Emotet Malware IoCs 2019/05/07

## Emotet Malware Document links/IOCs for 05/07/19 as of 05/08/19 00:30 EDT ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.


#### Epoch 1 Document/Downloader links seen for 05/07/19 ####
```

http://174.138.92.136/wp-content/uploads/legale/vertrauen/05-2019/
http://7min.eadmax.com.br/y8ww/service/Nachprufung/2019-05/
http://8bdolce.co.kr/wp-content/uploads/legale/Frage/201905/
http://absimpex.com/images/service/sich/052019/
http://absynthmedia.com/wp-content/nachrichten/sich/2019-05/
http://ackosice.sk/wp-content/trusted.En.accounts.docs.net/
http://afshari.ch/australia/nachrichten/sich/2019-05/
http://agata.com.au/del_assets/support/sichern/052019/
http://aggiosolucoes.com/images/service/sichern/2019-05/
http://alexwacker.com/nginx-custom/public.en.myaccount.doc.sec/
http://alliancelk.com/kiffsnew/wp-content/uploads/open.En.myacc.docs.com/
http://aloha-info.net/OLD20131103/secure.ENG.myaccount.docs.com/
http://alphaterapi.no/verif.Eng.logged.public.biz/
http://altituderh.ma/wp-admin/eruvB-uyUPfVtVAdOVSn4_bUVeNruMw-s64/
http://amis.com.gr/css/bootstrap/secure.ENG.myaccount.doc/
http://anareborn.com.br/atendimento/trusted.Eng.signed.public.com/
http://andrewsleepa.com/pandarealestateflorida.com/secure.Eng.myaccount.docs.net/
http://anisgastronomia.com.br/wvvw/open.Eng.anyone.resourses./
http://ansolutions.com.pk/US/secure.en.myaccount.resourses.sec/
http://antravels.co.in/calendar/secure.EN.anyone.resourses.net/
http://aoi3.com/20120104/verif.En.myacc.resourses.sec/
http://aprilfoolscomedyfestival.com/wp-includes/sendincverif/legal/secure/En_en/03-2019/
http://artzkaypharmacy.com.au/wp-admin/verif.En.accounts.doc.sec/
http://ascendedarts.com/gravitymtb/verif_seg.EN.accs.open_res.sec/
http://asssolutions.co.uk/flash/trust.en.signed.docs./
http://austad.no/images/public.en.accs.docs.biz/
http://azedizayn.com/26192RX/verif_seg.ENG.myacc.rep./
http://bachch.com/3gokushi/trust.Eng.accs.public.sec/
http://balancedlifeskills.org/wp-content/verif_seg.EN.logged.rep./
http://barguild.com/8192/verif_seg.Eng.anyone.docs.sec/
http://batlouinvestments.co.za/cgi-bin/secure.EN.logged.rep.com/
http://bdsdalat.vn/cgi-bin/verif_seg.en.myaccount.public.sec/
http://beza.at/flash/open.En.anyone.office./
http://bkdd.enrekangkab.go.id/awstats-icon/nachrichten/vertrauen/05-2019/
http://blog.blissbuy.ru/wp-content/trusted.EN.logged.public.biz/
http://blog.ruslanski.co/wp-admin/secure.en.sign.public.com/
http://compunetplus.com/stsny/verif.en.myaccount.doc.net/
http://conceptcleaningroup.co.uk/wp-admin/wxFR-avlJD01N17cSds2_ayJzfgci-ax/
http://confrariamkt.com.br/harasecoorquidea/nachrichten/nachpr/052019/
http://corehealingmassage.com/wp-admin/open.Eng.accounts.open_res.biz/
http://coworking.vn/wp-admin/public.ENG.accounts.sent.com/
http://csw.hu/aspnet_client/IlFoU-GU9ZBAHQ1M8piAC_unVjCcgz-pHI/
http://damhus60.dk/fonts/Viug-YUaL80Nbroy2vo_THAOOPAZ-bA/
http://dance-holic.com/2shot/ODJF-GWd94pNQpGx2OGn_nZwJuQBvv-qz/
http://danesinusa.com/webalizer/pSFA-qpboQiG0hg5zCi_ndBpvvso-fn/
http://davemacdonald.ca/wp-admin/AGPNC-EobLceRZDko0T4H_ygPYrFjf-f4a/
http://dcgco.com/wp-admin/yRwT-liyhRjAe7mTBLXe_ZNYbTkwvM-93B/
http://decorexpert-arte.com/lang/nQYKT-7FkRRvZJTYNWxXr_nbxxbouHA-ME/
http://dekoracjeokienslupsk.pl/calendar/support/Nachprufung/2019-05/
http://dekormc.pl/images/adwRp-R0oVcX7Ck8K9Hb_OJXOXuZe-fvg/
http://demo.careguidance.com.au/wp-admin/support/sich/05-2019/
http://demu.hu/wp-content/ABFQM-yXNGddnxfhyzEy_PhfXVoLa-DLo/
http://deskpro.kayakodev.com/wp-content/uploads/service/Nachprufung/05-2019/
http://diegogrimblat.com/flv/TbrP-hBrn6Mme6doK3V_FCOcgQxf-Ly/
http://djchamp.net/coupon/WQpL-5Z3LS9gaeO7gGy_HGweCRESF-3a/
http://docecreativo.com/LGaFw-R7rrN7gcUTBFlC_mXnZVFbZg-sO/
http://dog-mdfc.sakura.ne.jp/cgi/oHlFa-Qx6IqhJXMvrYptk_BvhRlauGO-YTE/
http://dottoressapatriziazamproni.it/wp-admin/support/Frage/05-2019/
http://drapart.org/Prensa/GeAoV-keRXiwXqbdRBEDU_ihaAxuUPT-Vg/
http://drivedigital.co.in/giftonway/service/Nachprufung/2019-05/
http://edenvalehotelgh.bulletbean.com/wp-content/ssuoW-cJEDgPArtCQiIr_UfHmEKoEN-JLU/
http://esmocoin.com/wp-admin/IFpMX-anYf9SMjxfPDVG_sSPMKnApc-bfM/
http://esteteam.org/wp-admin/sec.en.anyone.sent.net/
http://extensive.com.au/wp-admin/trusted.Eng.sign.office./
http://fepa18.org/wp-admin/open.En.accounts.doc./
http://festapizza.it/wp-content/uploads/public.En.accs.resourses.com/
http://fon-gsm.pl/ip5daee/MdGNg-BilBZzEMK1YXAHm_kXcoDOjGZ-9O/
http://forladies.pk/cgi-bin/pUeco-OGWucUW2gSieBe_xYetLoFEP-qv/
http://framehouse.in.th/wp-admin/uGBIC-wxwwI06bodBqwA_UtnLycgC-cqk/
http://frisa.com.br/wp-admin/legale/sich/2019-05/
http://garel.co.uk/Szs0514JGxP/open.EN.myacc.public.biz/
http://gawpro.pl/cgi-bin/secure.ENG.sign.office.sec/
http://gently.org.uk/stats/trusted.ENG.myacc.resourses./
http://germantechnology.com.mx/css/LYJQK-48ByjELqjRFJPUa_seCDZrjKw-D8C/
http://gkhost.xyz/wp-admin/bOrX-ZO3T0fUTT7ocgJ6_VqILIIqg-GM/
http://globalwebsofttech.com/wp-includes/XZway-gdfCTBOo6jUTSMR_zbjxJRYBj-u5f/
http://granfina.ind.br/noerk24jt/BGVKq-JfSW3P4tER7CrKP_ILXcAqpk-sI/
http://grasscutter.sakuraweb.com/wp-admin/legale/sichern/2019-05/
http://grupoglobaliza.com/ruedes2017/ZoXle-LCn8sNdGr9FdADi_LrUuJKdrS-uN/
http://gwdesignz.com/blairwdavis.com/atoxk-zYtgeQ4u6J8idhm_BFIdXiqkk-rNX/
http://hada-y.com/WWE/legale/vertrauen/05-2019/
http://hagebakken.no/loggers/open.ENG.anyone.office.net/
http://halliro.com/adenta.co.uk/sec.EN.anyone.open_res.biz/
http://hbk-phonet.eu/wp-content/public.Eng.myacc.doc.com/
http://healthnwellness.in/ynibgkd65jf/aYux-YjrhYcmLhj3DbE_TQeYBmfs-9W/
http://hellojakarta.guide/wp-content/uploads/enGg-ljP6TdlijgpMZG_aJFvARxsd-o8/
http://hmcharitableassociation.com/cgi-bin/JSEUm-78UztGcdJvVWHZ_dNpNfFJF-oy/
http://hoahong.info/wp-admin/trusted.ENG.anyone.docs.biz/
http://hopper-restaurants.com/assets/YjufB-r72vQH6mSEqrzf8_QedsXcXt-Dbl/
http://hotelsaraswatiinn.com/views/verif.EN.logged.send.biz/
http://ikastudio.in/demo2/nachrichten/sichern/201905/
http://imam.com.pk/7f80kef/verif_seg.ENG.signed.open_res.com/
http://importesdeluxo.com/whitesmile/jNUcC-vKNILeTbKj9JWtT_dpzzkxauG-dn6/
http://infokamp.com/edmatvu/trust.En.signed.resourses.net/
http://ingameblog.com/comment/PqIzU-EywbMWl2bDtadwZ_PCKLvIcrQ-FBk/
http://inoffice.lt/wp-admin/verif_seg.En.sign.docs./
http://iptvyo.com/wp-content/WmyX-jvudjM7sI7Fnbz_nOgisLWcC-HWK/
http://itc.stackcreativo.com.ve/css/AKfC-o0mkg9NBgybseA0_CFMOPZNBS-wNv/
http://itfirmdevelopment.nl/var/XZmDQ-1f9JVf6v1M4fvr5_hKuTUcNm-nv/
http://iyfchittagong.com/js/NdorI-YX4m5pFq0C7zDlg_xqWVcqykE-mC/
http://jayracing.com/focus/trust.En.anyone.docs./
http://jiajialw.com/membt/sec.EN.logged.resourses.biz/
http://jodhpurbestcab.com/wp-includes/xeYeA-CxBBoB5zeulT3nt_gOrVaqDmV-auW/
http://jootex.ir/wp-content/KJMI-IHmgabnCUww9h1_pzwIEvUK-OM/
http://jsc.go.ke/wp-content/uploads/FSnsT-NYxiOfchbRUms8B_opjXkvFZc-Xey/
http://jumpmonkeydev2.co.za/paeds/uVtI-K1UQf4BZWbi0HC_jPCNQrGHW-2Uw/
http://kalitengah-pancur.situsdesa.id/wp-content/qNMS-oZGg9DPeAHGotyb_KowmYyKz-WgU/
http://kaminet.com/topics/img/sec.En.anyone.rep.sec/
http://karevfk.tk/wp-content/epftb-oyan1VyXzB4k8dM_nVwdHdMX-nF/
http://khabarnaak.tk/1550157282480/JMlO-MdJsXT5eVrZlSr_MEboARqOH-Xzh/
http://kitkatmatcha.synology.me/qzp/open.EN.signed.doc.net/
http://konselingmahasiswa.undip.ac.id/cgi-bin/JzOX-TScUfpBu3k73MOt_oQfsUgfzF-ktN/
http://kreatis.pl/sitefiles/verif_seg.ENG.accounts.open_res.net/
http://kreditunion.id/wp-content/sec.accounts.resourses.biz/
http://kreischerdesign.com/wp-includes/nachrichten/Nachprufung/2019-05/
http://kuyabunso.com.au/cgi-bin/sec.en.myaccount.docs.sec/
http://labanoras.com/wp-admin/SAMWQ-JAm8swNSxrzuH9B_nJiQlWBW-Ji/
http://labersa.com/hotel/QahN-IMnDiZwF1TIMVT_LQzrvOcFq-E7C/
http://lachasca.com/wp-includes/emPlM-eVNwHNsUkVqzec_iiUcQbYn-QiY/
http://lampalazszelidito.hu/wp-includes/uuDj-mmn9aTcvJumewGX_dvSeHLsgc-r5/
http://lanamedicalwaste.com/esicomms/ZspV-xXpN90OOWsGULp_GmXLMFGX-yi/
http://laserowakasia.pl/wp-includes/secure.accs.send.net/
http://legostal.pl/noui3khkfl/pDfO-DXx1sLg9tNtzRFY_PuJnFPvEP-h1/
http://lohasun.com/wp-admin/verif.Eng.sign.rep.sec/
http://lsdoor.net/wp-admin/legale/sichern/201905/
http://mail.yotaglobal.com/js/nachrichten/vertrauen/05-2019/
http://mariamkone.com/wp-content/legale/nachpr/2019-05/
http://maytinhdienthoai.vn/wp-content/service/sich/2019-05/
http://medyalogg.com/wp-content/ai1wm-backups/open.En.myaccount.docs./
http://miimo.thememove.com/ncqz/service/sichern/2019-05/
http://mixolgy.net/play/support/Frage/05-2019/
http://mmcrts.com/11/trust.ENG.myaccount.resourses.com/
http://mnginvestments.com/pdf/legale/sichern/2019-05/
http://mnonly.com/faq/cNwLk-QpBILVmN2JGiT5p_txWIJPari-Xt/
http://mplmodapk.site/wp-snapshots/service/sich/201905/
http://mundoclima24.cl/zohoverify/service/nachpr/05-2019/
http://myhealthyappshop.com/au13/sec.ENG.accs.send.com/
http://mytechconventschool.org/wp-content/nachrichten/sichern/052019/
http://mywebnerd.com/moodle/ujRYX-qEoECJxkYZsdX5D_LFjqjzozr-Woa/
http://nadee.bizbox.pro/kdkn/service/vertrauen/2019-05/
http://nambar.everlast-agency.com/wp-content/legale/nachpr/201905/
http://nandri.pictures/wp-content/nachrichten/nachpr/05-2019/
http://necmettinozlu.com/hrpel37lgd/support/vertrauen/2019-05/
http://newlaw.vn/wp-content/nsAGP-HjFjZaIL1Eol2g_DCeZPUUof-C7D/
http://newlitbits.ca/cgi-bin/trust.ENG.myacc.send.com/
http://newsspe.com/fvefbd/service/Nachprufung/05-2019/
http://nissanlaocai.com.vn/wp-content/verif.En.myacc.send.biz/
http://noithatgothanhdat.com.vn/wp-includes/open.EN.anyone.open_res.net/
http://nslc.vn/wp-includes/support/sich/201905/
http://ocean-web.biz/pana/public.Eng.signed.docs.sec/
http://ogilvy.kayakodev.com/wp-content/plugins/easy-instagram/cache/nachrichten/Frage/05-2019/
http://okz.wloclawek.pl/wp-includes/legale/Frage/2019-05/
http://ouropretocultural.com.br/pdf_espanhol/trusted.Eng.signed.open_res./
http://patriciatavares.pt/wp-admin/service/Nachprufung/05-2019/
http://patriclonghi.com/blog/ZMkbS-fD9rCuattgP6xck_NKFzawwT-ahO/
http://phoenixcryptoex.com/wp-includes/support/Nachprufung/05-2019/
http://phongthuylinhchi.com/wp-includes/trust.En.sign.public.sec/
http://pitchpixels.com/wp-includes/legale/sichern/052019/
http://planktonik.hu/menu/BQAPo-AL7DfJPOLgqqE7_dCQuvGVX-nfN/
http://pmdigital.pl/wp-includes/public.EN.sign.docs.biz/
http://predictionsexpert.com/wp-includes/legale/Nachprufung/052019/
http://progpconsultoria.com.br/wp-content/uploads/2019/open.En.myaccount.send./
http://readersforum.tk/wp-content/nachrichten/sichern/2019-05/
http://recursosgala.cl/wp-snapshots/nachrichten/vertrauen/201905/
http://romanemperorsroute.org/wp-content/open.Eng.accs.rep.com/
http://ronaldnina.com/blog/service/nachpr/2019-05/
http://roycreations.in/wp-content/service/sichern/052019/
http://ryblevka.com.ua/wp-content/sec.EN.anyone.resourses.sec/
http://sablefareast.com/cgi-bin/support/Frage/052019/
http://sakhaevent.com/wp-includes/service/Frage/2019-05/
http://salaweselnalodz.pl/wp-content/service/vertrauen/052019/
http://salondivin.ro/tur-virtual/public.Eng.myaccount.public./
http://saludracional.com/wp-admin/service/sichern/052019/
http://sandraadamson.com/wp-admin/eb4hsq5634/
http://school118.uz/wp-admin/uGnr-MAYlNw5DMi9ofk_XpHLtHhZW-kZ/
http://secret-thai.com/lvig/legale/Nachprufung/05-2019/
http://selftechhasan.com/wp/support/sich/201905/
http://seriousvanity.com/cgi-bin/AgNVd-UYRDcuJKBBKr3p_HQlYRtyk-ro/
http://servidj.com/cgi-bin/sPjSE-RHEF89sZMILmV1R_rzwoPSTte-TpH/
http://shardatech.org/resources/legale/Frage/201905/
http://sistemahoteleiro.com/clients/trust.accounts.docs.net/
http://sjakitarius.com/wp-includes/nachrichten/vertrauen/2019-05/
http://skinnovatelab.com/partner/uploads/legale/vertrauen/2019-05/
http://sm0tl0t.com/wp-content/nachrichten/Nachprufung/05-2019/
http://songdung.vn/4d4ixle/cOvp-lyIhmQHvRaCr8Yx_yiejfQpnh-pp/
http://sooq.tn/g435goi/TYour-jRyJLxUzq45NFrS_MwNRNosoz-TQO/
http://southkeyplace.com.ph/wp-includes/nachrichten/vertrauen/05-2019/
http://spacermedia.com/wp-includes/support/sichern/2019-05/
http://srishti.saintgits.org/2017test/open.ENG.logged.open_res./
http://staging.addiesoft.com/VsUb/nachrichten/sichern/201905/
http://stinbd.com/stinbd.com/nachrichten/Frage/052019/
http://stomatologkubrak.pl/wp-admin/nachrichten/sichern/052019/
http://t3-thanglongcapital.top/wordpress/verif.En.signed.sent.biz/
http://tacticsco.com/Prod3/Lilcz-qQa2rjY6oOGy14_PzhQzJwk-00/
http://taltus.co.uk/ddkt-XkBNaaLqYLYqOHQ_LyLSihwC-NZo/
http://tapicerbielucy.pl/wp-admin/nachrichten/nachpr/2019-05/
http://tarhanyapi.com/wp-content/service/Nachprufung/2019-05/
http://teiamais.pt/wp-admin/otBk-VCzUxpTa3D1szd_TcyYdgcb-ARA/
http://teresaintl.com/wp-includes/nachrichten/sichern/2019-05/
http://tiendacalypso.co/wp-admin/sec.ENG.accounts.resourses.sec/
http://tipa.asia/wp-includes/trust.EN.accs.office.sec/
http://tipster.jp/counter/qCUgZ-WYspb9LhhgK8mte_ffgltQweO-3Ki/
http://toshnet.com/cgi-bin/verif.EN.accs.public.com/
http://try1stgolf.com/ebay/verif.en.myaccount.send.biz/
http://uklidovka.eu/scripts_index/SdOZS-cDlDInx6rSgY1m_ANiOonvng-2cv/
http://uzmandisdoktoru.net/_wildcard_/trust.ENG.sign.rep.biz/
http://vancouvermeatmarket.com/wp-includes/open.ENG.accounts.office.sec/
http://vcube-vvp.com/cgi-bin/verif_seg.en.accounts.public.biz/
http://vdvlugt.org/kaethe/verif_seg.en.myacc.open_res.sec/
http://vegapino.com/wp-admin/css/bNsb-RKvIDXJsSAtgpk_QeapIdNQ-IGe/
http://vemdemanu.com.br/wp-includes/sec.Eng.accounts.docs.biz/
http://www.digitalmidget.com/llama-speak/RpWlt-ALzUMvZjjTWZJ6i_ilUpaplU-7np/
http://www.greendepth.com/wp-admin/service/Frage/2019-05/
http://www.jiajialw.com/membt/sec.EN.logged.resourses.biz/
http://www.mediashack.at/error/verif_seg.en.myaccount.open_res./
http://www.rgmobilegossip.com/wp-includes/service/sichern/05-2019/
http://www.vemdemanu.com.br/wp-includes/sec.Eng.accounts.docs.biz/
http://yeez.net/_notes/trust.En.sign.office./
http://ygraphx.com/DEPARTURES_MAY3/service/sichern/052019/
http://yumitel.com/cimg/legale/Nachprufung/05-2019/
http://zachbolland.com/1drpn/aol_files/legale/sichern/2019-05/
http://zvarga.com/wp-admin/public.en.signed.office.net/
https://acttech.com.my/styles/vbtd-UnKieXrNYjXjRwl_HFDjpcyfN-0sJ/
https://addlab.it/wp-content/uploads/2019/nachrichten/vertrauen/2019-05/
https://austad.no/images/public.en.accs.docs.biz/
https://automotivedefense.com/wp-content/public.EN.myaccount.sent.net/
https://fepa18.org/wp-admin/open.En.accounts.doc./
https://galiarh.kz/wp-admin/pwenB-bCWJhhLS6IDys8E_SZPsZEVk-dS/
https://gently.org.uk/stats/trusted.ENG.myacc.resourses./
https://kitkatmatcha.synology.me/qzp/open.EN.signed.doc.net/
https://kreatis.pl/sitefiles/verif_seg.ENG.accounts.open_res.net/
https://nguyenlieuthuoc.com/wp-includes/trusted.Eng.sign.sent.com/
https://ouropretocultural.com.br/pdf_espanhol/trusted.Eng.signed.open_res./
https://psicopedagogia.com/glosario/kWedR-BfltnVQjS3yedn_vaUFUxqx-iE/
https://salondivin.ro/tur-virtual/public.Eng.myaccount.public./
https://santa-o.com.ua/bin/trusted.Eng.myaccount.docs.net/
https://tiendacalypso.co/wp-admin/sec.ENG.accounts.resourses.sec/
https://www.festapizza.it/wp-content/uploads/public.En.accs.resourses.com/
https://www.jiajialw.com/membt/sec.EN.logged.resourses.biz/
https://www.pinafore.club/wp-admin/service/vertrauen/2019-05/
https://www.ryblevka.com.ua/wp-content/sec.EN.anyone.resourses.sec/
https://www.salondivin.ro/tur-virtual/public.Eng.myaccount.public./
https://www.vemdemanu.com.br/wp-includes/sec.Eng.accounts.docs.biz/


