Counterfeit legal notices continue to spread malware
Today a friend mentioned that they had seen several ASProx messages being distributed by domains that looked like law firm names warning of court appearances. I was a bit surprised that this was news to him, as we've been seeing this for some time. I thought it might be interesting to try to identify when the campaign began.
First, I was fairly certain that the campaign my friend referred to was the "Notice to appear" spam that we've written about so many times at Malcovery, but this does seem to be a bit different than the "law firm of the day" notice to appear campaigns we've seen imitating groups like Green Winick and many others including Jones Day (jonesday.com), Latham Watkins (lw.com), Hogan Lovells (hoganlovells.com), McDermitt, Will & Emery (wme.com). Those campaigns were all examples of the ASProx malware. But how are those different than the "truck lawyer" campaigns? It seemed worth taking a look.
For the month of August 2014, so far the daily count on these spam messages has looked like this:
While many of the campaigns used subject lines that included randomization, quite a few subjects did not, including these:
count | date
-------+------------
1528 | 2014-08-01
204 | 2014-08-02
1375 | 2014-08-04
1670 | 2014-08-05
1571 | 2014-08-06
1967 | 2014-08-07
1541 | 2014-08-08
129 | 2014-08-09
1 | 2014-08-10
1182 | 2014-08-11
1399 | 2014-08-12
191 | 2014-08-13
58 | 2014-08-14
25 | 2014-08-15
1 | 2014-08-16
21 | 2014-08-18
(16 rows)
We've seen more than 200 different "law" names involved in this campaign, including many "truck" related law domain names. Here's the batch so far just in August:
11727 Urgent court notice
11693 Hearing of your case in Court
11182 Notice to appear
9935 Notice of appearance in court
8424 Notice to Appear
7433 Notice of appearance
7108 Notice to appear in court
6612 Notice to Appear in Court
643 Court hearing notice
568 Pretrial notice
441 Mandatory court appearance
This group tends to have email addresses that were a single word followed by three digits, so we use those to search in the Spam Data Mine:
count | sender_domain
-------+---------------------------------------------------------------------
7 | accidentlawyers505.com
1 | addictionrecoverylawyers.com
328 | alabamatruckaccidentlawyers.com
375 | alaskatruckaccidentlawyers.com
352 | albanycountyelderlawyers.com
11 | americanaccidentlawyers.com
8 | anewgenerationoflawyers.com
17 | arizonaspecialedlawyers.com
363 | arizonatruckaccidentlawyers.com
358 | arkansastruckaccidentlawyers.com
12 | auburnbankruptcylawyers.com
11 | aviationlawyersnetwork.com
387 | az-lawyersadvice.com
6 | bellevuebankruptcylawyers.com
379 | bensonlawyers.com
1 | bestlawyersinphoenix.com
8 | bestlosangeleslawyers.com
355 | best-ontario-lawyers.com
361 | biofuelawyers.com
360 | bronx-injury-lawyers.com
316 | bronx-personal-injury-lawyers.com
15 | brooklynelderlawyers.com
371 | brooklyn-lawyers.com
12 | bvslawyers.com
326 | calgarydependentadultlawyers.com
356 | californiatruckaccidentlawyers.com
299 | californiaviolentcrimeslawyers.com
5 | canadianduilawyers.com
362 | capeannlawyers.com
311 | caraccidentlawyerskc.com
8 | career-lawyers.com
318 | childsupportlawyerslosangeles.com
13 | colobklawyers.com
409 | coloradotruckaccidentlawyers.com
395 | columbus-dui-lawyers.com
