe2
71f774a6273d60ea3dbc0a0bbfcb74a53f944ab7f6b8c62f373f5f9813a4d2ec
7273a7d65e3eadeec8b1cb61a225e737f17c0708387d24a0faa5a08cce737be2
7341e01ed1a97d33041a38384c431e41b85a74bb4aae8340902df81ae75ba543
79dc0667357ca8a7603ceac92b72360d994315bd1ffc9727245dd4b8b772f60b
7c533c72f2bb828c1e86ff5ac3481016e056f89e11f418ea2881fb8207bda4d4
7c9fc14771b132f2fe11ecf7829c3123942797f314c7bed63ee41c9591d89bb1
8008c05f0556bb916c2dacba6ab783de73655bf3cdbf54763dcf10344f9f6a5d
811e686d0f9813fcd07c855e357b1b7325af823c827efa2f0d1cb86945a2b8cd
83efeb6736e9aa4e3659310bb4c3569acc033a0da1d63d51e477baede6a24ea2
873386d742bdb2f9adfc423e6a8ab03b19519c0f7fb9e1646792dab5964061c9
889a682dbc3d28cad3bef8dccaf916c1076c8380ad56c008992ecf7baf32d354
88f0cd68f47f9a10411389732d568b0beba747e5507eaa9647d33a80b908b566
8a06b0b219f81d581a52c6d22e570c4e41180fdec65f1d33d7c5bbe8530fe370
8ab0062b0f2ef3962a8a32c49b92c3da0166b5150d5edb37aae325f2a54078a3
8f3cc840e9c290923f103ae4448365e4dd110da85001a47b84fc62050757d737
944d39aba49f3f4f6ad500c1dcddb4e54dc441d09ed05e520f6809726a489004
94e9bfff4cf6f9b19baed2760a99ca180eb1db82950896a0d0f18beb2ab195a1
955eebc421cba31b1a08cf58b87d3857b1e643df93490ae6837a013bba6642ab
9563efc04cc182630d0f68ec4bd2f8917632f86f3c92db2a0b256f6285d00f36
9b7994fe81970a3e7a69877b0f93b1b4e4aaebc9d3575af0c2d48713bec6b93a
9bf3d726448f607ecdbc40ed56820cd737f46f570e9f93284488d8c4d4a795ca
9e6b2672af1be36dd45383678566ecf7ae4556e1d8a9587ee32ed95ae381917b
9e8e6471cccc7b739425937c4cb05ba396ab46c51968183b2f650f98efab87fc
a0cffa45b8f59ed5a56902243ac14e4c7f2b35f53d3faa52772c4b7066a03854
a191658389ed5b6be03769f37b8489c9dcb581c986720db5fb31430bc48b0722
a2191ef4296e7214a26ecd4200be5e2146e07a7b9ace86a63fbd8058fc73078b
a4a498870235ac97143b9701a225a69dabef424f42923aaff738af70f2c374ad
a4be902047be755ea43193c22cb26bd93ab4b59a2f28f63c1f59e97aa2b0323f
a4e4468d273d90139f51c29776e36ff038555f54a2a965a61c14dcaca93083c5
a6b028fe6d31cf5162ff4b6d509b977afe2eb2b2162a92e0560340382a75cd4b
a760ea16122f9c674d2b7c726d7ddea832e721cb2d69f5a8df897b8be61ddbfe
a9808dfe4b18d5edc3df9f441a616a2d538e3c0b53d643b3c24dbd9b1985a701
aa263967866b22300f58d2ebe26b74c7bb0bdc504f95a4d5f2a1ffe714ad98f3
ab80d3cc2e15456c8a35eb31a54f0bef809594bc9f944abb8b0aa2c1a8945424
adde52bc4084c4b8de1107e003861e6c6ad8ce19d228434ba9034a57b89bb533
b0116bf90ecc8780541666fcc71cdbbd062008068a132f9ecec4ab5dcfc8b0b8
b293c401818cf6b11460c3015f46dd61c797938fc049c458b0792ead38fb286e
b2c307a5835b2417a3aaf705674a4f9d01d723fcecbe0e58d740a7b296abf879
b38c644285f47f07cff296d7373b6a73bd93f1a2fc4abe57d858e5c2cb1f0c23
ba5df276a95a559d5660e2576bb1bd433d24bb16aff6d598f399c94ac0c1de12
bb8f6d4b3334e649e731442c002a743f0beaf353f8c0a42a73959d3c10d8497b
c39495cabb5146c2007aac138714fbbb120b9574f766803eee578a6885b89ca7
ccdea370473ba70b50b30b8cb9c6a41cd32080d357f279ca535d58699ac9e4bf
d16aa17dc93b8c42d1c97c4f6d3cad53d66fd151875cd3e6b4aa1665bd4caf7c
d4695b412365970f3061a9b994950dfe0309bb4c7bcbdc99c384c02026faa1d7
d527183b22cfc1c0cc17500fe59075da29edda5375239ccd2a791a17c03aa279
d5a40f8f25bdb735dffc0f0d14e16fc05104016ec525e2aa8a69d0b969118203
d6cdc0581d304d753f631e26b8bc0d994f119f132a712b99fe51fb146debe158
db1f92cd5473291a5cc84edf916d180021db4ca3ce3944d6b733570156c62a13
dc5995d0f977f8913e1db65f20d89093f38591f8fbc4013088289179fc5d736f
de8c5e5d737cdbc42b33a198d9ddd3b3609ceea9bea674d7206ffe22a6614eb9
e10256aa8460c9c6df046fee0c72c6d41130ea4ff241d3f85eb707d89b812225
e2793baa07cbda28507c9b8e423e2506a34527d3af97f22589a23b3b7a7d7cba
e6c278c805b4667ad0ac9ee3633048c2faeb7455aee1a854159bb6c75f759166
e7ad03ea2283743d4d76aa5d67d61a183eb1a34e9ef002faec1efd17e2b9a247
e80d6e8aa52c651b74282b9b9583fc67974f08279a954c1529f42c1ff02f948a
f1dc527a12949a0fd551074f73929a39a7381a9cd15d4d7fe80e8afb4c273501
f3f7dacde7b23e3bb1a1aada547587ea90278c7886841beae53e96adfab227b5
f4dabb4932c9f8e64e5f9e615ddddd2d07cec2698c0d4792bdf87fc3207290a6
f52ddcfae77baf32b4019f8faa8ca67995024b8b851540dacc57d495d9a90aac
f57c7c65bf7bfd85406357d2825f7fffa0355e85380081dbffb984ee75d08a9b
f704ca151906306dfa01610edafa99af652bcd917eb207d21bd03c6360808161
f7cdd130addf72757b1e05ac51a296db124f77ce5d5f7d467ad00d2b819960a2
f84b6302e707b56c5c6225e4ff5d33fbd75f6b15795ffb6b3aa1abaff1b76548
fe9467c35bda11e55b6aa58fd40f91d1ee4954245d271c804323f681d4f060c3

http://peikeshargh.com/wp-admin/HXU15i/
http://cooklawyerllc.com/DB/XygG68105/
https://www.meditationmusic.shop/musicshop/MYatxrUp/
http://magic-in-china.com/wovltk23ld/f9aH1153/
http://www.ikedi.info/wp-content/x4f7893/


Creation Time	2019:12:20 06:47:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
0345ec538c247f3ea08d861db520cfe70d4e9b4d776a61b755f56b897441169b
049602fa4863324beb66f7d2551dfdbaf58d09ee23bdd629f811fb44014f6739
04dd3a69f1b34141475d7d57815ff56dc74df99176dd88034e2ba711043acb18
07e9e1c6562c5542dad03340812ee14738e1d4382d3d4b68570e81b00e0e6dbb
0ac59cd72621f542445a2c3a5d2479ce8de97ab6c7693e5aaec009b47a0c533d
0ba2e6d9f335ce187041ea2248ff6bd017e71518e8c3fd67bdc8624ad15cca80
0bf5434f8edcf7e24025a27dab95418aa61f992f4d3ba7738441bc91775e3335
0c61d6d3fdbcff7d1576737fa4f10668e5443f5bff6746028266d2b8da55df89
0d24eb3bc04dd6a7df975e688b8fd13fb4c325e027327c7c278f2ce0b2350f4d
13ec8187b74f63ad9f9e3d970c91ecc2bfd79faddf924898ddd89a7a8194c63f
16716aa9d1ce38aec3f35e2a82d1283afbc3df72398013fe89e7f7b67eff084e
16d0d40b707e2260ef69e08586e3636d740d0aae322af18954a556ff5955f850
1a5463b997afa0ae8b86bfa385d42a11c7e29b6235dc2f2d245cfc1310f0ff6e
1d2278958367a998385b135680e18c3f7e4e7d3a33f295de9c47ef9d2f5f85c0
28effa5bc19693371f1622f8ac577b19b54d28d1a6330f02d93a262f98ad22ca
2bbf6858f7a9d855982f826a422431acff4e92b6974596f12b1a60e76d0ba770
31184e22f3ea61819baf079c9d0c16f5104c21a5fc0c3891783b1478e4ade16b
35b1b8586e6215b57f41715474197170ccd118aed76855741f7ba27cac6c9fb4
37ff26c664a969657d7bc3ada2a8bf3b338cfc6c6ab01b7b8980a03898437715
3cfda6f2e4e2149f66c871c8d80cb0bf7ccc6fb108ddb941ebee46ccf7f45224
3d647080af6b4a283249a8d4c97bc59846b1375d1698934794441103e23875b5
3e36ac876fe637e273b38de35f34f48f76ec7e7459654e5eced0c38bf877558b
420e5f6290eae8fa9adc197e7e43bb74b009272d1a9d1c18d777401661bdc4a4
44f40b1e24bddf175864fb1bed845ed23b612ab31acf0b4c33c40f6867946983
4bd2c8dc9bcc707ac15c5f4e4c4b4bd48d0e12439bb372420ab3db92ca9ae92a
4eb09a5a815f08e9455cb82eeae5a855dc137e30aff6e46efe0f67f930361673
4fa69a6e2bd147fed055ce29ac3da808c8b02490daedce960863bf3bb908105e
50323f1cfabb7ecf34e16d269a2a3c481f5a4e5ed23d3c9666c1ca9de1d5461f
506d36a217428fbd165df1ec2f67ed7eb2ab69e7f88518619755d51a17dac6e6
51710bfe642fb5b725d4eebb310310060391843f45885896aa06b3095453bfe0
51769ec4d4a32038ae94386128813f3d8d3f9b4e5abd02e596758ca9e2fc69bd
55592f249083e2f2e913ff218a79908346b9ccb105399ff91c4efcd2035a9e70
571538754fb74f2143cfc4b3ebd12bc7eb15e2feb41c054cf2f216b524f0a438
5a768c8a9097e8973a243227d54a9b58bbb5b06645befd607703496c8ec9e2bf
5b1912cf961c70ab67707d6a5cce4f48b46c30b2a85b6de931d35acc4b3453ce
5bba0a1fa063fc9739ad7168c7693568bbdc8b4ff61dc0c9025c8f6a85be745b
5e37aafe5f7a1589993fff98af185b4a7b92ab87946a8743ccd7f1bd5ada4389
5ff89563f185b55eb05da2f55cf8749cc90c65780af138ab2f4e317a40b8b138
6797de84ea8778d889382d1e7f14a6a391acea2a905ba111641ecb323f1cc2dd
68d5a4a6ef2ec809ca14e07a178c1d0cfe671a004ce807447feaec7aced08d9a
69abf40e862459f9acb51a743b5d3b424575e61095518c6b1e4a2667ebde1862
69c11b180140be50fa28e46a7f828d1056132391dfd0e0971d9a74f0118ef72e
6ad8a77765dd9c7bd93bd0cfb3aa91ac7dc38657c6fa5a33d8f7c02f189510e7
6bf13a95e5c50339d3d1517ffcd28b3a62202369eff24033eec94b2b6e5f58d4
6ca02e000dd780e08c1f781986bd326ecb5767a2f5be9251296045d43964dee1
7213414ed3235c3ae9b8640b50d9c4e072f449f3cdc288754fc677e92f606f68
7232bf5f551f7566370dec8c4a9988c3eee7205155a1056753e817758349a390
7829f40831131900668ea2a8ad17754f9c6d21d89dc6e25dbaa405b758164f0c
7c878ef5dd2703cb74bcea78437902f7a4b95132a73cdfafa193fbb5bf6611b5
7d1566e47f71fbe00859e3a5fdf33706efdd2028732cfc3b1dc5c256163a0062
7dfa15fae80909f63f1d59a09f40cc126c4a2795a746a830901515bce0361d47
7e8cc3d35422d922681b23e1490a24973b77ed632f1200d2c1eb44bcb89f8cf9
83de237c64511c5f1615dcc5c412bf4b661318af140d072a342a74c56c72e1ab
85103d390d96246280dbb7ef49f3382bee4c8bf893d6146349c78c48c230e6f8
8cb61ad2f76b83c58ef24e00836266494edbadaa464dbf0dbc5157891582a729
8eae959fa0091424b7d722d9a646734a62d1837026d2686a88c46ad3e178cf17
976d9cfacc7a1c1b4955d2053fdcc291b175739f693d6c2c4e2ab06fb41b5ba5
9bdd5a616b7f44faf354aaadf5cae3f9a1072c61ddb89c2cb17c5359231e9d40
a461e68a56f148dd8229948f29e1afba3ec22bba86556917fde3b00e2c9d5f44
ab64149114b0eff77e6a6b76cbd67b1b1f09d97ec9d9c1606c8eaeb0ae98bef9
aee727e6ead7968f145fa80c9fc2413327732a79aeab0be9d5f747a8fbc92c2a
b2af872f88fb31aeb1fd32dbc2f170ed02339ac096c367f5f80c21d70179d3d4
b411c9ef9e84007dffaab862b7c71a16b4a1e649216765469c85dbf171fb9ca3
b4a78fefccec771b9d26772d9c37a7bc86aa612a7561b755a7495788c103c11f
b64056ebcf9167d5b81a744918e6404c40e7aa762ee81c3b3fa1fca54d14da8a
b7aa9f9785333792725acf965201ebe973186d07e233e66d46e1f00d5ae8ef27
b880fec030b1cfb4cabc5986021bfc71702eb6204f770e2b08c34957463de7a8
bfd45e727d643a431e46cf616509c5e4a8ff44739520f4969a22c3331f9a4b99
cd7a55ac732ab54dfab8e759c6d2154fe0264126180f22ed51466a8a40ade585
d45748d8d626e9e8684a0be1dd6c2c228bb8fd8f99a11a626694f3148f66572a
d48d52cb85746e01e540c61eb957fd1d854717656132426c004a45342542e927
d4e3d681d03d1cd5656f2357b747b972e0c96ed59dc1842c47b57809c6e42c3a
d6b224d6db925a807935c4ac19101e842da60c144eea2fd5a2b5a21eb1c84a3b
d767c55e3dab3b5391d2c25225e15e213370a8627ad57fce08916871e8b177e6
db1b7614f7990cf6a79141f12cb65d47eae15099ee14be39f8cfee9872b1bd02
dc98644b4039cf69b3aeca3e755ea9380f66cc906fe23126044154fd4655be53
e24b1df843644ad5b7c9ff41650d23d5071a33f0186c316e099a7410f0eddc0c
e3712d3f74477de5f54b5f965a57b459eaf026c2ce36af0a8d2f4c5ffddf5f7c
e418fbb8c1f0b450a5ea6ab4de380b1e3a361440050c0d2fb9850177441ec84e
e4b2bd6caa1a592f14fdc652e0840feaf44e9662a0b1b49a3f33b6508f7069ec
e523282ef691d8b177a83ba9c9bb3c72c041e3f72b801f96a0615b116f987e3a
eea6745f2ce625ee185f195895d90aaecac54d118b90279ee2c3d6fe9f654eb7
f080cdfb6b72b532ed6b48391caf309e391a3bca43b7b084a065dc141dc8a6b7
f17f696a92feb9b47482c2684bb5dea756068ec6ede886661ca3dd8173bfc20f
f6bba6685d1c8e5f0fdd99d112cd1e6400b6eb8d95ab28ae259b1dbacbc2f8c5
f7020b19ff72d50c16dc0f71ed9ba1b03ed561c2a2848971494a621f1d2b033d
ffaec11edda9d17eca0670dacffe2b31854560df510898b727ab85973a60bee1

https://www.trangiabds.com/wp-admin/88IHJgsuqF/
https://kashifclothhouse.com/wp-admin/Pzv6563/
https://hgklighting.com/wp-admin/V5i324/
https://gloriapionproperties.com/wp-content/9k16/
https://azatea.com/pytosj2jd/e5X381802/


Creation Time	2019:12:19 21:05:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
012e370200b2ab333df4115479217e6d82380fe1ac3740bf1375b4aca308c558
0fca247a2152cff887bea6701266e75c8a24e618ad60fe31a310ce4c6cb7d4f4
1644fa04497b6e5bc7cae660acff074c05cf93a5e942e4151459d46b2488c322
2edacd46f6c7cb24386f8fe787b887d16ea418e10ea242fc4d357dbda24e66c3
3f6c5a0a9318b8976b9683df8d59293bcf81ba8ad68ea4d4ed16aa35682681c5
488e30bf74f2b57aea1cee4107bff223590e2f14a243d4d5b18983358b319b82
4d206a7c2564c68ced6dafde159565097f6e8c908c40c171b9670e4afc023fca
4e0e485da37a319d5ea48647ada706b0e98f9927be8f911cbb7e2e0d088102a5
50c7a9eb8d029d8035835a563d271a0468ba853b0b8326bdba757a6c655e4539
5f102ef04bfed9e7d2ceffcaf4730fd9cf14f9c7bbced5675b44d2495a5fac99
61042b99b7f554fdded2536f004f47fa8e2f42ba7d20dfc32e0c4886cda29964
64c22aa0ad75975cdfdb234742a572f4546f5b87df9eeefc6fc1cea150f09b16
6e5072f64657ec476491b85f1522366eb46e5b23dac47259abe2bd34a2e7e5f6
75b3e8ecff0075dbf1714a95d4316d9a56ada3547050ffc8a9035ca531ff6460
7a1588d2ab9287784430f165f9c344329504b5014a53dbcb491b32bbd002f957
7ae72be4c9f293fd6b1b133a7945c7fca2f4a2923f3638c15761cb1a15268a14
9f7ba5e0db07f3630c7b2bf26c6e320f449e1ee4fa7944a87009fb5b6b59521b
a35d23968eae8e3f9825a4f02cf04ddeccba1700c9cd890ac37ede3ad01c9976
b9bba87fc763cb97fb9eaeedc737420134ec23b0594474050b8802a71d6019ca
c8251e02e68e8434876f27d2b7ff062e0999e9848be7a509233da1a3c45f2a0b
cfa49184052708842411bfe15f6f14e2747d92a783df8522af7b3888e3f649fc
d1d42093fd7e00cb4ca7306ec7148ec32e357ae8eb69dd24a643d7ad1583b5f7
d86de0ecd1cb97f3f7dde492a1ec15a3dc884236310f7ce7b72fb70f959bbf0e
e0dcfd3d6bd0e7752e9aa6796acaf7cdec7077395e032de206cb8c39382029b1
e7f3d38e909a25fe37d40452a07b925e8777c017e1a9cfb65b8a637c14f37bde
e93523b142a17bedd13b3a85f4e34d750d412b8397d07505584b093782df40fc
f1f61a4139d1b10f0899498dbc0e653b33077eda7a8614b9d9a4f27a13ad58a6
f2c96c17e9d5ddcc9566bed87b8f102d64e68b1b1482eaddee95106f34a53029
f8abff3f67c2ebc49aeef4513531c0c7d77d0f91b9440d36da33b91075ada3a8

https://www.spectaglobal.com/wp-admin/SELFt1969/
https://www.jwtrubber.com/wp-content/73LYb/
https://adanzyeyapi.com/wp-includes/dD6121/
https://www.smartwebdns.net/_vti_bin/0QRGg70/
http://www.emir-elbahr.com/wp-admin/css/1u8825/