```
#### Epoch 2 Document/Downloader links seen for 05/07/19 ####
```

http://000359.xyz/b/ssZQGvirvoYpfwO/
http://3d.co.th/US/INC/IscvgJKxS/
http://4gstartup.com/wp-content/gi5jhh-3jrd33w-vxflqgt/
http://5711020660025.sci.dusit.ac.th/docs/lm/gDiyduZVrYbVHnpHuCkGvIuCsHeWjk/
http://912graphics.com/cgi-bin/Pages/ir757gj1824jqv35p6vdk43348xp5_a4gg8-312909601058283/
http://abandonstudios.com/wp-admin/js/widgets/Document/jal7qtcf2y3cqt1vkacms9s16mulyn_fgzv7a5ftg-37987136856523/
http://acquaplay.com.br/a/xufdd-2n6ff-gpap/
http://adagioradio.es/verif.myacc.send.net/Document/8a3k80y67ev36y7_yzfmkeyoe5-09480555553318/
http://adape.me/tavano/ljv95m-gb0ifv-wymdebk/
http://adapta.com.ar/cache/3gx8zljr8xeu9zi_d6lrv0d-540554359943554/
http://adityaproduction.com/wp-admin/af84go-h63kus-ftxb/
http://adremmgt.be/pages/2ims5-u79kr-hvof/
http://ahuratech.com/wp-admin/Scan/5b4bixkcui5e91xis396c563d0y_bu40zk5-852284955204/
http://alignsales.com/wp-includes/paclm/kssnnchth7vght26d3_19adkp-2528384604/
http://allhealthylifestyles.com/9yng/Document/KoYiCtoxcIBmB/
http://alliedcontainer-line.com/wp-admin/g8iynq-q55zn-rqaw/
http://allowmefirstbuildcon.com/35rnm2e/paclm/m9ixgkeioqa5y1s_9slxjzpc8-660235145/
http://alsdeluxetravel.pt/wp-admin/paclm/5d6px5jp0p8eebhdwx5zo5do8vh_c11n10aa1-514134734/
http://alumichapas.com.br/wp-includes/pwdr-wk50d1-lszi/
http://am3web.com.br/DOC/gnmwpjvq0hbr3lfle647slkti2rua_5qlz5m-570847870/
http://amachron.com/1e7t86n/iuJUqWwxvtfaqFwoTVKgsJQe/
http://ampservice.ru/installation/paclm/NXuXFiYmnUAJakkKSIzTwvKxKeJIW/
http://andyelliott.us/AIF/r67g80lujgz0p77gg6ecp8r4_o4akncrwh-465247106455076/
http://anjoue.jp/academy/Document/gMzGtXNcPbLhCB/
http://aprights.com/about/INC/YMCHSQlbZxbaq/
http://arteza.co.id/wp-includes/Scan/GpVMQKRdQyuqAJhqxwxhPpZhjGbUFK/
http://ascestas.com.br/Pages/hpam4mc9u5gg8heyli_f7dh4r-74986951/
http://asnpl.com.au/chkl/LLC/1dxbbzv8_eiubn-11195960/
http://avatartw.kayakodev.com/wp-content/uploads/parts_service/joi8ho2nwuc8qnm82tp6_l50hq50yr-401163121/
http://aviciena.id/data/FILE/0cij5yhvf81mp8_rxyd5grrh8-92274744344/
http://awas.ws/JUS/Pages/mOSIehpnpqqFgpRkmTrisdjldXOGI/
http://axwell.kayakodev.com/wp-content/uploads/INC/7ufoulqfu1fqgdnsv1v1trvhsh_emcevi0cp-31910285899/
http://ayashige.sakura.ne.jp/CGI/Scan/fz6cvw5e8ngufnol3p982w_bnti9car8u-67621092197/
http://azisonssports.com/wp-content/uploads/q2qh-gyg3m1-yggbs/
http://bandit.godsshopp.com/wp-admin/INC/q5enq8y67olkqrspdt_4dtexdgw-297260993224/
http://bendafamily.com/extras/sites/czpdme69ils_i19t4-679335525148237/
http://benzophen.com/pouchdirect/r6e9-eba9cy-boyp/
http://bestflexiblesolarpanels.com/local/vrcb90l-ot2z0p-opbmn/
http://blog.booketea.com/wp-content/dut6dlqqf27ayyv70po5xif53oq_v9ie9-422511994072//
http://blog.kopila.co/wp-includes/Document/EKQRnJXfnmkcQK/
http://blog.kopila.co/wp-includes/LLC/JSuwgPIaKbwMmEvgavQQ/
http://blog.medimetry.in/wp-content/uploads/parts_service/eJnoHSrMkxGIqBR/
http://blog.memeal.ai/wp-content/uploads/Document/ZFsLCmoHkqBbcmElpDUfJSE/
http://blog.thaicarecloud.org/wp-content/awtCcOlDLuWLcIYofN/
http://bosungtw.co.kr/wp-includes/DOC/ObRnmOSOiDKyYAksWHutcKbHo/
http://b-styles.net/image/c3n5kg8sgpgqaat6ip_dnaun-64608895701/
http://canetafixa.com.br/wp-includes/Scan/76vvinvzu9esyw5oz3f33mbtjoeyx_p84w62-706696352773/
http://cdaltoebro.com/wp-includes/nzfmtk-608ss-ofvye/
http://cocobays.vn/wp-content/paclm/3zwivi7s95_nxgn81-13338007552/
http://cophieutot.vn/pxha/TvEBFkCTShdOUFkxupuGJHkwVyZa/
http://corgett.com.br/wp-includes/DOC/739ap3nnqisc12m4fqm_1zsje6jy-000884149290/
http://currantmedia.com/cgi-bin/FILE/lnr87s3ccngq6bmbka_uw7qao37fn-305832618/
http://dagda.es/wp-admin/c6r4mhi9p76m6s_x272tlhmi-000684005/
http://daniele.dk/wwvvv/MRzLWYOUusGRYAbWobtwpdaBKe/
http://darktowergaming.com/l9ld-0dpofc-hiwewg/parts_service/UEDSVNiTQ/
http://databeuro.com/Document/ceMoosqXDVwVADKMFmZPOyhgRgSsX/
http://dcc.com.vn/wp-includes/m1wuj-bu0ya-ayud/
http://dd-fsa.dk/wp-content/parts_service/f9rohtejj3g3n4i3zuhul94_kprs6qfr6-589732811394462/
http://deccangroup.org/deccan1/skmk-dq0iw-lkiebbr/
http://deftrash.com/admin/parts_service/eTjfWTwnlraAeoyWdAjxqRNlHBl/
http://demellowandco.com/cgi-bin/sites/sqzhz732gvwiqll_xlpob-04136530/
http://demo.sshc.ir/wp-content/Scan/PdsZmZhFCDckbboSqwPoa/
http://designworx.co.nz/cli/Document/UCpCKXtNHVJMX/
http://detmaylinhphuong.vn/wp-includes/fonts/FILE/yftvil6rzzkijuy_sxn4efmj-987455061056849/
http://dev.christophepit.com/hbl2mda/cyeuic4iwmijo8yaunjo_jue8p3cx-57029315652/
http://dingesgang.com/wp-admin/DOC/PdyQrhPmBbeOxnLLjWELfrltbpDh/
http://dishtv.democode.in/awstats-icon/LLC/BkzbKhEvQPwBBdb/
http://diskobil.dk/gearet/Scan/v11mr92a14q08u_p5kx0-081584184/
http://dizzgames.com/comment/4lyg-olem76-vziibsn/
http://djxdrone.fr/wp-includes/wpb0u8itcdh_rfcfpxvb-250379630/
http://dp5a.surabaya.go.id/wp-content/tyz4-52rml3-tdltzm/
http://dpe.com.tw/jhtml/Scripts/css/LLC/SbvbkOKabpOxrLkC/
http://dragonfang.com/nav/LLC/y0v6gqd7jo3raan9lpop3hs_6xgsxyz-32646600837038/
http://drezina.hu/airport/INC/AzrRYHEZHncEavTKsQLFq/
http://drmarins.com/engl/VzPJTRKdIoALUUxCWqlel/
http://eccountbook.com/wordpress/lm/wklgxlmQsZMWTBMOlxFrCfyZQwep/
http://eco-chem.hr/nj3h/Document/tlHVNeJFLgbDdUkYydSFsIMgZ/
http://ecominser.cl/k2rojqs/FILE/ae0v26ecbxy400_3hh66ft-331486875788/
http://elrayi.kz/mvc/xff3t7-pc6p7-qjokari/
http://enersave.ca/pmp/wtmi1boxmw4ha2e_db6n165-3867751076485/
http://envases-matriplast.com/prueba/Document/t9qck5al5_vogis60f5-51913072975606/
http://eqbryum.ml/wp-admin/9lcj-t53o3-nzthx/
http://extravidenie.ru/wp-content/qlvyky4-uw6si-xlkx/
http://extremesandblasting.ca/wp-content/lm/urWMWGNWoKMhwGBwUV/
http://faroleventos.com.br/wp-includes/lm/apeg0cr42ajg8xmi64kwnc_8ypyvey-94351434156/
http://fashion.web4.life/wp-includes/Document/x6xa24l7hsx6h6j_lawkwzysfu-53338331044453/
http://fic.dev.tuut.com.br/wp-includes/DOC/eRIdnZAASAUjNCVVD/
http://fieldmath.ksphome.com/wp-content/cwc2lu-4hvnm8a-cgtjrif/
http://fittlounge.com/calendar/r2cc87u-eaaui-ofcv/
http://foodblog.club/9vmdo7k/21k32-r7uiou-rssigpr/
http://franosbarbershop.com/wp-content/fyg8-t2gv8m-hgptkb/
http://freebiesfairy.com/wp-includes/9fkp-va64t-glzrs/
http://ftwork.co.uk/old/assets/LLC/wu6vrj1ak44o4xkigqtz_psqz6qxq-63978921/
http://funclick.ml/wp-admin/LLC/fDjinPbOpzexLaydjYuRiOoKdrTC/
http://gallery99.in/wp-content/DOC/ZwmOGvDEJXSYENQtlqejKYrmG/
http://gameforte.com/rsjcz/esp/WZtveSVOLyQrLUMHxtuMSra/
http://giambeosausinh.com.vn/wp-admin/d57k-96x6jyh-xzrdqkh/
http://giangphan.vn/evhu/sites/dyhx36nd177e17b36auwyoo89r7vg_pyrwoh9zer-9704006111/
http://glasspro.kz/wp-admin/lm/ab0xacmyxgcr5oq1dmx_b8bwrxj5g-1248840572/
http://globalmanagement-ks.com/icon/Pages/q3g0vr0etjcvsllauu_bvh7r9fi9f-8405939656/
http://globalvit.ru/!old_enough/vz21-vh9udz-blpt/
http://goldentime777.xii.jp/wp-admin/adm3az-d0oe1-ndwxflk/
http://gownz.vn/te/parts_service/jRONkuAdl/
http://granzeier.com/projects/oc9s1q03vdhtrc5nwt_7elngug-6674537289/
http://griiptic.ca/wp-content/uploads/uwfonz-g7z2p-mvzmjj/
http://grouptnet.com/wp-admin/k02s-d9gmkx5-xdls/
http://habbies.in/dropboxkb/tnt9hrb-a76sy9-sadteh/
http://hldmpro.ru/1/paclm/jwUXftTBXVXAQ/
http://hsweert.nl/lcfr/Pages/v7m69kapz185opg5i3dcyhx_ip5ddnl-93348988764605/
http://iglecia.com/threelittlepigsgotoyoga/le857qcgyhkphk14_qt8cill0nl-123868710004/
http://ilearngo.org/wp-content/sites/NWSYWdyoqVqcAlQHEtMHkE/
http://imagesbrushup.com/zy9j/PLAQBIbOXapelVCtSzQF/
http://imnet.ro/Document/ywXmTGBHZrtxCQYZveIWmYW/
http://inspirationmedtech.com/freeallaquix.com/parts_service/m2cgq22unygscz95ynetijoj7_7xrkvzs-526446308377/
http://inter-ag.ru/wp-content/cg76-vwaqlo-utjjp/
http://ipoffice.ph/cebujob.net/zdkm-bs4jr-tqyfrn/
http://jati.gov.bd/wp-admin/yv48v-3ok8nz-lwpg/
http://jivine.com/sechdule_css/skGlccnSjbgG/
http://jpt.kz/wp-content/mnm2-p5r99-qjzi/
http://jugl.ro/cgi-bin/lm/s9rg17u08e7k5m15va2u1q_rx1egasqih-636673797660761/
http://jumiled.vn/owjr/58ec0-id8za-iuoez/
http://jumpcity.dev-holbi.co.uk/ealink_import/upload_d/ljd9whw-zvfn83m-qygabjd/
http://kaushalyaramadhareducational.com/wordpress/nj08yu-hb3ph-prfemz/
http://kec-cendana.enrekangkab.go.id/awstats-icon/eo43g-aesvq-stqla/
http://kentengsari-grobogan.desa.id/ktkl/maum-utkfv-ozrmlpw/
http://khabraindinraat.com/wp-includes-new/8d68b-fv4faq-dwwzdjx/
http://khoahocshop.tk/wp-admin/8jfi11w-qjvtdka-rqojb/
http://kviv-avto.ru/wp-admin/INC/KPaIMsFtFLjPcthVImVdBNmwnc/
http://larissapharma.com/wp-admin/lm/5j5m39udmdzno88srr6xmyt6_vf9t9-9622876406533/
http://leggingscom.com/wp-includes/4eo20ly-c9oa1tw-cnsg/
http://lejintian.cn/wp-admin/cnwu-qy560yj-kgtjn/
http://likenow.tv/wp-admin/unorsk-1hsy68-stnu/
http://liontec.io/cgi-bin/9dov-0a8c50-neugxk/
http://lls.usm.md/wp-content/uploads/vaez-tqvjvs-rskmo/
http://londra2.net/cgi-bin/2bin-y6hce-pwffbt/
http://luanhaxa.vn/sqeh/INC/x6yufaymc4d3gpdnoi2qao3f1trfk1_18aolclev-5636079340/
http://magdoil.com/wp-content/9y85eq-6vzsn-qwxg/
http://manualdareconquista.com/Search-Replace-DB/0i7tk-pr0s4-rpdtehd/
http://manualdareconquista.com/Search-Replace-DB/parts_service/phcz1fnn94ej2fpt9vc1w8e7ve_efs6naz-3849760247915/
http://manutdtransfer.news/wp-content/plugins/cms-commander-client/NRDLdNgISyXoUbMZjouhGRUAJ/
http://marcofama.it/tmp/FILE/yaw505dvyzqbczreq_egrgi22-2092830933371/
http://marketing.petable.care/wp-content/cpxmne0mul38rsgdxncdw1yulqbcet_0rryxqeb9t-9691010862757/
http://masholeh.web.id/wp-admin/paclm/ualq222qts1k41pgprsh_zc5fvy-30015379753/
http://masterchoicepizza.com/wp-content/uploads/z443f5e-q48el-rsof/
http://maxcreativesolution.com/wp-content/qt10krk1pxdmwd7kec7t3sp_l4nf6jfsc-71444705202/
http://maxgroup.vn/__MACOSX/Document/PzLwVKvPWVnHEXkDpCqBr/
http://mazzottadj.com/stats/paclm/vnz09fp2qjl4k7k_ux7tj4699-03652959397/
http://meknan.net/cgi-bin/cqop-vfzfu-koohdb/
http://mekosoft.vn/wp-content/uploads/5vrl-oy6p8-jehiem/
http://missourisolarenergycontractors.info/qr7qxgl/90k0-fmiqp-vwbbyl/
http://mobilpornoizlex.xyz/wp-includes/nl9te12-adkpday-okcwue/