9 | commoninterestlawyers.com
326 | compasslawyers.com
390 | connecticuttruckaccidentlawyers.com
14 | contracosta-caraccident-lawyers.com
17 | criminalcourtlawyers.com
334 | criminaldefenselawyers360.com
4 | crownpointindianawilltrustsprobateestatelderlawattorneyslawyers.com
9 | csduilawyers.com
5 | deferredstatuslawyers.com
401 | delawaretruckaccidentlawyers.com
1 | divorcelawyersinjacksonvillefl.com
8 | drugcrimedefenselawyers.com
5 | dubairealestatelawyers.com
4 | easternnclawyers.com
11 | employmentlawyersfortlauderdale.com
10 | ernestolawyers.com
10 | escortdefenselawyers.com
1 | estateprotectionlawyers.com
12 | falveylawyers.com
354 | familylawyersoforangecounty.com
10 | fla-injury-lawyers-blog.com
9 | fl-criminal-defense-lawyers.com
10 | fl-criminal-lawyers-blog.com
7 | fllawyersonline.com
11 | florida-criminal-defense-lawyers.com
9 | floridaseniorlawyersassoc.com
370 | floridatruckaccidentlawyers.com
15 | fortmyersrealestatelawyers.com
12 | garzalawyers.com
9 | gatewaylawyers.com
388 | georgiatruckaccidentlawyers.com
12 | gofindlawyers.com
13 | greatnecklawyersassociation.com
10 | hartfordctlawyers.com
361 | hawaiitruckaccidentlawyers.com
9 | hcvlawyers.com
351 | highdesertlawyers.com
7 | hounslowlawyers.com
372 | houstonmesotheliomalawyers.com
6 | hphlawyersonbloor.com
9 | huntingtonaccidentlawyers.com
385 | idahotruckaccidentlawyers.com
13 | illinoisbicyclelawyers.com
347 | illinoistruckaccidentlawyers.com
308 | immlawyers.com
330 | indianatruckaccidentlawyers.com
7 | indy-lawyers.com
5 | institutionalinvestorlawyers.com
352 | iowatruckaccidentlawyers.com
340 | kansastruckaccidentlawyers.com
300 | kentuckytruckaccidentlawyers.com
9 | kentuckyyounglawyers.com
337 | lakelanddivorcelawyers.com
12 | lancasterautoaccidentlawyers.com
1 | lawusa.com
6 | lawyeringforlawyers.com
311 | lawyersadviceinarizona.com
350 | lawyersadviceinphoenix.com
8 | lawyersandloans.com
14 | lawyersbankruptcysolutions.com
9 | lawyersbocaraton.com
11 | lawyerscaringforamerica.com
7 | lawyerscaringforarizona.com
8 | lawyerscfo.com
393 | lawyers-connecting.com
7 | lawyersforeclosuresolutions.com
8 | lawyers-germany.com
8 | lawyersinbalance.com
15 | lawyersinthecloud.com
3 | lawyerslawfirms.com
7 | lawyerslongisland.com
14 | lawyersonlineguide.com
13 | lawyerstaxsolutions.com
1 | lawyersthatrock.com
5 | lawyersvirtualbookkeeper.com
10 | lawyerswithdepression.com
11 | loan-modification-lawyers.com
364 | long-island-lawyers.com
356 | louisianatruckaccidentlawyers.com
11 | mailfrauddefenselawyers.com
376 | mainetruckaccidentlawyers.com
10 | malpracticelawyersnewyorkcity.com
329 | manhattan-injury-lawyers.com
362 | manhattan-personal-injury-lawyers.com
318 | marylandtruckaccidentlawyers.com
807 | massachusettstruckaccidentlawyers.com
10 | medicalmalpraticelawyers.com
388 | mesotheliomalawyersonline.com
402 | michigantruckaccidentlawyers.com
8 | millbrooklawyers.com
398 | minnesotatruckaccidentlawyers.com
374 | mississippitruckaccidentlawyers.com
361 | missouritruckaccidentlawyers.com
8 | mitpatentlawyers.com
11 | mittrademarklawyers.com
7 | mmspersonalinjurylawyers.com
374 | montanatruckaccidentlawyers.com
12 | mylawyersolicitors.com
14 | myreallawyers.com
7 | naplesbusinesslawyers.com
373 | nassau-county-lawyers.com
329 | nebraskaboatinjurylawyers.com
315 | nebraskatruckaccidentlawyers.com
1 | nebraskatruckaccidentlawyers.com.com