Epoch 1 Payload URLs From Unknown Document

none

SHA256s for Epoch 1 Payload EXEs

00317afac2e3bd8299f370f124309abbb6bcfecad70defb30ad32e0070d87525
011a5a9810085c44bb6241c3bb78a2d3effeffd0bcecd0bf5fe3e0141b7b82d7
022678c6d95fa15fa1a8337bae82e9374870ad4180050f1961d99b76dbd28d76
035953cb1b7fa85c973694227b6bab6aad6ea6eda79cda9d107e4d420ece06f4
05d8497e3f98316b4ba4c595be125405dece83db66a92801e490be1fffb26422
09804a006e7d1f50ab24c629a78c50596f4a2a07742de0c4b1022f47d3c7ab54
09842721f03b3fee88fd88855b7c62bbd290aec55efca09cd605e161c3bc5bda
0a8c86741f49c19ee91f406c101c5e4fce88c689967d204ad7a4c733f8aa90f0
0aacfb7e70da7f8b70e0f66222564f59cd7a15bec2b566ca97bc6a03b2c77733
0ad5bdffd9c592545204f12a1b7a7793bf0ab2cbe50818a8be29c8d901115ce2
0d30ae7d14bbd90dcdc508d939f87197a880017fa382de9f50e930a2e086eeeb
0e9c278db95da4b180ed67f036b92f70a2a1ee23e5f6f45adccdf9004f093c76
0f87338b5380b6312b0ee2750216b009571704e764873d553da3ea08d75a6243
11e4de3e358f6aa904b2dbe14f791cdd6bb02a5b50eb1e4d8e1e2f9d9f2df5a5
1462226739fc93391f47f6bd506cdd6b993d66876770d47e69906559f0cb26a3
14b245f19e866311c68c0301067ea674cee9b03387a1bc38730735e16c0231bb
17dec6852b0558e93a9aec34c1d403f6a3cfa140698c10dc312d14033adfd3d9
17fce464670bf9174a6a5759a13274e43052f0fd7f6576163e4bfd90646626e5
181766da97184b4303836561c49195ce885af2913ead76e59531346aba02cadf
19866efd72a5521175aeec5dc89c1a7e39662ca3638e5524c5498e6b8ad8bf8d
19b93fb7b8c80001835cc820fce2e9c3ce2696105909e8cbcfa381b8b2428789
1af4bddab861cf53eec952e973b53e1502dec4fb1e818b219ef94d0c0c646286
1b6106f600d434f2ec56b9574179d765f06d973c9e18f7bf765c6a3736b3c2f5
1d33a92c2c58a191df9f26f974a360bc31bb0636736dc8fda0c487a45f60c2d9
1d36f68cb703eaf0ce8c8dd53d1fe21100c8a96806abe56261e8bd5b9bc716ff
1e1e427af35d497af3de341225bb19bd30bbbde04eb6094ccdf7cc82bc7076cf
1f426d5c5ad2bb87db34ee23679bb2ef2e0d5fd314be453055fd09cab1d5cd15
1fc3e46bd300ef81992f2f8a747d736170d24ca340074f7fbfd99b0d2f723702
1fd385cc52dbe8c1c96f5014d130317bd61b648dbe15c505a601ad8de8b04765
1fdec816f0cbb174af6c5ea16c23e6340259c9b53685876367788bce3f2c7019
20eb2527958283cd854917e6dd8afcff8532c158d660b477f17c4e5228469f6a
214cdd48b2fed4309a6af41c8cda62420f7e5045f84e65549ee7da095bfcea60
2236ccf70d8e93fdb409bb1a12886df9311bd851f94fb6cd0e41d0f7a282ebab
22f289052c8ebcd5276c30b03a0d77ca1a00516ab182b13fb6377099a98a6a61
231e45abb33235713c094fea5fcdd58a9aeced88e48b91bdbe34524871f10638
247e258c3131050658a53c9957fb5b758e17fe435c99dc524b8ecc91b6960641
2627aeeccecd4a3a8ce8266c7bb00acb8a6935102c585d3b4889b1537f658e2c
27918e5538a446bdbc4b9aebbda7e9edf96951c23ad2682ccff11f4d5a558352
2a2fa40c1fd17aa35236b102654c891bdfb604d571e8c51f9ed56ca9a7dbd234
2b02e149304baa20eb8d3d6e33340d3199961b841232b6550510725910d21baa
2b0fb4c9e32b4095a8b72c56bef418e628d736fe63e9d6a882fa9a2bbe1118bb
2bbc040aa3c8059bf1683c8beb2036702e9284df3d84912b0defa10bc64534aa
311c93775a04a8bb9aec32f852d9477b307b55b4ff6b55933666b9581fcd058e
319db8aa65edfcd4a478cb6275f672c50746958f67c8200555be1481b3da8035
3238e7e9b4b4ec4378b6adb1345cc9e165174ff218c475c59e548337c98d8b67
326b58ea1f13b42cc6cc24d35b1e7b5c29f5ba551c4d1a9f8ab0c1107d69058d
3321456d131eb432e45009bb7a85f21638d464f4710f84ca3a679f7ad5c69233
35785a181eca0b2c406e015717efcfe6530f8c04ffcb496f113c3c85229034fa
3742e6802c080b85488dd58635c10107b4696e440bc82bf76a1bc8745b8cc5fa
3844d93ef1aa1c64b5b1bb1d49dcc7314ae353145e6fba4f671a008fe16d6049
3885fbfda1d67d08ef2cbd8537fae36ff434873c45606f72da30c7baa5b9a74f
3916cb8bdc4acaa9bd0948224dde65d5d2f0a1e1964ad7ec2345ea0ac650b2f7
39cb7105e4c4346f37e37b8475593d156917615433ff6588009d708d71594c7f
3b3bd938db96ad632b6779142ce1892c35ecea48dc6fa226b979a804b5e4f705
3bd8b2f1abe8cab0cc3edf8ee6db09f1618e43d73c43b8c9cae0c6a3491d1973
3ca7cb037adce3fb282fd46591de9010dddd4e2eab5171b47a7ecfcd14bcce7d
3e37ffad1299830c0ea9e4c94972fb8064fcbd7ba1df5e9e1506971f1d2ba235
3fcc6846a8c01e40535c4274a5482d4b6c23baf9b9bf9bb694012a1c8f8589d6
3fdd8a89ee19819a0334eea91853bff0cc08045fcfc2402f5b7da1a74e6050ff
40c389f3f01de5e9d4d4d1caf79848f3bfd87eaaca36f8c35fd90a81b6498cdb
417d422c71903ad82d1acc948ef283087f08423dc1aa6098cd8cfcae5800e0ce
418fc52a8b40a8bc6f0ba9e082651b1f7e2d9f52ab17378b1fd69a89ea31799f
445cecba4023f0f36ee48a3420213e8401817f93fb82d41d48291d9d5c785c00
4531a73f8cbd975b744908408b5aacf3cb4893a86697017c52e6704660d7ce4d
46661a0d0b87028a4d7c2dbee44a12d12e73429ad7c2724c93032f20da031593
47fde7c9eca3142e5a339f7cae4c04f56f72778ef75b701dfb40c669a1cb3346
487430565c7ff5510747801cfc9e8d4b1dc3dd4e47b9e51121d88512d6c03b69
4a39b3269e0828dde0b7dc6d0c689f9fe6690bbb3dbe7d0606774591018e9907
4a87414e6d6724fc348674ed5931eba4a4ee87292b4c3aace3900e22d77c114a
4ac47f84786bc0f7c87d090e62151a3588e02dfc8143e5b114a4fbf3de5e1f01
4de1c44cbbb7fbe500f730c2dd47b61340cbc8dcc247388288ec9b2fd9ed94d3
4e7a60a02aaef3f00886dc03456e0237b2a22a41825280363553de8f54d10cfa
507191155605843e912564771fd271f3281157e36b1dba3121c5e852915a2561
51a9005db4b0c177684639c7ecc753e65d3c90082677d05c14d612956cd05c21
524132184c94945b97db9864e47302d56eb2de5c4407aa3c50b13f306f68f2e9
52afc2b6e2364574b8dcadd3c1f47296e06da315d4d25c2fce365d8b999ef52f
538b942c6919e9dc99e1355ff9ca3de39d0e1c78c63fb47734c9e1775d1b3a45
55bc66b62fcfd1c2d55a19ba3fb25e9e18f14c0188d2f601b1324d0280a1a583
55fcaced5672a78139065769396bc71f4e0e6cb03a66dc03f4db6b3690291f02
5608f6209279f2a34d390686466967c7058156ac7493cdf4ef6482fcd877881b
56a732af9a1a1709588ecf5ccfddc247c07131994b349b40fb17e07989c133ee
572a317c0ebe43243ee0cbcad8f88addd69261286bfda791b192e9e3a8fac924
5a2e8efaba829e1862dc96532a63a3ebe1db750f3508cdc8ad370cda26ba3608
5a5b1ad3d7b98f8b25fd8917136ff2dd179bdb666f10e940e59f49810d63e5c1
5c14a8a3ec1886be114152f0a7ef2c964070c06c54fb8b8c7106df4f5ef5d776
5cd6185e68306b20f88d17c1d3f18107d019b85d798c6d81dd320261e8e2e904
5de14704e092c542d51783a6cbc06e04225d11bd667c5e54924d2013ce072e88
5dff26aca0bcb9914e2be80b138e260a1fbf0b14a4a2ec6145df9898b17e2996
6251959d2541fa4a404e1b5cba93b5616fddc3929297ddd89b613aee266fcf3a
63c4e233479f56395073f6d436c60d53382ea610d7aa7b1e5741907ec6b6a68f
648f0882750ac64efc1776e12a55c800eaac32ac3677fcd40e84593aaaa79b82
657685d085cb18368baa8a2af8f0b7654e6b5cbe0c1731b158533df95bc694d6
6b6b59a420d73caaf68b9ab0ede6b696ad10823fcc2530d820d79f9bf7a10f22
6bd1fb18887c090150fe806773d5548f272f507d99becd8289ce32a553705f38
6bea951492348a005147b2ef4af07ae479ae87fc210b3ac770206e4693992c06
6d44c749ea21bc9607275f1ac1539ca79c2cf70fd066a8c1d4e940640b00b0eb
6d8ea716197370ead5aab2584be608d4bdef3c6e6eea8ac21ad571c24e8ee4ce
6de1f04dcf798362307cc64f012c3d72479a8947a1c85ae6dda392c5da5b76ce
716de56dd4cc8ad548f6ecae08919d40b82bea7b76b6002e0ff63dfbd3f7179a
71e48487021f6e1ba5332e4a43566b5b573a7dc132f1600ad8a20ac58411e861
72e46fd7df4235fe3ede2ed4c74b806f02721ecfaa61432a2fe8c986b2a9c79e
73d8165658f3dc427001c7f4b8fe8db148bd173b32fc86f280e0c0b179736455
7425c4a5ba6e3e10e1b3f3891bbc6e468354be08109858a6fe2d4e22f1a5ff26
75d299acec29625348043c85a2b669997c603184f62f887e625ee1b4f2232f69
760ea9e42d996ca39aec9ccd88f2741dd5517bc8113b11c2c59f57bdaf2e4544
7658d368966a4458f4769ddc8e9fc2b56d561062de7878a6170e7e447403fe27
7771aaab34d9d2339fd4395c104808287e04507ddf7786fc5147fb86d238c736
7795a8b09e4e590a0955b9a35225eaf7c52720881a0635831d4993ac61b7fb83
77f52f5928ec82d5cc19044e69babab00b7e21af291d08c40b989a86569a1bea
7ac584695cf5ca472ab9ba6f327bad1a87d3a3b6a1d96674eab4591502d86889
7bd0113b91ed2b98cdb85683e347396658e09e670680d6c87a29c84688c4b6ae
7dfa8732ad103fbb6368d686ce548603a91da6e70895be0491644d1b9bc93171
803642ce037fc47c484674113ee2108b49220c620fc492b2903867be7c403623
8182f4bfd12fafbfb2eb9c67bbf26053aa16df5326771e558de451c8e4e4781d
818d9b6c67f1fa02d36d9618cdd4826824bc4252b3f518f683dddfd27c9d786f
828a14d5fcf8a7d5100cbf1be078e900e2455a00c6241b7464b2c08e914bc025
83b49b13097449ed0b279393391f5d52d3c26a84697ffe31b0579d844b95ed9b
84a444514e9c033ea28dcd507663bc7da19c68e4d687f47d8c02ad8f79f6f5c4
864c9e48fa3250399d6aefd1db502b0cca79f1917927354d7e4f1150536bd89e
888770e39b140c0a40fcb30d157818a31a2cf2a2aa504038c7197895c7804f3b
8903b45f717105d56ec36676ba3d24c682060baca4dd8aa7c0cb8b8c413932e6
89cece26db8939beef1d57ddb407fbf3546fa71a7d776d1d0bff16894f1c35fd
8b4b9914cb1954a43d4b908435ce6cb3ce1443a1cab623dd910558fd7eaa0c2b
8c097306cb2d882685b7dc0dd52de66d0bf9cc99752934b13d81a5070e96cf8b
8dc7477450b327270603bbe5efe39c96705b25321f4a582e6f5099b42deb2ae8
90cafd9f7ece344e6df47521bf5f9aecff36b29b847e299791aa82df56fdf671
90dd3890d53dfe95340a732d7a92eb1772c2b4b1cecf1d181c61041300512fab
92d15f86cad9203470179d293a8edbe380b1fa5987bae445fd65eafef8e4d579
93fcdd4dee62c753548f8f600600a485000453c4ad868c383d7be861f07b9ec8
945bb735ebe0a3b779047bf0e1b145ee7d8166eeb61dce058e8735dbb564b114
9486fbeddc245efa330d9fe666d093f6d0a6ea46490ddac5a0616af903ec2dc6
967915a36a6ff39de705ef35789bf881e416e4bebaf4d974f4713f187500c51f
97b943635d2e811ae49438061c05307e26a3c19b63fbc154e5fda1101f5ad6f6
98507032f4969a2b4727ec4ca677d3d4972d8b990c03f0bfe3d530fa0f45c103
999f5f1574381935378878b14744fd6ece19829157cf12b6edc260344728b163
9c2809431ee59ff7b042fcf3bbfc227c1ce7434f79e0ab71656a4cdca4bcbfc3
9c6b3683c39f1cf511d4cadb1042864820d85f1e9cf647342029023de159f007
9dd242fda4f305662555852b45cee283b3e338207a18263c0004cb111d57766c
9e0b6935453620ff9942e341c20d2dafa9223ad0f9cd29e89eb2171b37aed853
a230be3ff74810cea713693769e5cf56db464ffad2ff2c17e6369ea100f9a96a
a3903d05305a5922be373f39f2375d3c5caa50865bfcf17f02be853fa8f622e1
a505f5dc61d0ae7a64d554d94ec15e7d69c3601208c29eb97fea8102fc4c038d
a84126491a034d981f3616328c4291e25faa2230f757bc99c7be71823e74562f
a85426ec0965a34f2bd5c3ffd7def56655db491c3970ffee73298218c68cc8a5
b07bd9c216c90fef908e49ea132345491d7d749f1745d437c8a54f8206e6a5e0
b0900841d0ff592a7c61745962d43fda0e96e3e16600d6f125b5edcdce8e3175
b10664abad5663da6f969db89098ca0df2b94eb69183ef7e34cda5776bbbc7c3
b1d1f44e7501ca313786cbdfa92d85a10af529384a5459035c65bed789d10403
b26b98cc7646a4a689fd05908fe32172c59acfa7501b88bc3728169ee448397d
b7952fd5f53fd052c5fa11577cadaa3f32b0337c26fb4d5634def5a157d51614
b8f7b9868f9259c742651894ce8b7662048d94a000b1f917a887a04a5a8d16a2
b97867493941a9ee156c9fa697e54158cbce7e46cbbe3c48b33011f8e879eef8
b9e5a1c91c03df21dd52cdb895e5e59f73bc4de743f8d318a4d88e6be66c1d7f
ba539707a78e1aa7ab695e7b5fb1b697e38f30ba49480bc5efec6a29738e0ccd
bc0d6800a066fa89ea0f7c09c906c84454da3a43f07926d9c2c23def2529ee0d
bd773848843919ab4b03ded106f9a9cc488431a0d81c8bf47c90b27c4695d512
be373e17982cb2e6f16e75ceea215f523ef56b1921504d117388c9a735eb5fc5
bf3c12276a7e4ee455c91475b605f9b9b0682fe28974ba8a5e548182536dd435
c17b5694418ef55cbfe27092e395688f2c2039e435c8d765a71be73e82a1e9c1
c184ed3464fbcf1c82588c29429140885cc9f735fbfd4c3022e747cc1405a6b8
c2512eea9557ee02ef90c22f4f8ba58e479415cb878460a4bca4792f9bb901bf
c27bf92351dcfc7cdfd966766b22e8af198be8894e04292576195ad3c2dd55dd
c32979db48d4d3d02d674f884c0190eaa43305d00c4e8e1ad612246116ded3d4
c4eece4b1e46466a25b6c57ddf3da8e880f3b826fe4493bec7b9bb8600363df8
c7b8babe76c3b8e4eace172b91ff01360c67b9e7bc188578ffb8da06a9e041ee
cc2fd591149a2f52eafcc8d739093219bdee181333d7ab89cdb594ae81a15b2e
cd2a547e8232e789feea5ea4367f9aafcc11a0d990aba8583fed6531cbb5c8b3
cdeeb247ff511407414f681c79a3420111af334ff48c528356193a64ec9d7c1c
cea5807dd881bff39a1bf03a6bd73b4851cbda4ca26db346e786611613934de6
cfafe2d9b67e61eec30c27544b0cf0d3915ea8839ed92b2884841ad58c2522e9
d15e9ba56ee82bcf6ab3927e7fbf6a96dbfbe28e1babccdc4c506671f7347873
d1aa6706896dcbbcd71e1a06b1695caa6fb6d0fad0b0889f946e18cf356bd458
d298e91476ca19786493e72aa0cd95984d0a22e69712db04d4bcfd9256aff9ec
d39bd3c3e7ba4b39fbdc5645a58467e6583ac8db291bee3746c0a309f7f1c06c
d40c312432d72febb84f9179c93000a3bb1db82b27d8e9a66ca57898463ad1af
d4ede83f8fa31a629b4b05221d98d1d83963c8ff6373a125ab4a5a815e47fc0b
d7f573c0eb613481c2d6e35c3277037d0dbc38aeadd7b2f15d8f16b7b77e4212
d8014d19a9c7e18dfb6e8439603ad50e0aa70881646b943aa241bf7630f558ec
d85dfe1a911e988961700952f2ae88ec3d5773fe544a3f3d4f3c008e570bbbc1
dce415c0ee3e8d11ea6c79aac6e5e9f121df44b33a881e7cc5de3bf1c1870587
ddf923956f52cd7f8d333c35dd54a383888a558c9e10a6faed8129368c18dba2
dea4444104c56cf3cd6e97dc2486c9ab899afeb700eef6c01faf1058f2863420
def4e4b2e065512b7e15579a44d693a5a15892a6bb32d251b3f28c9e46675449
df22b3cf782c06a2785299448698156934c6e6388574aa6d5688905f442ef808
df697da86179ef1f7a8ae7bc2dd28da8d745bc7bdee860bcfa140422d6990760
e2b5ea461157f75d78d5e277f195d1fe392ad385ae5d91081e80a39fab37ac3d
e3bb674b108d84fcc8fc99e51a9c5054f1b1de21cd40d83779f86f516a4e9903
e51178df896a8949e906b3b6241ac80138b12804bfde88c00dafc8d5d24601cc
e6bed37953e6f7fcc18549ba85eac1c2b311335112d434dc2937ff6ee8e84727
e85f193ebd0175b8a7b77ed851b7a175596105ed1527c9865bf3786e49f06644
e9f7b69c5f12f29b19016291223654294bbb2860a08545fda263d6dc9077a578
ea2a329884c07259573cef5d4b80a6153585d90a8820ab2278241ac8cf60affb
eb0e7f4a029f933fae8087ceed519cfef2a9021ed6d0928a916919de99d6ea5a
ef4e1dc68f1652812840533a910c557c8c793b0f98d05e0ebb098ccad01a4eb3
ef5fe64214b4af0f433e0ddad411e7f4e87f0f8055089599dfb68f0e3f056e4d
f0aee0954c0ced75e935a8f48da5f7eb5c89415db7385fd27ad669c0f8facef5
f0fc38a249d6486c4db4b4d71640d6b3c9290d4d25f171f47fe1ba14fb364b79
f146285247cb436a5cc791c21101ed8c3ed45d8b224c09e78ab83b8baf85c823
f1a2b3830323dc73c4eb0dc92fc17febb325f57b425985c22a8607742f885547
f316f5617e1c8bed150e7b5e80b83a2c2cffa634ef6d2d3a2d9fb937772a9752
f32f89928d640af60422fd17ae3a435517eb50677c5d2969e164b00f236d7c9f
f3a631bfe7423a4a272665ed7a34e8a7fd4e4a3bc8eecb56cc97ec1902bf7018
f4f53e399f618515cfecafa1e7b519360d3f9104724dd9ca7476893ac3e5d604
f50f444a6b131044fc0f07f0a341f815169636e6b0d5931863079fe0b206408f
f512fbc4d03c0290c1ad676908dc0a55c0a4dbc2efc8cdb69fb17aacac74085b
f659a34ad54ffa3fe4c6cd13ec40e2100d04a2657ade61df76c72b65814a0962
f7a3493d8adfc4772d6a85bc095e63019bddac449dadc738935760e24bc61115
f858540de32049e7fd00cc99d6767d49d067e3605792c8b297a24ad203930b6f
f8cfc8c5564d1e129a484cc29f5d0aed0eba0eeafdb6dcc3412bacf721402136
fa375b2e1e6c1a56a5ff5252fa797686bf3bea2c9a16e097284e8b81f4d0d5be
fa5c9bc832dd1a673566d070c1d3b2a8598977004395b98784a93c4497b12adf
fb3da13494508054ebd56d8db7b39c7e252ac249d8c290335946509be92447e6
fc3e8615ee5edace6e36783d341ec5485e831a101ddfa04e59340fa4167c8cc5
fd3c4e389de509b666940acd970b36eef2217cc5fb6d57c6cd24913d131fcb97
ff34aa0113bbd66f4b55be22ae81c6ce6796876f5cf61648d72cd1d2d57c828b
ff3c198bd4c024dfd765ca4fa701be00911d237aee9859a1ff1b0fb4fcfe27ae
ff7131e220082261c150b91ad8e466deab3b9f727a92768abe38ea20ad2b187b

