SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world

By Aleksandr Badaev, Kseniya Naumova

Key findings:

The group is targeting various countries around the world in addition to its priority region of Latin America.
It uses long chains that incorporate a variety of tools and malware: AgentTesla, FormBook, Remcos, LokiBot, Formbook, Guloader, SnakeKeylogger, XWorm, and others.
The group uses compromised legitimate FTP servers for C2, and SMTP servers, for C2 and phishing.
The group uses legitimate services to store malware strings, and images with embedded malicious code.

Researchers from the Positive Technologies Expert Security Center discovered more than three hundred attacks worldwide, which they confidently attributed to the well-known TA558 group.

As originally described by researchers at ProofPoint, TA558 is a relatively small financially motivated cybercrime group that has attacked hospitality and tourism organizations mainly in Latin America, but has also been identified behind attacks on North America and Western Europe. According to the researchers, the group has been active since at least 2018.

In the attacks that we studied, the group made extensive use of steganography by sending VBSs, PowerShell code, as well as RTF documents with an embedded exploit, inside images and text files. Interestingly, most of the RTF documents and VBSs have names like greatloverstory.vbs, easytolove.vbs, iaminlovewithsomeoneshecuteandtrulyyoungunluckyshenotundersatnd_howmuchiloveherbutitsallgreatwithtrueloveriamgivingyou.doc, and others, associated with love, which is why we dubbed the campaign "SteganoAmor".

Victims

In the course of our research, we discovered numerous samples that targeted various economic sectors and countries. Most of the email messages we came across had been sent to Latin America, but a considerable percentage were addressed to companies in Russia, Romania, Turkey, and some other countries.

Some of the victims that we saw had legitimate FTP and SMTP servers, which the threat actor infected and utilized as C2 servers. They also used the infected SMTP servers to send phishing email.

As our research effort continued, we found servers with public directories in which the group placed files to be used in its attacks.

Figure 1. An example of a public directory

We also found malware logs containing stolen data on the servers with public directories. Thus, data stolen with the help of AgentTesla was stored in the form of HTML files whose names conformed to the following template:

PW_*PC_name*_*date of exfiltration*_*time of exfiltration*.html

The files contained aggregated credentials for every known browser, email (for example, Outlook and Thunderbird) account credentials, and remote access (VPN or RDP) credentials.

The logs included data from regular users, public institutions, and various businesses.

We discovered a total of more than 320 attacks targeting the following countries and sectors:

Figure 3. Distribution of attacks by country

In the course of our research, we discovered attacks on specific companies. The number of attacks on specific targets differs significantly from the total number of discovered attacks, as we could not always find out who the victim was.

Figure 4. Distribution of attacks by sectors

The research begins

While monitoring threats, members of the ESC team discovered a file named "factura 00005111, 005114, 005115.pdf.xlam" SHA-256: 69ffd7a475c64517c9c1c0282fd90c47597e3d4650320158cfb8c189d591db8c. Linked files led them to an email message. The file name "banned-20240117T134543-25672-12″ suggested that the message had reached the recipient but was blocked by security systems. It was ostensibly sent to a Romanian company from another Romanian company:

Figure 5. The phishing email with a malicious attachment

The sender's IP address, 46.27.49.180, was replaced with another. Our data indicated that the group had sent 22 other messages from that IP address to various organizations starting on June 15, 2023.

When the message is opened, Excel downloads with the help of macros a file named "packedtpodododod.exe" (SHA-256:C42288A5946D2C3EB35E7485DD85936C1FABF49E46B12449C9136FF974A12F91) from the following URL:

94.156.65[.]225/packedtpodododod.exe

An RTF file could be downloaded from the same IP address via the following URL:

94.156.65[.]225/microsoftdecidedtodesignnewproducttoupdateandupgradenewprojectthingsonthepcandsystem.doc

This variant contains CVE-2017-11882 and downloads the following file in the chain from the URL:

94.156.65[.]225/herewegoxla.exe.

Once downloaded, the file runs. The final payload is AgentTesla hiding behind an Excel icon, which uploads data to the C2 via FTP. The C2 itself is a legitimate website that has been compromised.

Other infection chains

Thanks to internal systems, we discovered dozens of different files linked to the FTP server, which was used as a C2 for AgentTesla. Most of the files linked to the FTP server were used in malicious files that bore Spanish, Portuguese, and Romanian names.

We also used our systems to successfully discover hundreds of different files and dozens of malicious IP addresses used by the group in the campaign at hand. Some of the files were documents with various name extensions and targeting different countries, but sharing one infrastructure and similarities between the attack chains. The files had different names in English, Bulgarian, Croatian, Turkish, Russian, Chinese, and other languages.

Below, you will find examples of chains containing malware that belongs to a variety of families: AgentTesla, Remcos, XWorm, LokiBot, Guloader, Formbook, SnakeKeylogger. We would like to emphasize that one type of malware may be involved in several different chains. A complete list of indicators of compromise is available under IOCs below.

1.1 AgentTesla attack: the main scenario involving an Excel document and steganography

The main scenario we saw in this campaign and which gave it its name is an attack chain that involves steganography.

A case in point is a file named "Cerere de cotatie.xla" (SHA-256: 64020a7a3f5f6c589272f28d727318eb5eb4eb4d41510679cb8134c0325c8fe2) It kicks off the chain. When opened, it exploits CVE-2017-11882, sending a request to the URL:

qly[.]ai/08XE5, a shortened link that redirects to 23.95.60.74/weareinlovewithmygirlfriendunderstandhowitistoget___youareverybeautifilformeiloveusoomuchalwaysloveutrulyfromtheheartlove.doc

Figure 6. Request for the next stage (after opening the document)

The file received with the server response (SHA-256: 2c58ca41949aa784dce6a2006162781fe7a7a5453cafb731ee4d512efe718c43) is an RTF document.

When opened, it runs and downloads a VBS script from that same IP address:

23[.]95[.]60[.]74/roammamamamam.vbs

Figure 8. Request for an RTF document to obtain VBS

The VBS script sends a request to paste[.]ee to fetch the next payload:

paste[.]ee/d/FZTcX

Figure 9. Malicious code in the legitimate paste[.]ee service

It then proceeds to downloading and decoding an encoded malicious string (steganography) embedded in an image from the following URLs:

uploaddeimagens[.]com[.]br/images/004/753/714/original/new_image.jpg?1709908350
uploaddeimagens[.]com[.]br/images/004/753/713/original/new_image.jpg?1709908316

The images are the same:

Figure 10. An image downloaded from the legitimate service

new_image.jpg (SHA-256: 1435aef381b7e31245e2ca66818209a7f8d54daef4d0db25ef78b3a9fec3242b)

A Base64-encoded next-stage payload hidden inside the downloaded image:

The PowerShell command inside the script:

Figure 12. The PowerShell code inside the script

The script then decrypts the payload from the image and downloads a further payload from the same URL, written in reverse string format. Its content is notably a Base64-encoded executable, also reversed:

23[.]95[.]60[.]74/romamammamamamaa.txt

Figure 13. Payload with reversed Base64 code

Next, AgentTesla runs. The malware runs a check as a bypass element to make sure that it is not running on a hosting platform, and the victim's IP address is real.

ip-api[.]com/line/?fields=hosting

AgentTesla steals data from browsers, email clients, remote access services, and connects via FTP to a C2 to upload it.

Figure 14. Communication with the C2 server

1.2 AgentTesla attack: an alternate scenario involving a Microsoft Word document

This is a late-2023 example that we do not see the malicious actor use as much any more, but still find samples of:

"Lista de productos 2.docx" (SHA-256: 54376ee15cca7c6cdecc27b701b85bdd2aa618fe8158a453d65030425154299a)

Figure 16. The malicious document with OLE

When run, it sends a request to shlx.us/eO, which redirects to the following URL:

23.95.122[.]104/htm/1/HTMLbrowserIEchromeHistoryCleaner.doc

Figure 17. The next-stage request after opening the document

The downloaded document (SHA-256: 6cab2705e5bfe56db1e9a74c8af9dca162de7631dd8dc074685dcb9c1dc7c5a2) is a malicious RTF document containing an exploit:

The RTF document then downloads "IGCC.exe", which is AgentTesla.

Figure 19. The RTF document fetches the AgentTesla payload

As a result, AgentTesla starts communication via FTP with the C2 and proceeds to exfiltrate data:

Figure 20. Exfiltrating the victim's data

1.3 Remcos attack

Remcos, or Remote Control and Surveillance, originally legitimate software, is currently employed by many threat actors as a RAT (Remote Access Trojan) to access a victim's computer.

In the course of our research, we found multiple Remcos samples used in attacks by the group.

One of these files is named "ORDER_SPECIFICATIONS_OFFER.xla" (SHA-256: 93946883de3d4074ac4baed60abcc3f2d0c57c8ef6e41ceaedbc5ca0de55dc30):

Figure 21. A malicious Excel document with OLE

When the file is opened, the macro inside the Excel file reaches out to the first C2 at the shortened URL qly[.]ai/p5Zpt for additional data:

Figure 22. The request to qly[.]ai/p5Zpt

The URL redirects the request to an RTF document containing an exploit:

147.185.243[.]107/45700/macc/shelovemywifemorethankanyonebutsametimeiloveagirlwholovingmealot_____sheisreallymyloverwhocarewholovedmefromtheheart.doc с cve-2017-11882

Figure 23. The request after the redirect

This is followed by a request to the next URL, which responds with an obfuscated VBS script, rather than an image:

147.185.243[.]107/45700/beautifulglobe.jpg,

This script contains the embedded address of the next C2 in the chain, which hosts another obfuscated script:

paste[.]ee/d/NYO9X

Figure 25. The VBS script in the legitimate paste.ee service

We found deobfuscation of this script to be more interesting than the first one, as it contained more encoding iterations. The result was a piece of code inside, containing a reversed string for the following C2:

147.185.243[.]107/45700/MACC.txt:

Once inside the TXT file, we found the final link in the chain: a reversed Base64-encoded piece of code:

The chain results in infection with the Remcos RAT (SHA-256: bd296301230adac77b09dc91d06ec26adbc49d015ea7d1b4f68b6805c2b5ee55).

Before talking to the remote server, Remcos calls geoplugin[.]net/json.gp to check the IP address, and then contacts the C2 using TLS mimicry to hide the traffic:

Figure 28. The conversation between Remcos and the C2 server

1.4 XWorm attack

XWorm is among the most popular RATs, used by many threat actors including TA 558.

Similarly to the previous case, one of these chains begins with an Excel file containing an embedded link, which redirects requests to another server to download an RTF document with an exploit inside. In this case, we saw the files 7b768394fa0869d92f872eb486f49fabd6469ef3a8fd8bdf9cb49d35b39ea73b and 94bcfc033fd6e445163116ebf73877ef71e22192bef829822314042b31a7281f, which, when run, redirected to a URL to fetch the next stage:

107.175.31[.]187/7508/iconimages.jpg

Figure 29. The RTF request for a VBS script

The script contains an embedded URL:

paste[.]ee/d/G5J31

Its content is an obfuscated VBS script containing two links to images with additional payloads:

uploaddeimagens[.]com [.]br/images/004/755/997/original/new_image_r.jpg?1710413993
uploaddeimagens[.]com [.]br/images/004/755/997/original/new_image_r.jpg?1710413993

Figure 30. The request to fetch the images

As with the main case described above, the strings from the images are decoded, and a payload is assembled, which then downloads a TXT file with a reversed Base64-encoded file, which is the final payload: XWorm.

107.175.31[.]187/7508/xwo.txt

Figure 31. The payload with the reversed Base64-encoded file

Once running, XWorm starts talking to the C2:

147.124.212[.]213:6161

Figure 32. XWorm talking to the C2 server

1.5 LokiBot attack

LokiBot is a stealer that collects data from various applications used by the victim, such as browsers, email and FTP clients, and so on. One of these files was received from:

23.94.239[.]119/_—00_o______---0o0_00_0oo_0-o_o0-__________o0o-__________/ozzwerdfdghjfdggsahfhfghf.doc

As in the other instances, the file is an RTF document that downloads a PE file (SHA-256: adc6a50e5985c31f0ed5ea885edd73e787f893f709591e5cf795fd78403d1430) from the following URL:

23.94.239[.]119/112/vbc.exe

The file is LokiBot, which starts communicating with the C2, sending information to the following URL:

sempersim[.]su/ha1/fre.php

Figure 35. Communication between LokiBot and the C2 server

1.6 Guloader/Formbook attack

This example begins with the file named "NEW ORDER.xls" (SHA-256: 3688f05556a136fe094de5cb1888eac2a579525f72cd027e19738582ed40c283).

Figure 36. The contents of "NEW ORDER.xls"

The macro inside the Excel file starts the next chain, similar to what we saw earlier. First, it sends a request to:

2s[.]gg/3zs

Figure 37. The request before the redirect

It then redirects to an RTF document with the previously mentioned CVE:

103.237.87[.]56/rew/re/binwecanmaintainthenewthingswithhimbecauseiwasrunningaroundthewroldwithnew____icangofornewthingsfortruestoryuloverbrother.doc

Figure 38. Downloading the malicious RTF file

Guloader, to be used as the loader for fetching the next piece of malware, is then downloaded from the following IP address:

103.237.87[.]56/setup/bin.exe

The Guloader file (SHA-256: bfd50523e4cabf7fe9e6f0afc926b9269708ac80af43a943ebcbc909a9ae0695)accesses a Google Drive to get the malware payload, FormBook:

drive.google[.]com/uc?export=download&id=1QJZpYWwA5nTHlXAY5PxXqGvqEBOtjtOi -> drive.usercontent.google[.]com/download?id=1QJZpYWwA5nTHlXAY5PxXqGvqEBOtjtOi&export=download

Once running, FormBook (SHA-256: e1259d936c3993e5d8671b8b5e2362eb974984d046871296c50cf51ee1a96e4b) starts talking to the C2:

thechurchinkaty[.]com/nrup/?vLwt1tg=a+HLDFsiIkHuV4rn/wjkuvItWj7ch7WMO9xbFOtVeNEzn7JMPDdWHI+pluLOfQ5QTDqWxNNxIGS7LM9UJKf1d/iZERaTVE3Mnox0RAyMAaysT2DaDQ==&tdCpR=qZUxOL60rvw

Figure 40. The communication between FormBook and the C2 server

1.7 SnakeKeylogger attack

As in most of the cases we have covered so far, the chain begins with an Excel file, such as "Payment_Draft_confirmation.xla" (SHA-256: 9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1).

When the file runs, it sends a request to the following URL:

qly[.]ai/TZWGK

This is followed by a redirect to the following URL to download an RTF document:

207.32.219[.]82/7050/snk/snkisanewthingswhichhelovesornotireallynotknowwhathelookingbutshesloved___alotwiththisnewthingswhathetoldme.doc

The RTF document downloads a VBS script from the following URL:

207.32.219[.]82/7050/imaginepixelimages.jpg

The next stage downloads reversed Base64-encoded strings, which prove to be SnakeKeylogger (SHA-256: 69dffbdcc112b62bfa93e2d6d95de42ef16e01e428b883b9671056ac93bbce8f) when decoded:

207.32.219[.]82/7050/SNK.txt

The first thing SnakeKeylogger does upon starting is running a check:

checkip.dyndns[.]org

It then checks the geographic location according to the IP address:

reallyfreegeoip[.]org

Figure 46. The geographic location check

This is followed by a request to get an SMTP server:

scratchdreams[.]tk/_send_.php?TS

Figure 47. The request to get an SMTP server

Finally, SnakeKeylogger forwards the information it stole to the compromised legitimate SMTP server:

Figure 48. Sending data to the compromised legitimate SMTP server

1.8 Other attack examples

We saw other attack chains. For example, here's an example of network communication between NjRAT and C2

But these differed only insignificantly from the ones described above, essentially being the same attacks with different final payloads.

Thus, as we were examining the threat actor's infrastructure, we noticed that the IP addresses used to host RTF files with exploits embedded in them and fake JPG files with embedded VBS scripts were also used as the locations for various RATs. As an example, here is the IP address of the zgRAT C2 server:

94.156.69[.]17

Figure 50. An example of this IP address being involved in the infection chain

Figure 51. An example of this IP address being used for the zgRAT C2 server

The group's use of legitimate FTP and SMTP servers

Upon closer inspection, the FTP servers we found turned out to be legitimate services, which the threat actor presumably had infected to use as C2s for exfiltration of victims' data extracted with the help of the malware described above.

In each case, the legitimate sites belonged to various small companies based in Mexico, Colombia, and Romania.

Here is one such site:

The organization has an active social media account with several thousand subscribers and a link to a website:

As in the previous case, this organization has an active social media account with several thousand subscribers and a link to a website:

Figure 55. The company's Facebook account

When researching the group's attacks on Russian companies, we noticed that, besides FTP servers, it used SMTP on compromised servers that hosted legitimate European websites:

The group created some of its SMTP domains to make its activities appear legitimate. Thus, one of the SMTP domains it used, itresinc.com, is apparently trying hard to look like the legitimate it-resinc.com.

The threat actor used these legitimate and newly created SMTP servers in two ways:

To send phishing email
As a C2 server for spreading malware

Interestingly, the group never used the same SMTP server as both a phishing server and a C2 in one attack.

As an example of an attack, here is an email message sent to an organization in Russia from a compromised legitimate SMTP server:

Figure 57. The email from the compromised SMTP server

The phishing email came with a ZIP archive attached:

"loading advice.zip" SHA-256: ca383ef7a0031ff933907be8b038ccc62ac556bdc0f077d7f9c3022952e62efa

The archive contained one file that was AgentTesla:

"loading advice.exe" SHA-256: 84b2a0360556088e4aad29627d4ed15d53b18aa72d9d98b4b0d1be27916c681e

When the executable runs, it uploads data to an SMTP server that imitates a legitimate one:

mail.itresinc.com

Attribution to known groups

In the course of our research, we found that a part of the campaign had been described by analysts at Cyble.

Cyble describes the same kill chain that we saw, including the use of steganography, as well as the payload, which may contain various types of malware like AgentTesla, Remcos, and so on.

Researchers at MetabaseQ last October described the same threat actor's activity, attributing it to TA558.

Their report takes note of the kill chain, which also employed steganography. Although the researchers said that the victims, as with TA558 earlier, were located in Latin America, the United States, Portugal, and Spain, we have found that while TA558 mainly focuses on Latin America, the number of affected countries is much greater, and TA558 attacks completely different countries.

Last August, researcher Ankit Anubhav shared on X (formerly Twitter) information about TA558's use of steganography with a final chain that resulted in infection with Quasar Rat.

Another Microsoft researcher, Igal Lytzki, referred to Ankit Anubhav in his description of a similar attack, where he drew attention to steganography samples and AgentTesla on an FTP server containing logs of victims' data. Igal said he had informed the victims accordingly:

Fig. 59. Tweet by researcher Igal Lytzki

Conclusion

The TA558 attack chains in the SteganoAmor campaign examined here continue to affect users in Latin America and elsewhere in the world. The group continues to exploit the fairly old CVE-2017-11882 in its attack chain. It uses steganography, an obfuscation technique, inside the chains to spread well-known malware used in other attacks in recent years. The phishing may be harder to detect due to the group's use of compromised legitimate SMTP servers, so we recommend exercising caution when dealing with email that contains attachments, even if the messages were received from governmental organizations or small local companies. The use of legitimate SMTP and FTP servers, as well as tools like Guloader, may complicate detection of the threat actor's presence on the host, so companies are advised to monitor network traffic more closely and investigate suspicious activity linked to legitimate services.

Product detection rules

YARA rules

tool_win_ZZ_OfficeTemplate__Downloader__RemoteDocument__Artifact

exploit_win_ZZ_CVE201711882__Exploit__Ole10Native__Artifact

tool_win_ZZ_MalPDF__RiskTool__JavaScript

tool_win_ZZ_MalPDF__RiskTool__JavaScriptAction__Artifact

tool_win_ZZ_antiVM__RiskTool__TrapFlag__EFLAGs

tool_win_ZZ_UPX__RiskTool__Sections

tool_win_ZZ_Themida__RiskTool__2

tool_win_ZZ_MPRessPacker__RiskTool

tool_win_ZZ_DotnetObfuscation__Risktool__Unicoded__Methods

tool_mem_ZZ_AgentTesla__Stealer

tool_mem_ZZ_GenericStealer__Stealer

exploit_win_ZZ_CVE20170199__Exploit__URLMoniker__Artifact

tool_mem_ZZ_GenericBackdoor__Backdoor

tool_win_ZZ_ConfuserEx__RiskTool

tool_win_ZZ_MalISO__Dropper__Generic__ContainsPE

tool_mem_ZZ_RacPack__Trojan

tool_win_ZZ_Gh0stCringe__Backdoor

tool_win_ZZ_Base64PE__Risktool

tool_mem_ZZ_HeavensGate

tool_mem_ZZ_EmailStealer__Stealer

tool_mem_ZZ_LokiBot__PSW

tool_win_ZZ_SnakeKeylogger__Spy

tool_win_ZZ_DotnetObfuscation__Risktool__Unicoded__Classes

Malware

Trojan-Downloader.PowerShell.Generic.b

Trojan-Downloader.Win32.Amadey.n

Trojan-Downloader.Win32.Banjori.n

Trojan-Downloader.Win32.Danabot.n

Trojan-Downloader.Win32.EkipaRAT.n

Trojan-Downloader.Win32.Emotet.n

Trojan-Downloader.Win32.FormBook.n

Trojan-Downloader.Win32.Generic.n

Trojan-Downloader.Win32.Glupteba.n

Trojan-Downloader.Win32.Lokibot.n

Trojan-Downloader.Win32.PrivateLoader.n

Trojan-Downloader.Win32.Remcos.n

Trojan-Downloader.Win32.Smokeloader.n

Trojan-Downloader.Win32.SnakeKeylogger.n

Trojan-Downloader.Win32.Socks5SystemZ.n

Trojan-Downloader.Win32.XWorm.n

Trojan-Downloader.Win32.Zhark.n

Trojan-Downloader.Win32.njRAT.n

Trojan-Downloader.Win32.zgRAT.n

Trojan-Dropper.MSOffice.CommonCVE.a

Trojan-Dropper.MSOffice.Launcher.a

Trojan-Dropper.PDF.Launcher.a

Trojan-Dropper.PowerShell.LOLBinStage.a

Trojan-Dropper.Win32.Generic.e

Trojan-Dropper.Win32.Generic.i

Trojan-Dropper.Win32.LOLBin.a

Trojan-PSW.Win32.AgentTesla.a

Trojan-PSW.Win32.CredentialAccess.a

Trojan-PSW.Win32.CredentialAccess.b

Trojan-PSW.Win32.Generic.a

Trojan-PSW.Win32.Generic.b

Trojan-PSW.Win32.Generic.n

Trojan-PSW.Win32.Loki.n

Trojan-PSW.Win32.Mystic.n

Trojan-PSW.Win32.RecordBreaker.n

Trojan-PSW.Win32.RedLine.n

Trojan-PSW.Win32.RisePro.n

Trojan-PSW.Win32.Vidar.n

Trojan-Spy.Win32.AgentTesla.n

Trojan-Spy.Win32.FormBook.n

Trojan-Spy.Win32.Generic.a

Trojan-Spy.Win32.Generic.b

Trojan-Spy.Win32.Generic.c

Trojan-Spy.Win32.SysUpdate.n

Trojan.PowerShell.Generic.a

Trojan.PowerShell.PSLiner.b

Trojan.Script.Generic.a

Trojan.Win32.DefenseImpair.a

Trojan.Win32.Evader.a

Trojan.Win32.Evasion.a

Trojan.Win32.Generic.a

Trojan.Win32.Generic.c

Trojan.Win32.Generic.d

Trojan.Win32.Generic.f

Trojan.Win32.Generic.g

Trojan.Win32.Generic.i

Trojan.Win32.HeavensGate.a

Trojan.Win32.Inject.a

Trojan.Win32.Recon.a

Trojan.Win32.Recon.c

Suspicious

Read.Window.Handle.Enumeration

Transfer.Network.Packet.SuspiciousTraffic

Transfer.Network.Packet.BadTraffic

Create.Process.PowerShell.CommandExecution

Create.Process.WScript.RunScript

Write.File.Script.Launcher

Create.Process.Inject.ResumeThread

Write.Registry.Key.Persistence

Create.Process.DotNet.RestrictionsBypass

Read.Registry.Key.NetInterfaces

Write.Process.Inject.SetThreadContext

Write.Process.Inject.SetInstrumentationCallback

Read.File.Data.StealPrivateInfo

Create.Process.Hollowing.Evasion

Read.System.LSAsrv.CredentialsEnumeration

Create.Process.SpoofedParentPid.Evasion

Wait.Time.FewSeconds.AbuseDelay

Create.Process.Schtasks.Persistence

Read.Registry.Key.CheckHWID

Read.File.Module.CheckVM

Read.System.GetCursorPos.CheckVM

Read.Registry.Key.CheckVM

Create.Task.RPC.Persistence

Read.COM.Multimedia.AudioDevices

Read.System.PowerCapabilities.CheckVM

Read.Registry.Key.CheckBios

Read.Disk.Letter.Enumeration

Create.Window.Hidden.Evasion

Write.Registry.Key.DisableTracing

Read.Process.Name.Enumeration

Read.Process.Info.AntiDebugQueryInfo

Create.Process.PowerShell.LongExecution

Create.Query.WMI.CheckVM

Create.Task.COM.Persistence

Read.Thread.Info.AntiDebug

Write.File.Attribute.Hidden

Read.File.Browser.Credentials

Read.Registry.Key.StealPrivateInfo

Create.Hook.SetWindowsHook.Keylogger

Read.Audio.Capture.Microphone

Create.Screenshot.BitBlt.Reconnaissance

Read.Clipboard.Data.RemoteControl

Write.Registry.Key.ActiveMovie

Create.Query.WMI.CheckAntivirus

Write.Registry.Key.ChangeFirewallPolicy

Write.Registry.Key.DisableWindowsDefender

Read.System.Info.Reconnaissance

Delete.File.Antivirus.Evasion

Write.Thread.Info.AntiDebug

Read.Window.Name.CheckDbg

Read.System.Object.AddressLeak

Create.Process.SystemDir.NewFile

Read.File.Name.CheckAntivirus

Delete.System.BSOD.Impact

Create.Service.RPC.Persistence

Read.Registry.Key.CheckCPU

Read.Registry.Key.CheckInstalledSoft

Create.File.Shortcut.COM

Read.Processor.CPUID.CheckVM

Read.Process.Info.AntiDebug

Create.Process.WinDef.AddExclusion

Read.File.Data.CredentialDumping

To search for calls to the malicious iocs of the APT TA558 in PT NAD, use the following filter rpt.cat ~ "ESC-manual-ta558-*"