351 | nevadatruckaccidentlawyers.com
384 | newhampshiretruckaccidentlawyers.com
398 | newjerseytruckaccidentlawyers.com
370 | newmexicotruckaccidentlawyers.com
365 | new-york-city-lawyers.com
9 | newyorkscaffoldlawyers.com
393 | newyorktruckaccidentlawyers.com
339 | njlandlordtenantlawyers.com
351 | northcarolinatruckaccidentlawyers.com
377 | northdakotatruckaccidentlawyers.com
284 | nyautoaccidentlawyers.com
312 | nycaraccidentlawyers.com
14 | ohadoptionlawyers.com
383 | ohiotruckaccidentlawyers.com
344 | oklahomatruckaccidentlawyers.com
404 | oregon-lawyers.com
373 | oregontruckaccidentlawyers.com
11 | palmbayinjurylawyers.com
8 | panamacitysocialsecuritydisabilityclaimlawyers.com
321 | phoenixlawyersadvice.com
8 | pittsburgaccidentlawyers.com
12 | poptodorova-lawyers.com
1 | portstlucie-duilawyers.com
11 | prescriptiondiversiondefenselawyers.com
17 | probateadministrationlawyers.com
314 | productsliabilitylawyers360.com
9 | refineryfirelawyers.com
356 | rhodeislandtruckaccidentlawyers.com
13 | robberydefenselawyers.com
361 | rockland-county-lawyers.com
343 | saintpaulinjurylawyers.com
11 | seattlesbestduilawyers.com
9 | seattle-trial-lawyers.com
11 | sfmesolawyers.com
401 | southcarolinatruckaccidentlawyers.com
396 | southdakotatruckaccidentlawyers.com
6 | southfloridaworkerscompensationlawyers.com
316 | southhamptoninjurylawyers.com
368 | staten-island-lawyers.com
358 | stentinjurylawyers.com
14 | success4lawyers.com
324 | suffolk-county-lawyers.com
7 | tacomabankruptcylawyers.com
386 | tennesseetruckaccidentlawyers.com
13 | thebusinessgrowthlawyers.com
362 | thechicago-deportationlawyers.com
307 | the-consumer-lawyers.com
12 | thelawyerscfo.com
12 | themauilawyers.com
333 | thenationstoplawyers.com
8 | topmultimilliondollartriallawyers.com
294 | trivalleylawyers.com
325 | tuscaloosa-lawyers.com
359 | utahtruckaccidentlawyers.com
326 | vermonttruckaccidentlawyers.com
338 | villanuevalawyers.com
6 | virginia-non-compete-lawyers.com
7 | virginianoncompetelawyers.com
395 | virginiatruckaccidentlawyers.com
361 | washingtontruckaccidentlawyers.com
338 | westchester-county-lawyers.com
379 | westvirginiatruckaccidentlawyers.com
1 | westvirginiatruckaccidentlawyers.com.com
1 | whsbf-law.com
386 | wisconsintruckaccidentlawyers.com
12 | wolfegrouplawyers.com
8 | wrongfulldeathlawyers.com
377 | wyomingtruckaccidentlawyers.com
283 | yourvegaslawyers.com
(208 rows)
([account|answer|confirmation|customer|customercare|customersupport|
customerservice|custservice|custsupport|details|dontreply|help|
identdep|infonum|login|mail|no-reply|noreply|onlinesupport|operate|
operator|reference|reply|security|support|supprefnum|time|update|
verification|][0-9]{3})
From June 1, 2014 to August 18, 2014 more than 25,000 different combinations of the above were used in emails that sent email to the Malcovery Spam Data Mine.
The attached .zip files during that period of time, when unpacked, revealed 39,571 distinct executables, all of which are variants of the "Kuluoz" or "DoFoil" malware.
Because of the apparent polymorphic nature of many of the samples, where each binary is unique, I've only shared the hashes of the non-polymorphic versions - where the same binary was used many times. If the final column is clickable, the link shows the VirusTotal detection rate at the time of our original reporting.