Epoch 2 Payloads by Document SHA256 - All Times UTC

Creation Time	2019:12:20 17:07:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
01634f4d231d70f5cf731cf9b82db1495a3e4231de921159aba75b9ac62a030a
04d86683e127d8e4f376a3cacbe5ec812b309aaf7737e02ebeb5d4110cb208c3
085190935b08f49102610d5161e97892089f567965412b270f354cf088338eda
08bab149c893a44f23ec39c10a85432c1180d99c868dfee6e7603a215f1c37e5
093aa4d0e8fb9fc2c43ae37f35765734e1150c42052293f9477e7d51ff28e43f
0990def2479e463b3e597c031952ee77a8a6c334b1698ad7e4094dd19af2c892
099c90a56eed6265d2db46fd99ca710a31ef5f2c5af551b3ec67b7e7543c53b4
0dfb5cda8b86af6c45b6bd4bc68f9e23f7b6723b29f905008f1da435bfb93bda
0f0544af7e2815c9af09594788690ca082f468a7f013dc8b40430bdbea4ae208
0fd8ac756ed43695bc337ff2adfaf10b807448ccbc81b938264b4eb7568febb2
12d3559772d2a32cea67f421d186e07b7c14b35875d562bea62f869299ded835
1a502dbda271c8c065cda683d61da6f25394920e19fb9d96fb1330968515fa2b
1a9e857c9686286a7c762d60ecef96c40c44ea56d89bc571a3e4d6a6abec38dc
1b266de87872d0d5ad947e4bd8ddeac882d2008375463a3330622a0bf9d49ee2
1ba4567587c2ad39fb46ddb71c97589cbb83d9ef66715933f7a6d9ca6f553009
1e56c537d825fb1ec21238a35e0938e367ae2063280d24afdae4208df65922d3
1e64e32dcc817706b030a6c8ab5c78b003462a51a6b5354af88beb9bdd45030f
212557e5f73016a7298fa5c565c9bb616ce8ec5db48f35d6c74d76c22d1f1537
27d3324475b676c1f0e3b8bd13d838309e49ed241c973b2e725ab819211d6397
2c09ad1e9f2b04bad470d559fe566a0415f6899e722b32c124fc3aee45bd4381
2caf05fb34bd7d621953ca25eb813c6ed8bcbda224727f82e072e3417ab2fa65
3409978ae5aa73dd6fcd7ab9da319f497937fa2bbae6ba8cfaff0786a3005690
358506b9048b8db1e6c3d8a888511044e3e6b4552ad3a08c4c840c1dae226649
3d20cdcdd6a9d9aa6361d1aaa25c6ca43cae691dd06925cd999034560b027a19
3dc0ed919c1acf7c0275e1481ff55a987092a5e0284d9441bbf9efa60c6005fe
4457c38fa3466a31724a0846c11ec83b350af1a921e84ddcc566889786527088
4a29df28aefd47fa261bdd7bee4ffdd88ff0788c3da9578a8439a969745d5231
4e990c6be25b0b6a6b5c1d316c0342a2d859e0e4df509c55beddb490b3d05eda
5160a2cee5b19d7aaa0703087edec7f1f577e616dc5913f08f10c7e950ad5cc1
534f328b2901fbc135008c7fc9bb01a8bff2ed4294c76160bb076d60c0836640
56788db99a9db411c541c8c23e8e2cdc22563558e319dbc834d4e40f71d0128f
572a62274c754bdba9d275f4f613b632ebd558b826eabaf5182ac07de09ea80c
58d57398ef601a1f1ce7b4b57294a5eb186c404b8260d1611bef84e2e60eddb4
590685576f922ae965eeea1e2f126f28eb7471119df3b3f96ab43a550d5282c8
5afa3f456f4678661b633156f2a74baa6be76ba2c784969833655888d0d4e55c
5d26e89bef6dc03cefe1631d6436bdb741f041ed08a03394ae9c79ca7bea452a
5dbc36a9b5eede8f07da95e4ac17f913cbf514e6e2185de383ed715cd81e513f
638f804c57e51f7ed5541d7055df81789b0075058ac6bb3681f2927527e3f173
6a0e546ddc743451b65c2b041b23377e892a1bb8718873ed5d544258348a2bde
6d74be1af79dcfd81b6b1aa64e4990733c0264973ca86c0ef0a1730ef2ab1919
6f465dafe474832d37516eb51e8e3fa72c4581d475b1ed1c14fc1829c469ab39
73e0e1bf7fcb823cfed34dd9fcd5ada1a006f8f0fc06b5e19bd581819cad12d6
7510a1cb6c41a61b6a5752f702177c248393db9ee0939ce44a78722e3f1eb9d6
751a1ef783e6dadea68f93d99198820b7417539afeaddc1f1938bea5dc6d04ac
7872d1eef120b64187844bd291e593f883599378d90398157f778bcf209f44ef
79e3cdd3341c2a20f5f88852caecd48fd292124c4b9e649a4c29305142ceb114
7c5c3f996c5d2f52e78ec5ecff7df3575e678e6797dfcd0831ac1b6ded9c839e
82700f5085922027e47a8eaf12175d986f2a61402988c50341b77c2bc0d12167
83acc539d07212d544b9cf8b2f879023324b9d5b43ba8a01888f63bd66f13f7a
83fa0162fb5324572374214ce4d756ff39be9a5996e293a86dfd305e61698dd2
8a80a1116376701cadbbd113a7443ebcfb35e2707295379d813f36bd70d17c7b
8b0f5dc01e176672cf3f810b2cf51f862c73912443727db61be8472ced592702
8c3f2d0b5b55dc7b3de092f33fbd964798ad9801328e4e9b3350014af6353436
8d9d12f6119eb1d07db8c86dfb9ffb0db42075adff311005e0dcefc4db4362be
8e879a24ea54ae356d64b6d73ce3c1fad7fbd2234ecfdfd250d2eab623be97b9
8f0e7a8b062dda5f1659dd87da65e2e0574c6ae2a8594fa51441f0028836cc00
956aa2e92b79e28bfa4510c27454a4ab1b3832c69cf0ff54a0b23b150622e6a8
970078bbb733a9de7ff71ab64f23339e495138805dc56d3aa99ca37859030692
99e567b65413467cd68e866366bcd22e1245a74078213fb4a5b21e4b1dbaffde
9b9576f36930491c979f71a6512aea5a300487460bb43449a28e39a885c36f4d
9cd5fae202d1ea157e0cec504525b7d63a0df6850b813468b784741f2808557b
9cd917edc334fd43e231e4864da194fc471ea5286992d47950228cd22297e63c
9f0227a3028d8c2cbcb243e0ba01bb32c02e7065d6e42b026a97f4f498c84a87
a44031feb2a71980a0980377c8f7b6f3b5b9dfa0f708556dd420be323c7e1a38
a497b9e7259378b666530c361320b75764ac320f66ab5c364244863df56b4d04
a798fce5b4ce37e5c3cf5c3ae5806aa3d6c1f0c79239b1822c6ad6cc2ce228c9
a85cae716859f3e9142fbb739e579b97683bf891e56f3b44ec9d4ca64ca4b834
a8aab345358a7a142281b6861a20bd5b7c88eb63742c7d062bc1f0c94ace58c8
a95e5f3c88c9004ba2daf3ee43e7ade9b2245c535c4cb19cdcad348f261f2874
ad253e6647362deb3c0d03399e7f512ef78a155763d032eab642d24c4bcec1b8
ae30ce4c9c50e734bf29948fe1f467668901e6d3ba8116986b92c25676dd6cd1
b1a7ca012fc208f046263280d3f4c87ff0ad419f35b3ab2ffc2225e4c457c4fa
b2dd52c31bf283569a128ff986d6ff7116b6e0e764d2fa1e3510bf54ce3f7e76
b603fb6f9be763b5dce303500a7e892ac44c42383b9d84f35f318bdee05ff36b
b6ae1d10ba34b2a1a7748af1be9b6893e73e7dccaad8d43137211eacb8b9c80a
bea6f95bef23deec1a826c009b1b40e47942365487ffde54563a672030219eed
c18f415c30bfb990db87f141e6480ee7f57f2fe8b4af77e4967563cb635a1902
ccff55c0b9cdd02839e1670484b79d0e89769a16b90c9c60302ad70484f1b76f
d106305602f785b4bd2e5649df1abe7323b959419deb45830362ddc5a438051f
d108368ca648e4f8cc3dbd315f6aa32495d97f5d4d4bc5fc11d288ea2889b7a7
d47e61cfc1103817ee9c1464422ecd7d72cd60493488d5ce14a4e2a499666ae6
d553754fcbcfb5f85255cfff2bc0982961ea94c14d654162991dab8d94c286f4
d7a8ef9d0298ef9f91d22b8c22ad5d94a62f5266f0d0134dd66c0eae013d801c
dc4bc131805ea983c08e42ed90f75bcb268154e22bed35088be67f5a65b2ecb0
dd011782fcd465ffbc8d9c822986ac46b6bf30af40946dbfc43655c39a8b0cad
e23bc5ee382cc5f5a5c5a62deca1d119ee4347bfd72aa40765a336f933d1f7f8
e25b463aacaf75a174a32d37b1bacb3e3bde6bbaa4a4b37cc2a794c07198c5e3
e491d3d6051ceab93c108ecbf96fec50be6c1eb4418ea85ed7ca607688b805d4
e52c393d4d8e97066c1c770681416dcc559569cd985e49ccb7667c60663a9feb
e8ac62a0e0e1eadff780cb1324a70ce03be311bb33d7c7bc69faddc1c7c2cb37
ec9b10bfebd166a035913934ae20dfa3f761b1f00bdb708e88274645a39b9c6f
ecbc0f7535c155d29b19aa8ce7a84f407c12211f523ca59c165cb9b5216e49df
ee4501eacafb83e4e74b484d060a2f02403635a851e87c2ee47d055dc01d8611
f28cd0e3c7cb78a397b023b5099508b8deee9ca015dabfa64e79a140d767af48
f3cc3d90dc92eff5b34a75c3c8c37d7f68f2fcf35dcd9fe87c496718a724340a
f4aba04301997c341244cffc171ab977ce5befeea7f2a7de184ceeb359667c6d
f578975dee296d928eea85432063810f890abcfd45fcad36de19f114a8eafbad
f86f0d031c0c3c7f3dcc078a2a49fbefd38f16bc4572a558502784bbb92d2670
fa0fca49cc1369d58271d666e7a26550f3885485c3fa8359afdd71c37c052c1d
fa8c0a7a76c3bf9efdf04a2f50342058dc0dcc85276c89a5a443d55e4cd4ffe2
fd61867298ec6aafb3c7fab117fc854e01fafc74755ac642b59e9a816092455a
ff44d7e57d982446732789b554c9013020210e60a893de71d4d1406bf054e8a8

http://diwafashions.com/wp-admin/mqau6/
http://designers.hotcom-web.com/ubkskw29clek/qnpm1p/
http://dixartcontractors.com/cgi-bin/nnuv/
http://diaspotv.info/wordpress/G/
http://easyvisaoverseas.com/cgi-bin/v/


Creation Time	2019:12:20 12:27:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
00879d4062050fddc9a7e92039861a0834489622d61fe49d036c2afd8183f5c0
019f2fe251b3b80c5a8b59251671ac4914e79bffb826d06e0282d58fbb0c0305
036cbf66c1d16ec9624126e66d07aabd37c7576eb595ce6b8b4572d9111ac687
050f8bc2582036b0cf0d47a35c265fe0240f670f863d8a5478eac83f7cce1179
090cfa5e788e6fcf11f9bc38c63bed2af15345dc22cd5f74feeff979eea2930c
0a7d86e3c517db64a8f0bed9fdf69f8660976d8be6a5ef697fbc6a57521b3f51
0ae687a3115bae6885a17ce6d8229d0237a4dde997b3869b15a0db34e12332f3
0e8acca5bc2b595b9acbcb113a43893042ec586883ec57dd42a8b65a7ad4a1f7
0ecbd488630eb08b32fa6f090cbc4cd7083c5fedc27dc3596ff1d7de2e215af4
118c66d3e9b8ca9c08ffd48c868218db3fdd2eb2f4938b1d293e9e38c783182b
1696507ff4eefa19e71f7cc955909038b3474f6c9c29473d23db8d1b974dd8d5
16f6fce6d6d6fa7d8741e5e6e331d6e752b54718f35b233885bd5c18c77a7de1
189f8c02de4411e05a92f4f3a5fc335510b7ea0b6b0c7cde2bc349235fc7f4f4
18bd069d0630ba4d562640803a22b27520e014ce754e8045bd6e6cc4c73dca19
1c940822b413aa944140d735fc746fa7b782e7ec8d4c4c6c4799bc968272a609
210eb44014be974cab1751d39b46a6979e7abcee7212adb327baf996265da61b
2b435e08b313b139e2cfdbf4a45ea3f217369cc1820f1f2449e57fc91cccd8eb
2dcfec7e2de04a28309f9833bbbdfaf2ed7a9ad73607c7c6fada1a50f51fa91c
3142e7e7f2170357a683d301a7427d29eb6751d1adcf1741b3b861b58831b6f7
3b01641cbe0205b5bf4ffb09e678fa1f3d21e36a36fcd568cacc70a892a0965a
4200d624d92a829c71add1a7ecc835ffb72c8060c1c99c24bc2fb9bc5318764f
43c4273c605e2711b1e07e8ad70c9348b98d8727006f39e53a8a56356f4933d8
441039ee7239e0f9571fde8256430a5dcc60f5828da6ae5813529f55620d7cd5
4690d575c79edd8623a3e129ac2bb9cd606f86c00e94fde5c0f1208bcca4cc5d
4721436a190c54591cdc8f0c0168b04986b187e10d3c874573f91f3077331832
50310b2de55f52b40c653924bd1b22f8712c4a8a3fc2222b6016dd6dbc4ae96e
529f02f3554492cb06ca4b63fe7b573d5a4ffa4eb9a3a2ab6a4cf20201a9ef43
53052d4a6219cda8823e9ecb61c03b31470625650c27c2ecd19acc8722552310
537039b383c253e9bc66c3ba052930833cc814f80070bf373f0e61262e60e069
556cf5f4c5f5674568aa72cefccf4a36d03ea8689981897523abdf6964716bf0
566e9474fffa76766b1618e6f882c076b2ce7a0a786d68f3b7a4c1c1d6ae375d
5ba135bc45790e3c2a34332e74621535bd0e584c06d7c10bf86fbc6baf8531cf
607bf2c459faa62b12c87c8106c6fb91b55908928107c35b9c4d5433ea3f3c5f
63391cf39177e85cd0ebcb031486946fcd768a6125b2086609298b12af35345b
6974eab3d91ceb718d3a25d4a73341f94919d987c8e0abc702ad152e1e4b47ee
6fcafbb8d2f4e90853451e5aa49f2f79b3be844072b59cca9e9370035b832c90
7773da7405e3481d19a4487a9a6a231039f8b5e5d924ebcc95b02a5b5bf5c355
7a07bd729d31854814c2c18bcb72fc985b1303366ba76347f9f5fb31a60e3063
7b16a9de98cf988e7b3a645d74cc6b34a0e5a8276fc8da430b7bc97b23ee80e0
7b7da4db1b3eb58407561dd96e615258201e7e136041834d604277a76bc69b69
7ede9068bb5f60750f5af8553a3690a8a59cabb7f4199bb6dbc029f6a6be5994
83525e8da1c282c7c74a06c6f8536011abdc9edefaafb5b98e6e798aa48d529c
83beb0c40f974c6b17b2d111947c739d538125514891eff1e93056bccf968692
8bf45fdbe04ee29d19b625779caec14c066aaa1e8f29043847965dcb94359188
a16683d956252d0e90bf97f984adcf44296ff68f831418b6ef8e38a61a066b37
a59c9e9e44e265083559fa39278c124dda988863ee5a7425b078e2e4500b6cff
af51da7bba2e8b7a337fe9f491b5ab87359606ca3cc797dc83e749fa162fad72
b046a2ba49a570e7aef80faec6efc50d4a8a1bb8cefa7563c2e424c5dff662c5
b9266aabc6480fdfe4aae2d1d65b99c8f8f8d3dfaf8e0e241f880da35072d50c
beb44a7487b62bcc2ddd341acc5355502a1bce84534316efe1ad302f4f5d9f86
bf5bbd298a365032b16852266b8d6a776f3cada4fbf71ba7a2748151ee534607
c07dbba99cea3c63e09d0f734c4bc9aa43ed70fb77735bb66a6845eb53ee6556
c19e4f9564e304e11d679ca37dc75ab35b3feb1f6e63df36add9dc12cc43e6ba
c99bb3c412455179a75cc6c83d36a3a13888e0a11a9ba6480ed0e8445ddc9ff9
cca96c0c2190712f91777aca07a89dab7d7853c40dea619c993e633e3f82dd92
d35483dd752676f630a120f609239f88640b7e1f3b67737cae80acd894a6843d
d3ab62d40574b55d2179ca986a327fb732ed6b285f9f1e341c7787a51fb386b8
d65060b787c82e2a3c6082a7ff96d03da613ae5c54a1ea16df07db6666b59022
d70f0d34569a4c846d46ca0b9e287c92819cf67e478aa08814b0ab9f37010e00
d7d389dce152e1dd1488baf5171badc8c210d66771a6d4aef159e0d7bf51df64
de882e2fa05c50811e4a6ba0411e4b3a45e80ba354939a6ca126186f9f3866a1
e56fa9a4f0dc74c920eaeb44d2cd665a27281a014cb68b4ba8fb597247991a42
ec73667fc30c8368436cd8c0aaa3cbffca32fce2f4260c9c4bf9336364092fcb
ed855c6059aea085d55420d31273ac855ab4316028611b29395f77723632272c
ef9d21a80ea979ee6ae94c9aa1416ffb78aaeb10d6f2a8878974395de9871bdf
f3ef0d4cc1a45a998104e8e5df177789d9d60bec55a3208f2eedc00e18174f22
fec8228aef35ce9b1ae40cd33e0a34a27e14aca3f9ff25e774591de83c96bb26

http://eilonstrategy.florencesoftwares.com/wp-content/mu/
http://pakiskemenagntb.com/wp-content/4k/
http://ivyfriend.com/ivypal/wp-includes/h20/
http://julianaweb.cordeldigital.com/wp-includes/0vu/
http://itsallinclusive.com/ar/Xd7OiT/


Creation Time	2019:12:20 09:19:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
01eeaba88f533aa53037198694250d11dbaf6c58dc5fee29e4051d00da85dcf7
0986f3e64ccd6c216e1cad8b9e24607102f0200846c1d057f38cc7e8005dbd7f
1ce3cdffc335e22cf4520d413f0293a6677d2a0543abffe8a8d87f0f15052662
1d506b49379676504f36f5d57bbd0487a74545b6ed939ca3433e71445400285d
1d940aff783e62d30020a423d4e3e7a18129eb048b965e7c6465056980a554a0
1f22788d64b0254aed689faa4347d2a33f006e7bd6ef9053512ea873f03d4038
22a052096876b6b34069249fa163265c3d3191c386fc2d458c5f69f13be1aa73
26490f058ced2dfa411ae51aad75638c5e91eeb976b8834a006358371f9448f4
26569361cfdf297e3115a89c00336d04fd9133d849210bd3171b37f95b6c62c7
2b608a8ecf50f358f5f3ddd27d9525373a4f894455796aab4fc7ca2c44ff3c35
2c9f1b41e29402c4ca83b761b23cf9190e0fbd3e2e8ac82a719d0baa3c96f1dd
2e1fd66e891718ba6867f05e25450972c1da9937f40fcae5f146e13f9fd1adf7
32d81de3853102b59368fb21b731091bf26851dd9a6712c6d5abfaddacac0275
3e837bebcc416f6b72280fd39915321ea066c443a0165e3f07fad305a4ae175d
3f64761808a91fafde125c9b7731e6e15fd957b40e819aea7f77f0046aab8087
44018857a27488deabff6d6d03ff1e2c38bc7eaf0fb9cb0181514144578810b3
452cd9a1e9c719b84a29f06405c9126e7eaa0ff6b8fd7af82e9e9e56cebe08ae
48ad480d807df327faf80f2295c6a19305b005acc21b232f19e7a03edabdd719
49d1aea1ced72dc8b6cbc9a3f0a54266bbb8bfacc124d9fa093d8ffc3245233f
4d47452c29cd61c37b8f6d24447a147021c1f3d2acd6fca94330955d9ef7dc5c
536e95c2ebe022c63d63304d7e01ca47b61fd20390791772f12cc2352f62e15a
5f1b3638392487a23f76624addfdd5e8a540db84fc527ddbfe758c44330f5867
61fb8ae3ee7d03b05428255111f7e2bd9e7c306ee06f16ca766ae5f1a94f84e8
62d5c22f6e9afb1b0d49016b5f0219a94a361b53edfd1d08dc5486031da9e985
64a74d9d0ef6c0ff73fe09c68da9416abde891be0a183d4b4b7668024c8dc080
6f2c1d09d0d22f2a8f4b7c13e38c7d0306757466e83d625c796984c298d1c468
84bf03c85f674ba74404164581591d5358a163a5f191760d98c9895cc684fe97
870aa0d60efa28da23ff80d2f29fbad80709a0e85f3ccb33a2444268f73a9e7a
8f62870ed7ba3a13c0f2552e3789de9221819090622393d8f689e7af17a42ebe
91892001edd4dbeab58fa293ffe831dec62bec50f2d874d945245c329bc509a5
9525856d0831ef62d580a3eddbf8421a1cb86bb16e9fb59b356ec2797e396753
9b9f52ec42dc6572aadf3f2c561702810f901dd2a96f0fe431103f712ed09d2b
9f986c19b59641fef60f6996237d787cbd395604a17e25c2e49ba2d9335b1783
a36170e14829b32968db5f9994b38970135d9a9594feabee1bc3061bbd7b2179
b1030547b0925eda5c12565647d50e0803c6dfa7e5690961187a4f41e0cdf2f8
b296901aee4b73fba3d6f27601cef86eebadeaf229ee76a503c2cf113c3b13d7
b3a7213579f74c678d6fd8c9258ba534a06e009c01418ef2b4ceb40a2c85aed7
b6e969b71ad504b159f474857901ba307b463fb32589b8d54ee1f7363014f242
c7939f22c920b808f86983b35986c9aa03fcb64895f456077983bb7d57f73942
c7ad96731d85b19a9474d4986b195ee19a03bc5a5575cdf8eb974d2e1fa8318d
cb61b5605e9c1a4f7b80e577cb82dd55ed1c36ab40ecb751bf7a2bcc54e7cbef
ccdbf8f2a4de5c6fee1e121fd7388fea0eedc64b8b629d77209a87c082198504
d1c79f6b4e73e9b5109d4e642473e227551af650798c7e98c4f03e2f04da6bd9
d746ee774c615539a8a3177b2a90f9b2fd2569173524ac8172fe111d8a77d462
e0cdb9e34c1cb66d32617db2d7a495c3b0c1699a12375090306a3c9c85a33d08
f38dcf54bfd5b0ccfeb06c4b34b85817137162ed5d895831b1f7993801c7e75b
fa953a4684d099379907ec566937581921b57c4cc6fcddc615a9acfb4122bc67

http://gratitudedesign.com/gstore/kfe/
http://hotel-le-relais-des-moulins.com/en/nbxA66tO/
http://herryjoa.mireene.com/wp-admin/Zv2k/
http://ikahotel.com/wp-admin/nlc2c/
http://ipoteka-24.net/wp-content/uploads/v/


Creation Time	2019:12:20 07:10:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
0574adecb56196b8c9e9e87477d97d5e1edea70ff0b9cb154de11775dd1ec919
0bbacd6f5ce36b0f2e6c1ddafaabc4d15a485f638f7c67408f5cd376cdc66b92
0ecc3679d18a205e9cdbbfa5ec91827a0ef14656c8f4e8946bacb37446eb968c
1287e3ee97144d79998b1cd7abd2fd5c88db827ed623c6f39d10e1d4ba8460d3
17cd2a4af3f45b3e45b10b4845fb6f7d07bd602e4d665d7a444a2e8505ad8817
196f29371b2c77a572408329b348cfbc56481c42d1b46882bc7b6f3abbd1efe7
19f2c7093452e7e5230593bed7cbcf8ce570ee2eadd6fa0513349c4f2dd4a175
3cbeb0dfda9f3a29ca969204a36efb0fccff63c529d29b1252f4cf8cd2509ab4
563f9a0ddae1277f7e3effa4a945f9a6efc62a9c173b26c9a41fe23b62559bb5
5a07cbef47c132a019dbc9a821cb3c62660dc28a0551397ef14725981c62d9f1
5b4c51549ef0d5fc079d0ab97ffcf469b3bddd4565a11012fdef14e1c13a90b2
5ed178596672e58a5daf19d4880df6fce8f1b9f0ad1f7dfd05300ab9a7699aeb
6023c708270fa6310962d4cba2395b9a5fdda301b8fb511c0bce60220e6afb3a
7934d03ce57364b656ab1ac80d05d1b8c48b7e7573a84e24e9548bd7b315acb4
7a6e49d015dd17031f8787561d96280641dbf43c4899e931bf65e6fc6775ef23
8b6407125f2b7a9ab8d305774f9cc7f7f9d62e0ec78797c7338f24f858283479
8bf97cbbcafdc1b8b21625bed27e639f197fdb4e480ef47852f1e22368a3d53b
a6591ba72d4785fede3eeb212eb1833c548ae46ea129ced423a8826138257004
b41cd0fb0350313a71d3b849162e9a8fba732708cbb6ad5964c055bbd6231037
bdfa63f5434e01dc8fc55720ac82096b64285577c080c0ff41dc7439f516d283
bed2bf9836109c6880e1aa17773076db666911fe3e4c2a636702a620bfa65141
bf8ad05d03dd22fe204a7eb50334211222e55909a9640a45bca4c1dc01cf54b8
c7f766e8ff9f54f31a9e52a46869d416980e1584f7e6b82e23125f6d0617a22c
cfe70bbfd339d184bcec44e5d8456c33d4092cb4bb0b9973022658d7903a8a6a
dbf3c0549ec014cc231eb4923c354cea6f8583eaa150984645f5b3de6341e0c8
de1925967758e4dd7954576cb5dd56508bdbe278cc8b737e33b046e73253096c
e433076a8225ccf66fd78a74aaedac45aeff8861f3b00a6b35a8d80695dd912e
e4bba0d01cbf6f796e53cffedf881a3285eff0426d344221ae144ac4cea10679
e7b1ef448b64fb5c6fd03acbc013cea0da3a4c19ada9302319648735ff2cf2a9
f8530176ecba16254b48f73748176bd1eef20a89f364847a96ab79752f6ab475
fdcdd799597a7e2d5608ddafda6af7815541f4cd6e3ea5374f52d4f3d80137b1

http://zaferaniyehcenter.com/wp-admin/d3k2c/
http://newsite.modernformslights.com/wp-content/gj18fr/
http://dunhuangcaihui.com/feed/wiytu/
http://blog.kpourkarite.com/et0a/ZnG6LPQDOd/
https://hellothuoctot.com/wp-content/dw7e9/