http://mormedia.biz/colindepaula/Pages/MXpxopCji/
http://morricone.kayakodev.com/wp-content/gallery/56f6otn-gwxo5mk-cvnxna/
http://movimientopublicitario.com/hzrs/63akx-iylv78t-hbmajr/
http://mrglobeservices.com/wp-content/dq22kv-jsdu8-etxf/
http://multisegseguros.com.br/site/koi30a-18cpaa1-ujrrna/
http://myminimosini.com/cb9x/zvjbfj-q4ie2x-dpcv/
http://mypimes.com/wp-includes/95sp21t-ay73856-onlogjq/
http://mywoods.by/wp-includes/0u73h-0howu-jdhv/
http://namastekarnali.com.np/wp-admin/j2inie-opepg8-fsqnrfk/
http://nangmuislinedep.com.vn/wp-content/pgbgOfwvndTUMZuS/
http://nangmuislinedep.com.vn/wp-content/ZmSxYGYcnVUbcIIct/
http://nawarathome.com/wp-content/sa8571-qmrhl-rdlfyee/
http://nch-kyrsovaya.ru/wp-includes/cu5nhi-a1ieogn-nqaqpg/
http://neoleasing.com/3odvm9p/u9xk-yxncsm-idnshus/
http://neoneet.com/blog_img/Document/1q3jw5lpahxa8sk72brbkwptlm9_7wgt4-32694547/
http://neurocomunicate.helpymes.com/wordpress/1ta7-2fsra11-ywohp/
http://new.enchantedmarketing.org/rgnt/qi5ce9t-z3w708-ubnjnir/
http://nobelshopbd.com/cgi-bin/2ekax-aau4z-oezn/
http://nomoprints.com/xk9gioo/0mkduw-gzevm8-vkjkz/
http://nuprocom.com/sagj/vHoUSmmBf/
http://observatorysystems.com/wp-content/x8wtyif-2f5seni-xtvacep/
http://ofinapoles.com/wp-admin/vqzwbyq-iwo3p-igtbc/
http://orangeink-tattoo.de/wp-content/uploads/ab8v8y8-35227v-pkpcib/
http://oxygn.fydoon.com/wp-admin/7m8ovcg-5rjeiw-nsie/
http://paulstechnologies.co.in/wp-content/mmikv-tlt7rl-jbqcn/
http://pawn-stars-shop-uk.com/njvs/Document/rk38yd54zm9jj72bw_ks75d-68780852428/
http://pcccthudo.vn/wp-content/uploads/2019/03/fenqtor-ysw1tef-hujggw/
http://pedro.geo.do/sitepro/css/1zxbg-aiyze-swlpkc/
http://peopleslab.mslgroup.com/peoplesinsights/ci34pto-grm12wt-aanx/
http://petigroup.com/wordpress/gkhoz-jjwn5-dhyapf/
http://phikunprogramming.com/bs/page/css/Document/hfoy037g5_o9sl3q9-17910792696532/
http://philamag.tirusait.com/calendar/wl9q-5gyi1-zzkkd/
http://piidpel.kemendesa.go.id/ngcr/sites/bblhemuhe2tsn1q_z712zf-279336711/
http://pilyclix.cl/wp-includes/paclm/zNzKdBFVdjHHrMP/
http://pmpress.es/img/sites/rjcQFqfxJiFG/
http://pomohouse.com/wp-content/h1hbm6-dsc5vhc-ikbb/
http://pp.hotel-le-verdon.fr/wp-admin/vwyw609eg_q4z6b5vb-447854009/
http://primenumberdesigns.com/mark/85x1-2ayszk-cjyy/
http://programmephenix.com/mnvv/nati-xyu31h-djkrvd/
http://progress.bitdynamics.sr/ikben/qg6jc-ujqo0h-hmhn/
http://quranpf.org/wp-content/id8n6-a5yc1-iipdil/
http://removeblackmold.info/wp-admin/FILE/JEyvDeNWrxGMiOT/
http://rgrservicos.com.br/import/sites/6en69iupyduq4nmmykhbfsux_06aeq-04633867975406/
http://rirush.elavivace.com/wp-includes/a0z9f-pgxd6-pfupr/
http://riyafisheries.com.cp-51.webhostbox.net/wp-content/jw034f6-4ab5a-vqnrkc/
http://rogerfleck.com/heldt.adv.br/FILE/ekQbFjItjC/
http://rucomef.org/wordpress/svfa-hlhbzad-mzkc/
http://sabkuchlo.in/backup/nblozt-8a5brgi-biubhp/
http://salonmelisenta.ru/wp-includes/whdfc-gayscw-osxag/
http://salonmeraki.nl/wp-admin/zi4igv-djolm3-sqin/
http://sanitaco-ge.com/wp-admin/lbuxud-u5vpt-csbmjw/
http://sbmlink.com/wp-admin/parts_service/CWkxtGxdfuCTLxGE/
http://sercommunity.com/demo1/Document/OBIUaZrZTUYEdyaEs/
http://servyouth.org/wp-includes/d59814l9l20q04gjrl_x7vsov6sjg-78774900983/
http://sfree.biz/iso/tz4qq8x-hn8zb5e-maxc/
http://shahrubanu.com/fkix/paclm/QPcBYSGYAjawCtm/
http://shibuarts.com/wp-admin/8si4n-9z4tzh8-ulpqfoy/
http://simlun.com.ar/css/dara4qoxz40gg7ahnrjj0khs6ik49_6euh7t53fp-016999312723/
http://sinarlogamteknik.com/wp-content/qoh1-7e8b2-vqskb/
http://skincodeindia.com/wp-content/x7ix-vyv442b-jkitd/
http://sliceoflimedesigns.com/journal/qbnd5l-o0qjn8a-dgpwjk/
http://sneezy.be/files/Scan/sdkXdyCdFaVIjwC/
http://soa.com.pk/routes/qbiyr2i-370qh9-glip/
http://spacebeyond.space/wp-admin/tfv2i3-6bgnw-mfuepeo/
http://spartagourmet.com/wp-includes/b6y17p-piyv0-drila/
http://steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/sites/nANIISuFCOTmhNmZ/
http://surrogateparenting.com/wp-content/en8bufg-khi8q-vcvojym/
http://system024.codehatchers.com/wp-admin/unqvuc-roqdr3-pmhldr/
http://tabuncov.ru/wp-content/uploads/uviobj-f6thcgn-rplemje/
http://tamgdziety.online/wp-includes/nncy-25r3v-tovdiz/
http://taoxoantot.com/wp-includes/wdo7m4-am6mle-kwbubuj/
http://tbwysx.cn/tools/Pages/uRuLfqdooDctYNMSNXsFLSURJz/
http://techbaj.xyz/one/efxowt-861q4-zfgszw/
http://tecnauto.com/css/DOC/jybqcg2n2n0jdh_2omsz5rl-0359457713/
http://terradyne.org/mobile/paclm/rj4dpf2iolbcmj2u_ng5yatax-825266693/
http://test.ruiland.com.mx/wp-content/DOC/MiYvypocoTliyWLBnGLlKxM/
http://thuexemaydonghoi.com/wp-includes/hn99w4k-1zch63l-qekaty/
http://tklglaw.com/wp-admin/70dnwt-9tkb7-detclt/
http://tocgiajojo.com/wp-content/uzsnwg5-o52th-fcfnxm/
http://t-ohishi.info/INC/FILE/zfi0900ohda1_zbo19v2-150329619/
http://tokootomotifonline.xyz/sitemap/9pzn-u7hfft0-gwhdl/
http://tokootomotifonline.xyz/sitemap/parts_service/z6jtjto5x0f68w1hq8ewi2qk_5ixa3mrso-088945941/
http://tpc.hu/arlista/2sgt2x9ne04uzz_rmhmodzsf-005928935561596/
http://tradelaw.com/jlvyikhzvrof242cplcvbjb_az9fhwi0-8135634527/
http://try-kumagaya.net/4_19/INC/fen0iluzo715x4e59yr_mhlgj-16907241903/
http://twinbox.biz/HlAGS-YbC7afvsnwR4ytu_xrhstgsY-Ai/parts_service/wq12ndkai0u1tk8_dmvhh09-5921915097/
http://tys-yokohama.co.jp/FCKeditor/BUSYVHdalmqZiLHLBPuMh/
http://ukdn.com/TempHold/510xh7rcpnrrni0lm51bnv5z5_bkvwa0a-76856304/
http://unborncreations.com/wp-admin/hqvc-rdvrv-wchxjdq/
http://urbix.com.mx/phpmyadmin/h2rb7-uekj9o-ycrlv/
http://veteransdisabilityinsuranceattorney.com/wp-admin/tp37-esyx0-pxqtztw/
http://vicentinos.com.br/wp-content/languages/paclm/wsPSobKugoTzZQpppZIDCPVvrG/
http://voyage.co.ua/mailsend/mpulxlvx3jnmvotudf20d6rwjjff_f40abukfy-6425362976073/
http://watchmoviesonlinehub.com/gamenews/j9ki9a-w9pdn-kocltg/
http://webdesign2010.hu/FILE/h6bm-n1nz5-jlusw/
http://websteroids.ro/wp-includes/zFTXvoDjojgkbNZhulxpEaxVULoNa/
http://wheretoapp.co.za/wp-content/l0mjnd-u5hz2-vvpvqt/
http://wigginit.net/wp-includes/r8747-rt6g9li-vgqih/
http://www.allowmefirstbuildcon.com/35rnm2e/paclm/m9ixgkeioqa5y1s_9slxjzpc8-660235145/
http://www.doyoucq.com/gtest/FILE/4hkiuibe4ugpao0a90bt93y_unks1d-136351677597/
http://www.habbies.in/dropboxkb/tnt9hrb-a76sy9-sadteh/
http://www.mobilitypioneers.lu/blogs/lm/5yqyc89z7njo7cvw7gj_04roz5d-5355090859891/
http://www.multisegseguros.com.br/site/h7uam-zwdaw-htlqzl/
http://www.pomohouse.com/wp-content/h1hbm6-dsc5vhc-ikbb/
http://www.rvta.co.uk/wp-content/uploads/1inofhovvs_qv7irpgp-09528951076247/index.php/
http://www.unborncreations.com/wp-admin/hqvc-rdvrv-wchxjdq/
http://www.whwzyy.cn/wp-includes/lm/qw2q0cxo8n7kmgtep03igi43d7k_lhhd0l-48826149/
http://xginformatica.com/aydasesores.com/DOC/3z96sxsf86p8i3pqji0_7xr6ckmfxd-3681421790197/
http://xn----8sbabmdgae0av6czacej5c.xn--90ais/test/t2zze23q22wagy93k0i669_htioaxphlj-24205647253/
http://xn--altnoran-vkb.com.tr/cgi-bin/esp/i3wu2115gs3o5aadt287f7khls95tg_z5zdr-92660439933/
http://xtravdesigns.com/wp-includes/yxxmorpuzn4pe7zmtjaq7bpsbj6qqj_qsyx2d2-801123510/
http://yayasanrumahkita.com/eqdx/XrBCOVfMabnSyBBtC/
http://yusakumiyoshi.jp/_cnskin/sites/quPDOEHRQJJBbdYEMdaREIghX/
http://zefat.nl/3n6saw13x4bwz7pgvxw47dyk7wf_6ffrqyaipn-0578905968/
http://zerone.jp/about/LLC/pnl9sbwu4qy_ozzj1wj1w-7564791705247/
http://zuix.com/leads/INC/zdwj03ios9nbmiy7ryx6b2apnrod_79t70h-88368783614/
https://acquaplay.com.br/a/xufdd-2n6ff-gpap/
https://adapta.com.ar/cache/3gx8zljr8xeu9zi_d6lrv0d-540554359943554/
https://alohagift.com/101MSDCF/LLC/2pnqbo52isqd255ervvy8iwby0qagh_xgs8mz-61772365737/
https://asnpl.com.au/chkl/LLC/1dxbbzv8_eiubn-11195960/
https://blog.bijin-co.jp/wp-admin/i6bk-ofwiho-lmab/
https://blog.kopila.co/wp-includes/Document/EKQRnJXfnmkcQK/
https://blog.medimetry.in/wp-content/uploads/parts_service/eJnoHSrMkxGIqBR/
https://blog.medimetry.in:443/wp-content/uploads/parts_service/eJnoHSrMkxGIqBR/
https://blog.memeal.ai/wp-content/uploads/Document/ZFsLCmoHkqBbcmElpDUfJSE/
https://blog.thaicarecloud.org/wp-content/awtCcOlDLuWLcIYofN/
https://chunbuzx.com/www/lm/kxar5kmxvdevy_cweh47-178203419000/
https://computerbootup.com/cgi/FILE/rrmecre1o8kyb7_7ibyl-5003418941/
https://dkstudy.com/JxuuXPhVg/esp/GlVKuoYNGAXZZmSaxClQG/
https://dp5a.surabaya.go.id/wp-content/tyz4-52rml3-tdltzm/
https://eqbryum.ml/wp-admin/9lcj-t53o3-nzthx/
https://franosbarbershop.com/wp-content/fyg8-t2gv8m-hgptkb/
https://giangphan.vn/evhu/sites/dyhx36nd177e17b36auwyoo89r7vg_pyrwoh9zer-9704006111/
https://happyroad.vn/wp-admin/xmqec93pt0_7eo5j86xzk-043862086895/
https://itspueh.nl/cgi-bin/paclm/AEcdpTIsOXIlWmLfWzQpnGCdOkL/
https://keaimi.com/wp-admin/7y5vfx-5i1leat-ffvhu/
https://luanhaxa.vn/sqeh/INC/x6yufaymc4d3gpdnoi2qao3f1trfk1_18aolclev-5636079340/
https://lucky119.com/wzzeb/r1nxjr-1unz4n5-lszfqc/
https://mansanz.es/banuelos.mansanz.es/BGNkzAlotwZZqPpVrDwijaSdhQjHr/
https://manualdareconquista.com/Search-Replace-DB/0i7tk-pr0s4-rpdtehd/
https://masholeh.web.id/wp-admin/paclm/ualq222qts1k41pgprsh_zc5fvy-30015379753/
https://maxgroup.vn/__MACOSX/Document/PzLwVKvPWVnHEXkDpCqBr/
https://nangmuislinedep.com.vn/wp-content/pgbgOfwvndTUMZuS/
https://noithatvanphongdanang.vn/wp-admin/lnpig-0q4kj8-holb/
https://piidpel.kemendesa.go.id/ngcr/sites/bblhemuhe2tsn1q_z712zf-279336711/
https://prearis.be/wp-admin/LLC/sfjcx2ghuc2_qiumnsx410-54676378932/
https://programmephenix.com/mnvv/nati-xyu31h-djkrvd/
https://servyouth.org/wp-includes/d59814l9l20q04gjrl_x7vsov6sjg-78774900983/
https://sillium.de/Scan/71qogdz-27m7a-zycwy/
https://steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/
https://tocgiajojo.com/wp-content/uzsnwg5-o52th-fcfnxm/
https://tokootomotifonline.xyz/sitemap/9pzn-u7hfft0-gwhdl/
https://www.allowmefirstbuildcon.com/35rnm2e/paclm/m9ixgkeioqa5y1s_9slxjzpc8-660235145/
https://www.housepital.in/services/paclm/w732u2chvgthcptjbvio_a4h1l-677539267161040/
https://www.steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/sites/nANIISuFCOTmhNmZ/
https://yduckshop.com/wp-content/f2v4-lo035x-koxm/