BOTNET [PTsecurity] Amadey (10010252, 10010256)

BOTNET [PTsecurity] Lokibot (10008588)

BOTNET [PTsecurity] Socks5SystemZ (10010157)

BOTNET [PTsecurity] Zhark (10010817)

KEYLOGGER [PTsecurity] SnakeKeylogger (10006494)

LOADER [PTsecurity] Smokeloader (10006991, 10007714, 10007877, 10008402, 10007793)

REMOTE [PTsecurity] Remcos (10007727, 10009759)

REMOTE [PTsecurity] XWorm (10005370, 10008311)

REMOTE [PTsecurity] njRAT (11000956 10005222)

SPYWARE [PTsecurity] AgentTesla Exfiltration (10005349)

SPYWARE [PTsecurity] FormBook (10003266)

STEALER [PTsecurity] Loki (10001404)

STEALER [PTsecurity] Mystic (10009396, 10009408, 10009409)

STEALER [PTsecurity] RedLine (10006855)

STEALER [PTsecurity] Vidar (10008458)

Execute_Malicious_Command

Suspicious_process_execution_sequence

Obfuscated_Powershell

Suspicious_Connection

3[.]145[.]88[.]189

23[.]94[.]206[.]107

23[.]94[.]236[.]203

23[.]94[.]239[.]93

23[.]94[.]239[.]119

23[.]95[.]60[.]74

23[.]95[.]122[.]104

23[.]95[.]235[.]10

23[.]95[.]235[.]35

23[.]95[.]235[.]86

45[.]32[.]86[.]119

45[.]74[.]19[.]84

45[.]227[.]161[.]55

46[.]27[.]49[.]180

50[.]3[.]182[.]140

66[.]175[.]208[.]79

66[.]228[.]43[.]8

70[.]34[.]197[.]128

70[.]34[.]220[.]238

72[.]14[.]187[.]87

83[.]137[.]157[.]51

94[.]156[.]65[.]225

94[.]156[.]69[.]17

103[.]27[.]132[.]200

103[.]29[.]3[.]200

103[.]67[.]162[.]213

103[.]133[.]104[.]112

103[.]183[.]114[.]5

103[.]186[.]65[.]80

103[.]198[.]26[.]111

103[.]237[.]87[.]56

104[.]247[.]204[.]205

107[.]172[.]61[.]136

107[.]173[.]4[.]5

107[.]173[.]4[.]15

107[.]173[.]229[.]146

107[.]174[.]138[.]160

107[.]175[.]3[.]22

107[.]175[.]31[.]187

107[.]175[.]92[.]68

107[.]175[.]113[.]202

107[.]175[.]113[.]204

107[.]175[.]113[.]216

141[.]98[.]10[.]56

147[.]124[.]214[.]183

147[.]185[.]243[.]107

149[.]28[.]109[.]84

149[.]248[.]54[.]207

154[.]38[.]188[.]98

158[.]220[.]80[.]156

167[.]86[.]86[.]15

170[.]75[.]146[.]119

172[.]86[.]76[.]208

172[.]202[.]120[.]36

172[.]232[.]8[.]161

172[.]232[.]163[.]207

172[.]232[.]170[.]236

172[.]232[.]172[.]53

172[.]232[.]189[.]7

172[.]233[.]129[.]114

172[.]233[.]130[.]11

172[.]234[.]249[.]47

172[.]245[.]163[.]139

172[.]245[.]185[.]30

172[.]245[.]208[.]3

172[.]245[.]208[.]19

172[.]245[.]208[.]28

172[.]245[.]208[.]34

172[.]245[.]208[.]126

172[.]245[.]214[.]91

185[.]254[.]37[.]80

188[.]127[.]231[.]198

188[.]127[.]249[.]32

192[.]3[.]95[.]131

192[.]3[.]95[.]135

192[.]3[.]95[.]216

192[.]3[.]108[.]47

192[.]3[.]179[.]133

192[.]3[.]179[.]162

192[.]3[.]241[.]235

192[.]99[.]190[.]119

192[.]210[.]214[.]26

193[.]56[.]255[.]218

198[.]12[.]81[.]138

198[.]12[.]81[.]158

198[.]12[.]89[.]23

198[.]12[.]91[.]244

198[.]23[.]156[.]251

198[.]46[.]173[.]145

198[.]46[.]174[.]147

198[.]46[.]176[.]159

198[.]46[.]176[.]175

198[.]74[.]57[.]54

207[.]32[.]219[.]82

107[.]175[.]113[.]216/pastor/Abzyvhxf[.]exe

192[.]3[.]179[.]162/262/wlanext[.]exe

103[.]186[.]65[.]80/79/audiodgse[.]exe

103[.]237[.]87[.]56/setup/bin[.]exe

192[.]3[.]95[.]131/160/audiodg[.]exe

192[.]3[.]179[.]133/470/asusns[.]exe

192[.]3[.]179[.]162/352/wlanext[.]exe

198[.]12[.]81[.]158/5505/NSS[.]exe

23[.]95[.]235[.]86/400/wlanext[.]exe

3[.]145[.]88[.]189/140/wlanext[.]exe

103[.]29[.]3[.]200/S2611M/wininit[.]exe

103[.]29[.]3[.]200/W0811T/wininit[.]exe

107[.]174[.]138[.]160/1200/CNN[.]exe

23[.]95[.]122[.]104/1728/IGCC[.]exe

103[.]183[.]114[.]5/250/wlanext[.]exe

107[.]173[.]229[.]146/175/wlanext[.]exe

107[.]174[.]138[.]160/18060/CNN[.]exe

107[.]175[.]3[.]22/9w9/sihost[.]exe

107[.]175[.]92[.]68/150/wlanext[.]exe

172[.]245[.]208[.]126/260/wlanext[.]exe

172[.]245[.]208[.]19/119/wlanext[.]exe

172[.]245[.]208[.]19/360/unsecapp[.]exe

172[.]245[.]208[.]19/win/unsecapp[.]exe

172[.]245[.]208[.]28/3636/conhost[.]exe

172[.]245[.]208[.]28/5298/conhost[.]exe

172[.]245[.]208[.]28/5299/conhost[.]exe

192[.]3[.]179[.]133/400/sihost[.]exe

192[.]3[.]179[.]162/3010/wlanext[.]exe

193[.]56[.]255[.]218/T1403F/audiodg[.]exe

198[.]46[.]174[.]147/3470/wlanext[.]exe

23[.]95[.]235[.]10/120/wlanext[.]exe

23[.]95[.]235[.]10/210/wlanext[.]exe

23[.]95[.]235[.]10/460/asusns[.]exe

103[.]198[.]26[.]111/45008/conhost[.]exe

103[.]237[.]87[.]56/link/anki[.]exe

103[.]29[.]3[.]200/M2711T/wininit[.]exe

103[.]29[.]3[.]200/S1211M/wininit[.]exe

107[.]173[.]229[.]146/175/wlanext2[.]exe

107[.]174[.]138[.]160/2510/CNN[.]exe

107[.]175[.]113[.]216/pastor/irrkt[.]exe

141[.]98[.]10[.]56/260/audiodgs[.]exe

172[.]245[.]208[.]19/380/sihost[.]exe

172[.]245[.]208[.]19/450/asusns[.]exe

192[.]3[.]179[.]133/122/wlanext[.]exe

192[.]3[.]179[.]133/410/sihost[.]exe

192[.]3[.]179[.]162/263/wlanext[.]exe

192[.]3[.]241[.]235/1133/wlanext[.]exe

198[.]12[.]81[.]138/420/sihost[.]exe

198[.]12[.]81[.]158/5506/NSS[.]exe

198[.]12[.]81[.]158/7690/CNN[.]exe

198[.]46[.]173[.]145/6088/CNN[.]exe

198[.]46[.]174[.]147/220/wlanext[.]exe

198[.]46[.]174[.]147/230/wlanext[.]exe

198[.]46[.]174[.]147/350/wlanext[.]exe

198[.]46[.]176[.]159/57006/CNN[.]exe

23[.]95[.]122[.]104/1727/IGCC[.]exe

23[.]95[.]122[.]104/530/ugc[.]exe

23[.]95[.]235[.]10/390/sihost[.]exe

23[.]95[.]235[.]10/510/asusns[.]exe

23[.]95[.]235[.]86/301/wlanext[.]exe

50[.]3[.]182[.]140/350/audiodg[.]exe

66[.]175[.]208[.]79/550/asusns[.]exe

70[.]34[.]220[.]238/5609/conhost[.]exe

103[.]27[.]132[.]200/177/audiodg[.]exe

103[.]29[.]3[.]200/T1411W/wininit[.]exe

103[.]67[.]162[.]213/M2503T/smss[.]exe

107[.]174[.]138[.]160/1210/CNN[.]exe

107[.]174[.]138[.]160/2350/CNN[.]exe

107[.]174[.]138[.]160/2500/CNN[.]exe

107[.]175[.]113[.]216/pastor/axes[.]exe

107[.]175[.]113[.]216/pastor/retain[.]exe

141[.]98[.]10[.]56/255/igcc[.]exe

172[.]245[.]208[.]126/300/wlanext[.]exe

172[.]245[.]208[.]19/200/wlanext[.]exe

172[.]245[.]208[.]19/300/unsecapp[.]exe

172[.]245[.]208[.]28/2400/conhost[.]exe

172[.]245[.]208[.]28/300/conhost[.]exe

172[.]245[.]208[.]28/3454/conhost[.]exe

192[.]3[.]108[.]47/Msoffice/SecurityHealthSystray[.]exe

192[.]3[.]179[.]133/520/asusns[.]exe

192[.]3[.]179[.]162/2547/wlanext[.]exe

192[.]3[.]179[.]162/3457/wlanext[.]exe

192[.]3[.]241[.]235/1132/wlanext[.]exe

192[.]3[.]241[.]235/350/ishost[.]exe

192[.]3[.]95[.]135/S2403M/wininit[.]exe

193[.]56[.]255[.]218/M0403T/audiodg[.]exe

198[.]12[.]81[.]138/480/asusns[.]exe

198[.]12[.]81[.]138/530/asusns[.]exe

198[.]23[.]156[.]251/42/wins[.]exe

198[.]46[.]173[.]145/90800/CNN[.]exe

198[.]46[.]174[.]147/155/wlanext[.]exe

198[.]46[.]174[.]147/2360/wlanext[.]exe

23[.]94[.]236[.]203/235/win[.]exe

23[.]94[.]239[.]119/112/vbc[.]exe

23[.]94[.]239[.]93/3855/wln/Luliohnsa[.]exe

23[.]95[.]122[.]104/2102/NahimicSvc32[.]exe

94[.]156[.]65[.]225/packedtpodododod[.]exe

94[.]156[.]65[.]225/herewegoxla[.]exe

bolandraf[.]com/prostutefiles/exedroidddcc[.]exe

sempersim[.]su

107[.]175[.]113[.]216/pastor/Czlsl[.]pdf

172[.]245[.]208[.]19/window/Xgqkoeinjvq[.]pdf

172[.]233[.]130[.]11/win/cmd[.]bat

23[.]94[.]239[.]93/3855/wln/cmd[.]bat

23[.]95[.]235[.]86/whd/cmd[.]bat

23[.]95[.]235[.]86/wmn/wm/redbull[.]bat

107[.]173[.]229[.]146/235/json[.]js

192[.]3[.]108[.]47/sweet/igccu[.]hta

192[.]3[.]108[.]47/we/3/gucci[.]hta

192[.]3[.]108[.]47/we/4/gucci[.]hta

23[.]94[.]236[.]203/wq/IE_NET[.]hta

bolandraf[.]com/prostutefiles/fridayexploit[.]hta

192[.]3[.]108[.]47/2114/FF/RBLnetwork[.]vbs

192[.]3[.]108[.]47/iso/audiodgse[.]vbs

172[.]232[.]170[.]236/24445/beforeloveme[.]vbs

23[.]94[.]239[.]93/2355/microsoftprofile[.]vbs

70[.]34[.]197[.]128/500/marriagepruposal[.]vbs

107[.]173[.]4[.]15/25009/easytolove[.]vbs

107[.]175[.]113[.]202/500/whtmltrnsf[.]vbs

172[.]245[.]208[.]3/99880/lovetocontinue[.]vbs

188[.]127[.]249[.]32/250/HTMLBrowserIEhistorycleaner[.]vbs

45[.]32[.]86[.]119/230/htmljson[.]vbs

103[.]183[.]114[.]5/5010/HTMLIEBrowserHistory[.]vbs

107[.]173[.]4[.]15/31009/exportideadslov[.]vbs

172[.]232[.]172[.]53/3031/Rosefromtitanic[.]vbs

172[.]234[.]249[.]47/20090/greatideaoflove[.]vbs

172[.]245[.]208[.]3/440/ibmSever[.]vbs

198[.]12[.]81[.]138/3590/IElevelup[.]vbs

103[.]183[.]114[.]5/1800/HTMLbrowserrecoverycache[.]vbs

107[.]173[.]4[.]15/24555/lovefamilymember[.]vbs

107[.]175[.]113[.]202/450/htmlvb[.]vbs

172[.]202[.]120[.]36/2119/Microsoftcookieclean[.]vbs

172[.]232[.]170[.]236/5009/newlovestory[.]vbs

172[.]232[.]172[.]53/2345/wealwayshappy[.]vbs

172[.]234[.]249[.]47/20080/greatloverstory[.]vbs

172[.]245[.]208[.]3/1577/updatechrm[.]vbs

23[.]94[.]239[.]93/3850/microsoftprofile[.]vbs

72[.]14[.]187[.]87/win/jsonjava[.]vbs

103[.]183[.]114[.]5/500/htmljg[.]vbs

107[.]175[.]113[.]202/177/htmlJsshtml[.]vBS

107[.]175[.]113[.]202/600/htmlmj[.]vbs

107[.]175[.]113[.]202/800/htmljss[.]vbs

107[.]175[.]113[.]204/6080/HTMLIEbrowser[.]vbs

147[.]124[.]214[.]183/new/cloudeyeScript[.]vbs

149[.]28[.]109[.]84/2550/microsoftprofile[.]vbs

149[.]28[.]109[.]84/3020/upgradedoffice[.]vbs

149[.]28[.]109[.]84/656/microsoftprofile[.]vbs

149[.]28[.]109[.]84/8100/microsoftprofile[.]vbs

172[.]232[.]163[.]207/4888/loverssecret[.]vbs

172[.]232[.]163[.]207/4999/loversfaster[.]vbs

172[.]245[.]163[.]139/2353/candyman[.]vbs

172[.]245[.]185[.]30/70033/createsurelove[.]vbs

172[.]245[.]208[.]3/225500/loverspoinlove[.]vbs

172[.]245[.]208[.]3/2355/Browseredgepro[.]vbs

172[.]245[.]208[.]3/3110/AItech[.]vbs

172[.]86[.]76[.]208/250/audiodg[.]vbs

188[.]127[.]249[.]32/1135/HTMLhistoryBrowserchromecache[.]vbs

198[.]12[.]81[.]138/354/CISIupdate[.]vbs

198[.]12[.]89[.]23/6700/coconuttree[.]vbs

23[.]94[.]206[.]107/5255/welovetou[.]vbs

23[.]94[.]206[.]107/5320/creativeidealove[.]vbs

23[.]94[.]206[.]107/5325/creativenewidea[.]vbs

23[.]94[.]239[.]93/1155/microsoftcookieclean[.]vbs

23[.]94[.]239[.]93/3121/microsoftdecided[.]vbs

23[.]94[.]239[.]93/5060/browserclear[.]vbs

66[.]228[.]43[.]8/166/htmljonson[.]vbs

66[.]228[.]43[.]8/250/javaJson[.]vbs

66[.]228[.]43[.]8/256/htmljson[.]vbs

72[.]14[.]187[.]87/588/microsoftwps[.]vbs

23[.]95[.]60[.]74/roammamamamam[.]vbs

70[.]34[.]197[.]128/500/marriagepruposal[.]vbs

172[.]245[.]208[.]3/225500/loverspoinlove[.]vbs

172[.]245[.]208[.]34/tuesdayfilemorning[.]vbs

172[.]245[.]208[.]34/eveningdroid[.]vbs

45[.]74[.]19[.]84/xampp/bkp/bkp1_vbs[.]jpg

45[.]74[.]19[.]84/xampp/bkp/vbs_novo_new_image[.]jpg

bolandraf[.]com/prostutefiles/mondayvbsfileeee[.]vbss

23[.]95[.]235[.]35/latinoooamexxx[.]vbs

192[.]3[.]95[.]216/tuesdayfreshmorning[.]vbs

192[.]3[.]95[.]216/myxlamexpCryptersAndTools[.]vbs

172[.]245[.]214[.]91/fridaexploit2[.]vbs

107[.]173[.]4[.]5/CryptersAndToojjjjls[.]vbs

3[.]145[.]88[.]189/www/MicrosoftEdgewantotdeleteentirehistorychachecookiefromthepctoclean[.][.]doc

23[.]94[.]206[.]107/3545/en/imageinethegreatcoffeemadeforeverybodytoloveandenjoythe____perfectcoffeefrommysidetounderstandhowperfectitistogetcoffeefromme[.][.]doc

23[.]94[.]206[.]107/5255/jh/wemadeentirekisstolovemakemorebetterwaytounderstandtheallprcesshowhappeningeverywherewithnewupdaitonofkiddoflovetokisss[.][.]doc

23[.]94[.]236[.]203/wq/wqzwqzwqzwqzwqzwqzwqzwqzwqz%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23wqzwqzwqszwqa[.][.]doc

23[.]94[.]239[.]93/cbl/browserforfindvideoswhichmakeyouhappyandfeelgoodtoseefromtheheartforentierwinworld[.][.]doc

23[.]94[.]239[.]93/ext/microsoftunderstandthenewtechnologytodeletehistorycachecookieentirethingsfromthepc[.][.]doc

23[.]94[.]239[.]93/gs/microsoftprofilebuildanewtechnologyfordeletecachehistorycookieeverythingfromthepc[.][.]doc

23[.]94[.]239[.]93/hcb/Microsoftunderstandwhyneedtodeletecookiecacheverythinffromthepcindcludinghistory[.][.]doc

23[.]94[.]239[.]93/hcl/Microsoftunderstandhowimportanttodeleteeverythingcookiiecachehistoryfromthepc[.][.]doc

23[.]94[.]239[.]93/mj/Updationavailableformisofficetocleanofficfilesandupdationsforclearpcfromthehk[.][.]doc

23[.]94[.]239[.]93/smr/entireeyetmeneedupdationfortocleanallbugsfromthepcsoupdatingmsoffice[.][.]doc

23[.]94[.]239[.]93/wed/Microsoftdecidedtoupdateentirethingsonthepctodeletehistorycachecookieverythingfromthepc[.][.]doc

23[.]94[.]239[.]119/_--00_o______---0o0_00_0oo_0-o_o0-__________o0o-__________/ozzwerdfdghjfdggsahfhfghf[.][.]doc

23[.]95[.]122[.]104/htm/1/HTMLbrowserIEchromeHistoryCleaner[.][.]doc

23[.]95[.]235[.]10/html/browserhistorydeleteallfrompctocleanbroallfrompc[.][.]doc

23[.]95[.]235[.]10/https/microsoftdeletedEdgehistorycachecookiefromthepc[.][.]doc

23[.]95[.]235[.]10/www/MicrosoftbrowserEdgedeletedentirehistorycachefromthepcforclean[.][.]doc

23[.]95[.]235[.]86/wdg/microsoftdeletedentirepccookiecachehistoryfromthepc[.][.]doc

23[.]95[.]235[.]86/whd/Microsoftdecidedtodeleteentirehistorycachecookieeverythingfromthepc[.][.]doc

23[.]95[.]235[.]86/wmn/Microsoftdecideddeleteeverythingfromthepccachecookiechistory[.][.]doc

23[.]95[.]235[.]86/wmn/wm/microsoftdecidedtodeleteentirethingshistorycookiecacheeverythingfrompc[.][.]doc

45[.]32[.]86[.]119/230/https/microsoftremovedhistorycachecookiefromEdgetocleanpc[.][.]doc

50[.]3[.]182[.]140/wew/I0OIIOIOi0ioii0oiioi0ioiooi0i00i0i0iooi0ioi0ioi0oi0ioi0000%23%23%23%23%23%23%23%23%23%23%23%23%23%230000000%23%23%23%23%23%23%23%23%23%23%23%23%23%230000000[.][.]doc

66[.]175[.]208[.]79/htm/brwoserdeletedentirehistoryfromthepcforclean[.][.]doc

66[.]228[.]43[.]8/edg/microsoftdecidedtodeletecachecookiehistoryeverything[.][.]doc

66[.]228[.]43[.]8/htc/Microsoftcleanedpchistorycachecookietemporyfilesentirethingsfrompc[.][.]doc

66[.]228[.]43[.]8/wed/microsoftdecidedtodeleteentirehistorycookiecachefrommypcforkeeppcsafe[.][.]doc

66[.]228[.]43[.]8/wll/microsoftunderstandwhyimportanttodeleteentirecookiehistorycacheeverything[.][.]doc

66[.]228[.]43[.]8/www/microsoftEdgedeletedhistorycachecookiefromthepc[.][.]doc

70[.]34[.]197[.]128/srvv/balloninstantupdatestartedrecentlyfornetirepcpeopleswhoupdatedlatestversionfoballonupdationfromthenewservicefromthepc[.][.]doc

70[.]34[.]220[.]238/erg/microsoftballondesignedbyentireprocesstoconfirmtheupdationtodevelopnewballonupdationrpcesstopcupdatepc[.][.]doc

70[.]34[.]220[.]238/ght/microsoftballondesignedbyentireprocesstoconfirmtheupdationtodevelopnewballonupdationrpcesstopcupdatepc[.][.]doc

72[.]14[.]187[.]87/whm/microsoftdeleteentirecontentfromthepclikecachehistorycookieverthing[.][.]doc

72[.]14[.]187[.]87/win/wi/microsoftunderstandwhyimportanttodeleteentirecachecookiehistoryeverythingfromthepc[.][.]doc

83[.]137[.]157[.]51/4545/mhc/everylovecantchangebecauseitsatrueloverwhichmakingeverythingmoregreatunder____newlovetointroducewithmyselfkiss[.][.]doc

83[.]137[.]157[.]51/xampp/ala/al/wecreatedlovetounderstandhowmuchloveineedtogiveherbacktogetlove______meandmyloverisverygoodrelationshopilove[.][.]doc

94[.]156[.]69[.]17/xampp/bll/leeisagoodmanwholovedhertrulyfromtheheartsheismycutegirl____ilovehertrulyfromtheheartwithallmylovetokissyousuccess[.][.]doc