Creation Time	2019:12:19 23:35:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
03f5d30cbf3a1af185a67f17b577c75525035416ddf32744a4bfea21cc456bff
07c8176b3a48a0959727b1547ade4e09f4ccf0217be152cabc77715f119841db
0828fafba3cfb5736d4e2b6c6e856f82bc5172499165a5f0a1f00e0d49c95aa3
11150c36dd502acf464d4bddefcbeb2e872b78640d5cbf16b4247e384260e3ee
20d333fcbfa9f893a12f91b8f2b6f3a99fc85be8b7ff893c11041fb944889fe4
2455e77839970bfd270ffd417fa9660178a83c3954353351a670fa63485b3cff
2a317d5d4f3a2dec4c522651a4d3575a0697a5d8da09f503c301c0b9f65f17fc
2b2ce4f782859bf7fb312f3afb5b68d246879f77e3d82ad49b095bfe17f2f05b
2c1dd6a3efaec4ab420f37ccd9926cb7ba67a831bec5a21dbb28a3a23a83c9a5
48ddfef68247861f6efd33adbf8a943e934638797e8eccbbd9e423e90c653a80
4fb4adbd5297820b987d0b0804d230caaafb56ffda0f4e925635a7d27579f682
51cc9cd53b3c963a468bc22b331adfd47a332525b29296cff74aa98fc05af10d
640206d3e78c74e6809bf604b4d5a36650a3bca008cbc4be7927c71671d9de2b
6cb5df8a41b06e6d2ce937078aef4a68a4ddf064a096db54bfc9d2f50279ecdb
736d12237e8159930230f031415240c76b601ef5e67d290ee4cd6d89b12b5c63
74471bf78f15aabdacd5b549b27dc62e25c2c3c99b932177725fdcb918dd3184
7a315169722f5287626958747b794da9103fa3b9776cbe12982c26959d2f0e89
7b45208ba107f13d7dbf2dfbb807a0c8283817fe25dcc61555ec60c445801b95
7e7f6d0d0d01f641124aca28225ec297c5b6600f4d49306419aae535e5358b04
901cdf8f5b371c489e000adc5997f690c3dd3c2815c3dbd087b8d31b8ab25e99
955a1f6f73eaf4a839941cc66e1ea96d5e06a7d5a9d291806d1172154eaac64d
99915006415c7fd8442fb095f287be13c6c604b9e543eebb8b6376ba8d3ecd43
9d9500698184db7afd0bd7e940c75d296e258565869dc4931e8929163d36144f
9e41bad2948eadda33dfc16e75a5e50e3e0d0babfa0767ec62357c94962ac7cb
9f03fbef024e2aa5bd70fb4e09fdba0efe696d714461c8e9686a86a8d83078ac
a3fd91ae9387890e17c956171ffff3d241a19364d3ad2a1091e242ccecfa89e4
ad03aef73388b1e7207f0a1abf8274b8fbfa703de21a9c27ef0ae041981321b0
af8cb2eb12b234ae8bf42cb457893acf395017fc8964c6f981900f89616263a8
b216fc799cb400e7dc78b92a8b5242b3a578a43b53e85617c8e656371db55798
b3ae698b4cec93800dc56b22d8f19cfe3e8c625e148ccf96e81b7c742b8c8991
bc3e122134e320b9abe1c624bd130631bd2c9cd5b799a60f1071f5791f69b56b
bf47c596059ae41571d29183c7415baa218992aa214426c158d11b3f0f82b370
cfb0cbb56627739ba234e9269d51ffb4a8b5b96ecffef88cd1cd54dbb2230622
d10b8661fdf417f1700879f39275b0f3a37f6f3603935ce813f57b737618652c
d3fd6f753f0bcd2229739ebe8d3f3670c2aa78d467b59bd782cb167daa41601b
d4d8781d525fa0bd1455f573c6e3661af6e8992c57c6c1d502e6c630784b8fa8
de8ee9d6ff5217db052c005f8e49a89873ee06eeae2acf202c3de1f3d9a33e0e
df640ee5d2fc922530bc68c52970c2378fc8def0ee81a5d2636df77326832cfb
e40fa448f07a21d390c960023162d35dd82a61a7ee51c9d898eadf1d1b6481f4
f358aa81c24c9b90c4b6dc2aa1004278f7a05b18df49d6e9d41d9f7b21f2766c

https://citationvie.com/wp-includes/F4E7VRR/
https://tapucreative.com/wp-admin/ds54af/
http://driventodaypodcast.com/megaphone/wrm/
http://datrangsuc.com/wp-admin/Szzu2WcG/
http://nguyenquocltd.com/wp-content/p7dl/

Epoch 2 Payload URLs From Unknown Document

none

SHA256s for Epoch 2 Payload EXEs

00e722534f0c585c0f2f9d32a7607a9ea4d8f4deed1f038be5b2ba2c98c0f837
01c25f160bfe85dfec3397acb690b278500c3dc6de095728673823bb9b69bacf
021bc81f6b1d07ce1fe80a481478605485e0974d55bb57a7b610772b65f7f471
02420cd7861db7e3fbadae992b240964e663dc291fc723c832a8c47b477d2163
02b293d64be28f58ac7e5e5c7e404dbb3177cbdf2efd907cce25a59df13291c0
02f2fd0dc293883ee740dea119cc1e1c350fca467efae60652ac1212cf4c95cd
058c98919d5c1644ef759578bdb9c5e6b7cc60558a49488afad1a39306a4238f
05e1a3b09ff12dbd7044cf9dbe4cc115491d9fe577385dc66e52cd66e8d3a228
06f8304d53659f8b5281db20cf2ce17958a0bde1d8b5e751a134d7ad3f1bb173
076434244865dcbbef47c2c35277a01a6d275ad9b440b484e42c9899d951a6ef
07d4f90fec08de7bc762d931530f4e099fbe5d98d32bd63b35e7ebbd2308b0ce
084dbbd5963613b0c15c9db929532e2fdf6491821b976d646f939299d791b45a
09580366e019f5f914e8ae5c4eade758b9ffd9e6805a3f02c688e99faa749820
09f977a3ca8b3dca694ae7d38f5c8a68d23bb94b84978ad92c1a7a2331630a5b
0a4a0e2400bae2c01b8ae387842e9724641704a25a675982e4fe8629b0b186eb
0afca8480cda7f7bd11ed4f7621ab9d93ff1070dd826f007603fa0f3dad606d5
0b285e577c29c54305cb4f172c381c35c55adc5bb174fdd0d7767f2b992f1c50
0b8e3c45051c1dda8725b696ad5653918d7bc754481e2ace0298208382dfadc0
0bf0af62e1a16bc8463d89e7d73166a0448d9137a8f40809de98a38f1275de56
0ca542f292c505b7a2d18bbf4a6d503255943100cfdcf9615b60e75f8b4bc7b8
0fe93e59a6dd17cba5a4517c0fec0a3dafa7f4751ca83449c155e4350f31ba56
10b521f063b5f4eb6a6b1efb77a4e12edef75fdae2acc59024e6b381bc30e0bf
131fbe01e6f842caf0acc5617a24236011e68d973e7524d98b4bbef675617054
1348dc38b70f383581e236bad6da3599568e3140a836a7b7edf919a8a46af83a
137956fafb617e2d69028623f8406c86615b7fe04a76c4cc23359031bdff6ef7
15e03e24fc05aec6dbfe8e7d6e31f5d176e271bd950dec577c9da67626e92efb
160fb36d9c59d84efa13d0efb29db6024e0d128876ad49e71f0438ebd2693733
1663adc1083c60342d479968240dd126efe20387d2af0ce2f8d6ebb1e266f583
16f60ea8f8a4e521a0e6184d3ffa8d6d73eb9d549b3aab5c6f0b1aced786ddd1
170d8478315b9567f63c71ebdbcd7d3ae7ed6e85c88d4f05d1e0d10b4dbc780b
1763810dbc8c1e531b469e831a8f4be32ac4d46916abdc011b37414c966a531a
19e4fe501666e89bb1c31134350f090cc7c85e3c866d225d18f9fdf3ba1b424f
1ad8b14294e8b73f8e1a169487b2b37bda73c171cffeb81ae7c768f7735dd7b4
1b033fe4d13f1cd98c780526839f6ba1035d75effdaa47cd0c64c0597b8e8a65
1d477b29e772869de816443a1d01bbb7f18d5a1c202134ab1ae23816a13ac8c5
1e96f84c1fa8688016e67dabe6592daef7db263cc4176572530b29a55f67b5f2
1e9ec1481722c185236ff6e576f11341782f5019ba4f15975ff7fba8b64e6f94
1f6a3749c12cfd427e4c26e228e54906645c88332fd1c3124835094f86c2f085
2341819874d3de14e5dfc3159ea8c060831467facd871fc1817edfd70ad89c87
2609ac18c14c67fb61e6a5daa14ac32fe8a1868d8a29cd27e05b6ebfe850d98e
29ec5421a93be388b8287c557af12b19899837809c812393d2c9f7d03690e7d8
2aece7e019c71bdd5e64f9d4ea665a4b7ad2ae2f321dcb70702d014e0b1cf0cc
2db3a4102efefcda8714f93772b21358a7976c9ca5e85d6275becac1fb7dcda9
2ddaa6463d7959b3d305aa813bd28187bfc0ac74944535f858ad1fb02725be8a
2df602dc5e37833439f5cdfe569133e1913dda008f1d4f2b0e140851d5cba5f2
308b56d8792955534c9e2802a1bada2ed13c96ed6498dd66b4d8315b55544e7c
321bf5b8381e87cc32972b90679ea03ea561ff785bccc2e85c5fb52df998d9c7
36f8a5a2859fde8d1529c5176512330bf7579ca05be15d6fe5650898052adb05
3713791b121ee6624b6cf3a6e98555cfc8b2dc5149c70f66605f9f7a27b7662f
383e4b01a3063974e9ab6e578efbd5da575ed3e2aa03c7e02d30f58b7bdb615f
3cb8209948eb56121ecc59b99068f2a28bfbb374691fc2406a566777f43bfdfd
3f046453a4a82d83835e3fc9a6f2574c7ce9e0c7a3c8f315120655392f0d5146
3f183c896c2b119baf27478e6c7aeee411687696f27c2d20edb72568dded44ac
412369edd06f2151906f1999fce8b11d9d5a24663b3f0d0db2eeb97d488e8488
41a3874456cdd869b999a753c34a6426a7e56787e961bc947e8145e4e73f7bcd
41ed394088c6e7471ad8dc0d96a2804387c90e4849aba46de0f4d0b8f6676669
42abb0109970d82ad7011809bb4f51008ba1615797beb94bce19c994b7abf1d2
42d61c76426b2ad775255e0a6492741ff57035e1bb13264b6e8b11cbe0510e24
44d7c8989b0e6bfb8b03398cf39189b1cae9580938b279869b44885f76bfd5e6
4781ea5e292181bf45dc72ab753d28f1ff40458c9cd164d8b56bd6b17aff6f5b
498d08cf6cd56fcc71578dfdfb78a1f5ecdcbf9511c1b387126d24118ca9864a
49dd5bd2d6d3aa46ef363519105ac0c01e54a050c51ff1d3b1c0c195c62a5346
4a1bc6f7c365c8cde440955c8dfad1c5dd4c6792668c0a91ee7054ac474cb27d
4b835b961548c66bf79a02d7118d26ebfbf08f250d2961e7fd59553cfe569088
4bc19b8b2ec63bda0d65dc12839f6b3d449df9ef65c96b9864ae2c0a37e8d20e
4c7b9d35e190a742ef1429920ff765ceec092262fa073c0480fbf02849a3d188
518ff97ae2a02831e6b1ecdb3b77daf8a14d9fc36a544bc2ead9de4adfeec3ba
5365ae89f61d01ae77f62a610555e007fceb763cf04f86f14e970eda05da33a1
5529e7c5aac6db2dcfc85b361d5b4b125d62d460b2e1fa5cebe3b6dd46cc594f
5542015bd15723d05dc380265f5539146351fa3fbe64fcdb89279fb74756eddd
559176ff95e9e044815be3278b197eb2901d6f03c9681c9efef9b4a95c0a8421
56555fec5d8daec267a094399a3cb095f4a0c1af8ef711d50fef9e886acbad0f
574220eafd943fdbf4524fb8b98c12f98f5e1e0763fcede2275b30ec46bcf1a4
57fea47c8d71054ee8cf1f223775c638b7b0cd98938d30dd95b3711acd569cb8
593a0feec8abb3c5c93969a4baf4544011e76506dfcda20a24f2b8f86ab428a5
5b994502b121c4dc97039021fe90f4eda8b38aa08793dbc397417b191b1ce403
5bf754621c9d944de8b22d9e71045e7a129f3e3de9411e0ae3f55b4296175a96
5cc857ca2c18e55af134057a191292615a868485e643906282af97cd86fb8c9b
5d3d02ca816c1c58e063d5ef5db5ab7a1bc1eebc0ffdc1be2128da1c67603894
61644528233f1a942385335150cb06638cb730da56d5a2aaeb9da80799456066
62b8d58909f67e20a8c0bdebcf7885adb433a3a101fdee66e388e0b44a9a6576
62ef29aed36af96c3747a076bea87c4fb2c3e3bda7a9d859ae66979e676b2266
6534389c8a3edd5e7de557ec43e8f5c89ef0b17b9668d9143b839c7208149f2e
655ba6a63eee5f71d89fab4decb5ee2957bb28b79543cc8b2724acb59c48baa5
656b6f966c34b839276e1ad482e914cb99dca95a2625084866c9e914f7acd2db
65c8862846ec2c7cc52a324e76f717b583ddf6b9a301cb51d7561bf059b0c14b
6814022f22527fc2aba01c6e9d49a15b427557170f691eef6b15a41691594a82
6c11d7184a6c95bbc88bf37274eda3a4b1d0655c010cf40b8682ba8cbad1ae82
6ca92504e2d3d9e3161e6644faaf7897d41d7d13040f0ca6f5c3c9b6ae341264
6ea1078a912e74ae10ea74f719c0b811eea1f6398425407e5bc2775cd9efed15
6ea32990f749a811fd8968e3b46dbbb097cde084d6fea2f19cd5f6bae9cf6d7b
71c8955d11eab9c38b65d612623ff0865be81336a44ba99794d53097510c0c52
72674bf39ac7af3205a07223c2249e3b2f3d6fd1007c7152f0007600dd5bd9a5
744290a436d9615140b0905d907a7c4d3acb87e671f006606729760bc5e18076
74a167e21dcd5351f5a7964227730a915d679a68cf09d22511bbd8b728b5ed51
7732826116c28371a29ef4ebf0384ebb800db4921d30d84da6d99326cc278347
79930dd42c6cab196f375b3ac460019da3e064c2c05d30eb8d1f1f4155ef1526
7a1f2ad430be18016d13007ff0e762b7afb95a6bded8c773d8bb1696bb7ff9e3
80d5846bbf7711c90b8dabdf56251b4178462b2d3a1fd3e5154e74c40f85d6d4
8185d15475c45c8eb1862a1a35182fafa84ac034a871ab9c3b48a22145af4a7d
818c649364b1e5676badff64dad3d14de3a3ed56855933e0f44cd5d75e07afb3
82841542efdd8f7a9158b887da2678baea723f5d0fd43872d863cabff09571d4
834d1d3bec69cf932d8eadbe9ec149ce12ab3a669e6dc30a73cd46426633e5d7
8350bf4e2ecd6dd5cbcab7369871bf00714aa9906ee4bde302a14fef67f78143
83d4a5cae0bd267099b6e0ca63eb0baf22448e416480abcbf4035307d1e63bdc
83e2e91abb3eb588c9536ec748309d440e951da2a9e517952fcca2655d4132cc
860811a83182ade41798fa04af0fd5b0fad475f4e5a920620978aa265cd46e83
87ff88480104fb4e5ca3fb3ad940434bb26caacfcef53d4413ea5ac5fea328a4
88bc69e4abc3aa047f91d50257c740754f598075ab795b60cd1d44c49d232442
897d3b0444a57379b76c2c98f0325a3ed7afd590563122ba430651a1f8fa3df4
8b52958959a77b4b800ec20b8db8d25062982ce88d4ec7eae3e6437a12d9261a
8bc9b4a98b702bcee224307abdb620f9b22d307c31002613c040ea459ba75200
8d29f7b743426a471c17d307f229241150a6be6fca7d6a6666a4772b7a150e9b
8e3d31c2e396c7736c6be5a47be48b5de0901be2cecbef99c062b5f2c125562b
8fc9309f5f334475b94e1d8c174884b54306fb64b217ea49128db076cd6be013
91353c600faaa62141280417cbb0cfd7d96a1d96c23911a3abccb058887ea281
931f3a5ab41f17b81f0fe11853a2598b9b555e4d7423f235816a44f13adcbace
959d1db58178879e81ff1b731cc00e64a8ea51b98f274dbe815fc631251432c4
960d9caea87c31c70091c98e524e8e6461c8ea5b280032d7c6f81e89c80a3f76
969b13d886b23dedf90e22800363cd0e72accbbb027f82f38fac1e816982e645
9b74c1bf503bffa8b7d3765a77c860cb635a00403fdcabe612417ed468b45f7e
9e3fa4d2c7219d0034324e41760b0d6741a34e63559ba9d4c82d6dc3d26b0c44
9e57f5a173ccdda7b06c96dc4c60f91fceacfdb66c466f76c5f9ead2c86e0717
a04fc95f37accac8b5767d1878500f3f129b82883ef40f29593c94acfefc76a6
a3c0efa34227ef213ed14e63c4b05dd50d3a1b46802f526c467ca479b3b6986a
a44d65bfcab97513a404b084cf41f2030b6f57fcde5887a8450605090869e9d7
a512f0dc7ca7980c76e5e08e72276916af91eaaf693b8d311050f0c0b68e69c5
a51f8e0b25eaf0ce54cc7d6f9bdb60e8095e090a30bcf039b1228df97f0a5ef0
a5e0a1c4510b761f2af48c43679d83a71c860882ca6a6340fb9fe0a119bf8627
a9f5eb16139cc2a8d9173dfe6adf2be2600d437e838e6ea60872b89a25bce310
abe16ef51275f947ea69c98e766738cead482cf982642f861b41e557ca2512ea
ac6fe050dff80f495a8cb7eb82b997d8d75d2aaefe4ce80df2afb56cc795dd36
ad58bbc1d93bc6563df424d65d50d0174cd1c8ae7b71a330d0da79c00da69170
adf7e5bf2282807067ac6f416be7b27ea525d7808e4a2f0c970b9b6ec8c75430
af534c2587a77fc01127f7cb9641704025f07d55f85750dfc868076c226f99e5
b0c7cb26a7a67b2da4be76e154a7395d4aaece6f555d09826f39019ac3b0ff15
b22f798693c3bbe951292d44e8fd6708dd3c8b5513c105fef47f6406a78974a2
b2504f0c2cb4473f83ddd1b0ea31a1ab04bd2455050b7ace2cbc8d5c16f21e0c
b3cdd2801e2cd164c28449a823d83f8cd1367cddb5305d74dc40eb5bf5570b57
b46822628dbd4f2bd6676261c208af524bef553137af65f0f89b38c6a603b024
b4b688f7dbaa7e52224d44747a1bb99f60e479ad9876abb6fca2aeb7f2719273
b5c320f4703f5b9ff0e012e2036e7fe1aebc30fab118c99a4e9e475a95e1de70
b71c8e94aab3bdf415fc0f1c759f737a04143c24749deaa870a98d4cc8c0d636
b766acbd00a6f50ab3f3097ed46d48b2f487badc8d85622488e19f5b32f04a3e
b7f151d1c04a3c9d552024cd4f8e40f36e5ea1edfe26a2d51505b8b4b4820029
b96d75d71f18f32a1f4c303afb5bb5c3c04b950768c2473aa5d3c23fb2929384
b99fd14259f7d1a4167aab6f8889a1b70520180d66dbc0e92414a021f974679f
ba9c31e7357f1a92f24e26ca89614f235b608eec0ba9cc2b311609d04862176a
baff9efe0355dd7cfc450ad0b7db9329aa49f8b19cf7bca4e7bb1b56dbf48f63
bc45bb0dbcf2871e7153866b136f9c6ca6cb79355ae46c2244e83fcaedcf6af0
bcbbde56eb07c3f554d006a297af47f7278ac9c4cac591095aeee9eea02ebee6
bdce8f5710433f704174aba6df648d0668137860d13abffe65048d8979aa2f1b
be7b5421019e174c2ed8506876bf7cd60425c7e54c2585f54d29b4a87b9963a7
bf07c39d3999ea6a390cc17e2c427604d805199a8f634d656106850106d4e56f
c0eba6fef908c3c4f88c1bb85a85ca3a86dd27b7a9079ae51e2ec32a3cd335a1
c2ed50ad4f2d8071a3f25b819a830f140675090a8ab32b7b1f630944df7a929b
c4047152a0f228e55fc0748cd21a0bed309c32fea414d22611b6eb3be9d3c304
c5d1250a6c06cc6f5e192f5bdc53bf6cfb5798247227f945934b7cdf9da85ec4
c732fccef70b49f09a3b0bc4a3861066aadc2d51f3766dafeb7f7f12159bb098
c811ec2eced4acb29b8c0e855bd51742eeb2fe3bfe0cda00a71641bfbd9cb6f3
c9923d527b987790512a735058196f7936aed11ade31f94f0486eb26db344ba8
caf480d646ff65a56adfeb9351d26a44906617c523a40cc63f7f0bddd24a5093
cb0aac6436006cf5f2ffc8edfec65af023e91c40c270922a7052f657b5327ae8
ccaa8e7df9defd22a10b7f4ed49d95fc1837e81c2e8be68cee933eed090586a1
cd04b2dc24d39cdabedeb8d8d67a9fb6e084311dbd873a496d5707c06fdc1810
cd477739a40ed1ba4f294cd8b9a6d668d1a860b3f134f919f0531b47d602eecf
ce17b78a9eda24f5306e35643ba237037d13ec1ecbbc0c59869119089e913060
cee68c86c82d9ed62b57e5f7afbc28bae552f4964ae1043015029426a1cd0d7e
d0ffa0917e86904d27a0b2f3fcf60367ddf6f31a6a504635b2102e58a468a729
d18f18532bf931fd0d0aa610dcbe45d7a8a5c4e0db160f67147c7b0fbc4605a1
d2500618f6830b61ebd197d02bb9feb82f86fcb66917c2c9b24e23f153c341ed
d312b32d4bee0aa9aa93c3ca15bdd1259804dcd4199fb7f733da5f1a83b53b60
d31dbd120c197719def67ac82576c19e83508234eb05f0b94b65eb78fee9d166
d46b7d0ad1818f4e828bb64b331b8d922b7d519bbfbba5b75c4bdf238b6f3b7e
d7c4d83e6e37f14d29ef59d3685778462bd1a81c5ae25448283a7fa8b1811056
d9eff7d535951fe9a904b572c45cdf8fb35c9686b97c7959fbb0f1a482db158d
da9dc5fd344c93717cd1b8b068eb2682410f32b0c0f7899e93790ddd7f4c74ad
db5842d365cad1c1ebadd7d08f145ee1c86896a93c0a8f390e177e293b166b4b
dc3dd547cd9994c246a1129a7d5c9018690c9d4f2ce1249870fcb6cb92c732b7
dcc34917a4bf2d07e5f2bcdec737465c4872a9894caa570b32209355e418f614
de87c0101e5649f41c7f165f8d955f4701296df29b98139323da7c3a200206b3
df118e8a4475a8419f2265b0c2f4974c74710a353793d3f7f81873181376251d
e009ace291b1f3476fd498c24388a39b0c43fdedea725d7dc216782ff9df80f6
e02afbee078f03eb3fa0dd53b5a0d71ef2b20dceeba781a99e18055f42a54232
e1b09aad87b213802b0581ec2ddbc560e7d5e83ce2f800cdda513940c00df317
e23baeb6e2bab7921fd49df0f240b1f82621569c6e9763a4e2f461eb637561f1
e2fc8360bf4313ba0774447c3ad4c6b83907706ca9f8f234c49657e0255cb96e
e39310af4f984f2470d2ddf147f80c951fd00958a984fe11ebac03c0e310f4d4
e514dde028ad921c42b7fd51f8eaf489e1ae5358c926481dd44ae7f319dd2981
e51e12d9421d9b04b75f31bd51f54950e52286628aae073b056f573b6e48b94f
e5a6227f73c4ebf43097400a5b8504ace2adeb1735727f7855086dc7e5f3acc2
e61bb24b7a79f0e1bb37f163e5f6b0c473f2ff75cb4a92343a6aad554fccf8aa
e7031868e99ae427f4785a458ef7ace0593de8da63369209ef1e089a292f516c
e8b3e39e306b43ad61e834b58caa56de29c7e40ebc5b4eadcb8673ae3fbd3d75
ed721503c47a0c084a5a3ea9ff67264d6344faefc094f236eee4c93ced6bd740
edc4208396a0a9b47670c94314aeb6c7849ec6f6509d5d736d32119ccfd72599
eef0ea886ec5314f4172457e7989b51a732db78fcae4facd13b4711762a66296
efc6dbacd1320144ae3e80b31fca5fa42f0354fa6903146b03131e578c68a5ac
f036ff18241d5aa1aa0af19b8cf1dba69f36848ce22a1e6e6b821f3b134b6620
f03d04a84da9e18308b1c85485e59252707cb4d7a447b7122b112222664a17c7
f29a1239373cb39c32ec93acf9d4fe36c88d587a33cbbc04a60beff5008530b8
f2d26d5077fee2060e7a4605117532afd03b91a7c6fe6e6fe3fa75f0b9dd0b3e
f325b82278c44c75b7be14b685bd7ed01bc17bc58e61e7c613f68958eb90c32f
f354db996741352b96f64bb13bc559a30bdd2c49091080bfe35e91eac2566d51
f5a28b097e633615ea88e32e2a8143d11aded1f52a230902732324f1cc845ddf
f5cfaab00317a124047d4dbd9158664fe2f1b892ef89e28c36f5b409feaa8969
f686b6f638e28854d1f0bbe530c09f0290390ceeb0fbedcbf567c86f4ec861f4
f86a2882452a6a3b7c33a7a5b7a7e129631dd6cef8b70412e4b7e0fb4da8e659
f8abba842f8e873ced67e276c188cf7380a2dc8f540fa4dfb0aef9a0d64dffaf
f9ae93d6e653cb0412969b83adb286fd24d94fcd200db22b39e81beaa7196f5f
fa5d44ff10183a88cd9a9a34c683b96e4fd0e5d7f5c78393a00d43bfb3cc78ed
fbf6ffcbf53402db06015c2f9cf5de76ddf82d060ebd613c6ca57bfbf3a733c6
fc327dcf2af827c6117d1e0c5c5a3ca64c2c8e000a24cdcca3974c7394c9b4a0
fcedf70434389444d11aaeb0ad42e1039fe6a87c45eed0773d8db4802c56a0ac
fcfeb55dbdc7dab7564d0a3fc80ce5fae4ee3892622d3a0f92b631a045a815f0
fdba2d8844ade0d3bd39ca921653328326da3549463482654c624435e2d6c121
ff81730f74896a2bcdc21e75f3784ba77ff55c7609e2f0fd6af947df43fee753