```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-05-07 15:54:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
1aadb58fde0d5930efe45b67877b68884437f3c8311cabd9d62fe08d563c16b1
ea5d4c535f425371ab118f223fa14e9f54201700f1302e4b30fbe68f9c445b3f
ce782d77e724997a02e7e03c49b96bc419eea745c44d47076e7c0bba8317bfa7
acdb1b2be789ffabe11b8d2cfc407bc03260be277ace12b50d9e69952c0525a3
df5fce2cf5a41b6cae0de341173a1c3f072734ab2686a54bcf0d9811a199f924
a4c4dcf79d6b070599d3a813d8b542c8688a393b69f816012924b9f4d7f04059
1628fa954d509993c6a6a2932592f04429d055998d42440c702fb5d9299b6dfa
a1e91c9fbc40861d132c909f1bfac528ce335bbd36f5905f3b6444a403953f27
41289082e20c3e62e9f052b546c976a55040189acbb92e08c27bf88ad815807b
7316dac03434401997d957718c916f71132bf33fd5223ccaf8a90dfd6074db31
7e04cea50f00b2126fe6a5c652db5af26695897eb80b13cbe264542a365cf319
945d2d135ae3508e486be34ea2bea9305c48a699ae6447462ee1f251e4fd3b15
e327b0795f320710f7e5aea2d8791e62d8170215b6ecc533cdb3e20a3f3e3fa2
54694d41210054d6fffe9271fd650a69c55eeaf92ae903d4ef07ce795984dad2
00650af5c835d6845b6ae8bbf2ffd870781d87e19d4fa1a4f53ffac93cabef23
bef91b7b69c2e4ef09f2b8b703a6bdb42a2d55e2a31fcc201f02c8f755ab7ab8
6c74e8cd204af8dbbb5ceaf66e4a09d1b5d0ab931f0d10f8fa3e5d392505c355
c03d22b252f0d74bd310b9674d7a852963c7f51dc5bd50f3623f29dfb137cc38
cf54d777d317f6560902e5a7cc40cd0a6be8d5b96c154ac063cd8bf4b1a56c44
535af08c5e5a827b5daba5ff5df228e00ce08aae8b972997362e06675c0d8a56
c14d58c877a8a41518bd68122ff5d6de09132057e9d26550a491df6581532798
ebb1ef08bf0dacbff6724a7d5852c5c3553d30ea64399c5f8e5b9bc40b3e5207
88f30754e15ba9b17cc55ff40459c8f567459a5790efa40370eb8a1bd4c7981c
790342f9d67266fc51352ad24fbd2615d0b7ca059feda6ffc6b8274e270a8909
6359cfca4c3a4f6c657c285c6840af0bc66e00fcede8f7e2d3aa8e5bb96a24c4
8670c8f5745bc3c7b663d04b2a806f217cfe4f76c2c149ee9b42e2b15ac9d9aa
6c7023a5fc913fb54f373b39e479577cca9549f8e88e027fcdbf168d20796738
07a44560da37fb475f59d60fcb3da3094ef2754f807a5cf136cc3fa2cc8ebc00
156e844588da646b631952680d1e656c8c78c6034d4afb43242289114d542ba3
4991d4c01967ef17683391a9912466b0bdd986de3dfc05fed0079ffdd359d480
cd0f24f23e5e1bbfec611a79e1a01601f5e02d7edbf73af8c671a9abae4fae19
457cf8b857df178f9bd6ae41fdef7d1975f767e5b2b46c37def79018a6e4eced
fdabc899b0c2bc25cb3b6ec69d5fa312aa2522202c2db571919fd227df45b278
e42ef9b8fccdbaa6d3cfd699daa8b1ba95b7b1108a653a648d6ce0d59913a805
2a220f10836a32e58bdd6096fd417f0f03d17916e9979769752e0b8b9b2a6805
53456f80f5d1a9f6471012a45a4139cb4c49820e06c519dcbb91cd48c598a632
7abd6dfea23905d558c92b1278fe6689b1c916bd37855afcd1a3544b30d1c072
39f2d3b8787f0e7f2b8b1f44c78083a794963f0577355cc7d4e498ba86d74390
2d7ced6f4a830f8bcde131572dc8b9169e4e575846ec7f6e9c9de6a3dbb2f185
43aad8b76dc5a1ffed686d4aafd266c31af8da8992b55526e4cdf393c19ba3ad
b37d86de392439e00b45f822f9699317c320fd4f2e825f370a1fa86184b69403
25aa3c5f6d9418509dfffdf4af45b44a86e0ffd1b744401f2d1cd605362956b1
9fa5ad3598085a481902c06a22980cc06fd9e0fd5d43faf7d5bacb01108e1269
209f2ee22799264f2cbb508ff8900a5d57ea781337ac201e0bfb369fa9c2a3ed
0c22106e5100d3eb7cbd0f42bcee73d9d39030462217726b4fb1ad9c509de78d
cbad48b53a2f8d11b767dd4b866c9f243afa70ef413db8aede0912abd4349fba
e92bfa4b3acf4c91be1bd1771a6befc7a39e64922f489936c9381add86ee7556
97010e51e25867647281291e4cd1ab068f492d197aafd55713aed4f4e7566c3b
d0b5b27f1f684fc3797cd946020b3a900f68596b334479ae0577c00ff5df6bd9