103[.]27[.]132[.]200/ZW/i0ioi0ioi0ioioioiooiiIOIOOOI0IOIOI0O0OII0O0IOI0IOI0OI0IOI0OI000000%23%23%23%23%23%23%23%23%23%23%23%23%23%230000000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300000000[.][.]doc

103[.]29[.]3[.]200/https/microsoftEdgedeletedentirehistorycachefromthepc[.][.]doc

103[.]29[.]3[.]200/www/microsoftbrwoserEdgedeletedenitrehistorycachefromthepctoclean[.][.]doc

103[.]67[.]162[.]213/6090/hig/hyperloversknowthathowmuchiamfeelingonthelovewhichumadeformeireallykiissmyloverfrmtheheart____becauseshelovedmetrulyalot[.][.]doc

103[.]67[.]162[.]213/xampp/gd/kissingagirlissoeasyrecentlyireallyfeelsheismygirlineverwanttohurtherweneverwantotkissher_______ilovehertrulyfromtheheartiloveyou[.][.]doc

103[.]67[.]162[.]213/xampp/kbm/kbm/ilovehimtrulyfrommediafxpixelhandtreatedbymediapixelnetworkstilleverythinggodd____sweetkissigivenheronneckandfacetoget[.][.]doc

103[.]67[.]162[.]213/xampp/nst/greatwaytounderstandhowimporantthingsitisgreatgoodtounderstandlover____ireallywantthenewloversinthelineto[.][.]doc

103[.]133[.]104[.]112/rf/iotiotiotiotiot%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23iotiotiotiotiotiot[.][.]doc

103[.]183[.]114[.]5/1800/HTM/IEhtmlBrowserHistoryRecoveryCleaner[.][.]doc

103[.]183[.]114[.]5/5010/whc/HTMLIEBrowserHistorycleaner[.][.]doc

103[.]183[.]114[.]5/gfd/micorsoftdeletedentirehistorycachecookieeverythignfrompc[.][.]doc

103[.]183[.]114[.]5/htm/[.]documentdeletedbymicrosoftEdgeforcleanpurpose[.][.]doc

103[.]186[.]65[.]80/ijc/2/HTMLcache[.][.]doc

103[.]198[.]26[.]111/fh/fhh/streetloverkissyoureallygreatwaytoavoidthekiss_________________________________________________iloveyousomuchreallyloveyou[.][.]doc

103[.]237[.]87[.]56/rew/re/binwecanmaintainthenewthingswithhimbecauseiwasrunningaroundthewroldwithnew____icangofornewthingsfortruestoryuloverbrother[.][.]doc

103[.]237[.]87[.]56/xampp/ffd/vbn/binWinthisbeautifulmomentwithlovestorytounderstandhowmuchiloveu____sweetkissonurheadwithseetloveforyou[.][.]doc

103[.]237[.]87[.]56/xampp/xnv/xn/kissmydearuarereallysweetformetounderstandverycuteladyyouareiloveryoussoomuchto___mybabygirlyouareinmydear[.][.]doc

107[.]172[.]61[.]136/[.][.]-[.][.][.][.][.]----------------------[.][.][.][.][.][.][.]---------------------------[.][.]---[.][.][.][.][.]-----/138[.][.]doc

107[.]172[.]61[.]136/[.][.]-[.][.][.][.][.]----------------------[.][.][.][.][.][.][.]---------------------------[.][.]---[.][.][.][.][.]-----/138[.]doc

107[.]173[.]4[.]15/ezz/ezzmicrosfotdesignednewmethodofballoneupdationforbabyprocessforupgradeandupdateentierprocessfastetthanbefore[.][.]doc

107[.]173[.]4[.]15/gbn/mydearcutieireallyloveryoualwaysforgreatthingshappenedinsideofusforloverstogetreadyforthepointounderstandtheupdationforproccess[.][.]doc

107[.]173[.]4[.]15/hgj/microsoftdesignednewtechnologyforlovetoupdatenewthingsforgreatthingshappenedaroundtheworldtofocusfornewthingstodesign[.][.]doc

107[.]173[.]4[.]15/hmx/microsoftredesinglocaltochildprocessasballonforentirecustomerprocesshappenveryfasterthanbeforetoupdatepcfrompc[.][.]doc

107[.]173[.]4[.]15/rg/nicetoseethecutebabaygirlloversheis___________________________________________________mysweetbabydeargirlforloveandalltosee[.][.]doc

107[.]173[.]229[.]146/hgh/microsoftdecidedtodeleteentirehistoryfrmthepcforcookiecacheeverthingdelete[.][.]doc

107[.]173[.]229[.]146/wdw/microsoftdeletedentirethingsfromthepccachecookiehistoryeverything[.][.]doc

107[.]173[.]229[.]146/www/microsoftEdgedeletedentirehistorycachefromthepctoclean[.][.]doc

107[.]174[.]138[.]160/crr/iaminlovewithsomeoneshecuteandtrulyyoungunluckyshenotundersatnd_howmuchiloveherbutitsallgreatwithtrueloveriamgivingyou[.][.]doc

107[.]175[.]3[.]22/UHO/i0ioi0oi0ioiI0IOI0OIO0I0I0IOO0ioi0oi0oi00i00%23%23%23%23%23%23%23%23%23%230i0ioi0ioi0ioi0oIOI0OI0IOI0II0I0IOIO00%23%23%23%23%23%23%23%23%23%23%2300000[.][.]doc

107[.]175[.]3[.]22/wgw/2/x9[.]x9[.]x9[.]x0[.]x0[.]x0[.][.]doc

107[.]175[.]31[.]187/45008/hgt/iwanttokeepintouchwithyoubecausesheisveryfinebecauseiwanttoinformyouthat____itsverygoodtoheartthateverythingfine[.][.]doc

107[.]175[.]31[.]187/78009/ogs/mylifealwaysloveyousoomuchdearireallywanttomarryyoubutunluckyicant_____youalwaysmysweetheartineverforgetyoubecauseiloveyou[.][.]doc

107[.]175[.]92[.]68/sgb/Microsofttoldmetheywantodelteentirepccookiecachehistoryfromthebrowser[.][.]doc

107[.]175[.]113[.]202/800/whs/browserdeletedhistoryfromthepcforcleanentirecomputer[.][.]doc

107[.]175[.]113[.]202/htm/browserwannadeleteallhistoryfrommicrosoftedge[.][.]doc

107[.]175[.]113[.]202/html/htmlbrowserhistorydeletedbymicrosfotEdgenew[.][.]doc

107[.]175[.]113[.]202/whs/browserdeletedentirehistoryofthepctoclean[.][.]doc

107[.]175[.]113[.]202/www/Microsoftbrowserdeletedentirehistorycachefromthepcforclean[.][.]doc

107[.]175[.]113[.]204/6080/Htm/HTMLIEBrowserHtml[.][.]doc

107[.]175[.]113[.]216/xampp/krm/kr/heisagirlwholovedmealotwithoutanyexptationssheisreallyagoodgirlshemybabydear_____itrulylovedherfromthehearbecauseverycutebayb[.][.]doc

141[.]98[.]10[.]56/hml/HTMLieBrowserClearCacheHistory[.][.]doc

147[.]124[.]214[.]183/new/micrososftdecidedtodeleteentirehistorycachecookieeverythingfromthepc[.][.]doc

147[.]185[.]243[.]107/45700/macc/shelovemywifemorethankanyonebutsametimeiloveagirlwholovingmealot_____sheisreallymyloverwhocarewholovedmefromtheheart[.][.]doc

147[.]185[.]243[.]107/45800/mahr/mylovemywifemorethankanyonebutsametimeiloveagirlwholovingmealot_____sheisreallymyloverwhocarewholovedmefromtheheart[.][.]doc

147[.]185[.]243[.]107/45900/bnc/icreatedsuchatrueloveforthatgirulwhoiloveyoualotbecausemyloveistrueinever___guveupanychancetofailireallywatutrulyme[.][.]doc

147[.]185[.]243[.]107/xampp/kbo/wfe/ilovemywifemorethankanyonebutsametimeiloveagirlwholovingmealot_____sheisreallymyloverwhocarewholovedmefromtheheart[.][.]doc

147[.]185[.]243[.]107/xampp/klr/kla/myworldialwaysurlovertohearuaremyworldbecauseitrulyloveyoualotbecause_____youaremybabyandalwaysloverhersoomuchtruly[.][.]doc

149[.]28[.]109[.]84/gb/microsoftprofilehasbeenpdatedwithnewtechnologytodeleteentireoldthingsfromthepc[.][.]doc

149[.]28[.]109[.]84/hj/Microsoftprofileupdatedwithcookiehistorycacheeverythingtodeletefromthepc[.][.]doc

149[.]28[.]109[.]84/mj/upgradedmicrosoftofficeworkfordeleteentirepcofficeoldupdationstocleanpcfromthehk[.][.]doc

149[.]28[.]109[.]84/mjh/microsoftupgradedeverythingfromthepcfortomanagedatabasefromtheserverrtocleanentierthings[.][.]doc

149[.]248[.]54[.]207/hi/hihihiihihiihihi%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23hihihihi[.][.]doc

154[.]38[.]188[.]98/7171/khk/kissinggreatwaytounderstandhowimkissingherwithlotofhearttounderstandyouaremygirliloveu_____sweethearttounderstandkissingmygirl[.][.]doc

158[.]220[.]80[.]156/5454/hg/icreatedloveinsideofsomeoneheartsheismydearbabywhoilovealot____keeplovingheruntilmydeathuntilshesayshenotneedmebecauseilove[.][.]doc

172[.]86[.]76[.]208/whttp/x[.]x[.]x[.]x[.][.]doc

172[.]86[.]76[.]208/whttp/x[.]x[.]x[.]x[.]doc

172[.]202[.]120[.]36/hjn/microsoftunderstandhowimportanttodeletecookiecachehistorytemporyfileseverthing[.][.]doc

172[.]232[.]8[.]161/7009/srvv/kissyoulaterbuttrulyiloveyousoomuchfrontheheartonedaytrulyiwillkissyouseriouslybutstillicant____ilovegoodwayforubutnothingicando[.][.]doc

172[.]232[.]163[.]207/krss/microsoftdecentupdationprocessforentireballonprojectdevelopmentstoupdateentirepcupdationfasterthanbeforewithupdatepc[.][.]doc

172[.]232[.]163[.]207/vlcc/vlccisthebestupdationfromthemicrosoftballonnewresearchtoupgradeyourpcfromentireprocesstomakeitfasterthanbefore[.][.]doc

172[.]232[.]163[.]207/wee/microsoftbabyprojectstartedwithlotofhappinessitscalledballonprojectwhichdesignedtomakeallupdationsfasterthanbeforeonthepc[.][.]doc

172[.]232[.]170[.]236/ghf/dudeisagoodnametounderstandhowfastwecanwinthisindustrytodevelopnewthingswithoutanykindofloveoractiontolovethethings[.][.]doc

172[.]232[.]172[.]53/gts/x[.][.][.][.][.][.]x[.][.][.][.][.][.][.][.][.][.]x[.][.][.]doc

172[.]232[.]172[.]53/rfr/microsoftupdationgoingformicrosoftofficeupgradingtonewmsofficeprotoecoltoreducethesystemtestenoguh[.]doc

172[.]233[.]130[.]11/win/microsofttoldemethattodeleteentirehistorycookiecachefromthepc[.][.]doc

172[.]234[.]249[.]47/20080/ujh/beautifuldaygreatdaykisstolove__________________mekissyou________________loveyoualotwithfromtheheartotdayloveyousomuch[.][.]doc

172[.]234[.]249[.]47/20090/hg/peceofmindnewlaunchhappneedlove________________________________________ilovethisgirlalotbecauseinotknowyouareverycute[.][.]doc

172[.]245[.]163[.]139/9088/mpo/howtomakecoffeewithfreatlovertounderstandhowmuchcutireitstolovethesystemto______understandthecofeetogetloverfromthecoffeecu[.][.]doc

172[.]245[.]163[.]139/windows/tc/iloveyourpaternhowdobehacinvingwithmewithanewastrologicalmove______toundertsnadhowulovemealotkissyoulipsiloveyou[.][.]doc

172[.]245[.]185[.]30/jhh/myheartgrowingbettr_______________________________________________________________________warmuptoundertandthegod[.][.]doc

172[.]245[.]208[.]3/ffcg/pointofviewballoneprojectismyfavourateproductwhichcamefrommicrosofttodevelopnewupdationrpcoessonpc[.][.]doc

172[.]245[.]208[.]3/hmj/currentupdationoftheexplertsayingintsverybigindustrywhichgoingtohitinthemarketwithgolobalfram[.]doc

172[.]245[.]208[.]3/rgrs/x[.][.][.]x[.][.][.][.][.][.]x[.][.][.][.][.]x[.][.][.]doc

172[.]245[.]208[.]3/sml/goodlearninghelptoreachaudiencetounderstandhowfastthisworldgoingonforideoretirments[.][.]doc

172[.]245[.]208[.]3/spc/msofficeinternationaltransferfromoldoffietonewofficeisanamazingprojectwhichbuildbyinsternationalstandarardforpriject[.][.]doc

172[.]245[.]208[.]3/swd/microsoftbeautyisconfirmedbymsofficetocreatenewwordfileforgoodvibe[.][.]doc

172[.]245[.]208[.]3/werf/microsoftdesginedballontechnologyforentireprocesstoupdatethenewballontechnologyfromthenewupgradeprocesspc[.][.]doc

172[.]245[.]208[.]19/html/Browserdeletedhistoryfrompcforclean[.][.]doc

172[.]245[.]208[.]19/https/microsoftdeletedentireEdgehistorycachecookiecleanfromthepc[.][.]doc

172[.]245[.]208[.]19/www/MicrosoftbrowserEdgeentierhistorycachedeletedsuccessfully[.][.]doc

172[.]245[.]208[.]28/exl/entiersystemneedsuchagoodupdationforsecuretheofficefilesformthepeopleswhocatchsystem[.][.]doc

172[.]245[.]208[.]28/hjk/msworldwidenamespreadingaroundtheowrldtoorigantixationtodevelopnewproductforfutureprupeorps[.][.]doc

172[.]245[.]208[.]28/wdc/microsoftwindowsneedsuchanupdationfromthepeopleswhotakeofficefilesfromthecomputer[.][.]doc

172[.]245[.]208[.]28/wedf/microsoftreturnedthrpolicytocontineutheserviceupdationfromthesystemprotocoltounderstandentireprocessfromth[.][.]doc

172[.]245[.]208[.]28/wedf/wed/microsoftreturnedthrpolicytocontineutheserviceupdationfromthesystemprotocoltounderstandentireprocessfromth[.][.]doc

172[.]245[.]208[.]28/wer/microsfotdecidedtoupdatemsofficeforsecurethesystemandentireprocesstocompletethetechnologicalthingsfromthenew[.][.]doc

172[.]245[.]208[.]126/SSH/MicrosfotEdgedeletedhistorycachecookieentirethingsfromthepc[.][.]doc

172[.]245[.]208[.]126/hsr/microsoftdeletedentirehistorycachecookieeverythingfrommypc[.][.]doc

172[.]245[.]208[.]126/win/Microsoftdeletedentirehistorycachecookiehtmleverythingfrompc[.][.]doc

188[.]127[.]231[.]198/9090/kuch/krishtokrushthelovebecomeabeautifulovetounderstandhowmuchshelovedmetrulybecausesheis_____greatlovertounderstandhowmuchsheis[.][.]doc

188[.]127[.]231[.]198/70800/jhi/imeaniamagoodboytounderstandhowsimplyicanhandlethegirlfrommysidetokissherlips___withoutanykindofloveandkissharder[.][.]doc

188[.]127[.]249[.]32/250/Nbc/HTMLieBrowserCleanupBrowserHistorycleanup[.][.]doc

188[.]127[.]249[.]32/1135/htm/HTMLbrowserHistoryCleaner[.][.]doc

188[.]127[.]249[.]32/cvg/HCLcleanupcachecookiebacupcleanall[.][.]doc

192[.]3[.]95[.]131/www/OIOI0OIoioioi0oioII0IoioioiOIOIOioi000oi00oiOIOI0IOIo000000%23%23%23%23%23%23%23%23%23%23%23%23%23%230000000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000000000[.][.]doc

192[.]3[.]95[.]135/xampp/hug/shewantihavetohughimtigtlyandshewillfeelgoodbeausesheisverybeautifulgirl___undestandhowmuchilovehretwith[.][.]doc

192[.]3[.]108[.]47/html/HTMLcache[.][.]doc

192[.]3[.]108[.]47/iso/HTMLcache[.][.]doc

192[.]3[.]179[.]133/html/1/htmlbrowserhistorydeletedbymictosfotEdge[.][.]doc

192[.]3[.]179[.]133/html/browserhistorydeletedfromthepcforcleanentirethings[.][.]doc

192[.]3[.]179[.]133/www/microsoftdeltedentirefileschachehistoryfromthepcforclean[.][.]doc

192[.]3[.]179[.]162/hdw/Microsoftdecidedtodeleteentirehistorycachecookieeverythingfromthepc[.][.]doc

192[.]3[.]179[.]162/huj/microsoftdeletedentirehistorywhichneedtocleareverythingformthepcfor[.][.]doc

192[.]3[.]179[.]162/jx/microsoftdeletedprofilehistorycachecookieverythingfromthepcformakeitstrong[.][.]doc

192[.]3[.]179[.]162/sbg/microsofttoldemetheywanttodeletehistorycatchcookiefrommypc[.][.]doc

192[.]3[.]179[.]162/ssh/microsoftEdgedeletedentirehistorycachehistoryfromthepc[.][.]doc

192[.]3[.]179[.]162/wg/Microsoftdecidedtodeleteentirepatternfromtheosforprotectcustomerfromthenewtechnologies[.][.]doc

192[.]3[.]241[.]235/ssh/microsoftdeletedentirehistorycachecookiefromthepc[.][.]doc

192[.]210[.]214[.]26/grfs/newdesignremadeforofficeforinternationalstandaradtoinvestmenttruththepeoplesgood[.][.]doc

193[.]56[.]255[.]218/eva/maintaintheloverwithagoodheartwithoutthinkinganythingundernewthingstogetits______newprojectounderstandhowmuchkidd[.][.]doc

198[.]12[.]81[.]138/bvc/internationalchallengeforresducetheperformanceomsofficebutmicrosoftdesidnisdifferentfromtoherstostartup[.][.]doc

198[.]12[.]81[.]138/cen/microsoftcreditedunavailabelthingsintheupdationtogetreadyformoresecuretheprojectfromtheotherstohelp[.][.]doc

198[.]12[.]81[.]138/cis/microcontentcleanbysysteminformationaindustrymostsucessfullpersonintheworldtocontinuehittheprogram[.][.]doc

198[.]12[.]81[.]138/gss/microsoftdesignednewpatendtoupgradetheprojectentriesystemtomonitoralltheactivitieswhichahppeneingfromthepc[.][.]doc

198[.]12[.]81[.]138/html/browserdeletedentirehistoryfromthepcforclean[.][.]doc

198[.]12[.]81[.]158/jjh/weconnectedlovereachotherformakethemhappyandsmilethemwithallheartstilltheyarereallyhappy____withourloverstogetbackintheworldoflove[.][.]doc

198[.]12[.]89[.]23/hth/loeisthebestpersonforeveryonetounderstandhowimportantforutounderstandgoodthingsevermadewithleolovertogetbacktomegreatthings[.][.]doc

198[.]12[.]91[.]244/xampp/bgo/cratedsmoothlovercontentwithintimetounderstandhowmuchicanloveyoutrulyfromtheheartbecause_____ilovetoinformuthatshelovingmetruly[.][.]doc

198[.]12[.]91[.]244/xampp/bii/sweetkissmademehugtoherwihtallmyheartbeacuasesheisverybeatutuflgirlwhoilovetrulyfromtheheart______ireallyloveherfromtheheartsweetkiss[.][.]doc

198[.]23[.]156[.]251/ibm/2/ibmibmibmibmibmibmibmibmibbimbimb%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23ibmibmibmbimbibmibmibmibm[.][.]doc

198[.]46[.]173[.]145/mkj/kissofyourlipswithlotofloveineverwanttokissherwithoutlovebecausesheismyheart____wefeeltokissherlisptrulyfromthehear[.][.]doc

198[.]46[.]173[.]145/uhh/decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat[.][.]doc

198[.]46[.]173[.]145/xampp/mkn/ceinmaisafashiobutverygoodlovestoriesareinthrtounderstandhowtolove____agirlwithallmyheartstillalsoiloveheralotkissyou[.][.]doc

198[.]46[.]174[.]147/lkj/lk/microsoftdecidedtodeleteentirethigsfromympcforcleancookiecachehistory[.][.]doc

198[.]46[.]174[.]147/lkj/microsoftdecidedtodeleteentirethigsfromympcforcleancookiecachehistory[.][.]doc

198[.]46[.]174[.]147/mjx/microsoftupgradedentiretechnologyfromthenewunscaratchedformulatocleanentierpcfromhk[.][.]doc

198[.]46[.]174[.]147/plk/microsfotdecidedtolaunchnewtechnologyforcreatenewproductsandservices[.][.]doc

198[.]46[.]174[.]147/ssw/microsoftdeletedentirehistorycachecookieeverythingfromthepc[.][.]doc

198[.]46[.]174[.]147/wdw/dw/microsoftdecidedtodeleteentiredatafromthepchistorycookiecacheeverything[.][.]doc

198[.]46[.]176[.]159/xampp/raz/ra/wandloverskeepingthridentitypersoanllyforkissingpurposefromotherswholovingmetruly______ireallyloveheralotwithlotofhearttrulykiss[.][.]doc

198[.]74[.]57[.]54/12233/wess/metellyouthatikissherhardwithmysweetlipsandshesaidshewantmorekissfrommeitrulyloveherwithallmyheart______shewantmylovetrulyandveryhardly[.][.]doc

198[.]74[.]57[.]54/13355/rrt/magicloverstillalsolovingthemagicofkissingandeverythingtheythinkingitstheyloverknowwelll______sheismybabygirlwhoilovehersoomuchiloveyoukiss[.][.]doc

207[.]32[.]219[.]82/3120/mah/whenufeeliloveyousoomuchthattimeuunderstandhowmuchiamlovingyouualwaysmygirlinever____wanttokissyoualotwithyouilove[.][.]doc

207[.]32[.]219[.]82/3130/mhto/imageinetheloveofactionhappenedeverytimeyoudidseetheamazingaction___weareinheretounderstandhowmuchiamlovingyou[.][.]doc

207[.]32[.]219[.]82/3500/543/imaginecreatelovertounderstandthewayofurworldtoseehowitswillbegoodforu_______thinkthewayhowicanunderstandthegoodfor[.][.]doc

207[.]32[.]219[.]82/7050/snk/snkisanewthingswhichhelovesornotireallynotknowwhathelookingbutshesloved___alotwiththisnewthingswhathetoldme[.][.]doc

94[.]156[.]65[.]225/microsoftdecidedtodesignnewproducttoupdateandupgradenewprojectthingsonthepcandsystem[.]doc

23[.]95[.]60[.]74/weareinlovewithmygirlfriendunderstandhowitistoget___youareverybeautifilformeiloveusoomuchalwaysloveutrulyfromtheheartlove[.]doc

23[.]95[.]235[.]35/imfeelingalotandbleedingseriouslywithmyheartandiamtryingtofigureoutfromentierthings_____ireallyloveutrulyfromtheheartbutiknowmysituations[.]doc

172[.]245[.]208[.]34/mrngfilelovetohiteverywheretounderstandthethingstoknow_________tobefrankiloveyousoomuchmybabygirltoseeyoualottounderstand[.]doc

172[.]245[.]208[.]34/icreatedloveonherheartwithnewthingswhichwillunderstand_____howiamlovingherwithlotoofheartwithlove[.]doc

185[.]254[.]37[.]80/HTMLcache[.]dOC

bolandraf[.]com/prostutefiles/HTMLbrowserChromeCleanHistoryall[.]doc

bolandraf[.]com/prostutefiles/HtaieBrowserhistorycleanercache[.]doc

23[.]95[.]235[.]35/decentchatmakemeanewgirlfriendwhocanlovedmetrulyfromtheheartbecause___sheismygirlwithnewheartandallsheis[.]doc

23[.]95[.]235[.]35/imfeelingalotandbleedingseriouslywithmyheartandiamtryingtofigureoutfromentierthings_____ireallyloveutrulyfromtheheartbutiknowmysituations[.]doc

23[.]95[.]235[.]35/feelinggoodwithlovertounderstandhowmuchilovingherwithlotoflove___trulylovingtheheartwithlovertokissmehardtolove[.]doc