Epoch 3 Payloads by Document SHA256 - All Times UTC

Creation Time	2019:12:20 12:41:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
00ab1ebcd1d58173fd34c16ffaa7c0d90d18d42fd32c7fc02712b579aff9412d
06a852431fa26a35eb48e054cbb1869ee748f631d06fbe4371c4e4ee158b6872
07519f4d0537e18fc8ff259b5caaedf93617cc90aefc91a51b8cfd75c656126d
07fe1498e7001504f1137532db2e9c412d962debc4238c708008273ac67e20a7
0a0fac8a8e06c84ab81548936455a94177f8662137904ad366497a0a1b2f8144
0e0a122d8aa3e93b0d0818e930e947a4b303b65ef981b44a2d84511e0c09eef2
0f0540d6e84c4a6236ebbbedd843430da4307d107cefcb1ba743a41c4537556e
1435f0eed8e830a12868190ece7e89a5dc11f51a89757053e599ca17674b6002
179ce61361e67b4b1fa287c3dba7cd40cfca29c60df6a168a1a7e4dc4ba002f2
1a8833f483ad592a4cd6f3f0f8b6e72d0ab7db62bd31333c1fc608ca7de0a4ec
1a9a9db05064dfcb6d5f1c699a31218fc0621c148f4638fdfdae3a9a5930f0d9
1b570cf84f2c6cf86f52d4f2bef280038f28a6420dbcbbd6051c9de17d2b0355
1d2370fd8bf271d68adf4ec40ce30c20088d8bf9f929e3c74a654551b27b9cb6
1f53b3c43a43ef79659e6cecb0dfdfe31037e5ed092ec67e6f5f9ac2cd26338a
1f7d59c10c2eb4a226ca78e86ffea05287dcc91624b357a4dc40ee65c781cc01
204cb977c47a5149e2c9b2b6c05f86de5443e9d7c70c540b26e4d61294b317e1
22ffff4b7e6abf5770aef04a5f773fa0df57ff3ca55459327bd65844694b30cf
23fc0d7b1a184775f8db74f792cb0a97977b412e13b5f1a40d2433efc0c1a514
2606bb82c89e6a37754f2f81939dd0dd591eb84b36cc8282c411b6bd1f5c04e8
269ef874c7fa04ee7e93a431982dbd82c2ee687142e381482e03ba9b86b76326
27a1e46e6142fa4b9ca85e9c8e1e1d101cf53feec46ee51de86a12fa75d5b23a
29082b108f8ba8a5ae6bc408e4a594a9f33d819959e9bf388f629ae9d3dadf55
2c46b65e08a68113d8e5218b14a44c4cda753f1ca3507e33e1da477e7d365b89
2dda5999b0ec81e1c1a24768fb784e545a9acf7ace1b00b6a2cb2b06c9faf0b0
2eb8bab0a2c7add91d99458b7857f8598db238aa77ddf0ede2aea995f7ab85e0
2f7ec2b7db36f9d9943ee75b0925e4629c98abb8c2710f85b4e454103ef0e831
3149c81bae8b8a39a0a910625bbe4305f45bcbe3f86b32fec980b55fbcbeaa36
31669304af8aa96a57e2e9da725005874f739122ccfb84fce23035d66ddc73c4
33e40933c398e2d8def824bed2e22c80facb628cdaacbc3957b2e13c88dd4006
33e558cd61a1419d30f6334648b7d0e7bf502dad3ea4fbbca3dee72dfd2ee12f
34c38d43e0762eb291cb497d18c9651c5441d1bbaab25f847c0ddc419947b3ce
35f49ef29f93cf8a27143156b26e90301b0a733d07d2c9448176b3eacbeaef17
3829b5c83774e32c15c8cf72f4c1a56942645efed53fc0edc55a67680fa2bd70
3b37964251fa576a99197df41044ce4fee2c56a507e1945c39c2dd24436b3b72
3bc5eb059312429327635ff9111a29cc004b6c8c7fabccfe06d00bfb4c179aca
3d73775c430ab45d467ac4cb15feaf688ba37910ec94057d1a4751cf31a56862
3f4cb2656e251b3047fa24b117f63608b91f3d5870ec83485b1f23f4a8ee811d
4292d06695c817ec374a7742f8bf39dcb415404e00c5b814c647fb6f8f930ad3
5177cc66d95e189b5d618fe24d57723cf8bd62323720c95d4c73fcd4d8d72a7e
52de91eb35ed225a0a6f2f037cacb860e71f5e3b3f210091998dd574506d81f7
52f21fb98ecb7889c75b77f6f44f4dc1993c8b8424d86a9aae99d425af807110
550f61c675a27c5aecc136fedeae6a8a8e98f61017f68560e37f5f676097b3bf
5553a680fce16d36e5617df7445b403ef974d97e704c10972fb277c0c4adf112
5619d1a2334942d5af6ad2e37e4dd6b5281d791ee286005f2b73fb29cf7f2a97
57197263e78ff51dd6a77d6a4fa20c36ee6be48a6127f2bdab277c2f641bfcb6
57c17c48696ecf579badbdca7d264ae4823f081498fec342f76a0b6140d2910b
5a5f41f04c1b96187fd2c9421b623b92b98a1ba80d0d7a93ae68097a02bec7fe
60cda30fb2cc32e889d0c324389c19c6dadce64b369f768283feb6ba1e6a885c
62b1a3a37e81e82ba3002001644b388ec41de954dd3a189023bc0e6d43827be9
636060c0af3ec22d236affd31fbc45e82f967cca4faec171e84545c80dbf89ac
654051b86a20e8ce90fe443154250091da45c681162c4d58098c3b71aa00fc6e
66d54fc8ac3fc473c6613d5266ee3049c9c5331e066796b55df5a28ef4989ec4
72e900957b68806b6a8c9801084df6526911e773ad9dbd2b5c445827c9896e55
755f45dd04501f50cc549e6395aac20a13a3cd4a5f54c2e887bd17a8ebed762b
7eecaf66b3c7f17e2f3333556c025cd5f00800fd9889db8435252e1e3100a4f0
7eef03190b30b6dae3b4b27fec3f255c748f054b96590e197b5aa465cb927460
80944c141a4105b3791cd5d000be2c26b99503487d733e62f0781592115c0c67
8af773b8d6bc0187ddf5f151b815f1cb3ff4d3e58b6d61bdaf17c17ca705d3ca
92c15588346c1a271a9b81738eff7979033644d3cd32108d80d407ee9a13e833
9451fd75c5e253d4197deabc5078487596a8d53f42e8bf907cbe53d598e2e089
98836132e77859ebda39c931d194875e25a24af6ecc148d037219383b27aa0a8
9932fc50552bc930b00a19677c4584461890dd39602c026b767de07ac78c3e8d
9cda72f7ed8b3376d642c3058f937e1b4a34ddb9b565208851a1ab560349406f
9ddf236403fff34e76058e8af882dd7d1586fec1a7ab4fa5cacb6bd23a796890
a1263a88db377896d7f63c0a3c15d44ed1e0b6fd08c36baf4075bc247a086246
a214bd8b2b6fec4dc1c81e025d893701de68741aaaaece9bddf6456653a5d431
a26f7c5765a5bcee77c906126e8447f86c9052def2bde3a3186f6aaa79f9e261
a311751d082bd47970adeb5044e4d4602a6c1d4b41fa5828338ca741e46b2af8
a388086296dde015951ca11dd3c93d573081c6223c7e6846f3f0d589332e4bbd
a53cfd0f738771cf533e6e06910d0a1cdced9e98cd1b9268df64b097b12a850c
aa5dd888e705275c637ccbdb974ec8299eda718438a98b5e5885eb33dfc7ca74
aac47e0b1bfed806be29c04f6762058cd7bfccc6f21d199983ed0f1a8ca3f003
b07d05ead023a2a0eb0c81999cc72fc0da3c0a48a3a87dd1d58e9cfab34715c2
b33f3b061b0dffaaec4d34554c14f06d2e53e8d8c548caf4bca066572d07389e
b3ceee03d4ee11fdd83a04a32ea64011f1d8a844ed52ba15aede14fee7e17a08
b554687e67437c34ba161bf732d8c04112d581e589a111f9a45772172f3e4f1d
b5bf2820d0fa01a690b36a01970707b7bba49eb7945bb34fb9a80d55e372f0a3
be1f08a1c7c789924a1516a8b431dad11d5dee05b4afd9044610c42ddbe444eb
c076c37c69800f8fb863f0e89197f609b4996a8fcd99fc65d3fd18656dedc6bc
c5e754b236930122c0b6f1d86a993b5249e83b90ed5db2ccb5a1f68f24de7be0
c6cdc9917e62313415a14d953cac0f81cd70ca8843ca2bd16be5eebb6bc7ffd8
ce316365cee23d35802aeaa948e09a3011f9b8a18761d89720ad1765636c5b27
d073cf5e554cb99230689d5aaed35e8245665481e0f2460028a172e7797665f0
d16ee5e6a801ea10cc27c7479ff07817082f40b992d08f0c1ac4c85d7116c409
d410863a1c8b16374692ceb69b9ff2c57edcb727721b0fd50ad5e8a241c7ce79
d7cb6947ae3bdd999ce53ecb9e04eb3a73b60e2a98be844432e41125a2f10c70
d8a7db205ed3a29674b0a34a4b3b78401f567b4c316e9ff6794117d4a7333b76
d99ceb1ecafd7f976d8b24cf554b53a43317ec7a6d0e33bf58787909016ddd9d
db8e444c711cef67b19c3c153ae825882c400ee7e7fc1c3aed6412d701e62bb3
dbe7e206ca28886935a0a81731e3f6b23de922e7b06f769cce5bd40ca35657a3
e1b5f8785b21ace524e1e95e4a719a4384c8752a2c94030ac320dbe59420e983
e1e44cee9302ffb5d528b4733e87302af34e0caa8332023865847c32fb79e5e6
e57a9ee60ab8ac96df928764dbb3da85195a8a817e5bcecc2cbc762a7841ed8f
e75cb25e9003d0337042120e69051cbf5d7ef5462ecba247eb9a0e186935fb9b
e7f4278b441fd0750846ccddd45df06e41e2686538fd47d1e07c140a0397d2b0
eb41c9929857e05dbb1c9b7c6c5461ac6bfc92c3cfec403577b2dcafb82478b3
ed40514aa7bea98a3a4c872039c5895d4019e5227a5a3ec0a6154d164d4d3dc7
efdc63039b5481ee5d68a509f4f419cd614632e6ffe0884299568f6d1ba1b366
f19e6a6fab57bb7157e808a0b892131f6c3e373286283a34f19cc5db1ab55a3c
f69194eaa1386c4d2853d95902f0bd28b25dba5c55c3d9ad2b176dec32c3a01e
f9e1789db09137a02fb7a7db2aa6630a95cd646b9110c78b3215b3d531b215a5
fb379cc828acc3bda0c4b20c24ab861c15cba2f4ab93da3e24653de269fc2c8c

http://dejavugroup.com/wp-content/JTjHLbr/
http://dev7.developmentviewer.com/wp-admin/SYSQOx/
http://krishna-graphics.com/wp-admin/11x12xd-nobh27two-82927918/
http://laboratoriosanfrancisco1988.com/9rlkyc/Ccvvezsv/
http://lanyuewp.com/electrician/ig9eu0g-4q1oml1qc1-749166/


Creation Time	2019:12:20 09:02:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
06528a99d7186f739256dd0b50e95e1e076fab52cda19718508f384271fcc33a
0a00d368fc89554b51b167f4edfb7a054c9294b5e3dfc5d608f2fcf766520d3f
107e669503d1f7514638cf2d6add616b4377d13ebc16b02b61e5fe2bdabbe988
1463e3e910bc9ac144cc9deb3571595ebc7b16ffc15636c0c0b5ba597c4a51eb
14bf4c4d896c5b6ebbabc3d601a882c5d2193e674c52e9750e764aa22739bc77
17c1bbe26f48ab66ff2455297d1014e6b1265e43c4f866063f32535a7c5f5c1e
1a988807c7c2cd575d18494d45d0f6accc4ab0be8c08a7cea9c638c1f91f86e9
1d44b91c06983f23c51e472364a815973280b5405f9e670f7dcdacda0247a24d
268f466c9b95ea119d91a254f9bda4d68db47ff10eb9119f835ebee9acb708dc
2b6698990815778fdc7ed964a0bc80b12b25fd22ff10b9e29106884bd412d244
2d5d618a2c675b00b6b52b5ceef44c1bd7d96266f60897c7277e3b56c091b243
35e0689792fa71327d91e93737a1129db616713c26f8abb798d53d1089e37770
398ddadc7554b5153738eca91cc084c52ca5fc929cb3ade034acaa182144de48
399ac95126d48ea568231bdb8689b6541018a983a10cb2336a96505808432fe2
39cf3c74fdf870bd0afd8daf31619e1b5db39dd50b261682aecf02d38c1f8aed
3d25299900ededce7b537be5824c0b30d978538574aa1e1ac78e14731a74b531
44545c77f93410052c629d3c818563d53d087cbf84f61ad5efc728a2df2aa2d7
44593b292428f5ae3332e4491c7c141aff48b3fca843a761c71c564d8ae2ac49
465dcf54b46b2a4db2a78128058c98e0fe5eb054e4c459f35754cba3480b4885
48147777395cc13c41e810369f03f8e9c7f529ff0b3e84bd132fea4e5bd7f693
485467b3b243e6843b16706a91d26db749f6203a37439a3b61ff24ee709e181c
4b9ec1a8f69d241841eae2512560a731487a302948ece756fd0c973a35a87879
4fbdc05906bcd987ac4c11cb94b360fec824b26560ee07a847f7cee086b6c80f
5aa7d04fb1d030d5920f2006e1c306b27e4261bc5af8de391ec826a71f297545
5cc0eaabdd29a7eddb262a865219a3424dfe32d51f501adeb77dcb337316490d
5fc189f7fff2be236c9191c04f50ef61b93ba8fdd072bca80bc81bf5a4b61f41
6399888d99d83ea2db8ad8b3ba3a33ae1027b80ee69a2c22d403cd6bfbbb78ef
70b252cc8302c5d03f9479253c382b3e7d383743c4ac1ca94f2efc2db1802d44
74583072c8217b90855dbcf43f8090badefd149a6fb267fc0b8d0ca5abe02a5e
789788c69529d560f0a775aefdf86e0edd47a18d7c6fa8159a3f2fc2ef0c9682
7983e0dbc78c7c66420d2b306055fb85863d69c67ce9ab328305b550293db28a
7dd3c3c20cd658bf0da89b0616b4ac28b55146aaeb697399d91ea78d55322360
7f870340ef605415edffe7061618e81dd223d18cf6538a410159aec520a09ce7
8138ad5ba625975fafbfb48174a5dfb8915d6631a9201b43c426ee7b0a78b543
851b896a27a840ed2aefd9b109e320f08fe2077f47fe545aa9f6894cee342bd8
8af5902f477f36e67843828eb9ec1191d170cb328af41f49e50ffbfe609ff1f1
8b9681ce2e1c66dc988ab650cbd61b4b9a7185b742d024f2b249a360f9ac83a6
8f5ac97c3c96d33e683759ec26506cb10d67d2443ed150d1cee03001e8223bf1
9731eac0c01bfc9b74a193a2102b906ab6611df0d2173bfa1f2ba65eef8bd039
9811467aa35dc2a5ebad0fd4e236163befc62f1be379a19fcaef7bab1ffc1854
a16938c1f88a9e58ba103425597a33a4e9d5e162caf009bee130b73d04580bd9
aaee185ae36cbdca44e0ca7c058bff14083cef534afa3116704e44892db8ac08
b02a21698186dbaa4ac3b200078093955f6c15300d5e39fe6e4035d2cd4b337b
b41fcfdc51c53c5ea8baa7e95a5056fdb7d789ec471112ea7f14c5cafec17b6a
b8aeb958388b6825a5d7fadc0052cede33574d7a2766a3ef9137a72c3d5cb03b
bd632430370c7fd99aaa393e010a0dd980c23e1ce1f191671e4f3e07683ce2dd
bf01172cddf77c0603bacf6e680d1cab2079dc3286de51c482be408c20c236a8
c15edb4ffd30d704a93d7c76e7602e8512c83dc6c9a01517bd60c867b67ec54b
ca5121806c77a61f1cfe59b5199044764010ef47aa90da999a2ffcde94dad26d
cde421191c341f23d4032384aec511b484c2fed15bb4ec19e62eed83d9001048
d09a37f34002549721f231bc6f1198c7595c31a586827c5d876d2701973c54ca
d95a38184dc7e82cb222abe2b326fd1cf552a02aff36b9b9dffef03961042e8c
df788b1313133ebab307e690a82d22036ae075b2acdc2e9cc023772cf141518e
dfe608c3d61d33094988f75358f0c98daeb35746e5be140e211c7a2483a70e42
e38b6ba13e6ebc06ee7c2eacda30677cf2720f0729d1c87ecf480c137c7efd04
e4479af00bb04d755893abd74278c76e07aa93d6bddfdecef7ae88f2b2891343
e74bda7a8d6db54eb8c35eaa8692d3b860790446a8cc9d7df51e942e7c7e93bd
e816d6a44dc6b57bebb10eca47a544755846910943ea70c86e6b49fe509cf7cb
e904f8a90b731d6f16fc45e6fb996d047ed74b5f8a5c51ee90e8a049b4b9d85e
eca3e80fda51441e743e9a5fa6107721fde3990e64719829a843e0df04dd6e74
eda3d8fc7385b9e02c996cc54836b47dd9674db4794d580d765afad139265c40
f21a7675fc2098f0745981ec38059463f6293be110d843dfa673a50aafc77b4e
f3268a9726aeb77441d3a039110ebd7d07825a184770f3348b5488b3a300a57d
f4ac0e0552d90a1e6122a9699d880b13f1bc64ae0752eefdbbbdc08c7cb8f33c
f4bbbc4da5a28f015bb779c44f4387bbd0f6fd0b67104e4e3c043fc9d1de03a7
f8051e4809252562e60a419ed1ac6c8d8e1f9c40e95223725c4fb8b0a8795ee6
faae7a4c2dfe2f3430852b7bb6036caf95c37b74bdec40ca7e477090ec0971b2
fc653d3610ceb9b3e745abf2d8f54180326c210522b62f034b176864359ffdcc
fd5086991e607d2c65fed72f0db750e8f1b84bae87e4541ddc118d10dd0e1eb2
ff597c0d75b1c96912c7b7289381a694911ed692d023b7670fcc3a276d8554a1

http://joaoleobarbieri.adv.br/test/l4d6638v6l-fotnu5m-867027278/
http://kaplanforklift.com/web_map/PmTuIEQ/
http://londontravel.com.ar/brc/HsGpuPR/
https://leavenworthrental.com/calendar/aoo-ue7-653740/
http://lareserva.com.py/aloja/AOISroJmq/