http://psufoundation.capsuledna.com/wp-content/8q5opa6/
http://nosites-top10.com/wp-includes/k826yx3/
http://oilportraitfromphotos.com/0eax/jvvar9/
http://radiocharlene.com/cgi-bin/gg2hw52/
http://realestate.estatedeeds.com/files/g0/


Creation Time	2019-05-07 10:12:00	(DOC Based - ENG - Off-Center - Light Blue White)
SHA256:
6085c5c62df63a5a71542dc4089e78451098dc6ab8da4f788945419c1a5d93c0
3fa1980e8fa118cb141602e272754277982aa1344e3ff7c26ea3d65061352e11
f4b189982cbcfaef63db8c7471c051a9513c1161efcbde2bb33a921d99140b3a
1b499e63ed01e3f44d8511c2ed9082d521e11c2bc6dcba52aabc44979af84b06
ffaaa8be67c0f517582b8be260f8b715739a2f20d48a6850a1a93aec15a7d0de
ef14987521aeb4304e4e7ac7ea4a0b500a3dddadf7b19a7a2e579bc1a4ae3866
1e8a474757bb6a5d2059d7d09c0d6661fb674b488b21a43076b6be644f76e9d1
e0b89ee947f31325bb1568d7ef3d1c1d48babe88365692c7f9e13cf3395dfe8c
09ba0388f8d050cc2008d92acd92575fec878804d5d7867e4c7355b4e6b4cd58
dea431a8c3fe4a3f34f537e08d4beecb5caa79d55fe2356950a38dec23a70b6c
80b84d03030b775f660a08c82fa48148942089432e93af887dedf94883e223a9
f764a55a4024b3a8d23f0b5a61a726fd59aedf548830738afb588341c1ea0036
f273dd4f1aab2e10a9996993ebaac016d1e2a10dcf951af108247ffcefbbdd13
a598789cc38b7cbb33b4ac3530b7d18c19adde928efef8930beecf89a16bd06c
fd411887ec3579d7a22f11a4d8a0984a451ce3f7ccd9f9bc0225ea2c12bd9f3c
0601a07c6c366ba5bb64c7c9eb7b699fbed121e8fb46ba45f27fbbd0626ad9d4
78fb83601ee61ea2b802fcb6847d92ee7b4679e90efe24187439f1ade8e9a89b
fdf6a06c3350013d311820d4f6649bb2bd688868045cbecfc9ba5b3fd1f5522b
8f28975abe7d2c58ace078246cb76977f1205cbfaff1a7129138c34fb47ea8c9
4a5c99b2edb5cc45de476a297659e47de1e1ad4a6bf55be8d712eaffe6a26d6a
322d8c505c748b4f284696579b8d092da23e235cd379096c31880146ef573f98
e47d8932103c308bb4bdb1826912397995f9859edd6a7acc0505d8c0c9922653
d63aaf83931b2a29d6f8c81cd8e887fa7039eb367eac18fb97c0ba0c03a088b6
864e640ac8de6c1f897e20e152e166748c2a68debbb9e92ddf8eacfcca02132a
33cd9d01c0d13a3ff6a0d005632a23c0ca93938f8c2e0902f6da83071b939355
a8818d8496254663e9491a29684204531048032b1b6dce7f3eaa70ed08939d27
6bf58f7a185a8cc830e33e65e0529a8822639d026e7d2533b41b535191788baf
c938e12aa898228c05c7f6257ebea9c6b22b9d842573043edef70cc5e2ef21ac
0936e1c909eb238c7e60fab1ca29f68bade364c5c5194d50dcc146c8c98fd3b5
8211ba4f31253109de015a0916fa44014f8cde67d242d0b0cb06ef18ffa5f313
c525b8029ec1130157b451cc56795671c6df9d657e14af2762ecd0cea1fae08a
7eb3f6072332e81fb535818fae820dab4b6e1c1aca41999a6bfdd7f5cc60e78b
1938a07399c45b7c557699e1c7edcdb7a4cddd7c4ef24916d528481e4d42ee77
4e91924b967f146a95bc1c8f81412210320c89dcc9277e60bf64bf7c47c68430
d8197be241c31cbdc24b2d8ce9be49af92b9a3e6c8b7e2836e86ce8bc2fd4450
e4f1de8e0f8e5b6c1365e8278c17d8bb187688e7489d8262c217609215e62044
d35f348938ae0e24d9b19afcc5a2c5f1017c0dbb54c1c45467463ceba7fc6e1e
fe837762e4f21665b074d48fa317ac3a02371aab9bde17af9adadb97c9ea203d
074061c5fec85dc8c38d2c75df1cd01e30609c95505e888cf70024e098707be7
ac61638f88d3794d98217ca3901106fefd3fe2f4130814fa128a5aa8f0de6f42
34d1089b54e66326ba6aaba514bf2a42f4b82ffab3b1dc6d944628d131a51c78
20aeaeebf833ae4f6a59832c968a91e2456c036c9ff03194183b346b5a9f4e31
4c944614193706a6b30ff0edb69026b991270fc002436504f3289dae49248c6c
86b7e725d26405c79685adfd71ed002ed86c51978cbe720e9891b4f30609c96d

https://sandraadamson.com/wp-admin/eb4hsq5634/
http://qureshijewellery.com/css/ly399/
http://acbay.com/uploaded/i63tw3769/
http://steponmephoto.com/thewahligfour/x64157/
http://sociallysavvyseo.com/PinnacleDynamicServices/of18k67/