A recent trend in these file names is that the first character, which looks like the letter "C" is actually the Russian "S", a cyrillic look alike for our "C", expressed with the characters: С (ampersand, pound sign, 1057, semicolon). When the word "Court" is spelled with the Cyrillic S instead, a search for the word "Court" will not find it! Here is the word Court twice, first with a "C" and then with the cyrillic equivalent: Court Сourt
| Count | Date | Filename | Filesize | MD5 (VT Link) |
| 50 | 2014-03-07 | Copy_Court_Notice.exe | 178688 | 55a60b91143c5c91849237f8e6bc3235 |
| 31 | 2014-03-07 | Copy_Court_Notice.exe | 78447 | 6f8a65b02fea37530af50e65483300db |
| 48 | 2014-03-10 | Copy_Court_Notice.exe | 81400 | 13b519634c4a03001122def3f471616a |
| 31 | 2014-03-10 | Copy_Court_Notice.exe | 78446 | 1f9570e4b628f81578ae0fb03cddd137 |
| 33 | 2014-03-11 | Court_Notice_Copy.exe | 140800 | 202a8720eddc389b91fb4d398df95da0 |
| 29 | 2014-03-11 | Court_Notice_Copy.exe | 181248 | 49723312b73067e66b0f4db453231825 |
| 41 | 2014-03-11 | Court_Notice_Copy.exe | 144384 | 8cd13060037ddd790c41a4ea4b209a06 |
| 34 | 2014-03-12 | Court_Notice_Copy.exe | 78447 | bc08d0c5f5a5e4e6a199fce5e243e8aa |
| 43 | 2014-03-20 | Court_Notice_Copy_doc.exe | 82856 | 0a2be62df1320b4f20d4777f7b69f1a4 |
| 34 | 2014-03-20 | Court_Notice_Copy_doc.exe | 81395 | 1c549f6bc1afcfd7f0af9b2e3ada1e9f |
| 29 | 2014-03-20 | Court_Notice_Copy_doc.exe | 178688 | 786cb67c6f8409ce1933bb838e80d2a8 |
| 29 | 2014-03-20 | Court_Notice_Copy_doc.exe | 78198 | 861530485284fc46c37b41400810477a |
| 49 | 2014-03-20 | Court_Notice_Copy_doc.exe | 78447 | 93b678cbcc583079cf7e0082910fc51f |
| 50 | 2014-03-20 | Court_Notice_Copy_doc.exe | 183808 | 99fc4dbc2082ee2d111086affd2c623e |
| 29 | 2014-03-21 | Court_Notice_Copy_doc.exe | 178688 | 040196c76bc37ede48262dddbb871df6 |
| 50 | 2014-03-21 | Court_Notice_Copy_doc.exe | 78967 | 305bcd56a92c0ecfbe0a498bb920ea89 |
| 49 | 2014-03-21 | Court_Notice_Copy_doc.exe | 181248 | 546608757bde754251975a5deefff67f |
| 30 | 2014-03-21 | Court_Notice_Copy_doc.exe | 181248 | 6e3021203febb924372c87af1d239b26 |
| 27 | 2014-03-21 | Court_Notice_Copy_doc.exe | 78199 | d4f214e94467070e09fac5f762769f39 |
| 39 | 2014-03-22 | Court_Notice_Copy_doc.exe | 82265 | e7175f3ac0f29146967da11375528d4f |
| 159 | 2014-03-26 | Court_Notice.exe | 181248 | 68c8cd0bde8b38780a2d2d7862f4e02d |
| 27 | 2014-03-27 | Court_Notice.exe | 114176 | 8b1fa6be2aa31212fe15cee8c4e0cedb |
| 3634 | 2014-03-28 | Court_Notice_Copy.exe | 177152 | 096402c1e21da0df9465511b600a135e |
| 2244 | 2014-03-28 | Court_Notice_Copy.exe | 110080 | 27c7f219798ad65b158dd9c4b4658743 |
| 1685 | 2014-03-31 | Court_Notice_Copy.exe | 211968 | 36b3d44816b933c2a3c2000ed50d4685 |