Creation Time	2019:12:20 06:23:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:
099b7d071d813f2dafb4db94986a221236234d480f92c8c3a6068eed376911f8
0a774ece2bc30cf714e093dab11553264e33c696ae36fb4f659fba380cbee41c
0b1f9f9610f3a06c683bacd880fdaa7cd5c8712f03f65788f48edfc09a5b9cd1
0bc791521022bc7957fe775f115b75e3dc7ccead5d1d67c29cd48ec45e265873
117f185373382495d2866bb7fc7cd5c96fe2ec86b512690b97e354ca1ebb02af
22934cf44a8df922f2e77cf42a4840c200c56f2811c5b652037f6c6241637e2d
22d3139492334fbafe83e0513dbecbb551fa79c06d329e9ac0c249ebee4aec73
28379c1b789323a6e7d6a19f611a45c6e4f63bac9d7f6eb48a4c9590e633b9fd
296d1d72d38b812cc02fa5cb484de34c482e04e19e378f687e3398d2a7dd1e36
31c014127b39edede3f8a0ac4d582ba8c61633579ab3e1c2fb0e858850761376
33d04ba1854b6f84959ee79bae331d0ae8a9d2066aa5a742f393446584a52a39
3ccdb98da6617af6ebc7452308e23e56c9bf61e0063b9d4d3cca26ac3c4e6728
3de294f63e72e9f17536a191c571e26dc7d8a238ec1d01bb4c30b54264eae017
451c79ad390676ff7128c7d267950279b840299181628b4dba6cac82a0ca8c25
4903616001af26a0df8c09fbf94cf5f5b8d76402d42379246df3b7524764d663
50792485c2d0c2f68e8ef162294da66a7993939bedb50cea44038134088a1214
51c1db80e21059cffa913be9036be7f2fcced009dac34d429d308064659669e2
5216672630558b920b8e599b7e33cb35d958831155452a805aa706e6631eb42c
5b02790982538cfd84a24b903e397984ed8a8c0cdf43e416a2ee211600f669ca
5e702313d38bd5a62546a10895bc3204bd417614e37da922304d1dc378b17bcd
69bb590a6eec0246d71df6e78a05f9e80d93b834fc2e9989cc1a5604093ef1c0
7614d7e747f447ffb1c3c4f455d2e73f2fe2ff7c88e6b1fd91c3d7a68d4c04de
78366911e456e938d5bf8b5caff69b0a6dba51dc4607548ee256698f0a923e55
7d4853fe09924695a8da553c11d9157d7921a6a664d75074a2279269fb79dc0a
82ae2cfcce345cdf1604b06320131de90ff62d5956d49649e9ddf7ea0dc0d12a
84a60c506e3e825ed001acf617e368200778c8c78007269248e094affe706e0f
87d379ea1aab06a8356dc754432545172dab1857955910c7919e18b2dec41f81
8e6e1845b87676c69b6f2b41ae820b16ed738fcc5bc8f19db5f1e5c004c31862
9b1bf89fd6156d8166744fafb7277c980bce5b6ed2e56c4a88ac2c8eb797908b
9fdb347705bc32172dd97c0efe6f868317d3f89ca4912cb7ce9b9f7336293b23
a446bfea720c57040b64b14e3bcbbf72f6ec49363586696cc41dba1c493306a9
a73406203aaf6bc290a39b420f2349da44cfab850b0c640745980ad3adf6f78e
a88444aec38505b4814aa0f6e11b353bea0e8e48f3de7bed306f875796d3d450
aaec5d2a8e8b2d53aec483d999a8b839af055bca333e1d503dfef3d36b224c93
abe44a2003fc291e1cee90df069608d0d10d6cb244507d185f8cb0b8788f52f4
b95acbf174a1bc1c71f28bc1d5100fd7467a3151d9e8b8fb12b9e154543ddbe8
bfe21a19247448e9a2f3a84daaf4512752578a795e3175701a19dd22dff435cb
d27a7af5166128c333a2f7754ffd148d808a47bd9a6286e504ffa2f290056c54
d55620b439df9f5960c2186b9c4916bb1f31bdb55b0acec9e3bb43e8809cce8b
d5ba68a5f2738d97ee6a396858e46c9161903ccbbe026cbec30e786f7f5908ba
d9c6b18206aa4c41b450a82dc36bf82273bf0076e1c8a9b736bf0ebb62374095
decd6c8d084b090490f5420c5ecfebd1ef75d098b3b7c9a6f6e2fc7c3606af81
e156d8bd8a32384ee8629d5cc06e510ead107771a37246a32e1ba4ea09421080
e25de8ed78c285b77346953cdc416020f6d8daa5df6acdb9e63c529677dd112c
e6337238381737c20ce79d869217f5dd68ea55a3a9846f29b642bc35333d7028
e66aa2004bce1383d67b550e3183920fb30411ba5196fd33289908bd015ed6cb
e763e726918c699fd8ba9e1109dc69f0896642337662d2546c75ae4e2647f8e5
ed0aceae2a018650d51c390ed9e8a4b36885227b3e53d4e31fa432d088f23703
f18bc76a2ee51dce1994d87c9a8e9b7fb51ea9360b83e06c81cead2ec43362b2
f62f8ee01e3b11434f6b52e2f7e6f950125b30347ef13f7f1b21a028287006f1
fcc64ffb755f98dd19a2f2426f800145ed27ec1d7285854428714a2f1daa5a9b
fdf58f06bacd4ebc04acc8545b241653626020d7d9bcc736b141d6a31a2767f8
ff0decf43039305eed1f34fc4da40c4155ce744148b60883a3119c446a2bfe3a

http://www.wangjy1211.xyz/wp-includes/bmzb-f0vjim4w-5277909/
https://www.compelconsultancy.com/2ic0/lNeMPamsg/
http://www.acgvideo.co/cache/rzvKsqUX/
http://www.smdelectro.com/alfacgiapi/fkq-lke7btj-80091/
https://www.air-pegasus.com/sips/ADcnKLXD/


Creation Time	2019:12:19 18:24:00		(URL/Attachment - Doc based - Office365 Orange)
SHA256:

https://fanitv.com/sandbox/oQmLZD/
https://4vetcbd.com/cgi-bin/CqCjQxYqx/
http://bicheru-cycling.ro/bbr/IEScmzh/
http://lesdebatsdecouzon.org/lddc/7wpe2-kckbz4za-25568/
http://zlatebenz.mk/wp-content/6nlkz6y-lmfk-9136296721/