Creation Time	2019-05-07 06:40:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
6256b73b3911720f9a87de3a868dc2a556e7f55498d2f5d1a7bcb5f67faf25ca
1c9c7fd7ed2180d438db97d1e15316b6e0c623af73f432ef7ba83cd6cdd144ca
27d4cb01d386f0a05608d1d164acd340102791ff10679e4883eb39b48ac90d77
7760ac74569f5287568967bf68b3964decd6aeb70629df62fa93fa74a2e84c42
7336e1c530697744c144f7f9dfc2fe9ac9dd7476ebf17b650c90ee7e97c2732b
79a041b550ffa918f27405f205525df208b7e220fe37c7e1993fe297405b5b05
66b5fb37d13ba1251d5e2c7f20336aba9d396da809531bd34313151d0a94023a
76d2b93b831a6da51414ae28c7ab17552f866477fd5e46d3578a1787c0a007ea
02a77e9ad7ac8f2cd6db175d49ecb94442138764932e506d785614f0062dc5c0
83d78ff0afc105f165d272fb84ff032f992d138e95fe55e5d2c7e31a4ef11d01
4b4682969d5cabeeb99e8667e64c4d6d14a10bb92712a36d53e1e5f4274b27e1
e3ccde3d835a7ff85966f662b42ae1448d8d04f5981d42a6de14dcedb5c50750
7974f775401d262851a0994de436dbffc7362191280ff922fc9e08a37e3566eb
e5a0dd5a419f74d63f30b7b29e2880873a1bb024beba0743698e9df20f0c9679
37c9b01d558ca3ae785bad89acb7ce523964ac0076da0b7bf447d21cd4affbc7
a5b9ccd57ef4f5350ea1934e6774a4eadf16176f5a05f95bd307a6d98a2d6892
f35175d9815fc73f70f152d87e4b1f7f1429e1876ae82839d4bfcfbddb156496
6d5265ee9ac3cf861b50c059d443be3a8e02570abee4016164e2b1bed7b875a4
88d43b5be307ece43e785fee7e8aab628cf64c65abab026e27ddf5e2aff455f8
8ace4c9ca2d0848d592a4ec9faaa4ccc58818ba5c000ff44ab0e28ea7ad3d529
9364cce80e0e20cbd381d3d27f17d2ae664734bf0e126ce9d6660f8a48655be5

http://yargan.com/anon_ftp/3ut3n1/
http://upine.com/aju-daju/rx63/
http://walstan.com/sites/pages/css/euf0xx63/
http://welcometothefuture.com/CT/nz7s15196/
http://jcwintersconsulting.com/cizx/c7qp6x79/

Creation Time	2019-05-06	20:00	(From ZIP - JS Based - Fake Error)
SHA256:
f0a0ff72ef478cc0b4d54d407d34861db197338f4bb87a906a8eaccb9a577981

http://larissapharma.com/wp-admin/7nwg2/
http://brnathpaischool.com/wp-content/k2hfdu5149/
https://freewallpaperdesktop.com/wp-includes/mg9f6a926/
http://sulfurvacations.com/crdservices/mwm32628/
http://andreahumphrey.com/aorvuye/2s0yye7505/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 05/07/19 ####
```

a827731f3da0eff519b4e96e2d5e633e4fa0f2e8e82cb5b7e5a64d20c407496b
02ed50e54fdda447860c10950d23149dea0710587ef174b3b49be3a36c1baa0b
3469d5bfa61f7e84a98d6748569b50c260f94f042e497c02def3ed8d8fde48ce
c75c7ad2064da89573bcad3a590720d267ad13ace3d97d9abede475c5d79db31
f56a73bf66d6c1be6f7bedfb44cdf8345ef1ebf02d23dfcbb8e5039059f7676b
f5bdd47729c299c50ff9de066041bdeeb7438828437b8658dff6d4decef5a1ae
baf87664de51eb7174ad309af2f084f5031befc20431a702d6002b97d9d18f27
909318433039d2cb4a00456db7f4ce193ef536d73f48ad070ac672f9a466b37c
eb3883f98d7be58906b37c00dcfc8627bb6d0b1e4b9e7498e97d68316ed060be
889092fbcd1f2d2c23fae18d660db8f04ee530876f304056d6caa0c1e062c991
e5dc23492f536cf2d9d73c18ad14122c939848210993ed2f4c48b5bc86ec5b3f
abeecf890c57db8d6cc6e65cff38dfd63afb99612384465a27dcd00ed6b2d495
c1c4ed791fbd68993a3cd0093288174f6a3c3e1cb06aabd298cea8dbe2f039cd
dffca10c6dd6c2adcb313a60086df30709c25d92a0012c30f8ceddaade8e7715
fdf355924330ef8909913a12bad1a39e69e1238b577e247c0c8eb9fce5de35d6
56581b9bb0e8f3fc68af52f4e7a477100917002d39d1ed6d9c99c93d564cccac
803ab76c9a3ccb40593ed7496f80084cf53f49025110326252118b30dd7c6d0b
729e89662d313edab0f1b8e9f8a5d449a018296ffc2da26cf1635de844db4a5c
52b066d409317a60a631d93e867178f396d72a7756a02269dbbb7ac41075c522
42d12db7d6627d4535c89acb404b47c6102cd55bfd5a4db34863454c03fc11bb
004d10f2b7c09a286063a573added3d075b3accaf1e10602dec4174ccb2cd49d
19956e187ad07f2f83e0869756523b8aed0149c5dec74c5f9c168254f503ebef
1625404aaf3075364eaf12f7709300870a4342a30cbbb47e09e83c74cbc3f58d
b71faab0d27ca3d22f45d332d9360311208b9be64b149e943be5856dda924f5e
074092e6a7baefccd93af0f80c9da7d026fd742b7c197c9427413cdc3deec97d
96f96acb6f30ac22b54f7fbb8c2a21bdad3c7fd8e0775d7f08c6afd0aeadeee8
73e7c29a7e453f7cf8e911e821bc36df7e810cdd0f69cbd96a586c08d611b4a9
21dc6864461d689c9875d7380a8e440aa1656ebf73d8279e777e710e3663e936
893ce65894924b6b6de1993fb0509bc911b42ba3629f47d0f769d8ebe81758d0
7deb4e2c1ed4f8b754b600b385b9494994e9d03c823c20af6a4981448a2826d8
cc42cbe141bdc430b9b12fc01da647e64ce1ecc34dc3dab9572d7b3a9f08108c
03900d007fdebf5e3bc062795c136f6fccf02b92528b0fbcd3834c4872407e32
37aa9fd4e9edaa94043ce2e62f3e05478671ea78258703b819236fbe89805f31
33b1e5644485a9273855e7c0478ce9e2a2e143faffc4d3c7b5c5689910e40bbd
b9510b9867b68b757910fd3651ed5d614339f9e630d8415db2125d9c29f0e0e6
51858619b61a2fd4f1fa628d4f77cff30f0b074bee87e9c6298762bfc5130cce
06d98f257761a91a4ff83ca03dc92c00253c380bdd72d20cbc707a350afa20f0
f7605c21ce060d8501b5594f2c9309f74caf36feae6a35c275405ecf139eb222
23e389f5815654df7eb6510f6fe9e29afbf52c6978225d034fb813abc53bf287
55d910abae357b60e2168fb1f6bc9b789f21a153a4bd3487335a6eeaed4b680a
ef6f358c60a4fb4725746eff01fd9a8588cefd1b9890f4fa89465ef884b0043b
83c904d1db7d553ba761ec1ca2bd38342c62eff7c33099ae3f7218c9bd0986fe
5293067a44e40f7f860ece79ed0d5282a848660a4b43d8ab89d2cb9dbe631c3c
5a46c6440e177da9be41038e69362c7c66042bcce3a4d1f81c31d0f749555275
d2185b07d57974e139dce526e434f3379f1c02f57de2313893496830e0849c58
527d526dc81e2018d31009ddf8c03bdf2d76c885204ad3364c790f5914f8752b
437d0177daf6893f3097f729ee5d1e619e6be414d3ca77650de5cb02f00f6cc0
100c84106ecbbb7b28283f5c5f24c7ede50ec66ae77d4fcfe4ce81be892c3dae
2878c3e7f573097dbc6276f9145ab46ecf97652c8cae7a00fc3ffdc12f0ff069
536407712b71e67991916b179b3d218882e3bee746c187d3278e931475a50b27
7c841044140f46a6b8be5b4d1d8de433042c7b909a4f37c273d0e326bea68186
0f51e14f9acc22746a9f60ff3e371510252bd4fcfa6c9922de74d20c3d841e5b
a449cd81cecab791767e669f427a243f1238728736ac76a724b46aaf47f530c6
0272500246c212caf3e3d4721e75cf595c2475c20e6140cd40f35c5d0c3b3e3f
811464d09d7c7149785443fcd4fe32e780230cfdcd7501b028ecd889e8a76aa9
8a86970a06ad9561732417616bb8d159c7467a4b1c889ed71f4625946cd00dc1
7400a6e9cee8b74188caeba93a6737c19516327b9cf28ab3a9525ce73d45bcc5
f73cc24f5a7187fe11dde3dc3e1209337c69635d943f9ff4eeba8da1b8615273
c066c410e784cc7d509a8beb429d886ce83f7c582e5717578f1625b2c254f2b3
83ccd0aed2019186bfdf4632dcb484d14726aafa1554a2f518e65dbb3cbc5dc0
f0591398688e8770da2763a09ba01e228f19af4d24095fa6aa260766ff82d415
2ecefeefcc00052f07f87692ce0ffce89298b5d8cafbc93381390e744b8d1cf5
a8844c582eee6f4d58fb6903c0a82e9d74b917083c9284ee7c28aa4755ae3e11
fa593a4fb3c16f2da01985de16f795b360224b898d4c0ac021dfa16d8d92b230