192[.]3[.]95[.]216/freshmornigeveryonegoingforupdatetheupgrade____________________________________________touupdagradetoupdategoodforgood[.]doc

192[.]3[.]95[.]216/base64document[.]txt

172[.]245[.]214[.]91/secondindustrytopofthelsecondtoenhasednewtechnologyfordevelopnewthingsfornewthingstounderstandthenewthings[.]doC

107[.]173[.]4[.]5/babuchattangoodforeveryonetohandlethenewthingsforhimgoodandgreafor[.]doC

104[.]247[.]204[.]205/microsoftdetecthistorycachecookieentirethingsfromthepcfordelete[.]Doc

107[.]175[.]31[.]187/45009/gjk/ianttokeepintouchwithyoubecausesheisveryfinebecauseiwanttoinformyouthat____itsverygoodtoheartthateverythingfine[.]doc

107[.]175[.]31[.]187/45008/hgt/iwanttokeepintouchwithyoubecausesheisveryfinebecauseiwanttoinformyouthat____itsverygoodtoheartthateverythingfine[.]doc

107[.]175[.]31[.]187/7508/ere/mewithlovetounderstandthebeautifuldaywithurkissandloveitrulylovehersoomuch___withallmyloversbacktokissmylips[.]doc

107[.]175[.]31[.]187/8808/ISD/mygirltobegoodwithentierprocessididwithhersheismygirlireallyloveheralot_____youmygirlwithentirethingswithugoodsoomuchlove[.]doc

107[.]175[.]31[.]187/78009/ogs/mylifealwaysloveyousoomuchdearireallywanttomarryyoubutunluckyicant_____youalwaysmysweetheartineverforgetyoubecauseiloveyou[.]doc

107[.]175[.]31[.]187/30008/vbg/verysurekisscanbreakallmyheartwithlotofloveireallyloveheralotwithallmyheartsheismyheartbecause_____ilovehertrulyfromtheheartbecausesheismyheartbeat[.]doc

107[.]175[.]31[.]187/30009/org/verysurekisscanbreakallmyheartwithlotofloveireallyloveheralotwithallmyheartsheismyheartbecause_____ilovehertrulyfromtheheartbecausesheismyheartbeat[.]doc