| 3378 | 2014-03-31 | Court_Notice_Copy.exe | 103936 | d185a21bf355ad67b8e75e0ecb28acb8 |
| 6037 | 2014-04-01 | Court_Notice_Copy.exe | 148480 | 4adee84193b467d0ea2a2a64e4767586 |
| 446 | 2014-04-02 | Court_Notice_Copy.exe | 209920 | 3368e248a76a7b7d090d0ce7cb7335be |
| 2183 | 2014-04-03 | Court_Notice_Copy_03-04-14_AP.exe | 143360 | 790cba7836b71b666592891f7bf75b32 |
| 2698 | 2014-04-03 | Court_Notice_Copy_03-04-14_AP.exe | 201216 | 7f268ff0850a623de27dbb835d13cd60 |
| 2248 | 2014-04-04 | Court_Notice_Copy_04-04-14_AP.exe | 133120 | 0ef2108030990e2f8914639b3c1d2098 |
| 2049 | 2014-04-04 | Court_Notice_Copy_04-04-14_AP.exe | 141312 | 24826d752ee438e78d689b5416170cd9 |
| 3657 | 2014-04-07 | Court_Notice_Copy_07-04-14_AP.exe | 110592 | 52e5589b6fe5be00a3959e0da2d08413 |
| 1841 | 2014-04-07 | Court_Notice_Copy_07-04-14_AP.exe | 146944 | a1e0804d0bbc17b895194d88a61c85e4 |
| 1338 | 2014-04-08 | Court_Notice_Copy_08-04-14_AP.exe | 110080 | 66b286f769753a9e51695205ae07ffb8 |
| 2165 | 2014-04-09 | Court_Notice_Copy_09-04-14_AP.exe | 139264 | 7e28325f5bc307646097a1481512f726 |
| 228 | 2014-04-09 | Court_Notice_Copy_09-04-14.exe | 216064 | bccc5c02d4341de68dc5195497e5a909 |
| 38 | 2014-05-07 | Court_Notice_Date_May-7_2014CV-D.exe | 181248 | e3cbfdd4dfa6561e22e19177a4f60e7a |
| 75 | 2014-05-08 | Court_Notice_May-8_Date_2014FHK.exe | 181248 | 648401ae4f3b5f2f7f9198a2fc3fe072 |
| 106 | 2014-05-09 | Court_Notice_May-9_Date_2014FHK.exe | 150016 | 413d43f0e5431b58de0d37d4fc5dd333 |
| 79 | 2014-05-09 | Court_Notice_May-9_Date_2014FHK.exe | 78447 | b6029ee57a3f6b8ca73fb1699106d9cf |
| 255 | 2014-05-12 | Court_Notice_May-12_Date_2014_FEN.exe | 178176 | 512c867583c1ba6cdf8857bdd8d84ff9 |
| 263 | 2014-05-12 | Court_Notice_May-12_Date_2014_FES.exe | 108544 | 5752260d7e2ac9e57083792a5f87e4ce |
| 197 | 2014-05-13 | Court_Notice_May-13_Date_2014_A-DC.exe | 141312 | 530eed9bc14c386b10d38c77bef44a4d |
| 167 | 2014-05-13 | Court_Notice_May-13_Date_2014_D-SER-N.exe | 144384 | b15932cb2a15f06de49773400c6e1f07 |
| 41 | 2014-05-14 | Court_Notice_May-14_Date_2014_EXL-DC.exe | 150016 | 41d7b395ca4dd5b3150b35be4fad3737 |
| 51 | 2014-05-14 | Court_Notice_May-14_Date_2014_.exe | 78200 | 71ab11b81995e8dd94b9c04813b95c04 |
| 54 | 2014-05-15 | Court_Notice_May-15_Date_2014_EN_DOC_.exe | 139264 | 723770d9cff199c400ea0d472736428e |
| 182 | 2014-05-15 | Court_Notice_May-15_Date_2014_TN_DOC_.exe | 82857 | f5a4690f12f64bbf4944980060dc56ec |
| 120 | 2014-05-16 | Court_Notice_May-16_Date_2014_ID-SER_DOC.exe | 78447 | 1bb1d62749258f4813c4cd1d1b62d92d |
| 188 | 2014-05-16 | Court_Notice_May-15_Date_2014_SE-ANDC_.exe | 108032 | 5e9b56bc10e7c1a5fcb26615de7f5923 |
| 94 | 2014-05-19 | Court_Notice_May-19_Date_DOC-SER_2014.exe | 108032 | fbcb2407e676c095b53196c630f16d9e |