Epoch 3 Payload URLs From Unknown Document

none

SHA256s for Epoch 3 Payload EXEs

005bb724c291b7b15a14394bf5073b738ec8072c77955dfbe9008bfc235d6045
02353005b809273859df35a3099532aa9fc873e32f733164e6135f5d7bad7eca
0265515a6b59b366ffb6cbba9e3df328b86ae381790e3d72db796c9569adee0b
0559d9de46af0c0d19c216f866b8e3bb5f44f1c34eefdb4f1e2bead8a572cd6c
07c70802cf4648fe50ab97c6b251f5cc3d1b5e45438c2dcaab4b2ede60e4e2f1
08d2fdb083fdfa7a550fc381a0ec8808984a7ccd2922e0d8c387474b85dfbd3f
08dae72e1c8906bef39232c1ac933bec51b60a165c9bb025f55fbbccc49f0632
09782554c077d96cc5cbf43bec82848fdfc085832c1432a487454c0cdccf10b1
0b1bbfa394c97742f9759ee20c9d8cd69edb5cc2b73a6d694764fc2a621c3d7a
0c03adc71b638aa21a43261de27f3e2c7964e1fa4c46c376ac0bd57d747ad8e2
0c0f673535c0d7586cf9d68f4b3984290ad2b8942df71c6e693a176566a1ea88
0c3fb6753aeb7196d576f2a82d0d00416ec59de2842865c5434e8c4ed8264b76
0cf4cb7d3f6babc587ebf21650b99bf4c1ccc5d4677125ffd8ec233a26e011c1
0e020424041bf016af5c3d38990237c00e6e6a43f3b073be06463622bb29f0a2
0e83a919877089369b08c41ccd4a5debdfd24e97a10880d7a142f9baad8029bc
0efd4b89460365e4932dfea65c647f275a287a255e9023585aebc21ccb9028c8
0f1b80f99489e684082d17e2d61fdd8e9013e2528ff4fba768634a85055b02df
0f875202a206b63dc603d9117b467e6c401fa20c5001503d3885154fbf260cee
124e896ceecd693fe99f72da9ddf81a1ca96509ef5db1816eddcdf0f27d552a4
12dc2cae5455e5b2398508b4aed4da1f921a2e163ef37163383110cd39dc4329
13006f23fb911ead67ee4ee8a9f4620d85f2ebc9c2d65a627300af046d57791a
13d9256aa70f9bb236deaf75459d00438b0bbafd5513911a42b81b78f7fb20b2
148df521dec5dd660fe9bffcb2083aa5d367ca98dd54e1385953540d21f00fb9
14e8355f92dfdf51dad6fc944e2de21b268c2d27e79d516bc070a0ca2c7b91ab
15a5be99c23257ab8c48b845f11391320909f87bbc9ffb150fb63d7be3f010c0
1802a5c59e14948c1d1d543f2bfc04a0d1fbbd7bb3249658c076eaa47287f4e7
1927148514e4d5e8039031581919ff8bde7183170d10a673f47e5b713ac8774b
19548d62781b2bf59e5b38ce9ea97280273054e13edb0b8c458ed43117e4aef2
1acca1b283fb3e2d1270377018501ca43f1bd7c3d1edb4a24c89584c59298b7b
1b3a44b9b6c6290e6424c3fadb3595e2eecc21f3abe8c42075cabf35db7808de
1b4362015e6211218a85c7f42f8c0e0f5bf46d17fbefe179ec6f22172a44da16
1b6baacf28dbebfa5dbba10549b244ac3eb213898e0717fa77b973000a627d21
1ba48d1c831a6d6e1b734e0ab735cf35761ad2a90b8c98c0d8b8807f592add23
1c37c132dab307eacbe2775da6af148a8363099c4578a1bdf285fa09ec5ecaf5
1d80f11cdb5bf6b8e08a2eb957a1bb7d409660c8fcf6293f373b919cfcdbc792
1e0d160977b1f42ffd3353ab6867a475e6d3b6b9cfc921f484355fe33a5fda11
1f90a167795e4a1bf748f7b4fd0764a4f2ec4eceaa5fb0287b34eefbabb3c358
1fe9255bab8b718dcbf832be93cc321b8fd0cc432209a233b9cec6134a3869a8
20522763d2f9057a0bafaef770f8ffa7851aa9fc4608cbdf3732d7052c4cda1a
20fd737b012d337961f5ff550a1ef515bc724b712f4f8b92484e75a25cfbbe03
216192de6ea76847f5e97e47351c46de324e44f35b5521dbe85b63b1c5cec72e
21c2eea9a9dbf729111abd40f8f4996543f035a811c4603ba9c7852090b5c14d
222d90c78c3ecdf4bb55bbe9058005bfc34e107ba576fcd568b5f1c0d9cc4b20
223bceb0c326496653993e4780f8dfd16181b8076b0a67effcb3e07ae999e9c3
2342d2d7af9ecf90c62f4ffbcf1bf61f90c3effe4956025d53958e83582bd69c
240abc61a83ffdc1232a36c7e2c3d1d20a58155588e908f4cfc0c3d05a48f8c9
252ae34958f263f2a8ee50d5b51955c133b270c043823e5b31b5be4c4537979a
26543ec305790786ecdd5e41dbaacfedd2381f599369d79efda967d2fc5759eb
26f27287f142cab2d2c00d1d6efa37653b393ae50b0d327e32ee950abe85458b
27615e9b26b403b5316c9075c23f42f94449bf23c53633b8aad06dcae16bad83
29cd4838ff9e0e0141222e21240dfa508edabc72a9aa14b973627e6853459a30
29d9d3107e2a23b2d33202e029db3d49f4194222467ec3218ce06bd6fed17196
2b4038f9ba9d29411690d71bd967df6654d1da40249d669d4a389f648835c1fe
2c4831a8e6ecc169c7097b6e8852e0e4135eeddd581b27b6631a96a031eb21ef
2ceecf2015f6fef8faadfec3d724082bace78a4a56af204b959cd8ad05d26331
2dedb0760cf3e1a58da6d2a50e5ee19e987d7501dfc3374d3d8610a17cba5603
2f2b6047b4abbeebbaaee7b8d4ddfb242aaba61d9c4f3c8bce0f7c2c7ddab8eb
33bf58c1716cc8c6086ef0ac532b3b76c2d06415f410fe2c0b2a0824d32291a3
33c7a12513eaf2a7ac6e0e116d0e5cd0316d41dc27476f8459325dda54f310c7
354ffb5bc69d991794d842d59146995f60fe3a2ac0f31ea66d4bf35d60b609c7
35e969f2ac46555e5ccc5ff13d5b94405ad81be35d69a421b2f870889fe3facc
36012aa91fda368ba85650c979941e394ec7bfbfbd68b8309b04ede13766b627
3731481566008d76b12d47515248508367b239e7c899c5cbe406641db03990c0
384797d5da45ad6c8737e266c47034f99ee1bd89a9be664287eed27b1eb5add7
399b460b2fa67382130a4c2e6db412b532aefa2e1fc30035e527bd7cdf9bf92b
39ac4062264c02bbd31886f6de8dd0ae1d17f2e809b909cfd247e8844a344305
3a28da0ae880d245815b3c56945cbcd72d328f398e6b63c1515be639a5ab7757
3a5db1736e92f97ae93eddc5ffbdd419b162bf4a3f9af46964dcec988de6d9d3
3ab614251fda77668a516f5f84a9624549f9b259a72be4cc0139e01f6074df9c
3b90fb025fd50e834b3be82e28d5af48a672fceecaca03990f9a75aaf711e280
3cbe9c2ad72e4939c127186841ddabc5fb5b02e129923b2c77120fdf381d4845
3d35b877cdb6183fb29fd705145c707c9bf3f8ef7971775322679398413f9c2e
3e7b56f1b7fffb6824dd7229a0b0a373d5be07d0617a94fc0ac56c70f82b4d80
3f75e1fb5461616acced561ae95168167461f30abeb93d88f47175ce3b091077
40ab9c317d5e08eb42753aeb8578c2c766935147aea85d3ea32e290d5398f2c2
41997ff73d5a691d0d1e5d6818ec799e17ef4166d53b630540dd45db05e605a4
41abff132003bf3a61a16fd56869480627146073f7a751e586a51ab5deeeb7b1
41e565472f62401138c7a0b69d36087c52f7f7e445c3629f67c53d988f304810
42111f5218e34cf27b6cd384f885ceeb8bf265afacf97f81e23a1491df5a7810
42a7b675a49fe255facc5e6facdc0b59dfc8ab2edf6baacf2bf4a70207a9f2cc
42a878e1d737397e3ee19b2b0b916e2dcb6f5a058953c935c3d63b098ea34819
43213548e3583d5b4b34b449b5604e18cefb67e1e4e7082c04e22d28b99f5cb0
43e251650643870021b9bef8334f7883d42338fbffcaa17a1c91ba43b244748e
44564ab0aab0de9461794249617766bc4e21799ec95e2cec4b4d235effd18f7a
455a943514e487cfa6df55d9c0307fcc2cf1532891ec97f4309e3525cb8392de
46cc87d7fee43ccece8fd1440143a31bf8910f6df3ea228dcaf7b78406ab01aa
4801332c615ec02b0588accd6281da2c650fe13b0e703d6907c6998265c6b46a
48ad03bd2a51b8e44d54cfb2deb7ee498e3e2256f556cfd51e78bab5d7f1db04
4a2ec7f915c9c3c1489b133bc0dfc5b4d0bb18f16990ecc81364799b1100c78b
4c4eea6aee0ddb1e271591652f1937ccb8d326af0913bfb6508141d0e0f61dd1
4caedeb0c33d45ef4ed99d82c4a91a147112b3b932a4335f1c9a434c53531474
4ea64b3023e58a10974a3d32bb9468f18be163989d41adf391223a5c6e377f70
4f5de28973fe5858cda1894f77608fbb22908b9b1f7596feff69a49c092d97ea
4fcd5cc1dc6e4f6b79f2581c4875326a6fd04ee464becf86f6d1a15925f4c038
504950d731ce4b39790c27d063c3b9c6c883af4760741898c42d0819e2236fe6
51bc651d1f9cc114d999f0bf873e5fbc32eabb0403bf0d9dd1a79c47961f0ba2
51d094190948023bd27b99c79105924277446f48f45a8518c460c97615022b48
526e7a40f5ac6b084b2f4ebadc53cd90ad8291f10c2f3c8472c56a641ca5d4e7
53560267b01940822748558e2af0d7d1f6770ef0af5339f1288000059c26c9c2
53b3aa6225cae646b20676164e99c86a9a26c098f5d9f551b4d23c9ceb55bbd2
5645049ebf8ddfdcf465957d81a9e7b23078cee53971f16e5a364828d8497742
57e8d92bc980a013c1b51c2f4108e895dcc7ea8041f6a1d42bda35738e70b126
58284c32471d30c3e149cd8d951ec21a40f01f118db9d9093c43268b7475b8a6
588d0827363f1385a132275ca52189c6d4c23ab5c49f6a31981d11b3103f840d
5c035d69bb778a61d6d13d77e9027d183460ac9c71c536cf157243615def2305
5c11dce84a9afdc3d6485c99821efedad6995bb46d288a157763467b118363c5
5e264946e1c40073e0bcf95f13de2304b43a1b4f1499da98eec97cddf276d999
5e4ab9988e41bcfb64dfc9d8641856a2a5d7e15be1f6e5f082f1f31ce51f3554
5ea28caea318cdb477039236cf2b503e6ce607eb79c80b8a40cb21af7c6c6301
5eb707b12f6c3e5422b0b5648ccaf473f82e82050b731e10260bb563f6d9ef9a
5f9e3555b9c9523d67f7a05b2d28dca40af0509323659da2cc98aa8f361ac4cb
5fd820d25ea67da37fd3f5341f8d5dccc345c1baf3c42aad186aae3dca032e6f
60589622f7e7a37eea9edabf6a251b2781727843c318f9cbbceaea0186eedf06
60933d4208915d623faa567d898d60b70462e1fd2c9dd9fc683ec102d70b3a18
63c8fc9f7c8305718726ad2039ec3ee07b6a39d7edd8a113b7bef24bc2b673b8
665771a1d97461cb233754b3e9c2d5a6bc557878fe833cd8f627a679b8932f0a
670f6cb7bfa06aabb84dc5aeaa3f20eb9c953036590ead0959ebb0c6445fe084
675fcaf2c688944e2d5ac94c93b4beb7d97e91ca3eb7f16ddce399cd63ec91ed
67d7da1aa456cd86b935c2af08733f196dcde12c40c2ae8b379059e1a5e0fd7a
6843727945e6e5f843180d332605f49acec3b5e6bb8b6cd082dd7ea1de64e3cb
687e6bf1e8188c404ae992f94159add19237b4838cf51c8fb0b2a208d617bb7a
695ca25c0ec385e0ff83ad318bb7ced4840a860d82ffaece8e0e077c65ca2a68
6977d890bb83a694aeef578402b3ff069b2ae408598b1ba932430ef4b7aca86b
69b4ea9261b45d39d4b95b41f853b527ff65155f74c57877f147116bc8f4fce3
69da4bdb5b27dc99477d2e45fa46944e18a8c60a91e3cc68881654f61af0c548
6b4ff8b315294d1256509d91e1722130322572728455011ebb02c80bdfe2ead4
6db084844483cfb95db5a1a4823b02add35c00aaa66fcba3907034d4c02c31cc
6e05a16e8c4e5e21a8dc0cd6521baac81a1dfd5d6bd0ff48a444eb48a79638d5
6e6b429dc5aefff3d9ff85bb38bcd4e2576a967d02bb8f2be7088f2578e46078
6e913c3fb9dfd85145f1356ae36a9ed4d6e35fb45a6e28549e1442cb60b2fdd6
6efc972c5806c5868e7805d7644fd42451d27d206a15777de914a98ece486f34
6f2a59dbe326237beb3a8207d510c50ff8a7bf87e6fb643920aa092808215779
6f5dd264d64b33e66a4569ce3b8856c49aedd3c938a7a2e4d12a69804cd31a7e
716df2fb8ac7e0f184242e8dc9552bd01a87425e06a2ac8ff116e872ca8d8524
7302f37493860c01c12cece475efa0d04d1b1d106888c9f5fa0c0df2e5dde4c0
74c677cab005170b34c3104c93bbc219daef854c2ee737ddc1a127172c04ec2a
75857ebb4774b5f8d4ea35795faf32e0046d1c5713f861c5654ffb91cffe890d
760fda56b8ff074f8cbe330c13f852c668d623017ab7880e50fe0359de9008a6
7741466994e45a3b51f42a54d998d637adecfd72c1aee256d8840d66017582c6
781d6c5ae7a9d73fa9ff148b83b5c72fa3771920de02b9cdbb8ef83b20a46d60
787f7c67829637a06ce057838823cf1f041c2532124fcab0dd76db5e8c6399f7
79a9762619b6da494b1b3009c0c748305c5588d5d68ad702d4cd8138e483cb6a
79ca9694257b8583ec4a153eb086b8caaa11bf1b6c9c2e3f847e5f9c3f9a9289
7bd1d94a297b0d5d792f46cf2a9030d8650a2e7c360d81858dc44d8738492656
7c424c11df0b2ef6c4810903b2b3185811e339d9609be621aff6d6a6fb449e08
7d86d810e63c1489d53035fe7c5efdbcb689f70b856314136c611d9f46b467c4
7f77bea9e35918c1567d1dac3babf27929d89fff7c7f52ab87c93d40b7f1adaa
80033b8426ef6196180135fc47991a185b60b76eff0c3b92c75040ac3ffed2df
811ead221a8a81a3324ae30d8072149fa5c3701ba9221f7df00b8303fec73f2a
81cc4024e161bdd707da65e8289375ff780c2f92c0012c19ae6829d24032b0ef
820a1740ac373e7686f23170f5c2241e0b4597ba17db2cbbd978fa6d892ba6c2
82a5edefff1d9a1b31e22a7b8d32ced553f7b2ff8a89fb7735b62f48da9b49b7
8327c7306c28b0eed5601ca347aaa847ae25e7a6dd3f271f54c49c8165227768
852dfaae2853ef766e7bdd3c5e99db4abb5d582cad70bf773bb9ea875f35bf0c
8583c5fadf183183e6b330655e3baa6a535ad6a7b66d46251748358fa1e67768
878b4679c3a332984750c46c984173c050108e4061800348bdd182e749870d31
885ec612e764892162a75138d2b18dfbb45c1bd55b6d50534f31d43f64f77d56
8924f0ca96eeb279cb06241e6a4f398773e8d32d2bf729b07122f4929c0304c2
89a9e41d46324651608ac8125ea1b93d3ee82df05135e16123c1263ad5845400
8b8307e4fd715cd0c3fd32b07a1b480ec277aead9c14dac72fc9bc2bdcdf907d
8c8bea2bf8d3c81bf885464b0e945a9de46386c054eb5b9db1368bce37e997c4
8ead979807aab7ee4e2d06e2c0c811aed54f0725d50ca0994ab10f8dc2e80d23
8f0618ba450adb1ff0c3959ddf48d683655a558b10c97aaf094315885c94a62a
8f665f5656d2b8b5499bc433955ce81c48fcbec60446909a9361ae28cde65842
8f881504304ba2372e343f2d905c9f18cf700d9b71bc91738438cc54d6189fa4
8fbffcbbc2ea8b1e1fb04027f6d308b0d90cb9c4545aa958165478711e113f8e
92083b1b8a46fd5d508d5e0dd8fd15be1096aa4eb8dbaea2f3bc012bb01e21e5
93874d92250543e283618238927f23b8063387f3c81ed0c369b4a419c135105f
938f5fb5c08a4394a8fc2b5eaa8f2183f1f9778dc1b96d14d5dfcfcdd1ca9a89
93c686fd106c8e25f68a28d2f09a77b5c9b8fd8abec61173e20376f12797deea
950d92a20caec87c966ff64f5700f60a90db789ce449cfc4f700d1158c4eb45a
9597ab0f291871ff12dc0ae2e97e53e9c1a0a24cb112f1f39806bfdc3d7041c6
96ed47286c20a24f5e65564f75cebf9beb5ad2c677ff12406b92eb2fa31f8650
97a80150b080362ee12f2a585d56bbc5b955814d1efcf27c0a2ce4f8f59fafa9
99b1c635c2cff911791de8bbb315a137ea2e90a4046bd8c93a6f6cdd559f3b1a
9a80ab49c2bc5a257224d4a19d80e532e6a7fa9e899578064defe478841f4cb6
9aa1a04b737d9a86e53b7ac729c2f142d32184d3b574bee0ed90a996eeb22111
9aa6fa9726bf5d248114d2271fd3d877a916b132d4130e8cbf4fae5cb8606caa
9afbb163d959fda38b5759ada8dc1e3c50cead8f03a9de0f3c3a78549526bb42
9b959fc4a4532b8d9ebc86ea6933be7e20931abb5bd8d1cb19d42bd8fc4f8872
9d61bab86a91dffe380ef8ebd12fa817d260de3a030221c5b482b4b8cde24dac
9e454cca185b51e66cc2083e2a8e8303116fb1d6835abb247f0ecaf35cbb5499
a018512584067e5ef1e234b5f68a0b8e903c4c915d678cb75dbbb64bf341ee93
a06ae8b1a03716d60283e6b13cf00901d70f5795ce78c005e3f32c21c702dd67
a0ededffc9ae0c51148a3e0b98c6d3a0fff237da5a6e4fe848d9edbab17c2f86
a20e201d062a773388b0a9834d3530fa1de15e479edc27659f50b0a60e5e0ee8
a22a810086281fe0146073a3e0aac1e2436aef704045c2d4fd9d6c0a5a1fe97c
a263d8ffe1fc7ab30c2830abb4e3484d04de43a866cdf51d05ca3e10e25b1744
a557692e6e80efb3863249ab223bad963d1406d5d2474ec2a958e777fbd0f8ab
a62402aa8d9c55a1c76f5721d80a5fe76c31761f7aa0f88ad16f953b95daddec
a63cc11723e6865693f338304751db8d6309742e2ed0fc441c796af70e025018
a685a784b5abaecd17ed632def60457d11b4662f445cc3eb5cc0b5aaf1131f20
a6dd1636a354eb0fc11526e275d4a6172e792b122884bad86b65a7609418d913
a721d1e2a01dd5ac659e3bea32ecb978baf3b0f96268ee6a3e26ff374ac39c03
a787e0eb0d104a306de25d3aad34273249538e01bcf6498ba2925a89905e27a9
a8c167a5e6ea205a33e32cfd81b5f8412f237a515fe1a94c3bdd82d40af11636
ac15fb769a0e45dc69ae22a77461377cb46f0e44702524c8ef86e95bd2d2d22a
acef6504db3253540634977c238fd99d6e97c66c7de779850ea53dca579bf68f
acf4a673c6fb0496083edbeb07bd757e973aa99e3bcc9864e3c72673acc10501
ad562f1540d3d1a4405df4e42eaf0fd1b3428b1044e90cc1265b3eabcb333ab6
add7fff71e0b55fce26a2f99dab91aeb0b3c852b3c6831633cb6d8dad580d2a8
ae5f2ffc7941b03a02e61af0b6cf836ac16e66aef72d67f67c87fc57ec3c68df
aea971df85a4c9531530f1266fc1aca6124a0c8789631bee087e92a322ac7f39
afa2607cea5a05b5f9ff0c23bb9c096228d8c143a07c8b2172a71250e9340e9f
afa61dbe61dfdad8d1db5019b9c03cbd964f2019476f23297e878a1f74da968a
afc77d856d2662bd70a524fcaedc6dfd1e05dc809a2f8a5ebc27b96bec7b3a83
b19ab45c36c66cc859d5736d5d499545ec2558726188b122c5eb20ea213ce76d
b273b6f9cea90a7145ea65e7908eb27fdbd89291289b13a3a3567eeddced8766
b2b4eaac058d08e568cb5590dab3948ec6c71909c030b58402ff5f4f38e8e932
b390e81cf810d892c07de94c4ce349833c10106270fafddebd1a254f242bf9fe
b39848aa285e924c6d19e8fa5c81a6e9bc0e3faf2962a5ae7e26d96fc5e651e2
b3cd8046abd0ce1aa3c43098f99ce65552ebb13768c591625f133e9e34bfdde2
b56ddc57d0a88dade6f163dcf8eeb8f702be7c0bc9de4feb22f5e1ca09b870ab
b69d6e5e2dab7bbfa41ebb5c68d9c6524614f5a2abe0dd13eb8f757aa5c183c2
b79babcee41cc7a8c7aa9c39fc770db3aaee2c324ba562e2203a9150e4e0e03d
b7bbf780f39ed950ec7c8a3bcebd0d5f5f5d0d7470ab068cf8229273551a9a46
b82841b78cd15c07abbe649c976757b2ec290d3cba3b130a6f6194012d55f9d3
b9139402329d24644b3c455b14fc1decb2a6263b6d8e7a5b58ffc5d23f98f374
bc99e092fa67572cbbe2960e48112ca6918217b206ebfd141dd9856dbc3b4fb2
bdced3d1eae6c7b5a940baf3fe2dbaa87de62f249ce6b152df9daedeccd41043
bec00f3c2ab8fc7f1abe575841c2ba9130e64bde3a66165682149a04d26daecb
bf1e1c5e2ae6c6176b884fc3a24863336ea81a49c33bf76bbf74ae066541c231
c05ebbefe670108e1f0e089358e07863d71675897816bbdfe6e6480c991f68c8
c101b8474f4452f8aa8f5b719856dfde87682bceeb5b105951c0721af5ce6f6d
c11392f154e6b8753ed7fba678f76255167a542ec07bf105d5f7a897016b0d8d
c13b65d1f17258c6768ca01e035704a672fa549e6fa7c068ed68f36911ba5900
c1ddf4f8a9280381c7af0bdc67c625d223b40dcaa2d1357a3de592278b1915ba
c219039227241bc74de25994b80fa466614e27ed489a1325f5690cc9daeff9ef
c2441f84ffbc362b1f330f6ef200b49611014a7565b74d3c97a1fef74dd82ed8
c2f3ae0e82b8068413e874f7488c80869dfe0b6fc01454428c65e96215839994
c4c8291f8789ba379c72907b380562d404678d141b98e312d82a5e4a961fba62
c55fdca8d525a74970538877d6470f13cfa0a7a5885024e63e9545867acd4be8
c59d9727ee3eaa3c39abfe1f8f06a8de8a8ef12e99c9bbe85ecc6e49716ee117
c63837b5e2f14ed4b3c238d3187246927865e4ce44949a1896f502516d720a9b
c6a571ba7db8819e43f1cef79926cac3049f6334122cbf2fcd4e062b1ea4cd76
c6e06bf20289fdfe0bdb78cb31e369a0f89e2abbc9f0ebc101cc48db2cb826c0
c765ff74fbd04351097e9a80d5ac142b714068af475fbd217c13744dc946264d
c79c356569c407ac23761529b32f144a5d8f1b8200b705582633131718beeffc
c8a6bb11c34c22dcd1fe58741133f8da7d831a5be3979ad0aab3ffc199c3d6b7
ca1a1e4d40ac92a3ba7a7c63ea62d8ed0d81ff1c12f2ca17f13b79fa5bb28bb1
ca44690664299ac88a5e0f9e864e94a0cde2161bbb9d52392623dfb77f692cce
cd917bcfdadb358c92eb9fd59f9b9fc7485258a1ab5a791de22a9eff0980b110
cde0efa18b7c2e9841fcc263e5f153107eadc34ecdbdcb71496f6abce52425c9
ce0889e54df1dec9cbf4e6bb2b22dd3e6c06fff707749ad5e9c9cbbaedb98af7
ce3d0de957cb391dbefb5eaa3f13fa14257ed60cbc94f7aae3e20ee2a08dbb0f
ceee9c3a057c390b89d0c4e87e005213a19a0cbf667d2be8a178d36d0e59f937
d062fec35e1845eaa377dcbe2ffecfd85e8b888330a47a359f40fe3bf8caabcd
d06a12b5e6663f2ade0a5001a3d5195efcbfcdc6ff5539ff7469f2d74e6a86fb
d17906335d3afa4a0a8453c5c6027c61110cf5ec53b375bc1b35667e4a11d64b
d182d84f9c760de1ad850cb9ad1f92fae95bca7d4f4e66124aab158d98792e74
d1d3a66d781b03b1913bc6a37907532bb405bbdfa14dccac36dce674ec1579eb
d24d745e881dc9e42f11db61b25d5f23282f6942d042cffadf435b95a40f04a2
d330b773632ee7fefffee8430d8d6d08a804df85b8fed331ba098f6fc6228b39
d34ee266f2aef62c0a9c9177f41f46c229c4ab150670958c37b0d681e5b32acf
d4a6946b1eaeb0cc538d85efc7abdc51820ed4bb2b5a9cba3665f7cc2127db88
d4df0f3cb74596b40b3f3015b3a813ab729412c59ca0a538c87decfebffc07a4
d538465900b90c6fde56f1a13e51f0a5af56e4fedd1b908b6bcb44386129a0b4
d5f2061f96ccf147e8dd68633f28c76a4bce9fa0c828fdf914e83bf8b900abe1
d712007d68b120dbc3158ad9bb4db75fbaa8e67a698ed86b10d39033c260feee
d728c4cfeefd4e72b3e7863121824148a14ed9e30c17389bdaa3fcc63813f1b4
d8188b62e3abd5d522d6559803fcfc02c09081995921baf1bc86c4719e827f11
d88d5bcb0508384ab45af6cae3a124232e45588b20a827f32cd1b41a1838ac54
da0d75aac2ae0f2b33034d03e077c5796727a6e88b0450cbbc3be1333ef8c545
dc805f1628cc9c07e26a2cd62c2a19379734ae7844ba24cf59d83ed09025eb29
dd03ce3ede312eb50f4e2fd28f9a5a8aa18ae39863025b5d55f69b1b0d1cc2a1
ddff5312733e8f7c05e7818edb82641207077605fa82b974b40f23afc1c218f9
deb15e37059a12f3ab1d26ac7b8e9fb88470c1c87ebea068b84523f9e5250d29
ded9d22c56c1cd0848fc27728899b6dbf1e204040dbc8d40c588201b7bae8d03
e038e5cd28e1c4c143fa99f569b272303643f41e277971f6d9723919c3b92bec
e0938f33f27cb0180a1dc167a5c70b41519d95b22771dd658e6ebef58e7a9700
e275fa86b56a46428460c0c8a6aff845dd0c70b5716f7f9d70c69486e06d1316
e2ecaf1e80a5a12e8dbe2f30a9a4a12f610e912e314db4624dbd5e0f321731d6
e5cef4c15aa1d0cd47957dffb8d661fab5cde4b658ae47bfc0f68e8aea08cb55
e625c53af63f592276081311c3ff961c6fa768480e2b418fe2a43486eb15c0a9
e64a432ec0ccac5f0071f7557264834c497e0bcf80c62ef25bac81710e2a9d9b
e64ed509ae0575ff7ce0e4125a5d59061deee7ff5edaaec134d43be798baf59f
e6a6bfc733412beefa2d55c2a24d685315430b5584f16d4e4e0119c5cde7c584
e73167df39dbf34e32ac586855617b0a0d8858910f700f8bbc196275e1a009d4
e77a3778fbf634dfc15935019e5b0e200fed739991f6e02bc360d5fd8ae0c289
e7bd868385e9dddd81cf4da4b022758b25b792caca312f7daf645e905a104173
e7f7c807c7b28d39ba5259f8addb1e9acaf50937857efc0f00a9ddadac51bd10
e863442f8979b5e4d20d335ad8ba06bd5ecb8627038034923c16f9771df22e50
e933894c7ea713d3cf380828e51223549c22b362c4e6864fec365fc1e7fa9e61
e9cdeb5403c623cbbebf4d90256b5a489cd8d6f6000f1d8e2a6750fd134a5e9c
ea14451a5c0a95280da5fe24a2c68fe7c95a92943d2ba36ae5ab8a00db8e2460
ea4495e3010008404fbb4c8f72de554d73e5ef2e0eff76d0d0e7870985f64e38
ec9fda9bbd98dea47368e77d73eb1fcc144648cf065c9b9dd9aa03dab2ac2ce0
eceb378072d3ae142919e41ddeabf913323b39bb477b344c3354bbd26d3e8f2b
ef8e3e71c1f6e5fa9ea7fc11f18626686d4cea59b4dff9f49cb167938fb44cea
f05648c9baa2ae1418513b66fd1de01e2e2fe62cd2f6567c63b86fe7396c9210
f19794aea8672ad5c1da9898ffebea75a1524cf426c2f3a7c4a86a641ba238fd
f33a892b7603cebbb018c6e4c9d3515bc5f1b667badb30bbf9282b15d92bc09d
f368db949af4c306df584e6ecace5cf5922a9dfa37888a7a026ec1b012ef3a13
f40827eb75161f63512951ccaaa187d3bf7c49728a9b0679ebb368af2e25f997
f4195d1203abd2f4fa0843d5401146c7b5d77be65fed26b1d3157116b057630e
f535a12010c351a00a365ae5214119dd3d9dc07d5d9a10a73d690cb79b7ebbfa
f6309123fd5cf1e202ba0af901bb93abf9d4cbafd81b50616079db3d85ed1488
f648824069591be55b91ce2919c8893a3d0faa1dfa0d8e473c819099ecbc2447
f6a075fe6316a03ac02669afce070d135ece1f86f530409e8e4436bbcfec78fa
f75af98422a22954790448bae0a93867ca8a58530db6770c72ad9477fd548b21
f8483a52877e7d835bde11ace9fb9cd0c5dc8cfe6bff2e053c889ca319afd560
fa5b07c7f23bd1d6b19623c2cf399ecec092deae192b05098efbf4daa4c2f577
fa5bd8cbec46d06c94fed4d4e2879adc25e298825e5fd9163775c5d14ca592f9
fab666cc297d37b207afaae17abc9d7e38a7cc4c8cb0c681446a1391abe5b589
ff012ec9cdf79b23c74391048d3fc021d37567cb06ad35fe2c34e3ba443c331f

C2’s Per Epoch

Epoch 1 C2s

177.180.115.224:80
177.242.21.126:80
190.210.236.139:80
144.217.117.207:8080
96.126.121.64:443
104.236.137.72:8080
85.234.143.94:8080
5.88.27.67:8080
37.187.6.63:8080
186.15.83.52:8080
201.213.32.59:80
97.81.12.153:80
178.79.163.131:8080
138.68.106.4:7080
217.199.160.224:8080
181.61.143.177:80
189.19.81.181:443
186.68.48.204:443
118.36.70.245:80
80.11.158.65:8080
68.187.160.28:443
116.48.138.115:80
190.161.180.184:80
200.123.183.137:443
159.203.204.126:8080
85.152.208.146:80
151.237.36.220:80
96.61.113.203:80
191.103.76.34:443
2.139.158.136:443
163.172.40.218:7080
83.248.141.198:80
46.101.212.195:8080
2.44.167.52:80
46.28.111.142:7080
142.93.114.137:8080
181.231.220.232:80
74.59.187.94:80
139.162.118.88:8080
93.67.154.252:443
203.25.159.3:8080
202.62.39.111:80
109.169.86.13:8080
142.127.57.63:8080
5.196.35.138:7080
37.120.185.153:443
96.38.234.10:80
83.165.78.227:80
181.198.203.45:443
2.45.112.134:80
110.170.65.146:80
112.218.134.227:80
190.146.131.105:8080
190.151.5.130:443
190.210.184.138:995
5.32.41.106:80
192.241.146.84:8080
114.109.179.60:80
68.183.190.199:8080
77.27.221.24:443
87.106.77.40:7080
91.74.175.46:80
203.130.0.69:80
91.83.93.124:7080
51.255.165.160:8080
93.148.252.90:80
212.71.237.140:8080
68.183.170.114:8080
58.171.38.26:80
79.7.114.1:80
91.205.215.57:7080
87.106.46.107:8080
14.160.93.230:80
104.131.58.132:8080
113.190.254.245:80
74.79.103.55:80
190.100.153.162:443
37.183.121.32:80
190.195.129.227:8090
190.186.164.23:80
91.204.163.19:8090
185.86.148.222:8080
69.163.33.84:8080
144.139.56.105:80
63.248.198.8:80
149.62.173.247:8080
220.255.57.31:80
62.75.160.178:8080
223.255.148.134:80
73.60.8.210:80
81.157.234.90:8080
72.29.55.174:80
91.191.206.60:443
187.188.166.192:8080
97.120.32.227:80
125.99.61.162:7080
2.42.173.240:80
113.61.76.239:80
185.160.212.3:80
165.228.195.93:80
181.10.204.106:80
45.50.177.164:80
181.36.42.205:443
200.58.83.179:80
111.125.71.22:8080
183.99.239.141:80
91.117.83.59:80
190.97.30.167:990
68.174.15.223:80
212.237.50.61:8080
200.119.11.118:443
77.55.211.77:8080
207.154.204.40:8080
175.114.178.83:443
179.159.198.70:80
212.253.82.142:443
190.6.193.152:8080
130.204.247.253:80
190.74.246.158:8080
219.75.66.103:80
62.75.143.100:7080
45.8.136.201:80
152.170.108.99:443
188.135.15.49:80
50.28.51.143:8080
93.144.226.57:80
86.42.166.147:80

Epoch 1 - Spam C2s

77.90.136.129:7080
83.169.21.32:7080
173.255.214.126:8080
111.67.12.221:7080

Epoch 1 - Stealer C2s

51.159.23.217:443
75.127.72.18:8080
190.115.18.139:8080

Current Epoch 1 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOmlscqbEIhLjVsj9r3eYacKi6C+Qrua
j5TlU+pn3zc0k06qCoahFXBBGnYMotHQc6OwfBKwHWm831LIVg29kEjT8UYxnN5v
fzNGgqXTe25QARf78CsQqqN/ImKdXo+GFwIDAQAB