147[.]185[.]243[.]107/45700/beautifulglobe[.]jpg

147[.]185[.]243[.]107/xampp/kbo/createideasimage[.]jpg

83[.]137[.]157[.]51/xampp/ala/imaginethegetit[.]jpeg

147[.]185[.]243[.]107/45800/imagepixelcreated[.]jpg

147[.]185[.]243[.]107/xampp/klr/imagainpixelgreats[.]jpeg

83[.]137[.]157[.]51/4545/sampleimage[.]jpeg

107[.]175[.]113[.]216/xampp/krm/PixelImagesview[.]jpg

147[.]185[.]243[.]107/45900/imageclear[.]jpg

158[.]220[.]80[.]156/5454/babyimage[.]jpeg

172[.]233[.]129[.]114/5600/example[.]jpg

193[.]56[.]255[.]218/15005/mho/imagine[.]jpeg

103[.]67[.]162[.]213/6070/pixelimagesupdate[.]jpg

103[.]67[.]162[.]213/6090/imaginepixelpicture[.]jpg

107[.]173[.]4[.]15/2008/Iscreen[.]jpg

107[.]175[.]31[.]187/7508/iconimages[.]jpg

188[.]127[.]231[.]198/9090/imaginesamplies[.]jpg

207[.]32[.]219[.]82/3120/lovethemagicof[.]jpg

23[.]94[.]206[.]107/3545/pixelimage[.]jpeg

23[.]94[.]206[.]107/75099/pixelreturn[.]jpg

103[.]67[.]162[.]213/xampp/kbm/imagepixelgetback[.]jpg

107[.]173[.]4[.]15/2010/imagine[.]jpeg

107[.]173[.]4[.]15/4050/screenshort[.]jpg

107[.]175[.]31[.]187/21113/imageforlovers[.]jpg

107[.]175[.]31[.]187/30008/cinemaimagepixel[.]jpg

107[.]175[.]31[.]187/30009/pixelimagesupdated[.]jpg

107[.]175[.]31[.]187/78009/pixelimageslovepic[.]jpeg

158[.]220[.]80[.]156/6050/imaginegreat[.]jpg

172[.]232[.]8[.]161/7009/pixelcleannotgoodfor[.]jpg

172[.]233[.]129[.]114/7500/image00012[.]jpg

172[.]233[.]129[.]114/800900/imagineloverskiss[.]jpg

172[.]245[.]163[.]139/9088/imaginepixel[.]jpeg

172[.]245[.]163[.]139/windows/icreatedlovers[.]jpg

172[.]245[.]185[.]30/7500/moh/ilinecreated[.]jpg

188[.]127[.]231[.]198/1500/createdPixelimage[.]jpg

188[.]127[.]231[.]198/8080/pixelimagespixel[.]jpeg

193[.]56[.]255[.]218/XMP/anny/imagecleanpicture[.]jpg

193[.]56[.]255[.]218/xlm/alaz/imagebeautiful[.]jpg

198[.]46[.]176[.]175/4545/imaginethepixelgood[.]jpg

198[.]74[.]57[.]54/12233/imaginehighpic[.]jpg

198[.]74[.]57[.]54/13355/imagespixelnetwork[.]jpg

207[.]32[.]219[.]82/3130/imaginepixelclear[.]jpg

207[.]32[.]219[.]82/3500/lover[.]jpg

207[.]32[.]219[.]82/4500/imagine00002[.]jpg

207[.]32[.]219[.]82/7050/imaginepixelimages[.]jpg

23[.]94[.]206[.]107/75090/imageRing[.]jpg

23[.]94[.]206[.]107/9800/icreatedlove[.]jpg

192[.]99[.]190[.]119/img/uwp4246971[.]png

107[.]175[.]31[.]187/7508/iconimages[.]jpg

107[.]175[.]31[.]187/8808/imaginepixcelwork[.]jpg

107[.]175[.]31[.]187/78009/pixelimageslovepic[.]jpeg

107[.]175[.]31[.]187/30008/cinemaimagepixel[.]jpg

107[.]175[.]31[.]187/30009/pixelimagesupdated[.]jpg

107[.]175[.]31[.]187/21113/imageforlovers[.]jpg

192[.]3[.]108[.]47/2114/UBC[.]txt

192[.]3[.]108[.]47/iso/bh[.]txt

193[.]56[.]255[.]218/15005/mho/MHD[.]txt

23[.]94[.]239[.]93/2355/MJX[.]txt

107[.]175[.]113[.]216/xampp/krm/KRMC[.]txt

188[.]127[.]249[.]32/250/NBC[.]txt

83[.]137[.]157[.]51/4545/Mohs[.]txt

83[.]137[.]157[.]51/xampp/ala/DFC[.]txt

103[.]183[.]114[.]5/1800/HDXR[.]txt

103[.]67[.]162[.]213/6090/FGF[.]txt

107[.]175[.]31[.]187/7508/xwo[.]txt

147[.]185[.]243[.]107/45700/MACC[.]txt

147[.]185[.]243[.]107/45800/MAC[.]txt

147[.]185[.]243[.]107/45900/MAH[.]txt

147[.]185[.]243[.]107/xampp/kbo/WQS[.]txt

147[.]185[.]243[.]107/xampp/klr/KISS[.]txt

158[.]220[.]80[.]156/5454/FFB[.]txt

172[.]232[.]170[.]236/24445/WSE[.]txt

70[.]34[.]197[.]128/500/SVRR[.]txt

103[.]67[.]162[.]213/xampp/kbm/RMB[.]txt

107[.]173[.]4[.]15/25009/EWS[.]txt

107[.]173[.]4[.]15/31009/BVG[.]txt

107[.]173[.]4[.]15/35005/HZA[.]txt

172[.]232[.]163[.]207/4888/SSW[.]txt

172[.]233[.]129[.]114/5600/SVR[.]txt

172[.]234[.]249[.]47/20080/SVV[.]txt

172[.]234[.]249[.]47/20090/KML[.]txt

172[.]245[.]208[.]3/99880/HGCJ[.]txt

172[.]86[.]76[.]208/250/XMR[.]txt

198[.]12[.]81[.]138/354/MNA[.]txt

198[.]12[.]81[.]138/3590/REV[.]txt

198[.]12[.]89[.]23/6700/GVT[.]txt

198[.]46[.]176[.]175/4545/ALA[.]txt

198[.]74[.]57[.]54/12233/SVR[.]txt

198[.]74[.]57[.]54/13355/RFF[.]txt

207[.]32[.]219[.]82/7050/SNK[.]txt

23[.]94[.]206[.]107/3545/ENGH[.]txt

23[.]94[.]206[.]107/5255/WDC[.]txt

23[.]94[.]239[.]93/3850/GSX[.]txt

23[.]95[.]60[.]74/romamammamamamaa[.]txt

70[.]34[.]197[.]128/500/SVRR[.]txt

172[.]245[.]208[.]3/225500/HMZZ[.]txt

bolandraf[.]com/prostutefiles/droidpedophylebase64[.]txt

bolandraf[.]com/prostutefiles/droibase64mohammedupdatedfile[.]txt

23[.]95[.]235[.]35/eurpatoday15th[.]txt

23[.]95[.]235[.]35/iurupaaaaaaa[.]txt

170[.]75[.]146[.]119/mokkhkhkhkhkhhkhk[.]txt

172[.]245[.]214[.]91/base64droid[.]txt

107[.]175[.]31[.]187/7508/xwo[.]txt

107[.]175[.]31[.]187/8808/EFG[.]txt

107[.]175[.]31[.]187/30008/ENIN[.]txt

uploaddeimagens[.]com[.]br

wallpapercave[.]com

imageupload[.]io

2s[.]gg

i8[.]ae

tt[.]vg

ye[.]pe

dik[.]si

qly[.]ai

tau[.]id

uri[.]ac

rdre[.]me

shlx[.]us

shtu[.]be

ssur[.]cc

toss[.]is

tyny[.]to

tt22[.]in

l-to[.]com

paste[.]ee

r2u[.]site

urlsh[.]us

qr-in[.]com

ur8ly[.]com

File	md5	sha1	sha256
4c7bdc42ec5df40146a73fef5af4928b.docx	4c7bdc42ec5df40146a73fef5af4928b	08b7d3b19ee002fc1977170c94f26a412dcd3787	6ca1bff32ddd346f959911e8aedcf0bbe3a3da18a143baa3c44d1b625ef1eb1f
ZFGG.exe	e285ed72d3371a9280374880e7e91d04	6469e6950a845c31765412b16a2031ca48212a88	cf26af0896b59a0e74f1ed17682d477f978979561f8783e222a64cacdaeb91df
YMIST0035362.docx.doc	162052c507a391d341342ecdc994692e	c764d6470cf3932ce3a13d5c05b14e9a236ff0fa	62e9d7296de6b25e0c67785d5c39557dfa1fb099b5f1fab24dfa1bcdcd78989a
Yeni fatura.docx.doc	9818f83f09da7f225a28153ad607e821	8bd40194c741c9ac9ee50c348981edca15a5519d	fda7e2d7a3ee70355988afc70ee4d6ebf08b76ef38f4504aa1cf5f8fa9a99b2e
wedecidedtomovewithproperprotocolofofficetounderstandhowimportantistheupdationfrom.Doc	870bf86cb353bafd925e924dbea2c70f	acd3b796d5665ded2feec9405348375507fa7a61	d73d45a518d1bdf7ac662aed7087923f06d3318981e27a3373a938be20bd84a6
ventaAQF786 152.docx	cb5219cd772efb911f3edbd43c9071bd	3d687920329bcad5a1ff5cd32388ce9a370a975a	1e24d4f848ee65fbf3229a681af9f25156fb41c97444cd95ae3186087b93ef35
VAN3065008.xls	72b5f5e195a0d1d6e8e4887b37712b65	63e27b152f8a608192ea0509af3399d7a51cd80d	7aee7531861d50a780d57eaf464dea4305e039da811d3ad7dc39fdbbf369972b
V-24-603-017.xls	f048985cc8229b16b5fbb282ece05980	c1ad7328fcf745c1656f3a541c66608da754ed92	67c8e554be1e02a42b6d4d7568917e69f346b7f13caed52c5d9ee5b469f4cde2
uSLQ.exe	d77b5da40ac0bb23565a865f95e6a395	11e713bb72de9814062ae2009aa373cfa7fe125a	2645d50a9a96fff16262028f4822c6d14cdd1b5332c2196ca8190cdf0d96e944
Updationavailableformisofficetocleanofficfilesandupdationsforclearpcfromthehk.Doc	1990c5debf314b3860557e285f8c00ac	0fdf6f2916881c99ae4f00fb927f1a5571da2d65	fc38782dc12198996057cfd2de64a43a2b0862a3c845edba5fd9903bf1d91972
UNB-PIO88938MBANSOP.docx	2913937764f653419e6885356414900d	79357ccab662489ed1e9c301f30371dd10701656	b8cb47db5ee0fe31ec1558226bc74a9c1581f4d157fb7dec1d98084c88205bb6
TTXCopy.xls	26beb641321ce859d389a80ccd1416d9	8a47f46ab9f3ed5fd132cd8f30ece15e6c47cf21	3c756278503cd67e4ca18fa2acbba31c308153b5801f24b222a42b4b3331c780
TT SWIFT COPY.xls	a2d25cee452ace0a4b948fd23f4f66fe	efc18a43109a3973d974d696bb9847c33addfee5	189e263a8de9f36ea0ff32a83b0155dad55c8aca9d8631ac93003ba80d4f4369
TransportLabel_9884037820.docx	2e8f8f7ee3f8bebb07dc65c4f3eb8a44	1ae33c13e5504b73f62189e04a7960c20e74c7ad	578e10ea5b14826cefbdc2f8a09af112ec0285d9579e2dc636a6ad69c1d623ad
transferencia09.xla	cd31d0c3ea63c8f3cb797f30250162ca	ca00c8e4cb09165da43d9501d7a28d7c31077eaa	9924730590b95f043ea6b021c806eb9f3135dc9f7e9150ae4eee0ba8b9308d46
transferencia.xla	e52f3b4411da52426f1cfc922a00ccbc	b900e45999942e6d61db42cd65f820e9957f0f52	b2040e137442469a9a023aa000cb10e6fa07eef56aa7a069676d60bb99d0c4b0
TiWorker.hta	328e0141e999dfe62d9429c5685aabd2	c0da7f205c769131e0433af452945c7e632218ec	5e0cd5b245475e94c2ae0e279629682b39963e7f5c66f176525c248f008dddf5
tax invoice arrival notice.xls	c471bbf5fc0c74bbb0551ed29beda615	a95943f311ec9e2e5e157ced3daac28beb31cc6f	35c25d2e144e776b201ef212a32141f978e0c38a4b973c64034865880d124f46
sw-O2024-Invoice.docx	f59d97797189676917d0b462a080fd29	a660ab84283b72f7a371aa806092800a0af1c134	2a3626fa590b72f5a372351b1a8e18a524f356b1499f8a08af326c67692217cd
swift_3094.docx	49a3ee37781cac92181f0c1c80e5fb0d	6d6d1889835319c81e546728d4ec6f965ece85f0	bc46b7b44928f6ad586d787db33f53ed962aab72441a5518efb3e971d36a40e2
Swift Confirmation-FTT107453.docx	8dca010cc5aa6f9e6e171f85416d80e4	4670088158f0d0bfbedd79d98b7a86ebec1a73ec	ed8a1397a4a0ffd9ef975aa59f56d7bb2ca6127490e9acd1b8d61dddb5f85152
SW240202P3.docx	784cd98a33d21ac20ffb4cf807c19f34	99c47d4ff4ce4c17ba415aff15ed49b19b0417a4	6dc9e293197193293300343489928fab266fe5a0052e6604bec41deb96357b6a
SW240202P.docx	2f2e683eedb1b533007453c00d3d8c88	3dc1b480a400ec2596340b11d44e86509941891f	e300572561c9ffe1a77011a2fd73df8b6758afd48c157b0c2c98c04af38730d4
SW240202P.cleaned.docx	ce00889ac22eabbc9d104482bf9c4077	2551b7d13ca515024c3201144341679a20a2f055	6a250bac73308bbcd6ff5f88a0d49193bfa8bc6ac782bc0fe1b7d2fbba70cfee
SURRENDERED BL# 235301035489 - IN.570.docx	4da0cf8c07b4e0909ebd030299c04f3a	8fae5af8e828901f63a82a7efa7e57e504fcc5df	edab2319ce7f93b8244e5f1dcc3050992e712eb6e8204e14e97247abba62b9c5
SurfsharkSetup.exe	aae822cfaae4e1cfcdfc4f1dfdd7a966	f22817ca641b30ddd80c05a6168169dc1d838af8	d06db1d822307914827ad6241ceba35895b95a5cb6d18629d0b6390b562204e4
STMIST0035362.docx	32dfaad230a65458f71218775481d663	c697255e7e2869253181d285a957d486847f137b	1a1846ff4275aa6b5f4e4ed4ac120e9d84f53d0e63bf63b961a9f27645e6fbb6
spiketail.exe	4a96b49869fa9d638338f21ffe76a749	d1e47e0b12747b4c26ad0fd2003c67ab7c89b5b9	6ce0bdeb481f793ef08a7768f193fdff672ec989ca1651c1f3ffa10a9f2119ea
SMC 185.xls	d9989db7ad4ffcef273fce28cefca62c	0e59baeb2575c53881793d0d856795a8d4b4d69f	344e937153381157df78c0df987f715038da6d3b771f1dd4ac4168025a3e9221
SHIPPING DOCUMENT.xla.xlsx	06ac0d563d75b5c3e4de9e686fdd0c7b	d56940deb34bc057e9cb8b476ff6e4095e7628b9	e58b181e402bbb177cba3bfe61f78670b4d2eedf36d81913f80d16b0f66b953d
SHIPPING DOCUMENT.xla.xlsx	ea0ec6a991e9088a9d1a59dc0a88aebb	21235976eaa20ba5d0341e7a1c75ad63ea4f5619	a5fe6c5f1e7e5fe67f8d142239c7cccb0cccc36716f3ccce480d6bd2f96c0c48
SHIPPING DOCUMENT.xla	569b4a6a968417636fa039dc796f2352	ae4ae9eb5045fb7b8c56224ebae0f0c2ca75744e	11137abab3a5704967e611345b897ca2efb448db171ef5bec0e521678a898a15
Shipment Documents.docx	73afe5be0d15b6dcd520f9655d7b03e3	aed52a2c473bbe5272636d738b2e214c601b3079	5572ffd080ba92dc24bd703be1d53d5b4bcad05ae87bf74c175f9cb03ac7c09a
SecuriteInfo.com.Exploit.ShellCode.69.31617.16904.rtf	14ab95c7f7b59deb0ef67a75217cd650	bed64cc6b8f0f4f632209515fe693800e0ef3e5d	8c02bf570e87d9515d43ab42e5e7846a5f87675a5d5a9cab386b7af44db01e25
SecuriteInfo.com.Exploit.ShellCode.69.31205.8329.rtf	ca1a5ff8098c6b5a7bf4bf524f12286e	ca381306bd0da25fd26d35577a6585bb966ca8b8	e34c2541becc487a6a0dad1e7e2a7a67b3d8cb6b817827ec1b4a9b0b5bf33936
Sample DrawingsOrder Sheet_09272023.xls	5d51496d75df6969e707fc16970c9c2e	6be0d19b811da758233951f95e483f8e76b5efb5	7d9994c10dc1afd596648bad3156e571c30f66667ddc7558097a1ffd3ebff59a
rtxt.rtf	950fe6bc02caac4ba8fff2cf76d56257	8ee3339859aac5f0a5becc1a2a034ee571a39c3d	8e26ad16c08d01c073092e210fa474f2f6df516fe26b04d6dd54e8d325e19503
RFQ_PO_december_order_sheet_design_and_ specification_04_12_2023.xls	b02aa474ddd7087b2ca33dbe0414f10b	9f819597d49283b719342b271d55d0a25b993801	0d9142a196b7a1715add306f46f4426a6c16afef83c906c2bd100c4919939fc5
RFQ.xls	413cea1a9f45536823254b21ea06b6ef	0cbbaee2d968b9eae700fcc0347d686ce2d50714	eda301ea5f51da4632028de04c78dbefc6e3f6710894dd2e05e37c23ceb2228a
RFQ Halliburton.xls	d2205c671d5221146e23d8038a4fc425	6c722d7ffc2e84ce49f4caca61536da6ea7e1bf5	16fb406b1f9e83a5d28e652c89545538b3ba6cc4b09ccc851d13c233ee95a02b
RF083209.xls	e58465caffa9c59b66cbd7f103efcf4e	e256b7c4d8310c13da7e56740f635ef935b6898b	11e070f1b5265a29906d455f5e9ad3acb4c2283e091c821fd31599e9c034937f
revised_quotation_for_purchase_invoice_order_3rd_november_2023.xla	4ef3d6fc7ad802ff545ced3b54432715	2ec0c7b9f96470969e2c11e6a97c392dce336939	2d5033463b7a9dd0efc32ccf56ba05d592a9921b8c956e4787e7479db26cc71f
revised_purchase_order_catalog_design_no_TZ806_27102023_00000000023.xla	26f25d2c145492004ff51235acfae7b9	81ad675d6b2951c0d83fa917527644cb033d9d39	25ff805aa8df04ddeb2ed6a8687f17569dda9ccdf4089dc0cd8910987e799ac4
Request for Pricelist confirmation.xls	6d17bb6761d398982b36ec58718f48bb	9d77828cf50c7821abfb904dc355e01708321867	f1921797e44af27d89007f013248706f6dd159ee3013c5b5270c7b8aff9caf51
Remcos_vilnius.zip	3e26a7c2f47d773a464e665e3c28b65c	9afb0392b4e44553d1e0bbb48ae166348ce91171	8b8dcfcbe24b3ae3ec17f1fcf5afd80e57f292ab69297405793b9c4f22910ca2
recibo_de_liquidacin_de_cuenta_bancaria_21_11_2023.docx	321538596440b512e24a5848662e4e9e	f4633dc2650f5ec00d99e50509144fdcf7c46aff	59361c148f231e7b2a62a609c1fecccaab4fc1c51a6c804a93b9fc14fcd5e2a8
Recibo de envГ¬o de DHL_GuГ¬a de embarque Doc_PRG211003417156060.PDF.xlam	f43c42ef5e8b484fe619f9d806a6dc89	41cb257e0b7c5a34ada21e5de69da73d1c4f3a5c	7c49ab30b668386315de64c6974e49b2fb84d86ac15dd6db0260b27ae5661828
Re_ copia de todos los pedidos pendientes.msg	35d92aac89de993730bd03a750ea7123	09b61023395bd39f43ab7af66bb3beb0661b32c8	3a0bd25c350e2ca3525986866890c735fcb964918004a7fc1486bbad28f670ee
Re Informe de pago.msg	6b38d236c94c7d48f6347896f4d1a889	8f573a4bc456cb24fad63c30bbb6babeb7737c84	91f6812a59c9457103b26dd1529cd698d4ee094508e262c54b02bf1c4a900b5c
Re Complemento de pago.msg	4503157a91005806910832bf0b2f0774	7fe26286388d4a497115dbac01060df29c0d203b	afa8f6a7aa0255923e570567a4c6d8dc4ad64c7c025e9eb91d4ab88df5e3c9c0
Quotation.xls	89ac8f73c5bbba3c8bd6a24a4673b27f	b6aecee4e29989615304b460cb13d64ac60b5203	6ab5b6d2e827e01ec12a55f3d634d512c4d9efc2a3363870e3060935b50c345e
Quotation.xls	900ce487607c0ca180df6378d096be59	ee9f6396934bca243adba63a593f54de69ab46b2	27d2b399871c8d36ef2bb51a869cff8360c0bf692b480fbdea85724745475fb9
Quotation.xls	fa53c034331e06ba9cfa13a9fb86529e	0ae07c406163d69b009d6b4abc0b873e7e1b6935	3bbcc99948c41ba22df2ff66b4f645f11931ca52bd07d78583db931016da2675
Quotation package RFQ 10750.xls	a1e360b030e9fde0d4b008baa218367c	eb64df19874aab134ec75baf72f8b619a7821f43	4d5e7328c921bb038230d1e5bf189caf0e872b5c78c6a98b05526a3d876e8623
Purchase Order -AG09428FX.pdf.docx	08a3350c530b303dae9b6661a43a6e67	bdf6b8cf59a16f8ae9fc977b2d2507c179849eee	0a4088db055edbeaea7baeb9d3eb62f7ab882f5b143321c65651b64759ec9808
Product Specification details 1 and 2.xls	0344b746e6aeb325cd115904eb037d23	fc0f6892d07214ae5e43d997c38ca393491d5aba	213d875021f8b6b515d520a6ab0ab9bf9632ed2fe7bc7cb5e092eaa0c86ae707
Product list.docx	594e633ad332973c5b3cae8c3d757409	48439210d824fe34418bc89320fdf2ddb698fa73	bdcd8e8d8d07dd6c91b862d40d0896a0c41eff593d71b2b23cd4a86a8f752992
pointofviewballoneprojectismyfavourateproductwhichcamefrommicrosofttodevelopnewupdationrpcoessonpc.doc	5f7cff25e4ee29930c938bf897666dbc	bbb963fb00928aeb3c3d56dcbdb266fc141d6cda	95d0407a85d8885f06828c6922ab685a1ff9cb9a8ea82c528a390d4826dfb539
PO-5299.xls	ca93ad9d9887663ed1afc2197b775268	017bb90012dfa9fd9a6a05efd01d1d929e411039	3a1b13e80cfd6e053f5a605e531c17a936a33fc5c5467e40be5a8845a2d2dbcb
PO-4500628950.xla	eae4e5ce746f77d6a08434d500ff8018	8c277f0f756ff225fe6862b1feca5d5ce58ffbc3	e645209c1eb6e2bdb67197d8b8b4e72bcf12dcd76cc7008caf3dc11d80d60231
PO-4500628950.pdf.exe	fb8ab8150a7c981450f3a8576bd77fab	15470ea8e47f9091f4aa5cc5f3bb4d4cd5efdc52	b4f2d89a589c9fc119a92886a398544fa64a10876e06c3d9001b419ebceef437
PO4029530.xla	aa5d234755590b97254aa586853d5a0b	cb09ec0010e3e4da977888c4edff2012e30d0f24	ef4ddf1a68424b249e99c040758799a723fe712c5f3adff7fd5a1f5d14078f52
PO-3073529-HPL.xls	dcc06f29d9c15df2fb5d9423a7e658e8	b680651aced67b1725a7a6e44771ac919c0c5723	e79dc3d2efb7dbba49cf07299a5fe39bbbdc9e10a75b5b0d5e4d9a462f4f56e7
PO-288324.docx	787252116109361f8d53524f8f62f7b5	e9614746a051af4afe484ea5964597127b5d515f	94ab6d64b501142701cff0c927ff3188ae04817dd364c54a1b96e4c464783ff9
PO25006039.docx	d732e057d158d9d6cc1f2dd1bb5095a8	4e2746000367071d818c131faade4fa6d12f1893	b83d419b53d64d4b11c32f125c2148ff9f28820ae51055a2adda6c98804563c2
PO1876.xls	86ffb0a3da748e5fe5f7dfa4bb2bfcd6	8eab0679cfb78fe905758bed258de9f454d6a65e	3d3dbaf0766de69b7f4655933106d1ed0282a5ec650c987e31fb3e0a1e0f195d
PO-0927902-27.exe	efd90dc18ab8b704acc723db684cc55e	f8bf895f8f2ab82ccf8b2c0ed23f3fe8845d6fb0	d715183696f33d61192d9c7815b099ccea321a0a734bbec82c2963dbc1b37b42
PO-0075930-1.xls	c677f23b98f41ace3e30b3451a29e865	c04789e8a9edea9ad9b8694bbc471460ce3d2e8f	46cc5500d9579887c1d2694b124d18f2915c0e372bd725aa57a4eb610e02a75a
PO0000086789.xls	62c18da06da0f1175b899b191e3a3275	e13e73821a0a0d3ed1e87aff00c742537de282f2	1bc9acfb39efa7765c8f09c9a43da04c8e9a23637d56885190ca9dbe92a8c4bc
PO_OCF 408.xls	b1b6a921c32d375e2bc145aabc5590ed	df721ea78886ba9fa47e0b4ff172cff71d3eac65	6d0082a6aaeb5d47a2083d5b416c7b7e906c9e25e0f1f1c92a9ae44ae6f38b9f
PO_Copy.xls	c53132c26ed5a87968bd23ff41c485ba	01b1a3c676dbc370fb1916ef17f9bb0309d5b966	02e273a2f40b1a10f15b08d4dee9356f778a82ee48dc9bad878fb4d789d01431
PO__25501.xls	0678967c9747a511c44ea783cb2d94b9	7d40d330c9f2bb7016e7fb7cb1dbc6684e3c9f81	0531e3510bcfffd37eb886c36555cacf3f748264d405d8e2ac47f94c06c0fe6d
PO-#2024129.xlam	3844c6b34d166404766220148aa49f37	eacb7cff538195418e807c8c23a0558cbb160ec5	5e958b5d3bd73a619671779162e95685c47b42260546efd8b6a35b79fa2e27c8
PO DK23.0121.xls	2e423b110068987af2649430fa5c3888	ad5b69f26885a229106c4542f195d710e045ff63	72d4ebe23af02c962be0bcf030098e1c7f7cf414d507335e38487e1f46ddefd6
PO COPY.xls	b3ffc6745ecb8da8db957d9497c90ded	5ba4479a67b26e2a8a1e4ad46f727474bb3e0768	ad5c210dbd558bb437a7eb9b95160442a926dbd2a33bb0ad639d06c5016cf912
Plata facturii.docx	a6da1b169088473a1aec3f38ebe7e032	e646247851726554f54a4b09f2288563cd623875	ba175b55f1e8e1daf1a9eb89af4583a5562423616f36106a1f2e3a54e3bfd71b
PI324-6BCE.docx	b1a93386675d1f10c94cc22c9866270f	f70746f19efa93102f4b40e6b65166e54d722326	59de14a928f1cb5b8b504be862a1eecaef3e816259dd4c96c030e25fd7a603e9
PI.xls	10c9b7a2f71f61c44df8b277fb2b7921	4e7654e97dfa1a287587b9d65c9a6dba39158fe7	3236301f89d29f90b003973356900c0365268fe1a6756dc98b75d120ce529977
PI.xls	b7a9fcf5443fd192447c40558f36e2ce	04f2249a7ec88e7e8394c8d9deaba835e2a80dd6	d3504887f597a94a1cfa63dda659441ae299d9de1b674e0b7a17dd8ff685392f
Pepsico LLC RFQ Information.xls	868c4c65e9eb89d245380b411b3dec9b	abdb89981fbc623ed0dfcb14543346200600deb6	528cd44c1700b9dd9b23002be111f912cc4285892038602545466f6075110b12
Pepsico LLC Company Profile.xls	fbedc42f24b70fe064a49f5486276c8f	32a0b9dadfbd452fef345d398658be1ebbcc6dc3	5e9db6b3ac5dc7fab7f7fcb9f0d565941020ce5f15ae61f53412ceaf5898b387
Pedidos.xlsx	2bb06693c9e1eaf5576f8a503495dcb9	e29c64134a68b3d58c18491f59c62428cf315930	d020d147b7c1988c868b9c84f738ce36f4e0d0271db8cc2b3e9d314acb0940f9
Pedidos.xla	7c076ba52ee4bb2e22204512ce665b9e	d30e3e26802d95f1931ecbbe5384c4ee78ee62f2	2827bbea71a2c90a1b3ef41239292c4803b78bd3bc18b7ef810d31bd9952d39c
Payment_Draft_confirmation.xla	e44aa3fc8915966c0164277654982012	dfba0231d1991f3f4e702d44a4c90598b99a2e9b	9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1
Payment Bank datils.docx	751c33f490f58a8cf08f547a10021ffd	69963ab2e390bf35e5ff9a4c94a170f23acdf096	7f24742114fe32be839bd4df96c91475a84933da9f180afe4b869c25591f1a65
Payment Advice.xls	c0b2bfac85c8e22d33b8741daf0b1821	99048c271e01792ef79118117e52ce68ba8c4b92	3259b3ec21622c2f6884d466d5a41f09a60bc26a553f40558bab8b421edf936c