| 69 | 2014-05-19 | Court_Notice_May-19_Date_DF-SER_2014.exe | 81396 | fc89720c573184b6b0c740025bd8f0be |
| 192 | 2014-05-20 | Court_Notice_May-20_Date_IN-FN_2014.exe | 220672 | 110a0bc676dc2094ebaf8faad0423461 |
| 133 | 2014-05-20 | Court_Notice_May-20_Date_EN-RM_2014.exe | 177152 | 76bd89ff3141fef1345053881797392a |
| 147 | 2014-05-21 | Court_Notice_May-21_Date_EN-RT_2014.exe | 78200 | 243d37f8fc6efac0a2e99d198af01d54 |
| 149 | 2014-05-21 | Court_Notice_May-21_Date_EN-RT_2014.exe | 78445 | 8a70b33c64c5b48c9691f0ddc7826bbe |
| 119 | 2014-05-22 | Court_Notice_May-22_Date_DCSER-LS_2014.exe | 181248 | 08f2f21aae0c2917c19dbbe70842bf8e |
| 111 | 2014-05-22 | Court_Notice_May-22_2014_EN-OP.exe | 181248 | 46a6f5a0a8c2f31477cb5812f094640d |
| 107 | 2014-05-22 | Court_Notice_May-22_Date_DCSER-LS_2014.exe | 78447 | d2d84503d4f43e8abeab158a351df290 |
| 286 | 2014-05-23 | Court_Notice_May-23_Date_2014_SER-ERN-DC.exe | 209408 | 51e12bec75e8d5a0b2e434a45b7e1c67 |
| 599 | 2014-05-28 | Plaint_Note_May-28_Date_FN-SE-DC_2014.exe | 209920 | 797f8d6da6c1ca6a6f3f60c257d9f6c5 |
| 1090 | 2014-06-09 | DC_Court_Notice_June-09_Date_2014-SER.exe | 109568 | 7fb418b6c4ec42ca1ccc4c372293169e |
| 1091 | 2014-06-10 | Court_Notice_June-10_Date_2014-ID.exe | 229888 | 01535c6f5594790e458e011dc4cd7a3d |
| 746 | 2014-06-10 | DOC_Court_Notice_June-10_Date_2014-SER.exe | 109568 | 169e683b948ae1bce6a45350201b427d |
| 727 | 2014-06-11 | SR_Court_Notice_June-11_Date_2014-ID_DC.exe | 109568 | f1542e83f0577f9d54370d9778074371 |
| 1009 | 2014-06-12 | Court_Notice_June-12_Date_2014-DC.exe | 105472 | 9395698fbfcaa1f5b297c01e4aa52e1c |
| 445 | 2014-06-13 | SR_Court_Notice_June-13_Date_2014-DOC-NR.exe | 105472 | 0bc400ab22ab5fd82a3408477d7f20dd |
| 809 | 2014-06-16 | Detailed_Document_FAX_June-16_Date_2014_DOID.exe | 111104 | 3c5a4968f70f0883971d312f7f97d4a4 |
| 1059 | 2014-06-17 | Detailed_Document_ID7723H_June-17_Date_2014_SRID.exe | 77824 | 55226242da24299345b45fb46751764a |
| 700 | 2014-06-18 | Doc_Court_Agent_Date_June-18-2014Y.exe | 77312 | b0cae006c23ca33c36daecd32f50d9fc |
| 1076 | 2014-06-19 | Copy_of_document_Date_June-19-2014.exe | 74752 | d6b9982d1b3abcb4530a7abd6a063944 |
| 27 | 2014-06-20 | Copy_of_document_Date_June-20-2014.exe | 74752 | 73f03523e4c14ca55a92dce91b958ba1 |
| 262 | 2014-06-23 | Copy_of_document_Date_June-23-2014.exe | 76800 | c5b6a4c546be34642141660e7a0dbb1e |
| 169 | 2014-06-24 | Copy_of_document_Date_June-24-2014.exe | 76800 | 0829817d83d583f5a55075dc0017ef52 |
| 209 | 2014-06-25 | Copy_of_document_Date_June-25-2014.exe | 76800 | 8c920901eca575593f580531e44ea62f |
| 311 | 2014-07-04 | Copy_of_document_Date_July-04-2014.exe | 80384 | 50daa5c135d5ad2da3b2c8a8dd4c3f50 |
| 496 | 2014-07-14 | Copy_of_document_July-14-2014.exe | 135168 | 559fd034d76e45aec67be49c2f93cfae |