Epoch 2 C2s

24.181.125.62:80
98.156.206.153:80
173.21.26.90:80
108.61.99.179:8080
165.227.156.155:443
159.69.89.130:8080
167.99.105.223:7080
5.196.74.210:8080
200.7.243.108:443
183.102.238.69:465
64.147.15.138:80
85.152.174.56:80
59.148.227.190:80
62.75.187.192:8080
174.77.190.137:8080
87.106.139.101:8080
173.247.19.238:80
2.38.99.79:80
178.210.51.222:8080
209.141.54.221:8080
91.242.138.5:443
190.147.215.53:22
186.67.208.78:8080
107.170.24.125:8080
81.0.63.86:8080
100.14.117.137:80
190.220.19.82:443
76.164.99.46:80
190.189.224.117:443
110.143.57.109:80
47.156.70.145:80
206.189.112.148:8080
217.160.182.191:8080
47.149.28.234:80
2.237.76.249:80
45.51.40.140:80
128.65.154.183:443
138.59.177.106:443
78.24.219.147:8080
87.230.19.21:8080
200.114.167.85:80
149.202.153.252:8080
82.27.181.93:80
173.91.11.142:80
66.25.34.20:80
190.162.159.212:80
176.106.183.253:8080
139.130.241.252:443
46.105.131.87:80
73.11.153.178:8080
210.6.85.121:80
178.237.139.83:8080
184.167.148.162:80
120.150.246.241:80
108.20.69.44:80
201.184.105.242:443
138.122.5.214:8080
182.176.132.213:8090
85.72.180.68:80
219.78.255.48:80
176.31.200.130:8080
45.33.49.124:443
174.81.132.128:80
201.251.133.92:443
104.131.11.150:8080
12.176.19.218:80
82.155.161.203:80
62.138.26.28:8080
169.239.182.217:8080
167.71.10.37:8080
47.6.15.79:443
85.67.10.190:80
192.241.255.77:8080
5.88.182.250:80
61.197.110.214:80
95.128.43.213:8080
31.172.240.91:8080
66.209.97.122:8080
188.152.7.140:80
159.65.25.128:8080
59.103.164.174:80
24.94.237.248:80
190.12.119.180:443
101.187.247.29:80
104.236.246.93:8080
5.154.58.24:80
93.147.141.5:80
31.31.77.83:443
31.177.54.196:443
75.80.148.244:80
116.48.142.21:443
186.75.241.230:80
86.98.156.239:443
120.151.135.224:80
165.228.24.197:80
206.81.10.215:8080
73.214.99.25:80
212.129.24.79:8080
104.131.44.150:8080
144.139.247.220:80
24.93.212.32:80
91.205.215.66:443
47.6.15.79:80
68.118.26.116:80
24.105.202.216:443
108.179.206.219:8080
37.59.24.177:8080
209.97.168.52:8080
91.73.197.90:80
92.222.216.44:8080
50.116.86.205:8080
218.44.21.114:80
103.86.49.11:8080
110.142.38.16:80
104.137.176.186:80
179.13.185.19:80
195.244.215.206:80
67.225.179.64:8080
178.209.71.63:8080
37.157.194.134:443
73.176.241.255:80
80.21.182.46:80
201.173.217.124:443
211.63.71.72:8080
46.216.60.138:80
1.33.230.137:80
87.106.136.232:8080

Epoch 2 - Spam C2s

95.179.229.244:8080
210.227.117.59:8080
37.208.106.146:8080

Epoch 2 - Stealer C2s

168.235.67.138:8080
139.162.183.41:443
46.101.7.140:8080

Current Epoch 2 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAKl4M80uy0jcxUiFIaJJyxgHVVnFtCq6
bi6f2xXPh/XUZNyN8UXDe5HzhTc4kwon9MBZffNwFOIc61QfV3K3YzEI/ktcyNqK
LS67ONxsVep769QdiVQJXrIaFjMXKz6viwIDAQAB

Epoch 3 C2s

85.100.122.211:80
78.189.165.52:8080
88.248.140.80:80
45.79.75.232:8080
124.150.175.133:80
164.68.115.146:8080
5.189.148.98:8080
96.234.38.186:8080
178.134.1.238:80
212.129.14.27:8080
78.186.102.195:80
66.229.161.86:443
190.17.94.108:443
91.117.31.181:80
119.57.36.54:8080
37.59.24.25:8080
200.41.121.69:443
217.181.139.237:443
86.70.224.211:80
216.75.37.196:8080
182.176.116.139:995
138.197.140.163:8080
187.250.92.82:80
82.146.55.23:7080
92.16.222.156:80
91.117.131.122:80
58.185.224.18:80
189.225.211.171:443
201.196.15.79:990
72.27.212.209:8080
100.38.11.243:80
190.161.67.63:80
128.92.54.20:80
158.69.167.246:8080
181.46.176.38:80
176.58.93.123:80
105.209.235.113:8080
67.254.196.78:443
190.47.236.83:80
192.210.217.94:8080
192.241.220.183:8080
191.100.24.201:50000
41.190.148.90:80
46.105.128.215:8080
185.192.75.240:443
172.104.70.207:8080
190.171.135.235:80
46.105.131.68:8080
72.51.153.27:80
221.154.59.110:80
86.98.157.3:80
195.250.143.182:80
88.247.26.78:80
95.216.207.86:7080
193.33.38.208:443
181.167.35.84:80
110.2.118.164:80
110.142.161.90:80
124.150.175.129:8080
37.46.129.215:8080
139.59.12.63:8080
81.82.247.216:80
197.94.32.129:8080
175.127.140.68:80
115.179.91.58:80
190.247.9.40:443
87.9.181.247:80
85.109.190.235:443
192.161.190.171:8080
24.27.122.202:80
177.144.130.105:443
108.184.9.44:80
86.6.123.109:80
210.111.160.220:80
190.93.210.113:80
162.144.46.90:8080
58.93.151.148:80
95.9.217.200:8080
98.15.140.226:80
113.52.135.33:7080
41.111.190.94:80
51.38.134.203:8080
37.70.131.107:80
190.171.153.139:80
98.178.241.106:80
186.177.174.163:80
211.48.165.9:443
154.120.227.190:443
203.160.173.202:80
177.103.240.93:80
175.103.239.50:80
179.5.118.12:8080
85.235.219.74:80
83.156.88.159:80
46.17.6.116:8080
142.93.87.198:8080
41.77.74.214:443
95.255.140.89:443
212.112.113.235:80
188.230.134.205:80
217.12.70.226:80
181.53.29.136:8080
95.216.212.157:8080
165.100.148.200:8080
156.155.163.232:80
190.101.87.170:80
189.61.200.9:443
201.183.251.100:80
186.84.173.136:8080
190.38.252.45:443
190.5.162.204:80
69.14.208.221:80
203.153.216.178:7080
24.28.178.71:80
94.203.236.122:80
200.71.112.158:53
185.244.167.25:443
210.224.65.117:80
211.42.204.154:80
89.215.225.15:80
42.51.192.231:8080
95.130.37.244:443
220.78.29.88:80
174.57.150.13:8080
82.79.244.92:80
211.218.105.101:80
112.186.195.176:80

Epoch 3 - Spam C2s

82.145.43.153:8080
149.202.153.251:8080
64.207.176.141:8080

Epoch 3 - Stealer C2s

198.46.150.196:7080
178.32.255.133:443
178.63.78.150:8080

Current Epoch 3 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMqZMACZDzcRXuSnj2OI8LeIYKrbUIXL
faUgIJPwYd305HnaBS2AfA0R+oPxT32r+3BbayI3KguqAn3E+rbwtLhqhOXOlTnY
7yvG4ufmwCCkRzc6Sq8baToxmd6y523AIQIDAQAB

Credits and Notes Section

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch 
because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, 
this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen
 
NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

What is Epoch 1, Epoch 2 and Epoch 3?


(09/17/19)
With the find of Epoch 3 that split from Epoch 1, this section will be rewritten to reflect these changes in time.

Community Lists/Samples


https://pastebin.com/Q3qX5xtG - @pollo290987
https://pastebin.com/vm0KCz2R - @paladin3161
https://pastebin.com/QLUJ6VLB - @paladin3161

(sorry if we miss anybody, make sure to send it to @cryptolaemus1 in your tweet and we will try to include it!)

Credits

Combination work of the Cryptolaemus Team - https://paste.cryptolaemus.com/about/ and/or specifically the following:

Doc DL URLs - @devnullnoop, @p5yb34m, @malware_traffic, @dms1899, @Paladin3161

C2 info/RSA Keys - @CapeSandbox, @unixronin, @devnullnoop, @MalwareTechBlog, @lazyactivist192, @papa_anniekey, @Paladin3161,
@executemalware, @luc4m, @SecSome

Payloads - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @p5yb34m, @malware_traffic, @Paladin3161, @ps66uk, 
@bomccss, @reecdeep, @CholeVallabh, @papa_anniekey, @JAMESWT_MHT, @executemalware, @SecSome, Anonymous :)

Spam Templates - @devnullnoop, @lazyactivist192, Anonymous :)

Special thanks to @lazyactivist192, @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/
infrastructure and helping out with this!

Very special thanks to @Binary_Defense, @lazyactivist192, @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project
https://github.com/decalage2/ViperMonkey, @digitalocean, @mploessel, @anyrun_app, @unixronin, @hurricanelabs, @MalwareTechBlog,
@KryptosLogic, @0xtadavie, @MsftSecIntel, @abuse_ch/urlhaus.abuse.ch, @urlscanio, @BlackLotusLabs, @TrendMicro and @Virustotal
for providing services/software at no charge to this cause!

Daily Log 12/20/19

This report was gathered by @ps66uk and @jroosen.

@ps66uk here

Emotet has stayed away from me since the September restart, with an average of less than one email per day.
However I experienced a last minute flurry of emotet emails on Friday. 
25 made it into quarantine, with another 8 delayed deliveries over the weekend so far.

(Always keep an eye out for emotet emails; even when active spamming is not taking place, some MTA can release emails well after the original creation date.
My record is receiving one 83 days after it was originally sent - check email headers to determine true timestamp.)

The themes were mainly generic Bonus and Christmas themes, and the reply-chain emails were all stale subjects, seen before. 
It's good to check what names/organisations/subjects are being used in reply-chain - valuable information for your filters.


Overall, Emotet distro finished early on Friday.
The last DOC releases were 19:40 (E1), 17:07 (E2) and 12:41 (E3). 
Hashbusting for those continued until 02:40 (E1), 05:50 (E2) and 18:00 (E3)

The last EXE update was at 17:00 with a big refresh of C2 on all epochs (10% swapped out).
Hashbusting for this continued until 00:00.

A similar thing happened last year before Christmas break - early end to spamming, and large C2 churn.
At that time, 60 C2 was considered unusually high - the C2 count now stands at 127 for each epoch.... 
More than enough to see bots through a lean period.

So, potentially a break next week - why send spam when no-one is in the office to read it?
Alternatively, maybe target regions that aren't observing the holiday?

General News


abuse_ch sent out multiple warnings of emotet/trickbot IoC on networks
https://twitter.com/abuse_ch

JTHL summary for 12/19 shows abuse procedures still need improving
https://twitter.com/JayTHL/status/1208802774219145217

any.run annual summary has emotet as most analysed malware
https://twitter.com/anyrun_app/status/1208006380491345920

historical Christmas reply-chain
https://twitter.com/Malware_hater/status/1208083841971306498

the only Christmas card I got...
https://twitter.com/bry_campbell/status/1208030202238062594

Drops Report

Email Template Report


Check out the templates in the news. Unfortunately out of time and dont have time to share more.
__________

Sharp eyes will notice a lot of that stuff above was already in this list below that I keep updating:


Some notable things to possibly filter on with misspellings, grammatical errors and odd phrasing:
(I will keep adding to this over time)(Updated 12/5/19)
"Please see attached the medical report of your helper for your perusal"
"This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus"
"Email secured by Check Point"
"Please find our data attached."
"As per the email below, Can you please advise when can I expect a solution?"
"I had forwarded this to your for follow up."
"if order was not place, please contact us and obtain a proof of payment of who sign for order, dispute if necessary."
"Please be advised that the new problem has been appeared today."
"I have sent the new file in DOC format."
"Here all our documentation for our question."
"Here's another email below that i have to make a follow-up on request."
"I have finally been sent the new table-form, which is great. I forward it to you."
"Please sign, date, and email back as confirmation."
"Please find attached the check copy for payment."
"I have sent the new data in DOC format and the policy wording in DOC format to be even more professional than others :)"
"Is this one authorised? (Docs in attachment.)"
"Can you please look into this urgently and advise?"
"there is a older outstanding invoice, I have attached this invoice."
"I meant to send a doc before ,sorry."
"Thank you for your email. I have attached all the data."
"Please find attached the invoice and detailed charges for the month. If you have any questions please let me know."
"I have sent a request to add this information."

These are some old generic virus scanners that I think may no longer be valid and worth blocking:
"-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean."
"Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering."
"This email has been scanned by LANserve Email Defence."

Paul's Boutique of Documents:
includes urlhaus report time

E* Created             Primary_Domain                        Urlhaus  Template

E1 2019:12:20 06:47:00 www.trangiabds.com                    10:06    open_office
E2 2019:12:20 07:10:00 zaferaniyehcenter.com                 07:36    open_office
E3 2019:12:20 06:23:00 www.wangjy1211.xyz                    13:52    open_office

E1 
E2 2019:12:20 09:19:00 gratitudedesign.com                   13:50    open_office
E3 2019:12:20 09:02:00 joaoleobarbieri.adv.br                13:53    open_office

E1 2019:12:20 12:36:00 peikeshargh.com                       13:12    open_office
E2 2019:12:20 12:27:00 eilonstrategy.florencesoftwares.com   13:24    open_office
E3 2019:12:20 12:41:00 dejavugroup.com                       13:03    open_office

E1 2019:12:20 19:40:00 hanserefelektrik.com                  20:02    open_office
E2 2019:12:20 17:07:00 diwafashions.com/wp-admin             17:20    open_office
E3 

notes
E1 stopped updates 02:40 21/12
E2 switched to 15 minute updates at 22:00,stopped at 05:50 21/12
E3 stopped updates 18:00 20/12


(These are experimental, use at your own risk.)

(12/19/19) New E1 and updated E2 and E3. They are better but not perfect. Goal is 75% or more capture rate with low
false positives. Thanks to @pollo290987 for his help on these!

Karttoon's E1:

^(?:http(s)?:\/\/)?(?:[^\x2F]+\/)+(((available|open|closed?|common|multifunctional|personale?|speciali?|privat(e|a)|test|additional|security|inter(ior|nal|ni)|individuale?|verifi(ed|able|cabile)|guarded|external|protected|disponibile|corporate|multifunzionale|contestee|aggiuntiva|chiusi|disponibile|sicurezza|custodito|aperto|comune|verificato)[_-]([a-zA-Z0-9]{3,16}[_-][a-zA-Z0-9]{4,15})\/)|(([a-zA-Z0-9]{2,16}[_-][a-zA-Z0-9]{4,16})[_-](resource|content|box|disk|sector|modul(e|o)|array|cloud|warehouse|forum|space|portale?|profil(e|o)|zon(e|a)|area|marketing|spazio|allineamento|module|disco|settore|sezione|risorsa)\/)|((available|open|closed?|common|multifunctional|personale?|speciali?|privat(e|a)|test|additional|security|inter(ior|nal|ni)|individuale?|verifi(ed|able|cabile)|guarded|external|protected|disponibile|corporate|multifunzionale|contestee|aggiuntiva|chiusi|disponibile|sicurezza|custodito|aperto|comune|verificato)[_-](resource|content|box|disk|sector|modul(e|o)|array|cloud|warehouse|forum|space|portale?|profil(e|o)|zon(e|a)|area|marketing|spazio|allineamento|module|disco|settore|sezione|risorsa)\/)|([a-zA-Z0-9]{4,14}[_-][a-zA-Z0-9]{5,16}[_-][a-zA-Z0-9]{3,13}[_-][a-zA-Z0-9]{2,16}\/)){2}([a-zA-Z0-9]{3,16}[_-][a-zA-Z0-9]{3,14}|[a-zA-Z0-9]{9})(\/)$

New E1: 
https?:\/\/.+?\/(Christmas(_|-)Card|Christmas(_|-)e(C|c)ard|Christmas(_|-)(G|g)reeting(s)?(_|-)(e)?(C|c)ard|Christmas(_|-)?wishes|GreetingCardChristmas|(G|g)reeting(s)?(_|-)?(C|c)ard|Greeting(s)?(_|-)Card(s)?(_|-)(2019|Christmas))\/(\"|\n)

Updated E2 again:
E2:
https?:\/\/.+?\/(addons|attachments|balance|browse|calendar|Document|Documentation|DOC|docs|esp|eTrac|FILE|INC|invoice|index_files|LLC|lm|network|parts_service|OCT|Overview|Pages|paclm|public|public_html|report|Reporting|Scan|sites|statement|swift|system|test|uploads|wp-(admin|content|includes))\/([a-zA-Z0-9]{4,18}\/){0,2}?(([a-zA-Z0-9]{1,12})\-([0-9]{3,10})\-([0-9]{2,10})\-([a-zA-Z0-9]{4,12})\-([a-zA-Z0-9]{4,12})\/)?(\"|\n)
E3:
https?:\/\/.+?\/([A-Za-z0-9\-\_]{2,13})\/(([0-9a-z]{2,7}\-[0-9a-z]{2,7}\-[0-9a-z]{2,7}\/){1,2})(\"|\n)
https?:\/\/.+?\/(_old|ABOUT|AdminPanel|backup|calendar|captchacache|cgi-bin|cloud|cpnl|css|engl?|fancybox|fonts|images|media|oauth|pub|Register|scripts|setup|test|tmp|tr|us|web|wp(scripts)?|wp-(admin|content|includes))\/([A-Za-z0-9\-]{2,7})\/(\"|\n)

Also keep in mind, your filter needs to look inside PDF files to find the URI to test against these above. Otherwise
this does not help.

Loader Report

Payloads and C2 report has been combined into this section and it is now known as the Loader Report.
_____________
Reminder:
EXE naming convention changed 2019/11/14. The new names will be 2 of any of the following list of words:
texas,func,deploy,run,leel,stuck,def,print,hal,monthly,pdf,char,netsh,memo,trns,rds,maker,more,textto,
chunker,mailbox,compon,shades,scan,non,wsat,speed,publish,manual,hant,inbox,malert,zap,fill,angle,wrap,
boost,cors,iplk,sitka,wow,prints,acquire,wiz,smo,footer,attrib,group,appid,xcl,sensor,methods,ipmi,raw,
title,nic,ias,lua,dispid,special,serial,wsa,tcg,msp
______________

C2 Deltas:
E1 now 127 combos, was 126 for a net +1
E2 now 127 combos, was 127 for a net nil
E3 now 127 combos, was 127 for a net nil

---
E1 - j 68.187.160.28:443/177.180.115.224:80
Range          Size    Create   CAPE   hash
23:40 -        469kb   18:19    9880   3898496071268d8dcb6dbcd05bc91b97412eb5ccddff9195a2f9f81ea95ad39f
06:45 -        701kb   18:39    9908   8b4b9914cb1954a43d4b908435ce6cb3ce1443a1cab623dd910558fd7eaa0c2b
11:45 -        313kb   05:36    9931   1e1e427af35d497af3de341225bb19bd30bbbde04eb6094ccdf7cc82bc7076cf
17:00 - 00:00  665kb   12:23    9954   6251959d2541fa4a404e1b5cba93b5616fddc3929297ddd89b613aee266fcf3a <= C2 change


17:00
Dropped:
63.246.252.234:80
68.129.203.162:443
191.183.21.190:80
94.200.114.162:80
188.216.24.204:80
82.8.232.51:80
82.196.15.205:8080
82.36.103.14:80
37.211.49.127:80
185.160.229.26:80
45.79.95.107:443
116.48.148.32:80
119.59.124.163:8080
200.124.225.32:80
99.252.27.6:80

Added:
177.180.115.224:80
177.242.21.126:80
190.210.236.139:80
190.161.180.184:80
200.123.183.137:443
181.231.220.232:80
202.62.39.111:80
190.151.5.130:443
114.109.179.60:80
113.190.254.245:80
220.255.57.31:80
91.191.206.60:443
181.10.204.106:80
179.159.198.70:80
212.253.82.142:443
190.74.246.158:8080

---
E2 - b 24.105.202.216:443/24.181.125.62:80
Range          Size    Create   CAPE   hash
23:40 -        469kb   18:19    9881   a9e89ecde496fbcce271525c0f6148536f28161a650d29504c04151ddd4ee5e2
06:45 -        701kb   18:38    9907   5cc857ca2c18e55af134057a191292615a868485e643906282af97cd86fb8c9b
11:45 -        313kb   05:35    9932   960d9caea87c31c70091c98e524e8e6461c8ea5b280032d7c6f81e89c80a3f76
17:00 - 00:00  665kb   12:27    9951   5542015bd15723d05dc380265f5539146351fa3fbe64fcdb89279fb74756eddd <= C2 change


17:00
Dropped:
197.254.221.174:80
58.171.42.66:8080
66.34.201.20:7080
121.88.5.176:443
101.187.134.207:443
160.16.215.66:8080
70.46.247.81:80
1.215.28.101:8080
2.235.190.23:8080
173.12.14.133:8080
190.53.135.159:21
74.105.102.97:8080
64.53.242.181:8080
71.83.82.123:8080
108.191.2.72:80
189.209.217.49:80

Added:
24.181.125.62:80
98.156.206.153:80
173.21.26.90:80
183.102.238.69:465
173.247.19.238:80
91.242.138.5:443
200.114.167.85:80
190.162.159.212:80
82.155.161.203:80
47.6.15.79:443
31.172.240.91:8080
212.129.24.79:8080
37.59.24.177:8080
209.97.168.52:8080
211.63.71.72:8080
46.216.60.138:80


---
E3 - f 98.178.241.106:80/85.100.122.211:80
Range          Size    Create   CAPE   hash
23:40 -        469kb   18:20    9878   4957edede21f4b88a821e6834586e5c6b7690b4f67b3a0cee61f2541beba384c
06:45 -        701kb   18:39    9909   58284c32471d30c3e149cd8d951ec21a40f01f118db9d9093c43268b7475b8a6
11:50 -        313kb   05:38    9933   6db084844483cfb95db5a1a4823b02add35c00aaa66fcba3907034d4c02c31cc
17:00 - 00:00  665kb   12:26    9950   5c035d69bb778a61d6d13d77e9027d183460ac9c71c536cf157243615def2305 <= C2 change


17:00
Dropped:
120.51.83.89:443
23.253.207.142:8080
50.116.78.109:8080
51.77.113.97:8080
78.46.87.133:8080
78.187.204.70:80
59.158.164.66:443
69.30.205.162:7080
210.171.146.118:80
82.165.15.188:8080
163.172.97.112:8080

Added:
85.100.122.211:80
78.189.165.52:8080
88.248.140.80:80
119.57.36.54:8080
105.209.235.113:8080
185.192.75.240:443
190.171.135.235:80
190.247.9.40:443
186.177.174.163:80
181.53.29.136:8080
95.130.37.244:443

Closing


abuse_ch has put out a number of emotet/trickbot alerts recently - if you are tagged in one of these, please take it seriously.
With a long break coming up, there is plenty of opportunity for an Emotet/Trickbot/PSEmpire/Ryuk attack chain to occur.

Use this time to detect/block C2 access in your network - even if you don't find any now, it's a preventative step for the future.

Hopefully this is all until New Year :)

Sandbox 12/20/19


E1 
https://capesandbox.com/analysis/9954/

E2
https://capesandbox.com/analysis/9951/

E3
https://capesandbox.com/analysis/9950/