Paid Invoices.xls	a782a89d736b8151f153373731479184	f3490a94b98e2f1f964caf90f8ca61e74619c813	1e2a74e19754bc8f438fed42e3794cc44af3f949db9658c29ee6862c5adcbc09
Package.xls	3e33c8cf5b3ce2fa86f1b0ab22d2d3c2	de4c28fc5c4eab8c71b09830ff295b901be6a844	7712b3d4b61189ccbafdbcc285b7a761d517bb68295626e30c33c24c38fb95cd
OrderXInquiry.xla	9f0fedb5a159b247d698fe525fa42b71	1d466b66435f85871baf84e16bf476be7622dbb5	e31f2c0dc3d83adc49c85d60876825d5591bb398472d101d179eeff7dbf89952
ORDER_SPECIFICATIONS_OFFER.xla	11a62e1437c97806b4087a209952abb1	6f4a65dd084cfcd67567da0b232226a08d6ac1bf	93946883de3d4074ac4baed60abcc3f2d0c57c8ef6e41ceaedbc5ca0de55dc30
Order_Inquiry.docx	16723390e9e377cfb1a11beaa547d155	f048831662e209245fe3996b621f2de170199812	b815f14430626af2f577b41dda23cc080eb00865462e0d12854bb10728f1d737
Order sheet RF083901.docx	f83f9fd222724c38642f889e4bff6dbc	3993bebae6d4c5c0b0e494472f8f3973367d7f39	c0e49a1256f7e6b66607f2440219ce5e684bd591fc1fb7c64b90e9b9218374a9
Order request list.xls	e8c8fee58f84cd706cd5955773887500	f80268a58e1f1635dd9ccd6dd029dae2bf93fd58	3ac1e9bc1c29e4f900a34d8e98672106887155015c3d868eb35b18a546f64af9
Order No. 4800014530.xls	3c80e835bd56830bd4bc943928bb8a85	6ac7bcf1a0ab03f20a88b713f193803eeb092bf2	fdf0ee91f641ab4d55e25928ba08e37611aeb783f0c157e412ce165496eca24d
Order No. 4800014530.docx	44cc8bb84036012178abc1cb254174f1	fca7d6bbbd81f136e5c24b6f78e0874e0eb0726a	3c88795ae0319e90dc049fa8027b65c9d1e28544a341e0791a178aacec1c50c2
Order Inquiry.xla	5fde1297e687b85f1fe847246005999f	5ef1903f2f1be545a86050e3437d61ec02cfd1f9	49a50a2d00be1c5aa8e802faf94ce42adffde19531164626393dee3d9fe4a7ec
Orden de compra.pdf.exe	da8794d3ee22f38a939eed529f4dc7eb	4db5afbf61b198629bcf58b215039c777c5ebc72	863819135c6ff8bc850625c3db84239583c687cb0d8e1a6630adcb9e12b9862b
Orden de Compra No. 20181_976453457687996875645345768.exe	96de6b812dd13086b5b4e2e7a92fb2ee	6da76b692ff1699cb723ef25abd74c9a1db27b49	0ae74f29edfbca423aa0b8c472b7ec7c65232a69ca8cbcee9896d7a46e0180d4
Orden de compra 4000171682.docx	725fb0efab1ad6f2a0e1140a5f4694b2	86450793957aca416e2c72733642f0b46a9de403	f21b855487f1dbef23afff5434945a15720ee7c48207afba0a2707c55f242b97
ORDEN DE COMPRA 088562.xla	eff1a9a30517e0640620ca5375973e3d	1a96d14bec33dec3bbf5b8d27681fd47582b70e9	0bdf510bfe3cf6e97ad50c516be33fea106f502bb0b474880bb016a7c18701be
Orden de compra 000987-006457687465354465.xla	452968ec9dac771e695b82412989e839	4b1b2c297077f9a2cf927d300e642e6d0b0051db	a9fa6e9541cd3c605bffe5f26016093e0c4f1f60dba42399398e096d5bff2ad5
Orden de compra 0001-0025545456745869768968.exe	0bd3ba54e625948b9378c9ff8f2905ad	aa2de74b5fdfd4e92bd5f8ee46b4cc2768d5b6b6	3c2e45ec9a4b0e3b05b964f8cc1b5a124101e223aaad08f060c90e9140a34377
Orden de compra (OC)008979 (1).xla	3273d0075dc084dbc66fa017480e4d0c	c6b323faca3427f1c7e7a28f53f998f5c11c5668	b8f1479b3dd48eccd6fd70f47d48d44974158024acde0e0cd5d7d3202f0581b1
Orden de compra (OC)_0079124.xla	bd3f44153b618109f79fcd79ddc856b6	4e005a97e144515a8c1eeea11d43ac9f16574421	44bd1742b1a2cc9be39518785f31b827fbbe8255628d752378ddd500a3d2212e
ORDEN 679564.ISO	e5ecd287f92fc21a040967d3ae73541c	4edce7c3f0b2625b1e5c0c67c54e48f455100c8a	37d1fac3e7719ec36184f42843ce99318d824a028b93cde30ecb7b17c6a5595b
ORDEN 679564.IMG	a45e1ef5c425af7a59a60bdd9bfe9f2a	94f67dc9e663ff131a07822cf6c4c8b0ace29cea	aecdac4275404c22cafa6d8b00d76d25dece5aada5f792cdf8696b0659067650
ORDEN 679564.exe	c2862a279b89476b1df9e7a9af4c65f0	461a92b53f3c24755689fe8a766bdd593010db80	a3a049fede87ed4f75f98952ffd42ef69c94f415523d2bce602c640e7efb7ab0
oPPC.exe	2cca0f57a5dc4b45b8fc725382a3454f	6ceb3a2d8a406cc33ca88ebc166f2deecf28a99d	2dca9f54bb840c457add0ee4f0543c64c92588072b6c5bdeab4f3028ac36d993
ONEYHANC02054300_draft_2023113030650.docx	eaed84cd51ffb8dc03354abe17a3eb2b	9d7ea472196720734d396cb1fea677c9ef32eefc	ccb4b6b61c76854170176772738c013c79a6b95067d38e1cefc5c3438a43aaa1
NovГЎ objednГЎvka.docx	c19357cdc182bdbfd376532473edb053	46627b487ee37bbe389fff151c9761cdf6f2b97b	4be9989fd257468e616186effc46c4bd07ffe1423ab3edfcd1004fc439018985
NordVPNSetup.exe	551b0bdaa46a48566dcc72b230618289	a514325d8050829352c929fe3d283db9fb290182	1c86ea69172d009a3cdd1743213353ecfde93cbeeba216b81b2bfcf60934db41
Nicht bestГ¤tigt 383820.crdownload	bbe81c26d08c61a85e5e066a83e768aa	5848ecc64eb9c66073c481435c28b726b9353cbd	6cab2705e5bfe56db1e9a74c8af9dca162de7631dd8dc074685dcb9c1dc7c5a2
new_image.jpg	2ee7a5e1395b58223f5b50adeb6da813	1e1620387907a9a3905b4bb41bdcc4bc1b0dbf46	1435aef381b7e31245e2ca66818209a7f8d54daef4d0db25ef78b3a9fec3242b
New Text Document.zip	3c8b819becd177edcbab3aaa436f1038	191e32ee0095c03ed38fb0cf656830eed585e53d	f5091b65f748236c24c4f1d289cfafe78236dfea4768929a1f1fa91b2e5d0779
New Text Document.zip	6928fa91ca64fae96060f50f7b1d2812	ce23e21e0db4097037a1760285f447c6f72d6cdb	449be8b7045888171621f844a0fbd92c7e79b7b1dbee7b9060224cc3be69e955
New Text Document.bin.exe	0b0d247aa1f24c2f5867b3bf29f69450	48de9f34226fd7f637e2379365be035af5c0df1a	a6e7292e734c3a15cfa654bba8dea72a2f55f1c24cf6bbdc2fd7e63887e9315a
New Text Document mod.exe	69994ff2f00eeca9335ccd502198e05b	b13a15a5bea65b711b835ce8eccd2a699a99cead	2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
NEW ORDER.xls	3a676a14c0aa582a465032b971ca23f5	04b12227d6b22ed562005d126cd7e3366c4fe966	3688f05556a136fe094de5cb1888eac2a579525f72cd027e19738582ed40c283
New order RY93HT-1.docx	c51b9d7369a3bfa22ba57e207a51ce97	8e84857b6286bbf38b96faf1c05aa5796d412225	5daaddbb1da5856279f627f1c3051b6d5a53924a221b641b70c3632532a19593
New order RY93HT.docx	bb3c4edc15d0ac64ebd4ef59a9cee968	4bfe6bd81502ff5bd45d17703e73e348b25dc665	f1097cef75901d1949f77276e41bf0a6f6bada97de62aace81d5788de194b34d
New order list.docx	8a10bef8547c837c442a585e36e2370d	726afc25dbac5004232d28a2b83deb7603e6b375	32562e2a917d9827d3f24ac715a6af7468d627594c90126641349d25b735234f
NEAS.cd1c9fad93fdc00b3d2b34bb65d84029c5a8529b7eba10b4922b503dca449c74.xls	4a6c8b75271dfb2968fb511984fcdf56	607a5d42b94aa5362857f893f5ff12d8fe6b7dcb	cd1c9fad93fdc00b3d2b34bb65d84029c5a8529b7eba10b4922b503dca449c74
NEAS.05dcad5146ced653ac37a38ac3088de9542fc2773c994ceb1e32dc706261c193.xls	20684d36620f825c2997a99f86fbaf7a	1bdeab2b6857e99af6d67c1038e793710423607a	05dcad5146ced653ac37a38ac3088de9542fc2773c994ceb1e32dc706261c193
Name_File.vbs	16045E27C2555159200589060B0EE82A	E60FBFF5F9387C47FA3CDF9ADFB80709F16537C5	817FBA874F30C7AA12E95AC1C7D4956679ED1EEDEC1976103036C87D6725CBFB
My Nude Video MMS.js	f6837a76c9e34147f893807e74172cae	0722fde06e25a8c4e18e08dcc7cfba8d2be2ce47	a4403249e69c05688d7f778de7930ed751777f6aee277902084567694801b53c
MX23PO2024.docx	7e9afffcd5105a119308bc5e1289fda4	56222c0cc90d4a38625352f8e57f2d3016a51c9c	29325e23a684f782db14a1bf0dc56c65228e666d1f561808413a735000de3515
MV CINNAMON SEA.xls	85144b3ec0924bbb35d2f90aaddd4e0e	c202d352895b4977494c10d2942e3f5800a55d84	e94b0c39b54b3b3032177470c9a1872122abb48ac98242973382ff8bfaf02a32
MT103 0216009430 - AnunИ› de transfer efectuat.pdf.xla	0b1f2960e0047c82de95dcebd5152cc6	5aced3fb181a459b9883b492039d9951bd378abe	dd207767a10c3a271f9695f82cd3185049eb45a53ea38e994d95293f70b5fe2e
mrngfilelovetohiteverywheretounderstandthethingstoknow_________tobefrankiloveyousoomuchmybabygirltoseeyoualottounderstand.doc	cc2cff560f0d56ab2a59cb95ceb0d3b9	a80f36aa7ee61fe48ac1e59111dc9c734b2fa885	ac28693e8d336d0ef4a117c9fdccb0c2a62450b65f578838859b7e0a67ed5876
mondayvbsfileeee.mp3	9018c6484efdb093c0fcb31eae58dd78	e5002770edaf060167a45f12b3b5b2f62aeb36dc	0de885453c03b4c7442a396790b80fa89cc67efc84470b9b4baa159fae7e486d
mkhg_New Inquiries.docx	8fd8a5b6f8736d3110cdb9500474968d	c7ecb90deeebb50b8f42178a44cbbd4f06c1278d	e0ffdda854c71992a74a8bbcbd33d4686c203cfa4016783db3b252a9c3edb361
Mit freundlichen Bank details1.docx	2008b72753350090fad1a2d1f8dd9a14	55fd9fc26380414b340aee4c605fe227f82f7380	89620791af5788c9b7087b1451b3b58dc95b25988a754a7b85a6cd074028ae2e
Mit freundlichen Bank details.docx	9dce5e33cd55bd42ec6a58156c0ef7b9	6d976561672a0423bc9188b695b82711db6a9d03	d32010831aeea0fe0371239789041f08a6cc930152b02f65e04e186f85fce2cc
microsoftunderstandhowimportanttodeletecookiecachehistorytemporyfileseverthing.doc	c4cde68e89e1c045c73591c40eeb439f	fb8e0e900762b9b78944f66fee54a135577c210c	f373742655fb9425ffaaace705effec7efa569a8d7e4cf1fdc7d41b59ce4f85b
microsoftprofile.vbs	c911b355a1ae2212b6277c9ffb568e01	2c7885a5b28910bde36c4799ae2b2fb21513087e	a08415c2adf22811250b7b9b957720c44a6362d205a59100e3ab155690a13fe0
microsoftdeletedentirehistorywhichneedtocleareverythingformthepcfor.Doc	7a7c971eda224445a6bfc3ad872c5684	8d5d02b6394787570699267c802c3997e35f5f40	3cfa7c4671b284dbbad69feafa9e19fbef9c94e1509df85c2ecfcb1d4fca5123
MEHS QUOTATION.xla	bfdf5c6ffbc15820dc5d5a6756ebfc25	7b709a3b7356de2d3aefa9095096af1c732c3e07	0007ed17b3ce378e3bb495b06bcce6f79e8292ebe4e3ed913b708aeb70640f44
MEDUCT125498.docx	13c0ab7822d7cb6fb662db639cd85853	a9f256dcac6ec78bc5f00489ce45ea2c3025ada0	4c6f41c2ab1a4fa05a90166d30112791c59e522781e8c6daf01ad6845de67066
MEDUAF844650 - 5997041.docx	cc3f12790875f56be91939cf9bac977f	536bab4cf9e397d987d4b12d0320145c49365555	5742a2b4569ba169f948f40abc5bdf85015e61b5a018fb9f35e5c349fca5e38a
MEDUAF554678 - 6678905.docx	b4714697eed0f19d288d95dfc40961e3	3a2b7e5f506347b9e507ff73ec9d0f236fd9f980	7d01105f295d40095611d397b631d34d5c67d3b2ff45602b703251c31a746319
matrunlovefeelingsgreatunderstandingthegreatfeelingstoloveyousoomuch___________youmyheartyoualwaysmydearlover.doc	9461d8f3ecca8c413e5c72f4f6447fb2	be46f0af75b61558145791ab831606e27ec6788b	00c89663b102dbf99e7aceece9746a218ff9917f8831621e661bc088c9e5a151
Lopl.exe	8bff9db73f282a3111396980f47f299f	2e9270b03f6aede4608511c3b8a5eca93ece52a1	3eea942e74619bb0b7d8a07df37e53886685018278672a6f7db07db54fa2d172
Lista de productos 1.pdf	2c166f2397765f3805034e2b37e6f0e6	46d860462c37ee8a5a5cd0497bd83ca560ec1a3e	381eee722d7ea62ca2e2c66f9325ec69dfb606c2d320bbf875b87da3e2f4a297
Lista de productos 1.pdf	e44227db9fa1222df07557b83e3f1720	545b851ca621da383063fdef12af805b1ec7925e	406677cd85ea0764e60c5c5db3e351451fd83fb8ffb6a6ab7f993296a2f3e695
Lista de pedidos de YPF S.A..docx	61a75514b673c8fb881e08fd5779c298	19f76e04060d92ca0d7192b654ef145b3aae2311	7257d4975d12e981d2186fa5a158f7eba105b97e0a4373b48606e283b88a4c03
INVOICE 180923.xls	d08130b13b6cfa2ff169deb03a7b1008	6bf4e708d05f086e78257126754494f2055affa0	6052ad2c4b2655cc24f30a1d6ca1369d8e04324143a12ded494eb906018d6a08
Imzalandi_0029443-Q-1347.docx	e60e0d8df1141910e451dcc03403e9a6	1a5668a22fa1eb520dc05e8bbf10c6b3a9e130bc	21a0e157395751b7339b4f7775d90c7d0433d23bcf2cbaeb306379d5a6115a99
IMG_690B23.docx	90a6d14d8912ff9a8db5e52750c151db	77e3d99a32fc9b66467f1d7dd40dc8a71fa94ed8	769d9bdd8b3c6ae165185daa52e6d204b270e7804a83b01e17dd3e77e094fae4
imageinehowperfectiamfortolovethegamewitheverybodytouderstandthegood______soitsbecomegreatthingswhichunderstandhowiamgood.doc	1c47c9cd585bc78e6284a18fd4c9a78f	48a39ec502f24bf3e3fae5fad09f6e26ed23a736	063066d6865236ab84fcbde54cd4c9f88e1741967a43f8a6728c84858190d571
htmlbrowserhistorydeletedbymicrosfotEdgenew.doc	0a869df2007f5731f95c5d84aad6bbbf	bdf67090623133a2e966d789ac36d1f66802bdd2	7a9329653173e57341b337f0fb842e0b4ab56249bf23c6eda6b766e87a52d0c8
HSBC Payment Information.docx	a76d31b5dd94f8fb20626d127e797344	6e0a8481d276e212df18746e9ee4f92c0857a015	0e76bf9cdcd80a64c038349065c1fa9f2afc8119e4f6444f038c3183f00eccd5
HSBC Payment Advice.xls	3a4eb467c8ee5a0661b005aa8f728c7a	1bd83ca584acf1339c9d0257ca00f36800a13464	1354ec56e9bead8a7821e30f3b15578ca803359e9d19746bda9a23b62e1f471e
HSBC Customer Information.xls	9276d0a4ba3a880dbb8162d609938d9a	1cd4aa98e0a1e0ac3c7c074e90e57a2cc57af907	38fec907dc95bfe40e4eb9d109587dec7169e274c3a5515a19f2975b6dca3c96
gunzipped.xls	2ac8a298c47d91f127ff8951e5e00fd4	bf41a1fb5658b33d886ddc20b7d424c6dbd91d15	49cbd743a040465d6757e0e5d408d674624053368967940cd8c51ac97925bfc8
gtGZ.exe	153b7fb0358a64759b97b7cf55bbf0d9	fb49751f66bbb232a6c625b1538e07a43f2a9c76	0860607457a5496285d212827fa3b308a034851970532f110f9b5e15c974fff3
GTB0088.xls	a8859f0203ac5f0265dbfb2b7ded0e64	ae42a49a3b3e6c9ef20ae8ab49632e0ed44551ed	f637bee377aafb82f1cee23f7aaaec2e84e88a0a32945daf03f6fa7862f8034e
gmovr.xls	fd8fb53ab7fa694061b522655c0ef606	e0e4a713ea490b03bcefbcf9c39e5656d33d12c8	a473dfc4162706e4f299353381a26e1f372bcff5223ca8568de6acab98644933
Foto Multa_Comparendo_N302A00471pdf.Uue	3f1d52e05ab28f591f854c0618a55f3e	ba13031c90fa551ed3128a51b7d691be015f4120	6afb3d3f6b335d7f800f263b8e35886144dda70912075f6f7c3f075a55d5086a
ffcc528cab820f16da6b2e9210adf688c291455fc0c1d47e87fda017f8e16883.rtf	d53f7e00291f84524a082751b60402ee	0c806d77241b6b7fba72cf608fe619db86c62194	ffcc528cab820f16da6b2e9210adf688c291455fc0c1d47e87fda017f8e16883
ff1c6fe051be3018e58f56d19ccad79c76be7c7de1054ccc2948996ba068544f.rtf	12ce424e2d7bf60c86e697c97109146f	30ba7c406754335058fd1c59002318d5157df9ae	ff1c6fe051be3018e58f56d19ccad79c76be7c7de1054ccc2948996ba068544f
fe46f0ed67fd82da0561fb894b8928b2538185173b2dfa0dd543daead2d026ad.rtf	5496804597a1bf4beb89256c24c27c35	5a39a8e9f872de1207e49a20b4baf2eaf156cb35	fe46f0ed67fd82da0561fb894b8928b2538185173b2dfa0dd543daead2d026ad
fdaba17c9e898ed20233a853be28ccb5ff9410a623ab42f5e330079a2b7337f6.rtf	0df35a6bc957bd586d9e3931d5fe7a22	cf1a9a7997fcfda446f396cd915dc7ac4c7d878f	fdaba17c9e898ed20233a853be28ccb5ff9410a623ab42f5e330079a2b7337f6
fc383ae9ae43ca53b0cea754c85e4cca4c978ccd45f4fdc1a19ce3f2c6857bad.xls	b39ac38fa0a7dd2bd9786c3944e087fa	761926f3ea3b5b68ac0749ff965aba15b67690d1	fc383ae9ae43ca53b0cea754c85e4cca4c978ccd45f4fdc1a19ce3f2c6857bad
28079328abb78e6503a68b6097c7da8c936474e50e42b6143d89658890c53d0b.doc	e79c9e9198572695f518a70c66afed2f	4337db458d185cc465b804e57cd550cfb64dafcb	28079328abb78e6503a68b6097c7da8c936474e50e42b6143d89658890c53d0b
FATURA YMIST0035362.docx	4778ff1a984f9d2e0d30d4f244579d3c	81a784866b049d3fe7ecaeefd206e2e4efabd699	bc1ed9ec04c5127a01de6b8a0da8a033d1bf35e32b9daabbcd56deb34f317763
FATURA YMIST003536.docx	cfb1fc6e5e24394022ef1776d885d95c	80a8c652d5ce8253494b710dc4773e257c2b8811	d70cd48666a4b58d38919c77c229f9b9b8df5deccd73848466d0f8d03fa881bc
FAKTURA-YearEnd.docx	6492dbe0cbf75724904db733655fb091	1776a2177af5eaaaa6ce615223a4e3e61667eec4	642a2925359b44a212b64fe82fadefb711748c4adfa534a00f66889350f13e00
FAfLZbV.exe	ec431cf3c8700aca3431b8559ccf16ea	2f98aa1d2be76cb921259157064af220ea08ac35	266415e546ef055f95f6434acace0b2384879cfbdf51e16283770403f6334bd0
Facturas vencidas y datos bancarios.img	7905d293e71d58ef908511650ef5a54c	7f88df3a43b850913c2d1688a4810689fd1cb772	8775679fac7f78c8cfa1c12648d243d37d9c0131a6eabdd92a5c5f335e1536e5
Factura fiscala 100492.docx	f00a028727b6ff2886f6eb329bbe69ba	e7e135c24dcfcec99ec2db3edc05ff7a2d4ebf49	ae166ff60b18c06e89fc31bf66aa44a5ee7bd31ec9271026d85e768eeb13f9cb
factura 00005111, 005114, 005115.pdf.xlam	da8b178b2f11d5a0e08c08395dbe484b	420de07fa1a999789d6da89e26fe7bb1fd122d12	69ffd7a475c64517c9c1c0282fd90c47597e3d4650320158cfb8c189d591db8c
f9e336279a1e2bf97ef4c8179b3507c4acda345c388695d766ec5f423be22577.rar	646ce6ec3effd4b9d7cd93c656cfdbdf	3f2affe56ff8af95727a64faf82ff8c99d3607ee	f9e336279a1e2bf97ef4c8179b3507c4acda345c388695d766ec5f423be22577
f229b3725dbe9bc2b555daac400a1549cc6439d1a46e20a41578f42a2bf4c70a.exe	88c9646797eef80e9184085d8ce32662	1f07b17cac8d2327e1b16c3114dcec27407a3cf9	f229b3725dbe9bc2b555daac400a1549cc6439d1a46e20a41578f42a2bf4c70a
f0424ecae14b1eee4a874f7c013358221fc80468164de6e88ea7d057eca7e0c6.rtf	33bdebc8c9eb9374b33c357ebb01fbd0	48defa74814d2744c7cf4cd3731f6dd91484f1d2	f0424ecae14b1eee4a874f7c013358221fc80468164de6e88ea7d057eca7e0c6
expressvpn_windows_12.59.0.42_release.exe	ebe0c0bf3c56fc2f6dccddda8ff93dcd	713c663eed7cadeb40bbbea1e56efa2829260350	cc141b7289cd7f46f00dec52019353138badf3df643c6d056b296257221016cc
EX773826866570.docx	542ffc17e8b12eb25e9ae1d1684627d1	0874b04d13655d0e9e38fda43824f1a55a5e13ed	0e128b2a41ec9fffd7d0fe552cb90a1b9900ac4b9e6274c2949e9fe01edc9eac
eveningloversarereallygreattotelluthatitscoverentireprocesstounderstandhowitisgreat_____newloversneverunderstandhowtoloveagirlwithlotoflovetoget.doc	e959e69dfb1a7811bbe481bff160f3d4	196b0cbc196dab44d19d8252e115a8045e919ea1	a6dcc8e0c9af9d28865e6d64f6c2317c7970dd5e2706fcde33871c4d12329469
Euro-Zahlung.docx	3d18cd2c5953a9734c595e59004f160a	8aaa974f0e51908251b9817af5cf7072dd863172	395047aec8100b8f7b061be5ac7dc92af7b5fba1d479d8c2f9b9ae04eaca510a
Euro_payment_copy.docx	144e6a47d55fcfba4abecd8ad2db3c6c	285e32a73738d98f26d6af0e5bc1e1fe913ba821	10f35efadd04cd64311be22a5cf2cc21ed8c4c0734241b2b1a9453c8b0a6d4b2
EnvГo de Orden de Compra No. 20181.xla	f3d4d349895a53bf2d8b4aaf38a13fa3	bb08e09e40d2f40e8fe99037b6d3cda695343ef1	e2f3b2fbf5feb0d84fc5bf0e5e328272f4a174174551c349e79abb1961ba827b
Enquiry_023.xls	887a03e8eea6d69d8191ba1755bb83d9	46f0e67a127ab61c667124e513bb038e09d82621	36187a12d7c1ecfa21aecc61434224ec977217961e85d29a6f15a2f4c32423fb
Enquiry No. 2427005.xla	6bbcb442ec062bba0d99bee675a85fe5	8fa9c3cf820b0a65e1d70fe578240cd3c60eacb0	9e14518293222641ae92eda4c4be6625f43099a13b01d072060fec4bf69ca8f0
En el presente comunicado se le notifica que en la actualidad usted presenta en nuestra base de datos una deuda por foto multa comparendo con radicado en pdf 85632554157964314679.vbs	cfbbe8937e0d667e226a4f2ce046c4e0	e2a05c418de34d46504e046e0341e96af2c1639a	c1f655c780eaa59215159e9516a1a9e65fb0fc23efb62771f241037a170834cd
efd5d48c7e7c986e7af1a716eed388b3c2832f3fdb73700642601467e271af31.docx	040bf1a02d4caa5a7842f5c721ebe8e3	d57c9ec3f6e103d79f37763f08ab4d400d9c88a7	efd5d48c7e7c986e7af1a716eed388b3c2832f3fdb73700642601467e271af31
EES Offer VT.xls	ff0838a9b329a42820eb824efd11c58e	a34668789a9238660453e5d8ccec13e19614bbc0	8930434ff6b03734e2a5deb45c6149017a441be1def9ee514837037c7204ebad
ee5c4b17cd1da34f6ad2d47de7bf8fad000705086c34243cc0d36a15e1dfb903.rtf	a126d8e25e0d57c17c815713b389ee34	f879369a4da547c9778025ebeba3b58e28372f8e	ee5c4b17cd1da34f6ad2d47de7bf8fad000705086c34243cc0d36a15e1dfb903
ec96a9fd53dea71b91467846c09a2322.bin	96b8a239f2e18c426a98799381b7f7cb	1045f331ac8846660f9c8f5069a91869c39c3e63	ce3109a933f2467c31655772aefe97eee79ca73be689f9ff4205e4965cba9070
ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b.zip	bd20a475a94bed3fd40c24a18d47f315	2bfa962996354538e52a2d0b0fd42667fb22785c	0d9cc1339c00c507ce8a4bc20f10dcb89acec3d131e1714bf7a38742e968f046
ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b.zip	e498ffb2cd90d3b121844bff43777851	da52e4ed8222a4d5a21509ce7af4bea0e04993e5	90cc9d90488db9a799652c5765584da94d85d51dd0b81b3a5e6f93ad496bf3ee
ec383d6ac56ead020f52e054ab94f9b0 (1).zip	9e5976d7cf63215eb2a1656ca2cb127a	61ee85005265f2e2185dd9b07c66dfeaf6e300f9	f45a6658be040e5f7cf1f7dc410086a1ec165e78b6da83293b996fdc7935c5c3
eba7cc1d50adab9015ecee5ae3512fc5.bin	eba7cc1d50adab9015ecee5ae3512fc5	6c90360abc9605eaa09a630217f14961c30ac70a	54376ee15cca7c6cdecc27b701b85bdd2aa618fe8158a453d65030425154299a
e9d8f145cf7e0745a6eb448fe68cb774fb5549440218fae3be937600b7b1bc96	6de35c22ca3f026a6a645fc9fda40565	252a6d49a0d9096e8c48c11d7c9a934681e55f6a	e9d8f145cf7e0745a6eb448fe68cb774fb5549440218fae3be937600b7b1bc96
e7b1dab5d64b8e37ab2c8b0a05fd486c.rtf	e7b1dab5d64b8e37ab2c8b0a05fd486c	5ae4d3a7dec17b9740d4573e8f1014769e683f79	fc8d8e349b245c33b43169523d6d8ebbc617f07d3ec592bc71eccba272a53bed
e60d9091fb659fe00b1c4a25825e82d9607fedfe48e9c46a52ccca782cfcf69f.rtf	c86f12255fabf8b223f2aca753727dfa	33939e398901764dd5ecd0cc567f0ff5a89029d9	e60d9091fb659fe00b1c4a25825e82d9607fedfe48e9c46a52ccca782cfcf69f