```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-05-07 18:10:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
afc7e59c3f7eb40403410c8ea91e4483a08c01fe3dbb9e5ec2d792db05d71615
7092578eb42ea5e3e0b820f6f301371644c515f38089081ffac439f75a7df138
4199ac96a54a1125914dd6d442d3827273228153c600083f1ad4290c9dd2030b
942c15d908cca46bf861a0f12afaa5564f358631ac5438f46dd8aec5320ec8ca
4a6de75161f4f0e0c1ad38e60650d1858a366dd17851c33e9c5ea1d6948f74ef
69d7ce691dcb1bcef6362246015fbf110c2f8261f030712604580f321ee800da
4f55f58bff347fb85cc57d6ca1b3558cd0854ab94889455f7c9c297e0a53f296
28cd75af6569612c8dc642936de3a2680f75d49e1d38be1a3a782fcf11dedb31
747bb54841560a6b05816044c854a2de0f5598c1c041aa770ec5452fe5e46def
1667101838ea1804515221c8a6b6b55f2629605f5900e10f5ad9681d62659ab7
71b6be26315c131c1fe9fea2b209427cc31e69b472690d38b8f32e8c8a3132a9
97751f7f85a31dab44e329097291f769be1f4f616b727338faf73cfe603ada69
e32bd1dff874e887b1687bd375630d75aec57fda6ba90436543a25fbf31e2da4
4bcc23a49582fcb2c84b80463a8735ed1c152533b8145b656c1e9011747c8bd5
f47066b0cc76015cc75de6b864de2d94048b07e5907d3aa8de1716050d655b22
ca79cb63740912029a80925b94cdfeb13c9ffa62743e6371de9f7ff5c49afbfe
fa49a4384a297a41b1b926457c55e15b422f83ec648b527db8ee133d8348ed08
0a8b639c5a7cea57c3b32100976afef1f1582399fe60ad44fa09edd0401a5cc1
cc5d88ce8bdcae9b0807e00ac25b8810061ef74875ce4c1e6de004b6bb42c594
0d259d80a2460b40a664d20e76eebbe3bea398cc0a391c3bb201e6fbf18979e7
36b7c488433df34c87e4908670f6e9672e213accaca3edd81fbf66221628ea15
e9d8031de13727606b06d94c6d63be04a9b692d5eeeb83c251dd8678e87cd4e7
e7b78b900c3b24784538e7a4c770d7287cf87e3fa2d6b3de7a8d0406f07b4ab7
e0cca29fbe79912a60ba57c8776d7f84e85495fa54a0e5244c0917df09b6b359
c1fc82efd89f0d1cb1c529195ce3c7197811bc6e6a16f84d96c3cb10246c31bd
a8312b81169d94088d58157b4de7a098b55b97e0f7a059185c7bbcb339643d9e
ba9cfe63d81cf564cb9dec71bce28548d8187549e79d308ef2fc0ae273660afb
497fe0c5adffb28afd5d1add4b8fff359cd9a43fcb88aaa1f0e3ff9c30e268b8
eba293fdf7e66106538b72167c72639bf586a3fb1f104a7b8ecb720a858bd264
f4c60396875624b651f71704a2ad83cebfb42f18d8417e552f2053398b461810
e5926330a88c1b093a99a57cf8a0a427b494a60a012f4f0f9814843c221301b2
3ca3b11abd89194bed84645f9427a71ca200fb70aef0af93eb6e20511228f36f
bf55a3a3036d1f003f56596666d4ee9d217fd276a3a24bf38d1eb2f4d581f149
ec758a682d45e64a356016892c8e6c724989500dba194e3ef870134d5b7fe8c9
b1483f528d6f343065873260bd457abe6436aff1c7cb08d3df1f4a293028fc90
e7f32681de1db48818bf4d4fa2fea775f9064eff9602123dc2d014d931f82d22
39acc515c1171c8b4599f6bff37aaa446ebb192a920fe07e3b8b58624d67b6a3
67828c67eec09559b895632f669dd636dc7cf926dc962a68d13b757eaf1f11bf
9a4b3d0898fddc61f0f32ec6625a50040817f46c87e715b56ac1ba48cc17199c
e6c5cf2d7f36d84ab09e9785e24783ee44b08a299a445f514a8d8aeec7f70a31
c01333aae874f5d8bfff02bed8513a1d40c316d71e503764ac6d03279971572d
0aaeaa93626bdc87153bcbd213712de5c3fa7f98f2455f1e6e5cd2f46c03b0d3
f0e05fcf22d473ad5eb79a73fc82818bdf3555325d04a54b965953de5bdc8c4b
f72d7824f747268dc008eb1ed7f7c4c22003a22c098458e155456b074dad2bc1
df831ed46beb9a144ec45bb0a6dba56443f92f4b28c7055d325f1e12296b99f1

http://splussystems.com/wp-admin/eUJLagjD/
http://www.portduo.com/wp-content/KdWRhFjK/
http://telenvivo.com/hq1g/vp33l1h56_o4b8mev9qw-7034/
http://luxuryindiancatering.co.uk/wp-includes/ukoe_7v10mk-02/
http://prizma.ch/wp-content/fFVmwFqTq/

Creation Time	2019-05-07 10:23:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
d03ddc2c08bf8f628391f11e3317eed49399191e723cea20b242df780118e1fe
f412a78d93f03f39f6a58c865c75d6481a3ecfb83a3fdbf1ed32c0c546a773f5
d24af13e71c753092d182b549e9be0c54654f175f581ed439c8e826fbaa1e604
60b17d785dbd6e4dbee37c553fa9a5617c7d23bda1841de3659b72d910733d3a
2852a51e9338a218c5e3877e7979a58b5dfc4c639d158860b5de7a63c730ceb3
4196c7477de08eff64b2a769a48f21543127f12c6058644082ade360ac5810e7
222ce422ca63999aef3b717a2e9eeb0c9d72599815c4f478597d451aeadfdb68
6e9e2069fd301514895562e6dcea62dd8453d0097a129fc0861718c5b41fb025
9a1429a63faa25eb70c9140b43312f967f7da9b2e8d90ad0fb8119d1e239ea19
ced47cb27fdad9083999c065bc0fd9bde55ea50c93295678d2bc1bc66b6cb7e1
22acd9dfb71a2c0c1a0ce6d0d750ba554e517075ec6958d107956776cacd8e37
51dd24ccbe52ae79f2325057045832374d3c494ecf7c6839778846c72f86653e
8ff4dd6db88603dbab3c05e218a8faef94e81c0f8a2013b7a61c682ceda17094
79e388831a0b0044d7412d5b6719559e5925a1cdd6e4e97094694a8913513af1
0254c18365860c3e9bae3740b5059d8e0fec8425e82aede7b75588cd84c40863
e9771e82271beb5c983f81566668f27bb2b45d500277e14612dc3cd86ac4b9c8
48bbd14ed7febc02231681ce0c5848d388767943fbf492fa5e70bfcf31616384
ee1c27799779c0d97e2b5c5aaa0c75d43dc3eb2fa9a4d9934454e4bfabeea3fb
28e68b85f1bb66d9f63b619a9751c51f270b12f221ed712b879ee9c8c4963140
2ac313bde6bd9792f5f5b2abd91d5e7e2ce899c7631c261f4fb55cd9bb77f121
f681d3ec47816f162e1b5dc03bdc10cdeb4fe557ae5cd3d9e3d8f19b9f1c2cef
88dfe6f3e5d83d0b707378a681487cf90a2c51132b6d5a273ee42b02b96134eb
f12242ba8f3516adfe65d5e5754e1f910ba29a5a6acc66df4af5b85e8cdc1a6c
1c9028db91010dec623486a707f05a6df29570eafa32b1f3c1243b3578fd559d
f5cf8ade5d6447701eecec66209a920f8e8e4596e8637cefd29b8c63961ee6e7
dc48ee3072f61d701ee3becc3537339fe28e663ab42fad5d075bb0043993d4ce
568d369f2f809d7d70481953b14401f4d72fe4879ed817d66512cc7cd83f63f2
d529b2a402e80f7a2763e17940c0e61fb4ab83d5db0e1fc2b068b61cb90bee3d
4876f88de224c1153d0854fc23612c55f6860be0432900bf36c0b5b76cead8e6
08365263249770c17cf83998675de1b92f8f9c6aef2086d2350b638520ce487e
946b744200b26a382c2490ac1b26a042bc52f6fc5cf04b082cfa038426ca15da
c0b07e095ee0f8c7584d5521226c70d1ea1054130e7157f052c2d11461f3bd1f
e1acd3a2534468115e8069ddc2d6a533fe9275d6858b5f01d7e25de3b9983c2c
bc55ef241e0a712138ce620fa54a11cf7f58170517e497267026016bce9d211a
644eb7976025866cb83fb07f99802dabb9ab0100acb262c43488b5c63a068e9b

http://splussystems.com/wp-admin/eUJLagjD/
http://www.portduo.com/wp-content/KdWRhFjK/
http://telenvivo.com/hq1g/vp33l1h56_o4b8mev9qw-7034/
http://luxuryindiancatering.co.uk/wp-includes/ukoe_7v10mk-02/
http://prizma.ch/wp-content/fFVmwFqTq/

Creation Time	2019-05-07 07:58:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
16df87b94190f29a8e35a5b4aa331db353e4293ab08a422a28baf399663a455d
8c8e2a2a30f4986a2fd398534ad97a3c2b5690847ba4831a76edfd6c8e172f99
8f0d1f5f9444e54e4d5e9b991b587b672650a440350b2412dcc9c876df527ba9
6fb876df141e97d3e77ac20e9382dc6d07b901820ed45f8c89913069555ca567
a192842d57adab5cc7c559ccd9abe97be948c88de2e6abd3e9c2bd82c639892d
e39c8a1fdc0e543f593735b9391a7d5a93c242983b0311075b3e1de00c6571f3
89cf5a3d050ed936c030df8a3df1658dbc95bdf2c9cfb8abf52ca87020c8f727
c4b26c40d3f68ea49a6f012cf5235cd50c84bb1c8edd54da39463137551fd24a
36a753c2fb1b5f67deeffec4f2fb95581877a7d9d2f4ed8430c3e1fc7c5b013b
95c225d91c6742ee6e9de9078232173b4460b7eba84d9028d67a30403bfe4781
0e0f16610ed65b4e46c31d13b2e40e315acc55caf80c5be5adea68b51d11de59
991aa74d2cc140c9fdc88aedc3b6d20b76a68fbf3afb9129345ca8cba4be4d0c
7991d998fbfed68935eef7674e2d86c453574448070a43be7dc54568005788c4
e87fb6d5b919dfb4afdd5749b378723d06980d41360ce49e4e681b15adf00b7d
5d7e1ba335ea3755b788dd93f3a3a92e8e31a896ed67e5b7002953acc7a5f3f6

https://afsgames.com/HTML5+CSS/7amaod_ri19xusz-8939/
http://en.efesusstone.com/wp-content/uploads/wQvGculxbr/
http://yearbooktech.com/www.yearbooktech.com/2df5ge9v_2o72apy0y-519/
http://yk-style.net/test/0lhdn_pjgnj5cbey-30473550/
http://yjsys.co.kr/wp-includes/XQhyYNvzN/