| 552 | 2014-07-15 | Copy_of_document_July-15-2014.exe | 135168 | 80aff3257ec4f6f7bd5e5259ea08815e |
| 584 | 2014-07-16 | Copy_of_document_July-16-2014.exe | 135168 | cc19a778b730d310a1bea1518bdc7a6f |
| 704 | 2014-07-17 | Copy_of_document_July-17-2014.exe | 135168 | b43e9210da3e06dc2b88ae028a13d8c5 |
| 526 | 2014-07-18 | Copy_of_document_July-18-2014.exe | 139264 | 1531f529f73d79f1cf4dd1d6a7426429 |
| 614 | 2014-07-22 | Copy_of_document_July-22-2014.exe | 135168 | 3c3944f52d194fd86d12ebccb2c7cf85 |
| 623 | 2014-07-23 | Copy_of_document_July-23-2014.exe | 135168 | 046f9dbedcf03749d0e7ae5cc120897d |
| 600 | 2014-07-24 | Copy_of_document_July-24-2014.exe | 135168 | a1eb4a25be83c770f38203fcc64f9419 |
| 717 | 2014-07-25 | Copy_of_document_July-10-2014.exe | 135168 | 35850cfececd274ee5f182bd64c221ab |
| 370 | 2014-07-28 | Copy_of_document_July-28-2014.exe | 135168 | 6edec50da5540820682387c71434d209 |
| 613 | 2014-07-29 | Copy_of_document_July-29-2014.exe | 106496 | 2f8a429f6e005cecc25f9bb86f4211dc |
| 555 | 2014-07-30 | Copy_of_document_July-30-2014.exe | 110592 | 529e7348bca26b22d0b42a7fe6c63e8d |
| 604 | 2014-07-31 | Copy_of_document_July-31-2014.exe | 106496 | b2c8662858ed7a8c052a080b03ca26b2 |
| 806 | 2014-08-01 | Copy_of_document_August-01-2014.exe | 102400 | 2ca1e3d6312c3f844de919caec77fc1f |
| 711 | 2014-08-04 | Copy_of_document_August-04-2014.exe | 110592 | 6c83a7e471421899141e7e13a635abbd |
| 973 | 2014-08-05 | Copy_of_document_August-05-2014.exe | 143360 | 1463aaa9b393a1591df049534e9f9ddd |
| 734 | 2014-08-06 | Copy_of_document_August-06-2014.exe | 106496 | 49985d6ae2805c2301bd941c783991e4 |
| 447 | 2014-08-07 | Copy_of_document_August-07-2014.exe | 127488 | 659f348503f30952f19816e2afb1e595 |
| 447 | 2014-08-07 | Сopy_of_Document_ID4923.zip | 75375 | 802529cf5a1c85eb0389f9e0e0f309da |
| 826 | 2014-08-08 | Copy_of_document_August-08-2014.exe | 106496 | 804f0d437f3c500c9d5a340d4f783b6b |
| 4 | 2014-08-11 | Copy_of_document_August-11-2014.exe | 118272 | 2fc5cc07700d3eacd0d063f93aebfa14 |
| 768 | 2014-08-11 | Copy_of_document_August-11-2014.exe | 104448 | ebb9e152618e4b0a871aceb1966b8f85 |
| 4 | 2014-08-11 | Copy_of_document_August-11-2014.exe | 118272 | ffa9f70e72fb7eea06fea313ef979502 |
| 739 | 2014-08-12 | Copy_of_document_August-12-2014.exe | 103424 | c6a53a80b7425215d2f32332e2721a49 |
| 22 | 2014-08-13 | Copy_of_document_August-13-2014.exe | 113152 | 6bb5e1502b8cdfaa5ae78238cee7ab85 |
| 36 | 2014-08-14 | Copy_of_document_August-14-2014.exe | 94720 | 956f9551579314bbe74e55fbdbe4b869 |
| 14 | 2014-08-15 | Copy_of_document_August-15-2014.exe | 90624 | d38c3aa977745be341ae26e439d8e111 |
| 15 | 2014-08-18 | Copy_of_document_August-18-2014.exe | 92672 | 49aef017ad8880a7b4d24c8190acc068 |