e07f65fd99a36e8d930a40b95ee09203034e242cb3ba4058496903fde05a6231.rtf	11132e1c20a4b54f5d04e70ceead9b6a	2b8e2c6709e2f3920941384d492cbd7b478ac3bc	e07f65fd99a36e8d930a40b95ee09203034e242cb3ba4058496903fde05a6231
downloadedScript2.cmd	994447a192bb6bddfa5c8387564a442c	1ef621122eb75827cf3bdd33ac4055882a706c77	1395fa26942f98d50408f4f306c300c5429cab97d3f1dfce0e6ef76345617ad7
domesticTransferTemplate-full (70).pdf.xlam.xlsx	32f0aafced57eedfe2071dca28d37d3c	ea4442f03b71397eee6cb7c781646186318bf3f6	54c98cd22550bb9fa9fbf675fe687eb9f97813cfbe42945eb1e784431f38a379
Dokumenti za plaГ„anje.docx	39ca1a5fe23b4fb44eeb9d6180c3eb20	5f46fa9c8b61706c76ef23397db2fffd0dbc2be5	335815b294bf09bfe701fd0f3803ce0ca7f96ddac0d113b725d68e5cd0a9ee1a
Dokumenti za plaГ„anje.docx	7527a0cad49f64fedb8bd46cb3cade13	535f8a7f356fdc428af253c256980a1d6b235623	629ddfa5ec4865204854218e457e9b89091f8e62a1c1149726d521a00a0c2f38
dokument.xls	70e6735bcaed935c1381bb186dd67551	37941431bd552ad1cd1a385c771e44fe93917f5c	767551cf481dd3ed20bb6cebc9d8df9ad17d91464ea70d8a7ae5e7d97510177b
Documentos.doc	fecb8423ffadd7840e6827efb5f83e5a	bf3e3960792bab3a8e798934ac8325636eb64b93	ac1dc9e090139e6cad01698a47a5a7d462b35ff64d0d464c8d552684d828af54
Documente BUHIR00682317.xla	8d387516f8604367e765614f0332057b	224279b474c067f00793befc067d71ab706a9022	6d9549f90bb5b667663ad8ea76743ee890eb2757c22db4f59da27c5513ecdf43
Document PPS 430092.docx	0b87d0bfca1737a28596bf7b490344b3	28f1eb380c9ae75e47a84561328cce81bb7c73b4	a7628493e5c5c961204dd1acdd0e1e28a72946bd60b18bf0503e632ec91384f1
Docdorpped.doc	fc2da8a287f2c0c47bf3647d0547f378	8de492602efab51138f53cf92c4734c2a1524213	ce1ba968c22d18305647e43f5d28f0659cdfefc07101615b24d5c38fa3ffd63c
DHLXInvoice.xls	8368369f13b5e6cb966b05059a52c735	82f2e4db4ee70c73b3a7a98aea67e20bb977135c	a92953d67221c08b9f84d9f4abe80183fe921c4a2d44cd22b0aaa9a7832e2def
DHL-LHER0006981753.docx.doc	fb090bb6f92f0ad0f0ab27cdf57db31e	4b2da628635bd8244665663c61afe7a42f3a7c7e	fe66fb963813344af4305faaa4d3ced1390047228dcac18693c9b95ab88ee353
DHL_89576534576879899009079968.pdf.xla	f25a01a0294796dd954083ee074c1041	84f2fd32925940e988bd1284fabd244935fb375b	5c411a9a04644ae5cc44c8f081c9c95577f182e7ab9d40943991c36f6147ac90
df57d5c5e318a81ce2ed7924741abb127f2955d2ec0826c83663bd0137c9e269	9e8948e8a2ee90bfcc000ba2246e87d2	f7cf182890f3321eaecbadb9d21ce31bc7f0e722	df57d5c5e318a81ce2ed7924741abb127f2955d2ec0826c83663bd0137c9e269
Detalles del banco.docx	3c218e35368b077e9d6734eef319160a	5e45c80c1dbd31890e70d582b2dc79756914c5df	fc33919b6b4b273a2163c938b3f0fd4d2c9cb5aab7b9779d5252154790e3457e
detalii bancare.docx	9cb67f5d3390cc3e2737a5baef3b9ba1	7f5c5b019067effb512a920964e60e2d6a7e6fd4	cfbfbe80896e6cfd3d98bc76590f508e3bd9a046d96e75705aadb8f2cf466f0d
DELIVERY INFORMATION.xls	c30c4ad198638cca64573872aeccb75c	c43574e3cba99d3553d9d57b33acb34a503a4cc9	dc802a3ab49c4c46bbaca5f0419e6631919ede3f119509e0b3255e88553ce831
Dekont.docx	c76fe8911f3417ca05c0b3e8cd4b0e30	7d474baba37200e0c401f12d50126e5ebb6cf62b	bfe20077f7b28848a608ed1ffc4b1eeb1c6021f63790e9fc53cc27a0820aff22
December Order.xla.xlsx	4e94b24e7c24c4337012a912790561e0	103dd11c34e66b826abac28381ce80eba933e2b7	56a54c477188a6cd7727b241513eb28d5c9e1c27412b8c72f220f8dc85181d5b
dd94c4c0dd46a40cb71f1b59b079577c8a4f6e4a1df88533d7edfea19099729c	2d6edf232ef2f4e9ac72de52b4b4efa5	2bbfb909e4e3bb1a1518e973afec5b587b59e426	dd94c4c0dd46a40cb71f1b59b079577c8a4f6e4a1df88533d7edfea19099729c
dd281ccd017d05af98701f22870d30ad99b89c64d68962c60b93147b187f9524	9569c625fe07176dfe4f65e27891c8a5	a5d786f8d9ad0fe1ffbd6a8b00950f96d82420bf	dd281ccd017d05af98701f22870d30ad99b89c64d68962c60b93147b187f9524
dCCN3_new.vbs	0ee8cf81514863e371aec625d426e1fd	13f3c733960aeb518e51b0883c3bae4524da64d3	6bad66f4d44e12897aaa559e112cfa8bab277321c96f25a055dd6c62ac3d940e
DaIr.exe	f4fa417edb846ef06618fdde703a4d6d	6bb2a3e292761ad2323d9371be3d18781dc68bca	1c834faf06a90ab84d0b20ad85468cf0d85f3e0842ba46f79c33c7e9ffe61835
dad62d3203e96eb88d25d3f0969c6289e64e7bf0c8135e7b9f468a8ea9ff3206.rtf	ccca2007f5e72e8ed7bde35eff192a59	12aa02703b0f69bd6e2084405b3d1f0c06c85f84	dad62d3203e96eb88d25d3f0969c6289e64e7bf0c8135e7b9f468a8ea9ff3206
d9e24ffb33ee9ed68cae4ec00160898b6ccc4f20ee75d5cd1e7dae6d56ba2e51.rtf	a5c477fe361014b945b4ca609f992e62	9293c09804ff0e14fa9112b2138f8aa1c1d7ad11	d9e24ffb33ee9ed68cae4ec00160898b6ccc4f20ee75d5cd1e7dae6d56ba2e51
d5e8ac20bd384b8c4f2b71d6963d504a9c546ff9427ac12157b00da7fe6a9734.rtf	0c5b1cce06e972bb77b1990284688981	5fb1ce62fa6753a9b217e7e9e7c5fea780b1e571	d5e8ac20bd384b8c4f2b71d6963d504a9c546ff9427ac12157b00da7fe6a9734
d306c83b6688dda1592b7c63c7f45299f5ccb2b8b75a6df990b13adf67f0b272.rtf	07c3147caa9efaee6d548eba9eef219e	f537c9fd4ab19a1c2a65d002fb61b60f5820f8da	d306c83b6688dda1592b7c63c7f45299f5ccb2b8b75a6df990b13adf67f0b272
cotizacioв• Г‡n.vbs	714b30c0e9f42ef1fc3ce2788d099fe7	bbb90acce8e40e13286066a82049671f5f3c515b	ae50ec30b3ef5db374bd6176058758edf0250c5c3dc22180271a9ad2a4309967
cotizaci%C3%B2n.zip	12c91944136d87483ea4ab5b5bebb74d	a56f5c4143e1e8f56a191cb1303c2b0f7f59fd80	778cae5d9cecaea7ae24c53e20d9daf8095540a7cdd21ef1410b526523f68c75
COPIA BONIFICO -INV231467803122023.docx	8d7e9a986f49afdad8fac21e637ae2ac	5b375d9994fd22ce44ebd8e1098aa0935c090357	ee500b81ed4935732e7fb6f4e6927b7f05e87a215315a26fc56d8bc02e951af1
comprobante.zip	ad14988e834ac5f50b85cf25994f8ff9	89be03fc76eccc6ad6c12bbc491891833cdec9ce	ba1308017467ac7d159cba9eaa3b2a158ba06f1e3a3cb3a9647bb61607b81b40
Comprobante.xla	3fffd142a944ee842b2b1f7b6d1446e6	b93bc9282ad4b8cf728e24148da0f1f2872e834f	eee83e07b173048b55a102b680dc4df3b4779c6a1fbbafdf6c1665eedd1a2a0f
comprobante.xla	bc14fce2076243f399adc6d94a219e4d	52fd4fde60876eaf8dbde9279282fdc3601bdd0c	ff122d0b1b9edb864a6dd92c345645234939318e7aa6f0992605443aa9da97af
Comprobante de pago (PAGOS BBVA)009.xla	ef9a2eeb179b5a1d9ffc9f5de6f87843	9b795e4f06ba04238541f68dad15a7da88ed1eb5	bce6b89a755a1842d504d832667dc75da54a8e071ee64c0ebe367b9827832118
comandă de achiziție.xla	c8fe5932663f547cc531b352aaa1b43d	d5f06e5ae1d810bf265797ab1d2d6ec12989d81a	12b3fa8adb484c5f63fc5b6af110c36291fa2d2b565cbc25bc0c04ddefed01f3
certificado SWIFT.docx	44a748785355189fd886cd69347e6c87	605e8891f64f3ac8943bd40f25709869545d40f6	01a9518ba16e093feb91e1994365879428f826f5c45a152bae8174ad2262d830
Cerere de cotatie.xla	558fadb14037e01b78e223e799b568d3	43758e1db2bc0fb7fded6ec864ec20973b26251a	64020a7a3f5f6c589272f28d727318eb5eb4eb4d41510679cb8134c0325c8fe2
ce0088f920725b139f3f4aa4e5702dfc3ad4d5fdc2a6b54390554e0c6413865a.doc	d78a6a5131ba4c59d278234b424115ae	cec6895dd3fc1b3e7abfe0312404a3ab7e597a18	ce0088f920725b139f3f4aa4e5702dfc3ad4d5fdc2a6b54390554e0c6413865a
cdfb07f5c1848d62f49dbc2497f8d05dce04bdc1b3d4ea264b40eeec03b8aa5a.rtf	6d243110db79ee1eb0438a2e7b96ec55	4bcc2b5b1c3a8d5ab5f81b7f249480da91b1eccd	cdfb07f5c1848d62f49dbc2497f8d05dce04bdc1b3d4ea264b40eeec03b8aa5a
caf61fe47dfac15c2c4e0f6db57bd60e752a14b3fbaa2b705ff4b4c11f9e32d2.rtf	bc163cddee2ebc25e3eeb9fd62e4ebb1	aed1d5b7bffec047b22152fa4cf7e601c8ba963f	caf61fe47dfac15c2c4e0f6db57bd60e752a14b3fbaa2b705ff4b4c11f9e32d2
cae8bb9d33e2340998ba5f75ad37f803.rtf	cae8bb9d33e2340998ba5f75ad37f803	75e142060680509acade4921ea417e1d438a34fd	aa48be12373eee7adb43270e7adde9a854875ceebd5c267fa6bbb79e91ce2030
cabeae35ddaadc9b285400eef5fa6b08ca978ebab1d7dcc386725d522e44e785.rtf	07c147c508668defb1817d2e187ec9b2	e2830040a42c15c3825c2ff5ed7c96f3e7a14dc1	cabeae35ddaadc9b285400eef5fa6b08ca978ebab1d7dcc386725d522e44e785
ca93ad9d9887663ed1afc2197b775268.bin	8c215f4571c24ed7023d5a664cd20f8d	17cf2050e2ba38677b95ec319c4642f65d0e3b8e	d9e6606bb5c34851b5a647df0b4185db0a75dd19d18088c0bd73e5b04862e4e0
c8acfc0a8a5144d6472d6761ed175a855802e625359eb33fae7962d087908131	984658d36ffed26548d1c625a6f4718c	5787b635711b51cffb3399ef069f58683a18e9c8	c8acfc0a8a5144d6472d6761ed175a855802e625359eb33fae7962d087908131
c4d6e9d13089b15a952d9bf10fe34c7fdc36ccfa00b61039cc9c81cdc7b84686.rtf	8129abc7b545b3e42fee6d8b0f719de3	1396c25a417e8fb7cf4e6b72899688b9f6ea8329	c4d6e9d13089b15a952d9bf10fe34c7fdc36ccfa00b61039cc9c81cdc7b84686
c39e6397fdcff66da2ebb9fc2a8c54671a3706e9e15cdd5e50c5009b205469bc.rtf	e6f76b89356f767c1e4579b115621d8a	d316f5418950945761c24fb92a6b8e017c53010c	c39e6397fdcff66da2ebb9fc2a8c54671a3706e9e15cdd5e50c5009b205469bc
c2d92f57c551932f68c704db32918b01eedef76decd521782ddbcc1aa6087588.zip	3067be449ca2d6d892f7ea6350c86e96	2ce30b992142e318ee9393170b8106058007eb2a	9d8b12cd1dd4d3f5bb11c5834cac34255cbbe554f954a020ed230b050459d216
browserwannadeleteallhistoryfrommicrosoftedge.doc	ec574fac1fbb1844d0e0c647c1d05946	f015c46dcf09ab813f3330e2f297346ad26e7091	163dbbc1b9faa326f1a75391539736e8cdc737619dbfa9e92cfccb257179449e
bf33684f4ac18e2823d8c7c7ad7370baabd4c4b57506ed620cddda203512eed8.rtf	9282088d06c3ef7436a8f8fbfdbed13f	53122c78ed663ad84714ba55e6690934ab05077c	bf33684f4ac18e2823d8c7c7ad7370baabd4c4b57506ed620cddda203512eed8
Bernina order list.docx	21e2b2210be245a60b513046f923fc46	75d0ea0edc9787db1bc13fed10e916a1e46ed1bc	8fe98ae573432ec9f94b3ad6ed10bef5f3a5308751842c3a5f8f4fcd1786028b
BEM00263.xls	bb2797723a36235be9587aa35897d97d	3c7c28ae981200e69e86545aac468377b2179d82	8d87e881cc1effd8cd61df25e44516078569a87bcf1055828b12a2fe935d9c73
BEM00263.docx.doc	92ef75a3ee0a68490eff334e4dcd7627	a45dc186286d95acf747f9aa521fb3b39a229b07	d16b6458ecfca8bfe19aff18071efcf91d1d5b11c056f1a764044e1242e8f15e
be1173550910a40bd03c78f0f9aba5a8572e43b79fde162ffce521d833d9b8bb.rtf	61ebc536a8018c94dd5ec0dbe911dce1	f80549805bbdd9a62872365be4dc8aceaa71340e	be1173550910a40bd03c78f0f9aba5a8572e43b79fde162ffce521d833d9b8bb
bdc926e8bffface9dfd885a03488e675f1633519fe30181d013a3e1f0f33202a.rtf	4d8bf77e9def007fd900684dc886c102	2c070e8123357f94dc0cfaf584c787c0793760c6	bdc926e8bffface9dfd885a03488e675f1633519fe30181d013a3e1f0f33202a
bd9f2e8e17f8a223ba9d004fa8cc6bdf2a5a1abb54cb565ca166996cf7240dbb	a4ce1a6aa5c3545900c08f314c057eb2	a6d68f4ea448e4945788d47d434e697508d3728d	bd9f2e8e17f8a223ba9d004fa8cc6bdf2a5a1abb54cb565ca166996cf7240dbb
BankPaymAdviceVend.Report.docx	22eede72746e7a9a26f3f6d311a12a7e	6738d1a969194359c7c7579956269d77fed8d26f	2e1408013503cbc13466e2041bd3e045833ce65f5c91b7226e28e27d43d6eaf9
Bank_slip.docx	93ff0a6161d030da3780d8c99100a106	567848dfc535f4b1c77d4d4a89bffe1e7714bb11	37f55cf9cc33d428790726cda7fdee967e25918a56bf21ad9db70347376e0bd5
BANK DATILS CONFIRMATION-1.docx	8aab14981c6e4bc32b84e44b0a8477d7	7fd2bb176a7013df00bfefe308fe72ed60cfa4a3	c04828c353c3017c8034c9805290798ec2f5775c835a972a8922034fee9b7222
b9b19a8f74384601fd0ef8b2f8f4f202ee17c48d25a4e4073ce81b2f3dec8080.rtf	cb3410524ec48e9f279e177b7317d4ac	7a9ee7131ceb522ce6ee9da968537c472c5ca677	b9b19a8f74384601fd0ef8b2f8f4f202ee17c48d25a4e4073ce81b2f3dec8080
b8b90bdda88d3417350529e203f593ed62a737639c8076c373e6135859a086e2.rtf	6e3537a1bbd79ea9cc4dd5de11f59dae	954387bc240bcbb21b6c80509da81df93a2b4d3c	b8b90bdda88d3417350529e203f593ed62a737639c8076c373e6135859a086e2
b7160e3400ac72ba74a94525cf2061f10763bac093d96ce651300288ea2f1070.zip	8c1fd6d8f9a5d28030c160edf677fcf8	a058647c11af7f1f6deb655421c8a307d30aa08e	f1dcfd7f0568e45029ec7c418e1f89b49316422291520debc3f9985e5be536d2
b2baf74a7ee97999730fe785548643f3c55839c06837eff7f24617131668d955	6f05888f255f6383694853973f8007fa	48efdbb41f2a724b2d158b32f7aa34fb25d9c658	b2baf74a7ee97999730fe785548643f3c55839c06837eff7f24617131668d955
b1d22cd88e30dc84e19d73916b221502.zip	77c5ef28c59420512ed20df9dc3c5ec8	8cd81d3254cc14e6ffcba4aa6f8985b75b0d996a	76c5131b7016ac38e3c56f0bb60824d59a9e3af222755a887ef31cf83cc8e657
b162b45839d7c3b61457f814b0c317226ceeea22dc1a286283d114d1d835eb41.rtf	98b8bb7c10d46e969ec3def1fc4409b4	db48b90b3c3fbc58b90a08b74ac948c25a15c0a0	b162b45839d7c3b61457f814b0c317226ceeea22dc1a286283d114d1d835eb41
avira_en_vpnb0_19374396-127457345__pvpnws-spotlightvpnadw-test.exe	2403072d939599e88431e5d0ed0e2b1b	507d6e48c7d74af7651a1af5e1d0844f45f9c263	5ad0285de999973d1a665bcfe5d7040494f64c113d8ef8664d3bda3ae66b8d67
Attachments-RV EnvГ¬o de Orden de Compra No. 00501..zip	17637c0d221c8ec5c60761867ecd25d5	150f1de0e17ff66b74105bc89fd02f498c205d79	e7f60f9b86c47e82c28a6a3cf664502c01f6e8c91b1c7457ff18a8a3755d6637
attached bank details.docx	58489bf2e2559decb2adfbc1da6b344c	6be0d5a7c7e43101462799bbe5f1d16a0ba2b9fc	4b480d9ea3fcf3c4a5a5ae4ce55ea874c7a6ee1a8aa91bb863c5b547e32bc8b6
attached bank details.docx	dcad65bff1c1288c8c463cf98e641436	8c95bae113ad1f730cf4008e144d2698eda378f6	7fc2d86ca84ac00b59725902bf3370c352e90eba6ecabbc0aec0123446293227
approval order PO.docx	4f9209573c01d17a1d1fa4ecdba74204	3d432e0a884179dd31cbd3707f4109bc5f84b1ef	102303be47a94f79480b361244fa4683e101d143330eb5df8411039caea946c8
anfhhhp.exe	e4ec7312b2b2c95598913e59602b8c65	d48fc60229b4b3b76407e3db0791c98d4b6a53c9	6597b8ce494cb1e256d0e9882263f53cf00373edebd61298f4d9e20c5a3cf5ab
AMENDED PO-120004445-410010000.xls	cda40a4a2911a4a1cdf3f39863118544	a66a656c08d16f8246c252a0e1ecd2629254e346	a439b325b1da51abf53e26ab526e33414bcb9e0126502656462ee50a6d686da0
af7b9b3a213b28e752d3425e69d3874fa94d57ddf8cf57ab3899f6bdc532ee8e.xls	d04a984c872760499ec9537c512d3766	cb210c13c9f94e0e2273cf50740a3d32b08d8fda	af7b9b3a213b28e752d3425e69d3874fa94d57ddf8cf57ab3899f6bdc532ee8e
admin18error.xls	08157377026679c03f592c9746d788bd	c9b97bd1827d06e1a0d57366c1ea9629b8166340	25bccb2a4c449a65946645f1f5b961903f8d5b269c16f9cc5456b9d1ea27e058
admin18error.xls	1e8dc8aeb7af1075963442b61c69dd01	f5fcf4a6312e5d6b0543731e5727283ce37711c2	d931824be500f4cc470acb23e40975b46c269bc82735068809ea9f3929efa88f
a9bd81ae5d703b95c1a06f84802d01a875b11a9e303b31f0cc15786fd5ccad33.rtf	d3a71be05307fe483a8cbf2ced9824b3	c7be6c8c83b1d019735464a96460c452834b54dd	a9bd81ae5d703b95c1a06f84802d01a875b11a9e303b31f0cc15786fd5ccad33
A9489A8.docx	7e2444cc01fd06b5c658f8c806014f49	2da37d96fdde37b6b24c561bc04a8c8c88290e6e	506fefdb9a67b534d9624dfd4cd24ac2f40d3ac9d36330ac6fa8c4ec26ec0624
a86c6e2995c830758d9e873844bd89ff739ee366e78d2c2457ca75b67a79cbb5.rtf	0d6534a2466c7ee9640c194b4bc62545	6c99895b6cc25610f7d882693a06f7762eac0b9b	a86c6e2995c830758d9e873844bd89ff739ee366e78d2c2457ca75b67a79cbb5
a59d04040da8d05a2c51ab2c1247b3b2621dc5f092fada0f5189cb1a3858e24c.rtf	9043647d2c71640d02d1b5a5b5ed938d	880cdae437a21e8d7d45be18b0135aaf32146893	a59d04040da8d05a2c51ab2c1247b3b2621dc5f092fada0f5189cb1a3858e24c
a3a20a621de2a22a262e287713910a92d6cd9212af1d30e8a5a167f8a91f14c4.docx	e41ef98b056ef91945c17544fb5e30dd	557f7ae7b7382c2bc06db09f7cb07f640332238a	a3a20a621de2a22a262e287713910a92d6cd9212af1d30e8a5a167f8a91f14c4
a306c3cb8e8b5448ee4a9bc49a3b671b10d76172010d2bb5da629f5371943029	921f329135f8544363dbf20114e594af	95b74f7267867cf7f538876428cff90c2430ce6d	a306c3cb8e8b5448ee4a9bc49a3b671b10d76172010d2bb5da629f5371943029
a23b9d9d263079d79dbec3794490c4917141f4dd385ce136fac2f58c0f9ae5ac.rtf	0cba0d555503e54b720c52cb1f37a3dd	5301aec910164eda6b9b36ba04a51211d038786e	a23b9d9d263079d79dbec3794490c4917141f4dd385ce136fac2f58c0f9ae5ac
a1d323166349f499aa796148c0120f89d3a0946abdf74f0dc045c5641b2ab2d3.xls	2707b9ed82b1deda4cb0ce3cc3e727d3	cc9400861fea3deee8815eb34b7f5879fd6ca3ab	a1d323166349f499aa796148c0120f89d3a0946abdf74f0dc045c5641b2ab2d3
a177f5a4992ac9aab718f15c71f2b0e4_m_Updated Order.docx	a177f5a4992ac9aab718f15c71f2b0e4	a4309c6c02bb320784c5952bf900eb2cd43b6ecf	91f7d692760bbadb48882e8a8d8abe9e6890bd4d5b735fad22b3247693da834e
a077a9f97badfc285269999a22fa67ffaad234bf365486a66167bc53457d7663.docx	0ec85d950d76c39348e38a342058f9a1	c00a137d85855be8c462f835de67201124de62a1	a077a9f97badfc285269999a22fa67ffaad234bf365486a66167bc53457d7663
9dbd6f1fb0be8bd4a000ab35f4ab5c9505bf5ec72a17ca1223d7ad240d974423.rtf	98d2580289f8c25658225ac92aaeb179	0046a5cf40bafa768b5afa282b91c63dd9fddf5c	9dbd6f1fb0be8bd4a000ab35f4ab5c9505bf5ec72a17ca1223d7ad240d974423
9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1.zip	e3554b89fae6fc774a232b84eedfb8fb	c5610449b5cf0a3171fd5ce7b2cf2886a0d7de1d	85e8475d49cdc941df059aa9c8a03d507837a139c27fe2564cbe3d1a51d74a22
99813dd920b37531d7e9dac681fc90efcb9e8996b927e3202e14028cf5e32385.rtf	5f9cc6a878cf235dae2033762aa0d2d9	9befcfe5eb0f5fda18fed13ac4906eae3b702387	99813dd920b37531d7e9dac681fc90efcb9e8996b927e3202e14028cf5e32385
96569d96ffe599a1a7857f454ea1d6181c39941c29b72f28a5427570bb1558af	72b66b3acf7f916a27a2c38984461fe0	fa05f64345f74503e8d9ee1ada145942109c8aa0	96569d96ffe599a1a7857f454ea1d6181c39941c29b72f28a5427570bb1558af
95a3b190d9961ca5ea5070bdfddca32750044b128cad46e4b907319aa534f32e.rtf	b3ca6e705795841cc37660d80ddea209	ff9d30f793f2bc5c5279f8a082b31e6d0279a2c7	95a3b190d9961ca5ea5070bdfddca32750044b128cad46e4b907319aa534f32e
94e41b03dc3a2526e0a24db6e059975fd7b1021a0194d0a5e81a3fb97baedf67.rtf	fed5c3883cdeb131aecebfed023da3aa	777b5a8771f9571c779b2a85a439de80a7652624	94e41b03dc3a2526e0a24db6e059975fd7b1021a0194d0a5e81a3fb97baedf67
9388a04aa9b347704d4fb9b07035a640fb0f4a07e4b2870a3eb0b4bc4abdd007.docx	485f8284359ac9dccef395ccaa38e73d	63b4c7daf5d4f821b660cf07733f067ac87b3662	9388a04aa9b347704d4fb9b07035a640fb0f4a07e4b2870a3eb0b4bc4abdd007
9276c.exe	71d0e2af39d6e13812595dcf2c3039da	6944ca6b892e18901352010080cee39462d2940d	9276c83317fe64cefe8e577f329984fd1975cbcf9c29c92e1e7d1991084a15d0
9236af505a3ebbb408b4cdd0f8650309951764d6c0234ee75bb8d22d8b44a08c.rtf	a01fcd2a71ac256583f9f1b0d1bb5cdf	7636aaf9e6186f81da27b39031504aaf33546aea	9236af505a3ebbb408b4cdd0f8650309951764d6c0234ee75bb8d22d8b44a08c
91e6b7422ba81d359bb76c1ead103600b6258d6b53ea511c11f7295192573dc9.docx	45b64e21f4ef4a9248ca77fe18af7b25	7eb41cac06080bf49c46725455aea2f938581ce1	91e6b7422ba81d359bb76c1ead103600b6258d6b53ea511c11f7295192573dc9
91d02bfc9a8699fea8f447158a67d90af2f5cf62b024b283611d17c9f5fc8567.rtf	c597f50730816c8a2b1e8a9952a9bcdb	a7382690fc0c843dd101b97b2b2a33d82912a88a	91d02bfc9a8699fea8f447158a67d90af2f5cf62b024b283611d17c9f5fc8567
8e99014f6cf2ab5fff2b0b86c2aef86827f69f7cd2d443d82c9bbde1c0ed87e8	59ec1a55c20b6464ebee41b126e5eb87	35ec7d9a0a0b6914fe636ba89a3ad059ed881051	8e99014f6cf2ab5fff2b0b86c2aef86827f69f7cd2d443d82c9bbde1c0ed87e8
8968fb7e81053d652558b77a2048f5dbdc9b3ba2e8835acddc5c2c213ef979d9.rtf	36a36c711ac6aa0fdaaaaee1cd39763c	665270dd573f8486a68b8a9082d71b21fca952ac	8968fb7e81053d652558b77a2048f5dbdc9b3ba2e8835acddc5c2c213ef979d9
89038abc3ce9135430d17546b12856257b4ce93f892882790a4f68755d34607a.rtf	47d0caed6ae71a66535bf2ace90d1029	a11d6a33a26b9b6a13fc011def75e4265f6e777d	89038abc3ce9135430d17546b12856257b4ce93f892882790a4f68755d34607a
87d08483b9344b913c05b5dbc0fe459d009aff031cc64f4bfba8b8d5b51985de.docx	c74e50fcd34c27534198d63e10466242	af14df85dd55b518030f65cdd955201133e423be	87d08483b9344b913c05b5dbc0fe459d009aff031cc64f4bfba8b8d5b51985de
87ccd5b47d431dd7173ab3d243aad544e1b0321c643a6c9baed250128e7b72e4.vbs	09e08661f7b0ce2d135ee7b18c701aca	2b923dd6f2192f284697ed6f8605ad39eb38ec5e	87ccd5b47d431dd7173ab3d243aad544e1b0321c643a6c9baed250128e7b72e4
854dd607aa970ebb1f953b3209e604078944b7e563b1af70204dfcf2c66e20db.rtf	c59aff1ad5a212e6ffac14da843297bc	202a8e9c79abf7a41a5b1e6a35df7e1f381bca4c	854dd607aa970ebb1f953b3209e604078944b7e563b1af70204dfcf2c66e20db
8373f60ec68dc7de83b3e7c6bf8af263d7f3e24abb720774876755c3e2787186.zip	ee88c102063e2d1fb9383b989afd9052	9029629af55f5e3f738cde263fd665863d8af8d8	e95595db924e00d215a300bb892a9a02efea2ffb4f57fdfbfb9b8dc9a1f11bcf
835828b6ad9fa17b9a9ab21ee9ab58d2.xlsx	835828b6ad9fa17b9a9ab21ee9ab58d2	cc26334cb8f4dde326f59c6401c1543589d3f2ac	d22d96f737ec78da675364445bcbe31d1bfaa14ee75cc3df45b8b774bdb48393
83082b3658df1576b1cd33ad7d6950377be5c86fa3806276a9f4ee18cb036194	59db61201acc8d3ba969567066985b20	a76cf1a0546cc1afd7d00ccc5df3939f287e8f95	83082b3658df1576b1cd33ad7d6950377be5c86fa3806276a9f4ee18cb036194
82cd5ed58b2a63b3098f8322a7f45e2125406125354981716601e5274bcc9c9e_JC.xls	b4845a241a8c4e8a22e221edd9d9b5d7	62c760e98d352131474947f3be744a1336d49643	82cd5ed58b2a63b3098f8322a7f45e2125406125354981716601e5274bcc9c9e
7e0a0de7f1bb767eb1d6b2690e7a7233350a071159ffdb6d2db2a0b232f61bd5.xls	d44aef26c4a226bc61fea9f6982d7c4f	a21812ab46cea86aad67e3ec3ded5bb8c1bd812f	7e0a0de7f1bb767eb1d6b2690e7a7233350a071159ffdb6d2db2a0b232f61bd5
7D270000	75582e7333ecc67032fafb653c86d7f5	c57dfbcc8058d00a1f97a05947eb7554e0a13fdc	d011d980d81a450d4f4beda92ab90856320c5aa0e31ec3c8635639a65bee16ac
7c673979f4c006bc3978f0050224b4ad06afe11e98d37329abc2a27a94236b54.rtf	c03d290f88484e9eec18179dd71c04e7	db5058617cb8f1ce5d6f9a39ff566487b7d8470b	7c673979f4c006bc3978f0050224b4ad06afe11e98d37329abc2a27a94236b54
7b768394fa0869d92f872eb486f49fabd6469ef3a8fd8bdf9cb49d35b39ea73b.rtf	35dfa84709482403fae73333eaa0f4be	636d1ae335692e547fa65ecff198d853ea9ce083	7b768394fa0869d92f872eb486f49fabd6469ef3a8fd8bdf9cb49d35b39ea73b
7aee7531861d50a780d57eaf464dea4305e039da811d3ad7dc39fdbbf369972b.zip	7e42a7c1228b49de3a456db84b56af4b	4ed925880235aff579fbe5caa7c35b3578a96634	7ebacc4ff8e80d921155d2e8f52f93f1bf14a66b13eae35c85e7ad55cb9940b5
7aee7531861d50a780d57eaf464dea4305e039da811d3ad7dc39fdbbf369972b.zip	2f03daa44462c4b126438e6c9f22122a	a9e07ce56e1f9ed4e8e04a5412730c4fc61c71d3	d99ca5bc5f1e3b1b805f291b976d7ee140bdf349a48ce5420e804e2eddf70594
77c1816ede862ab4f27404b6395d40342181645513ca55e9f7a0256d319ef312.rtf	6ccb218bc14098710bbc714e539ab432	e89d1c6f127834cd447c5a88e4e65b2e235ded47	77c1816ede862ab4f27404b6395d40342181645513ca55e9f7a0256d319ef312
76ef5cfb196efc0a28b740826579c32dc96165ae1c6beda3f0b5f3e5f5dde93e.xlsx	61784c64fa678eb4b4141fe4930cb386	c1d4b47f66114e33bb3f8af30aacfcf7a4fe2118	76ef5cfb196efc0a28b740826579c32dc96165ae1c6beda3f0b5f3e5f5dde93e
76896d8f8fd4b1af2507c663044aef42b9d7256c6e50fc4f2c4e2b7e0d8c22bc.rtf	b05742a1e7d55915fb471aa6d8e40603	16957a9697a8720c61ec3c91d9a06f0f1e5f729f	76896d8f8fd4b1af2507c663044aef42b9d7256c6e50fc4f2c4e2b7e0d8c22bc
764e1d6e17b2bf3ff9beab19e067594d2a7f1fdcd9f3fe74031c11f650aa2f49	10becade76ccb8cbe488fddc823f7fbf	17a58fd39584c3e01bf4738501ecd3b03f3f8b7e	764e1d6e17b2bf3ff9beab19e067594d2a7f1fdcd9f3fe74031c11f650aa2f49
751d62148e22df314e2d52d87ddedb3c640b00203c099db1525d015273c8c338.docx	4ed93ac38f315fb4d99ce75614f45c3e	f7de3365879a5f401a22e86fb2880778ef18fdc3	751d62148e22df314e2d52d87ddedb3c640b00203c099db1525d015273c8c338
724b5870f31a5bc553b89a5d72625b112f6a5970b52189f0027747cc82f5697e.rtf	472d8150e4aa666cf5b9904c2e5ca9cd	9334c0dbba480706ebb9e91065eeb14b11412795	724b5870f31a5bc553b89a5d72625b112f6a5970b52189f0027747cc82f5697e
716560400b53cafcc395a9bdf7dcdc66d060804a893dcfe37ad4c2387f517c4c.rtf	ccbd20da3ade00b9373a9008fb7f29aa	d99b20cfabee66b7cb8a415841f05eda84f06b76	716560400b53cafcc395a9bdf7dcdc66d060804a893dcfe37ad4c2387f517c4c
704ce601e54cf1bf4609ce5b1e8c19db3c6c471d6ac206724b599dbcfcfc812c.rtf	1df6438da696c1560b6d488948620f94	704ff0a28aeef3a0fe67d5d593041a8685016b13	704ce601e54cf1bf4609ce5b1e8c19db3c6c471d6ac206724b599dbcfcfc812c
6ff6c442c265d570f4ac800b48c25c85df51b3e2ce4d98aee9eb666894251e09_JC.exe	7044e350d5ce87c637beb058755884c2	ac1062211fd3e2d0e0cb363e484a5ed33da88fc2	6ff6c442c265d570f4ac800b48c25c85df51b3e2ce4d98aee9eb666894251e09
6d83a1699bdaf7e37d6a6179b6e5fb45.rtf	6d83a1699bdaf7e37d6a6179b6e5fb45	bec6644f6e7272117039d14ba93e5b1b69f21cb9	427ecb0976dc25ed32aea69e338dd5bb6f2e8ec2aa56a6c9c49428e52bcb03e7
6c2ab6f9e93b0959f735dbb024574cfa114f438577eacb3aea9b36c64e804c53.docx	d90d8c2a6a60d384c331ab32dcafa643	326b6bdca100671e52ed2cda567f62ad9bf06d54	6c2ab6f9e93b0959f735dbb024574cfa114f438577eacb3aea9b36c64e804c53
6bda8758129b89e1c89114397e7e790ab358947512ace88a0d07d8a7531b447e.zip	e79275a42921f98a3b1dfe7756fa8274	1bb64ff0cb3e579494fc9110658063cf862f40d8	89c1e0ece1318c274da2d975f1eb9a50df979a8b1ba5ad689dfd50d63b9ca6fd
6bda6f57ab365451ac082d9e70ee2b28e143750b80ff271171baea1d260cafb3	b7a4b3379e409089b707362995887ea1	7b2a104e475234b87ade4d6ae655eb61878ab825	6bda6f57ab365451ac082d9e70ee2b28e143750b80ff271171baea1d260cafb3
6b5ae14fcd6565ae94af730636763eba7e3933c0.docx	9b6a9d8407d957a16861a6dd2ca2e6e9	6b5ae14fcd6565ae94af730636763eba7e3933c0	1066a64194afd87f76f87b6524087a1c4eeba60752802e2f8a7c2c513f197e7a
6985c11c3bf98678ad0def590570dbb301a91d31bdc82bffa17be8baebf91c45.rtf	3c16e7261de827d233569ab9db4f3381	7c5b91cd266c0597f2f042ee4be5ce3ac4dfa8c0	6985c11c3bf98678ad0def590570dbb301a91d31bdc82bffa17be8baebf91c45
683fe594b6a65f0dbd6d015c5eff0ed1c7c74a022580dd3a35806a01966d7683.rtf	73597f09fd2c045eab166bcf31ce2d1c	060d5f8cfd6f692ab8cded1f97970f5e1bdefcca	683fe594b6a65f0dbd6d015c5eff0ed1c7c74a022580dd3a35806a01966d7683
680a32a818c843779ce8b597c8e561d6.exe	680a32a818c843779ce8b597c8e561d6	130229782a69515dc5affb15cf50e3226410dc1a	a419133b9f7d3fc141e69dbe9c40866ab30537f07e267f6c72a2ec6740c73f59
66b45aac6a00a45f2c297b9db693235519e42ba2de56a8c771a882c6c0542159.docx	68302fe4dc380c739bff69e51f77efed	9689f972f5bb59fe6e57123f8425e025c1242336	66b45aac6a00a45f2c297b9db693235519e42ba2de56a8c771a882c6c0542159
65501a4d423197612f30f2d0753c95e6a5f658a3c1205cd9972cd49a287190be.rtf	0059196773fd7d910f0bd352fe05531d	ba63027b7dfe880c95fa57234a98f8d1a789f3ac	65501a4d423197612f30f2d0753c95e6a5f658a3c1205cd9972cd49a287190be
632f7e212cc149d81b322def328534953b979d1f1885140e2645e4ac41d0f56c	9e0226adf02222bbee9aa7e2f6f1c07a	64e031bda28509528f26a64ac5d7935cf5afe426	632f7e212cc149d81b322def328534953b979d1f1885140e2645e4ac41d0f56c
63056ca0409d5e15d038ec044aa4fccf4ddddbeb17ee697274feae60fb520f0b.rtf	4f0f6cd3d79ef0d367bdba2aa80554c2	cd023c49119fb7a6edf2cd4eae824f5ac0a0f6c6	63056ca0409d5e15d038ec044aa4fccf4ddddbeb17ee697274feae60fb520f0b
62763ea99a08c8de0139281ea02be501.rtf	62763ea99a08c8de0139281ea02be501	99f481ad361658bbe70f3adf1e558131af3fce3f	41877fb7bc2bfb83e6ec4b28dc8be3fd3182ea2502c45b1b1447b72b76702ef5
616b1dd0140390f57b71d94045495d86a3d4367952a4c74b7e329517ef346b90.docx.000	14b0e404e2c87745f187b3eb6089594e	cea585a58f4e0de28dd3490ecc71e3f60035b9f0	616b1dd0140390f57b71d94045495d86a3d4367952a4c74b7e329517ef346b90
5fcc7e7307cbe74f1d56ac65ce624d4063782bd058dc8e1c3333ad3d6055d649.xlsx	d6ed46fe026cb544c76ee58e6a37f219	2c63719b47c03c0c0fac65ac4c1e36c9225d67c4	5fcc7e7307cbe74f1d56ac65ce624d4063782bd058dc8e1c3333ad3d6055d649
5902de8ab5aca16a29fa99a1f2d66694266429bce310f41973c6d3339be082e6	683e1fe2044345ac61752696d3e8bdb8	1de1701134a5fd88a5a8abb88c8e52ea698fad31	5902de8ab5aca16a29fa99a1f2d66694266429bce310f41973c6d3339be082e6
574fd1b8dc0a6d791c26bc6f4ebc25fed6751ae316b34c481b16ed0154498ad0	e74e1305b7d0117907ff400e1f7949a8	bed8d6f6f2fe85b6e2ff123957e4fbc9a7f39152	574fd1b8dc0a6d791c26bc6f4ebc25fed6751ae316b34c481b16ed0154498ad0
568a3eb0bee91d00c51fa77bd15f5f24caf1502fa33c1bae6b507bb2958ff79f.doc	956f1e43ce0c4cdb9322fe1411e3b502	0f4841790d7e28b89c154b7027600264a4bf166a	568a3eb0bee91d00c51fa77bd15f5f24caf1502fa33c1bae6b507bb2958ff79f
5572ffd080ba92dc24bd703be1d53d5b4bcad05ae87bf74c175f9cb03ac7c09a.zip	4a86c4d38f594701fba6f491a2506d87	dce65d2f23808451e525d76bfb3d20b2fccddd11	2d1db3dfa7af61b7e6fd5843a111de7c005466e4c2eb063341d337343f34bf63
54a55f979678320d1f40d02b3bb60e0ba8639e8f3968dd93922a7f2fedf0c2bd.exe	e1ef12c1327c307f1cfee9dec7626fcc	c571dc00092e1dc217c534ed801a7901e4f6adaa	54a55f979678320d1f40d02b3bb60e0ba8639e8f3968dd93922a7f2fedf0c2bd
53f5480c8961c05a0d59dc759cd4f3bc5ee55cc9ad5b7258879755f21aed2a37	721b5bf44bc2e8426238d71a4d6edcb1	224f19c9eb80108d7cf3c67f0c0b70db48126fa5	53f5480c8961c05a0d59dc759cd4f3bc5ee55cc9ad5b7258879755f21aed2a37
53e383f5044cde47421b80f8795a4d10aa40543ec60aae5b575086fe1dcd7b3a.rtf	92f3ff8cfd7ed05969d854a6e41eb98a	95ac8338a39675ef5b2c04d7a54221c926590e40	53e383f5044cde47421b80f8795a4d10aa40543ec60aae5b575086fe1dcd7b3a
52b32ac1009f5633f0dee6a2305af7ccdf99c726c4757fa2bca6a0ea212d720f.zip	318d7add3ac9595fcb1a328f3061231a	897f46786d020add2b78fcf74fe889955328e6fd	099644900123dff81b7081184d746a21216c348dbf1bca2dd94076c9c190703b
5298418c258b63fa6301982801d5c2c340e35f6577ebc78c3e2df45faa9af8f7	bdab2a18c2e6dd62667aef2024e9965a	79f795aaa0051fb83cfc50be5a4ab9f761f6bc18	5298418c258b63fa6301982801d5c2c340e35f6577ebc78c3e2df45faa9af8f7
52415f12e2a46da2a182093d2a6eed8c8273946e98c582115ba72a49e9bb75e6.docx	a87634abcfe030d5fc41612a9c1d2dd9	f7b92fe99e3d7baf94e726697b546d57f1f8cbb9	52415f12e2a46da2a182093d2a6eed8c8273946e98c582115ba72a49e9bb75e6
517b779565c7a57d487398679762a8e39266e175131a2aec673322e6af9e7f5a.rtf	67f64212a6dc1dee79d39b72d1d71041	72f7cdcec9d629632b1a6b6a4d3c876313ffa709	517b779565c7a57d487398679762a8e39266e175131a2aec673322e6af9e7f5a
50%XPAYMENTXSWIFT.docx	4e7e904135d59dbd59f2823d554322a0	c8b477d80b06556dec6a97962a48ede70e858eda	f088a2f922d7596ea3c2cb73fb9258f8b37e80accb5ae55717e10b45179cf831
473c820df4b238a6e5508912b66d9b18aa10157c826bb42271797ba952051c7a.docx	300eb05a990967cac8483d98e8ae5d05	3246714299fd84b3bb530e7138e570dfcf5948ae	473c820df4b238a6e5508912b66d9b18aa10157c826bb42271797ba952051c7a
4363463463464363463463463.exe	2a94f3960c58c6e70826495f76d00b85	e2a1a5641295f5ebf01a37ac1c170ac0814bb71a	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
42d3837bf1dc78a79c488153d7ff0ca9.xls	42d3837bf1dc78a79c488153d7ff0ca9	40dd20643ba58bb81a27c3be4c37c84cc6a2ce6f	d483c4f1670ea7a69f9cdbbf716e67f1511e271d485229566afaa67011304dd6
41e92c70e0cfad3d8a15b25c9abbc79a3145444ec2c589881b46116ccb7b0a7f.rtf	1f677f128897e4e490351e140776a44a	363cbb65b86e443f24de3d4915db01208217c08c	41e92c70e0cfad3d8a15b25c9abbc79a3145444ec2c589881b46116ccb7b0a7f
4146aa473e4605091ab178f61e40782bda93cfbba733f52ee02a6b51fa0f052e.rtf	755932e4a5dd0262ac2b91a3f28e09eb	36a98688e0d50e0584034daa45565b75905de044	4146aa473e4605091ab178f61e40782bda93cfbba733f52ee02a6b51fa0f052e
3f4f5e4f1b608b471db6433607ea0b223c31df06e35a740572747e9a1cee54b3	ba76cccebe5adfdc669e933b5fc320e7	7457a05e415855131efd3a4c1bfda45a9051a656	3f4f5e4f1b608b471db6433607ea0b223c31df06e35a740572747e9a1cee54b3
3d3dbaf0766de69b7f4655933106d1ed0282a5ec650c987e31fb3e0a1e0f195d.zip	82839ba79ae7d406f665af2dac7de7ba	6eb28adb6e8cc866f70dbbd22407f7ad0f78dd6b	01201b5e9dd34df5522bf0db0bf0f7bac87272249316c4e7470c493edce157a1
3cc2f066ba77c5d0468f77580957ce0d872961f8803bd9dae47ee65a8088b004.zip	2fbf857bdd296682b997ee6b36dd76a6	47e6fdb6b3b72501d0d6bbadf73b7ba16117de4a	d313872b940057f9eb596b028aaae330e0569bc1339a3e71a00cc6580e3276f3
3cc2f066ba77c5d0468f77580957ce0d872961f8803bd9dae47ee65a8088b004	26570b685186f148d866f342f94d04b5	46d5d6e37c2062c8c7aef94dca143520d4be42b8	3cc2f066ba77c5d0468f77580957ce0d872961f8803bd9dae47ee65a8088b004
3b8ec0e9542ec0bddb9ee64b4644c65c069f1c03a505e7079fd3ff209ff5045b.rtf	cb38fffe4cecba910dd0817a0e755f11	248968f14c1706a105f86ed9da4cdb48a98535e0	3b8ec0e9542ec0bddb9ee64b4644c65c069f1c03a505e7079fd3ff209ff5045b
3b89a9f5f315f37ec110ec2e59c40e9635841115a73bb031edcbe7d059904ae2.rtf	4b8d9718182adc5a816e871c94e893c8	b4738338f23c754a889f88a3de30fa7341b2de76	3b89a9f5f315f37ec110ec2e59c40e9635841115a73bb031edcbe7d059904ae2
3a23b616a5944735ffa156ebfba3fcf8debec466c00687a52ecdbde03b2bd94a.xls	0cd0b71b219419b688ecd6599223639a	fde7e33898b73304755f1cff8578139f34246e23	3a23b616a5944735ffa156ebfba3fcf8debec466c00687a52ecdbde03b2bd94a
39eb5f6f12c6556ab7556dfc5684e430323ff1768d305f527538615b55b884b8.docx	10a0a845587723ca7a0f48d013e93d9e	17d8ea8de47cf645f4f922a9e601e74e3705bfcf	39eb5f6f12c6556ab7556dfc5684e430323ff1768d305f527538615b55b884b8
395694b99ce0310e2aa9e6b96f479c36956af254b047c959a022c2b1fef2d6c6	ad19c30e8fc0f89004a1f960b477707f	0bb59500525d0b45c506c7b4fab6c1d905ee3280	395694b99ce0310e2aa9e6b96f479c36956af254b047c959a022c2b1fef2d6c6
379bdcb7512aedd9bb87d875d66281766a478b2288f1074b95d938589059d4f8.xls	fe1947022cd5ff9d3ef2f267f323833b	ca07d2d6c63dad12362bd6b5576721e3426156ae	379bdcb7512aedd9bb87d875d66281766a478b2288f1074b95d938589059d4f8
3688f05556a136fe094de5cb1888eac2a579525f72cd027e19738582ed40c283.zip	ce7dc9a4a7e2542a7b3c53ff2721c182	6855f4213dbb2b74e80ea4c299b2d94c7166590d	60c69e3878cb29f0fab45f01c3b806cb7d046929c708a86ddfdba9598269ae5f
3688f05556a136fe094de5cb1888eac2a579525f72cd027e19738582ed40c283.zip	2aba6e09b7af674c9cc2bf4047fbbd2e	cb68241c564ea94f825836eb47cd282114466b19	9e3a92130b1b47f14434eec80d6f533bae95573737eeeefb03903519f9f806d1
3688f05556a136fe094de5cb1888eac2a579525f72cd027e19738582ed40c283.zip	60cb81e75b1f23e4198e371ffcba614d	7fa5d3ca357cf2fb82d0b21a9303dce53642bf62	d0c7210491998315db8482296530309073e8cd6c523ba6f1fd3001f697a8c2db
3688f05556a136fe094de5cb1888eac2a579525f72cd027e19738582ed40c283.zip	a72efe79e24df656b1c55d2c67f4c9dc	65ca40119351f524c478a6c65c1c201c0023d439	d42e9664e09335d59b0ac731746b766ab92f6d02a8f39e8c55f16407f8499797
3688f05556a136fe094de5cb1888eac2a579525f72cd027e19738582ed40c283.zip	4a84fcd38e7fa484f814f1a545fffea3	25373a57005f725c32bcfc0b72a06f001c375843	f62e462f1cb35aa88716afc7d30f87ccfad72fe7bd079469fb92b89990110f5a
34d4f41be41415d251e917eec848e3a0e93a741ef5ac3d17e2781597c6d947a9.rtf	e567a41dabaf821c0bc51aff2925c190	761fe57c2da0aa95562369e67370748239e390db	34d4f41be41415d251e917eec848e3a0e93a741ef5ac3d17e2781597c6d947a9
317823955933fb40757674275b08eb58d03956459a0c2d30cb14b5edaa557c2b.rtf	18f15cd6a792ea9a0a5d835e9e9e5c89	5d9f70fd761854f72c719aad591f8a29d70d5300	317823955933fb40757674275b08eb58d03956459a0c2d30cb14b5edaa557c2b
2f346530bbcfd52b48cc589e1ba8f42ac72eae31ed9aa0b0e20ec7df0cac3bf6	01984a8dda890f0ed6dfd9b6b12fbd23	9abd358ab00de031588bbe3d4cfbfb02beb3a00c	2f346530bbcfd52b48cc589e1ba8f42ac72eae31ed9aa0b0e20ec7df0cac3bf6
2a8e81ea949501a0c65786800d080f8162e56e7a6f988231097acebbf86a7b61.docx	55fa849c3fa213c1d7127af40c569a06	d3bcc82d43fd4accc211fbbba5805c5c314d9254	2a8e81ea949501a0c65786800d080f8162e56e7a6f988231097acebbf86a7b61
2a3626fa590b72f5a372351b1a8e18a524f356b1499f8a08af326c67692217cd.zip	6e368fd3b0e77b57756e2bb60debe2b0	db2839ef38551d72f6367e7e6e44072f6b6a5e87	a17bb0b1fc411b8e8977406ed66d36933c637ab9cdebc30b205862f353a45aa2
23INSU020103090 DATED.docx	7486f804de21255e1fbb0b717619b287	c328edc80f120b5b2cd71981df8b84419e565da4	4505f3fe4e37e604dea5f5c0c1d4550b7b028f1707604128732affb0246cc650
21112023_2210_21112023_HSBC Payment Information.xls	2059752a372d5e3ac4893cf85d6b8079	264e2ff34bb6cd54f31a3de23f9d9cd8f0b20224	131a501ed29c2546575209cbaa6837c0dd4d81f9705d3193864d549c10fcddb0
20032024_1753_ilovehertrulyfromtheheartiloveyou.doc	6e0935d0e6c119b346c499f2d8ec171e	72649006fafce65ad62619a64e9e785906198986	cdfb1f76c1338d4881d0ba45d443e48dd8889a430a1cc1ce1cc0b5437e85b77b
20032024_1735_Invoice.xls	099fa19fc662f00083453ffd27d49d14	5c491c6625ab617f0850bcd4b567fe2d9746841b	aff6f5b1d36dddde99b477a425330ea1274681c0b216b2e6da388f15c4527d1c
2.docx	0d282cf714d36f7883fa1f65996cb487	e7ddbe6bfb647627db77b0af9e8e5cc2abe761a6	a9b453e2a8ddd01dc977946bb0a99314779e1322dc8cd769d9d1f68d58e76053
1d8afbb50c3e46ce4311d51bb1af9fbcace0f3db9b4ddf3a92f2e6e4fa7c6d1d.rtf	9653583758a6bed24ef3196424892166	87e7e8fd6e6b95591edde3ceefa7ca3ae3e857e6	1d8afbb50c3e46ce4311d51bb1af9fbcace0f3db9b4ddf3a92f2e6e4fa7c6d1d
19a775bd69ce741a815e6f67b3b78d04fad87a296ed2515e88b1ad3fc5a74aae	263e05601d520fc6dddae63a2346eca6	55f96d85611d46d948370b68dd300b0fc9042f2b	19a775bd69ce741a815e6f67b3b78d04fad87a296ed2515e88b1ad3fc5a74aae
164e8075fd8029e9c27525933f62ae9d1aedce53729b58630935a7c2299b350a	a77330743abb7fea71dbc33a122b3c09	6b7c0946aa8c00ea239b73eba3baafd559aa7683	164e8075fd8029e9c27525933f62ae9d1aedce53729b58630935a7c2299b350a
13330cf96be68f9c1058a2608ef46ae54d9af561790a2e4b6428b076d40f457e.rtf	afd58c071d6a783e11854b9efa544840	30a6538dbede15967e30c0c20bbfa6164229c7fc	13330cf96be68f9c1058a2608ef46ae54d9af561790a2e4b6428b076d40f457e
12047ca7ecfe6caf4a9798565ade481d1a1c46f7d1aa09b6576b11a36b431547.rtf	a4a7d9d368757b4d491b8b295abfd16f	89bb7cf606ede494dab8c89282ea399418f536f7	12047ca7ecfe6caf4a9798565ade481d1a1c46f7d1aa09b6576b11a36b431547
1202.pdf	a2751806395507a1418adbb995cfa26e	653c01f221326ecd6053187ed566eeaca6b75879	d93bdedf8063e3d6ecd99d1c7d938e1f140d3ae873b2ef14b63af367e31f6df4
1132.xls	15a4cb54baeca1e5a1a8fea8483ca1af	6f24d08fd83320e303d0cb3b48a2ba029b783d38	1cec950b5a2818af2a8419bac0f55467a9334824f86a060a1b4f555dfa4dfd1b
1.xls	ff0965097d4bc67f1f5f29997a812e8e	df2b0241645cc410a1439f354c7421f7aecbdf4c	f4442af3eafb900414079fe11369f0fd22624ade35640e810ee674cfcc22501c
1.xla.xlsx	1620224d6efdc7d009b64899a6a67626	aa99049bcb8caaac23c7c3a9488b47435ce524ec	d1836e6e0661938656d0d8883daa624f59b4a0885cd663be712bfa88a5ccea19
0c28aedb85b82641bdbe7270293a97f440dbcfa14489b1348fa89ce0ca331896.rtf	612413293cd0c309075ebf2898115316	53b5ab29ad6bb922960fc7614a2643b8b4277a05	0c28aedb85b82641bdbe7270293a97f440dbcfa14489b1348fa89ce0ca331896
09d5e042a8c569bc785d4937bf4b07f53897c37f5d91304f2a69ed18ec60d7ef	7193e486093ab597825062dd2e1bbe4b	9cc536e983081790eabb19cf872dfc612e39aeb1	09d5e042a8c569bc785d4937bf4b07f53897c37f5d91304f2a69ed18ec60d7ef
06e152dd7b3d5488f65efe376708f9fdc8f5b1f061f2586607a142d6aff8fc3d.docx	b7fbea603526450f9f196f0351b411d2	69cec4e11ed336b0c5bd4d5d39ccf49c96ad7823	06e152dd7b3d5488f65efe376708f9fdc8f5b1f061f2586607a142d6aff8fc3d
03905ce2b853ebb6341c53ce261752613d067720491765fee7be8875d941cf82.rtf	23d984b56442dc4d69c773d3e7e7a8d8	ba1d5792f37d858c54df890e48bdb5c438821d96	03905ce2b853ebb6341c53ce261752613d067720491765fee7be8875d941cf82
036be40c38dfe9b01a9830dc58c05a29ba0c7667f3913257e84c7db54ff32db5	f9a4a421230c941005f983604a619ef6	dc8a3f1164bf81c9aa872012978ecba503c0d1c2	036be40c38dfe9b01a9830dc58c05a29ba0c7667f3913257e84c7db54ff32db5
0095647867574.xla	1b6ed68d65553124a3b0a266ff88fd42	c0f3a01777c5fb4706121e8933b7f3b67a1fef03	e9eb94bdd10b7e013449738066c3d13a31b2df74c1a84a75f41b6d33a3c4969f
0.doc.RTF	b4552a9b06f886c7ae9990ada1294f4d	d46339a4aa3a51c8d61dabb10e73b726ef150265	36b77972bb03b4fb5533ea72f7981734a6275be2e844ac2de008572c26c7f418
./приложени_банкови_данни.docx	9ec17d2bae2cd51d85087d0338431532	0e3f68bbcb8dc9bce8583e7f2f77c79a971fdd74	b192d6c1ab63008a8b7b297d9ae821767cbe36375579c3d16247ac64fe72910a
./detaliile_bancare_atasate.docx	0e4417768f89ae57da3ae8e91caf836f	1f350dd42bbf58737a3e1b3ec439bd30b3eda252	e9379cfe023d68f4da4adca4c7404d7082a68769e397fc8474f7bc503ddaebcf
(24.11.2023) BT BANKA DETAYLARI.docx	c297fe78203a25cd0c392329609b20ed	2394740c6c354d10eeebc9437f56a46fdcd6f6bd	b5bed05852eeefda58d941a14d9ab9c8f10a8c33ddfba17f18d492f91459a11b

SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world

Key findings:

Contents

Victims

The research begins

Other infection chains

1.1 AgentTesla attack: the main scenario involving an Excel document and steganography

1.2 AgentTesla attack: an alternate scenario involving a Microsoft Word document

1.3 Remcos attack

1.4 XWorm attack

1.5 LokiBot attack

1.6 Guloader/Formbook attack

1.7 SnakeKeylogger attack

1.8 Other attack examples

The group's use of legitimate FTP and SMTP servers

Attribution to known groups

Conclusion

Product detection rules

PT Sandbox

PT NAD

MaxPatrol SIEM

IOCs

Legitimate services used in attacks

File indicators

The eagle eye is back: old and new backdoors from APT30

Hellhounds: Operation Lahat. Part 2

TgRAT