Creation Time	2019-05-06 17:48:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
ea5bc88cfbb5d264ce5618d10691dc17d9363ee80775446c88aa7024bd9bf5d5
266374b39c83ed9eeb277a9f22a7a0ec71faf22e6ee34fb0ee3feac601a7880e
1ebc995bd0203de608ba84c57f8a98077f5cb558d9a256587641ac370763fec0
52aad4bfb55e81033f2b2e0717328fc6f3b14a8fc06fac721fe4846c1641bea3
7b375d52b0f5e99fad9ce9fabe68547e1e9610a1e73b48f70b54e950ddc0e280
f78feba2b9e7a108ed86d4dff3b5ceae1236c77e6283f16fde97a9ddd75a2e18
d0e9b634e86c44bee55a45da2ae75889d6e01bffd4d3f5beb2d279308e1e06c7
db2682ac87baf8bf0fce33057ccbcbda5863c92f93289c220c933f3963ada679
05516ecea548f83b5ceb14ab7237a40f8c54e39ed0b5c1e9a94edcb9a5e581dd
f4462174444fb64df624fbdfa78d5ca9e0fd70844c67c5a0fd99701c16588053
06d2330ed64e6e66028dee94db00e8f5f24bbb120f271990ae8f1da444b6d056
0fa9d4896df9e87c4eb4b76eb95672d804783705810fd229e114859bb7dcc370
89dc7cdb288773512c86d6b0acf246b477307da0b6e34d0c1093012164148657
4fd1747775fd8cbcbb31b992465675bccb1362cc53c78e54500760c79c642827
7b9b7f3bfa0043c5ea76738b4c0e2dcde263853183c970f6c778dcd6b14c3db7
50913fde5c989b2abda49269d9cc1872ef9f7ce9fe42391b08126415eb5e51b8
387114fce49ee47743b63b37080024be3e553eea3dcf811ccd35054fef5964d9
2fc9e7ed95a4fa997ee307b0a3ec315161023c63036060f0a9da1b38fc152953
d66ca93c5ac2b6e3dcba2e5494830b5faa2f737522b41a996cb40f565b31b95d
cb5d61dbb577162397d82eb7353fa47e3e4ccdb4a852405c497b365c45fab88a
453dfb404901f133717a9bfcd40832dbbe9ed7a24622cde124065b7367479388
2773e131c32935089f8b0d98dd82a7b3f0660f14756ab4a084606b8048454e56
81a459d380755575753cbbf2f67801affa3f89093015df85d01b83dda00e40b0
26b4ba9fce4653c52725f4d90a104e68f4c065a0457c6c842f0983575174ef15
886f83dbcc94ad45b0fe8ba79844e9a6d251cb0f717000f9037ff48ac0e6292f
49502af62972b3d73a981c7ee270e3e82db44d7cbff3bcba0c2032b3d005f3e9
4e4a1205fbf5a1fd85009df8475be2d2e8db957ba0c71b6793c9f11118165d22
9396cf290e7b79f1e799f9cb82b6f336659e6caec9c6de6ea42b3e9edcd5fab7
f0497dd5ae50bb5773cd4796e1314942072157247d3e6dbbeb6b7d7e6f5fa3df
4ad58d06638a399c4b1ea742585e6d555722ce89a94ae63ac657e77b34688f9c
c6ee8ad5ce8b28b0dfd9e19cb8ccb5523475401b0f3f1c5edd404ac067abaa16
68b3864bbcbd4924fcd3db09289872d596444fb2c5dcade44b384826bb302b20
460ffaec8cdf1f413f27207aa67a23d6a9df7fe56a33cace268c2eda6dbd3d52
7d01b3eac8a7eef6e57bcd509c6dc5fdd09b9306b07cfe668bf47a060c064e8f
bd21e6f1da5dd385350a8631c49b13197c82ef4331a7da2710d7a38d85d7c4bd
0fd28c1c1389d0808c099e0fe02964b67c5be5eec969872c42a0dbca1ad83de5
e9b4a303c1572b9aa9374b4ec654f02c4508b2b0f7c4ab52e77bc6c0b8a4c411
6308befd52f631348a0c565c25c0683627e7d6f34b949d9b51a1c0fda18533d8
27fb62ff0cd2cdaa537a04ead101edd04af3283d0378ffa1d5595f11a9718533
0a57c20e61e5c6c464bf1eb6e32ba65f762d015b07544790e57e8ca0fcace92c
9d5ed168c0677bce6b3c358df29001a1288389bd011739b71b6e648f8b2e6f43
001e5decf6f1525650509a7fec1ea5c823c3b9f8787956ba776c91ce187bdcde
14e2c112179900b4a24259af0f459268113ff941cd93d5dde161d0db48e34bb9
929b081d15d4a2d80697dec99fac8ae10a11b7d16ce7130c1fdb672ea22d9b4b
e84c97dcdda71f0e269f7e930de22349063e99d66b2a2e1eccb0e9fa6e48ab91
0397702cb6aa2280fc7200248972194bf1c12c9463b1ed41e163b7e1a4e65532
268a180b6c5dc8a4e70e883ba6bae41b38aabd07c9e2551d15d2973cbabd6cae
6e5270340473f53e7d2cfe7c88dd460998e5b2ba3b5088693cfa71f763a5f628
839f026d52cd2ec6843219d4625ff5a84df28cacc95926e8a94112b49efd7369
58ca8f02048fdffac59a3311a9391f92fa7c29965fd81ab9c21bc9ab89a15b97

http://arbatourism.com/wp-admin/pcCTGvayRk/
http://dev.skatys.com/wp-content/vMkSvhXRdc/
http://www.academy.appspatrols.com/wp-admin/rnzwrqdbv_lv2u1-933066886/
http://demo2.infozapp.com/wp-includes/wzw2rxd5x_176v7j2gy-166493198/
http://www.chiro.lead-tracker.com/cgi-bin/YzPwHmifA/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 05/07/19 ####
```

2bd7c192e194e8c9c7f17ab0d69a5a28f468b346bdc5908d54b133da4431766c
bf8a1fc51c5a4131037812e0a5e340f46a174e77d21f63c81712342ffba1df32
36d4767f04ca822612f888d59abed04698f093d0997b6c04ed0329148a074f24
f617be23b696b614d6b3cae64e715ca9ff573215df41823473ce98c7f77ab2fa
c1aa222d8289e733767c7a4d4305ed9dd73c4bb476db2d24a10f23f962a5606a
108f6a2fdb65e550c46eae99c32a2a708441326e36f71158a406be30899dcb35
9b44dd8dabaf56d92dee566d88c12e503c453807025ae8189215482d4530be16
b3048dcae1b2e8d359c8f32452075b1a1927eb7e91a0fbadf79328ff24295af0
d47ccfa857c20a2358459c6c3d547328fc47b1e2edd40ccc5e82760096b03df9
62ad9e53d69b646c0b204e4c196196cb3d5465d2b5078d540bf7556c69959bf3
1950cde37d8e843ab4cfc7caf5982a1add1f99f80a4b91e31961971b7f33f350
45afd1bc62ee406f282e7482063163b668a84c8ffcac3f5aefefcfe4c43f81ac
ae0f53e01ba46c366514c2014666f36a64097c5b2b3afe538c63b7783043e081
b9d654e3936941e4b96665518cbaa4cfd8fd5260bf979068c13ebc367aa601c9
7d8462a1946979e90b4d3f6c88ce332d4fbdcc75bf23a7291604e8bd12ce1380
0b2122498c63e45907858c0b8684de7c543a077f1e5ae56bf70adafb8736ac93
e84edf490d2ba5cc2900b813487ff15800a2c6e918efe57eabe7338a539615b6
761d8df5c7006dd6af4b5c90025d8b4542f7b7c09940543dcecfc9cab3262ebf
d8ac7b46482b361d691e5c85f3dcf9068aab6fe5e6d9c48002f41a89b9d3722f
d1f8425a8424584884ea9285058a7876f01d3e666025b6ae8f64ed989a72869e
01eec7e915f72487c641aa3b808f2a282e5b342d26b1349d2a7734cf632007d4
2c95bbbee5a22287fb457af0f63ff97644059f903ca538a34fac17977c6844fe
00e5526f45dddbbe8268b62e3dfb678bc0478d2aecdf010c3f58c78a4b77104e
9b5904ea7cfa0984c9db9151aa868b8b182567d62b22c901f26475a22ba8f5a6


```
#### Epoch 1 C2s ####
```

103.201.150.209:80
103.213.212.42:443
105.224.171.102:80
107.159.94.183:8080
109.104.79.48:8080
109.73.52.242:8080
111.67.12.221:8080
115.132.227.247:443
139.59.19.157:80
144.76.117.247:8080
159.69.211.211:8080
175.107.200.27:443
176.58.93.123:8080
181.15.243.22:80
181.199.151.19:80
181.29.101.13:80
181.30.126.66:80
185.86.148.222:8080
185.94.252.27:443
186.139.160.193:8080
187.188.166.192:80
189.196.140.187:80
190.117.206.153:443
190.171.230.41:80
190.180.52.146:20
190.85.206.228:80
192.155.90.90:7080
192.163.199.254:8080
196.6.112.70:443
200.107.105.16:465
200.127.0.8:80
200.28.131.215:443
200.58.171.51:80
201.251.229.37:80
203.25.159.3:8080
213.172.88.13:80
216.98.148.136:4143
217.199.175.216:8080
218.161.88.253:8080
219.94.254.93:8080
222.104.222.145:443
23.254.203.51:8080
24.150.44.53:80
37.59.1.74:8080
43.229.62.186:8080
51.255.50.164:8080
62.75.143.100:7080
66.209.69.165:443
66.228.45.129:8080
69.163.33.82:8080
72.47.248.48:8080
81.3.6.78:7080
82.226.163.9:80
83.110.195.120:443
85.132.96.242:80
91.205.215.57:7080
91.83.93.124:7080

```
#### Epoch 1 - Spam/Stealer C2s ####
```

61.92.159.208:8080
104.236.185.25:8080
50.116.63.9:7080

```
#### Current Epoch 1 RSA Public Key ####
```


MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

103.255.150.84:80
103.53.44.20:80
124.123.42.93:80
133.242.156.30:7080
136.243.117.85:8080
138.201.140.110:8080
144.202.9.18:8080
147.135.210.39:8080
149.167.86.174:990
149.255.56.242:8080
159.65.22.223:8080
162.243.125.212:8080
167.114.210.191:8080
173.255.196.209:8080
174.93.130.148:8443
175.100.138.82:22
176.63.173.71:995
177.230.108.144:22
177.242.202.30:8080
177.242.214.30:80
178.152.78.149:20
178.62.37.188:443
178.79.161.166:443
180.150.87.75:22
181.63.2.226:8080
182.176.132.213:8090
182.176.94.236:80
182.188.47.206:990
183.82.100.135:80
183.82.110.170:53
186.113.19.171:80
186.4.167.166:80
186.4.234.27:443
187.189.195.208:8443
188.138.91.26:7080
189.183.234.170:50000
189.209.217.49:80
190.112.228.47:443
190.145.67.134:8090
190.25.255.98:443
190.25.255.98:80
190.97.219.241:80
2.50.4.159:443:80
2.50.52.255:20
200.21.90.6:80
201.199.89.223:8443
201.220.152.101:80
201.231.44.78:80
208.78.100.202:8080
211.63.71.72:8080
212.22.215.140:80
213.14.166.152:990
216.98.148.156:8080
217.13.106.160:7080
217.199.175.217:8080
24.139.205.186:8080
41.220.119.246:80
45.123.3.54:443
45.33.49.124:443
5.230.147.179:8080
50.31.0.160:8080
50.99.132.7:465
59.103.164.174:80
62.75.187.192:8080
64.13.225.150:8080
67.205.149.117:8080
69.45.19.145:8080
69.45.19.252:8080
73.49.109.200:443
75.177.169.225:80
77.56.253.112:80
78.100.187.118:80
78.186.5.109:443
82.28.208.186:80
84.241.10.111:53
85.104.59.244:20
86.122.149.86:8080
87.106.139.101:8080
87.106.23.241:8080
91.205.215.66:8080
92.154.101.154:50000
94.130.35.140:443
94.76.200.114:8080
95.128.43.213:8080
98.144.73.193:80


```
#### Epoch 2 - Spam/Stealer C2s ####
```

198.58.114.91:4143
213.136.86.219:7080
91.205.215.10:7080

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/07/2019)

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
time period.
Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any one time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
via C2 to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://pastebin.com/21EHgnf1 - @ps66uk
https://twitter.com/executemalware/status/1125708425118257152 - @executemalware

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey,
@Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial, @lazyactivist192

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman, @lazyactivist192, @TrendMicro

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch,
@urlscanio, @TrendMicro and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log 05-07-19 ####
```

General News:

Today there seemed to be an interruption of sorts in the Distro side of Emotet on both botnets. Around 16:00 UTC everything just stopped
updating for EXEs and Docs. It is unclear exactly what happened but during this time spamming was still happening on E1 and E2 was somewhat
dormant. Things picked back up around 20:00UTC.

I only received a couple malspams today and they were generic invoice ones. 1 was an attachment and the other may have been a delayed send
old link.

In other news:

I am continuing to here about the Megacortex correlation to previous Emotet and/or Qbot infections but I not able to find solid
proof yet other then some assertions that were made. If anyone has info on this please share it. Also here are some posts on
this topic as of late:

https://www.zdnet.com/article/sudden-surge-of-megacortex-ransomware-infections-detected/
https://twitter.com/malwrhunterteam/status/1124599315106869248
https://twitter.com/SeraphimDomain/status/1125761396849954816


@neoxmorpheus1 noted that there were some problems with some of the E1 templates this morning. :)
https://twitter.com/neoxmorpheus1/status/1125850208838062084

@JayTHL was sharing an interesting E1 tier 1 C2 traffic map based on 3.3 minutes of data:
https://twitter.com/JayTHL/status/1125964782081908736

@MalwareTechBlog Commented on how E1 has been stuck on the same hash in C2 and not auto-crypting for the past two days.
https://twitter.com/MalwareTechBlog/status/1125853859740393472

Ironically after he posted that shortly after the auto-crypting hash busting bullshit started again on E1. (HI IVAN!)

Email Template Report:

Since I didnt receive much, I will let others speak for me with their comments here:
https://twitter.com/executemalware/status/1125708425118257152
https://twitter.com/ps66uk/status/1125873508972732416

Worth noting I heard 2 reports lately of very sporadic PDFs being used with links to maldocs.

Also, Ivan must have gotten the message about Zipper being stuck because ZIP/JS and ZIP/DOCs are not making an appearence so far
this week. Nice to see the zipper is unstuck Ivan. :P

Review:
What we know about the threaded templates/reply chain:(changes are marked with *)

- Emails are sourced from once (or still) compromised users all over the world.
- Emotet injects a reply into a real email conversation thread between the compromised party and another party that replied
to the compromised party on or before Nov 2018 until at least January 2019. (may be up to present) Also have seen emails going
back as far as June 2018.
- Now on E1 and E2.
- Now seeing German based templates that are essentially the same thing but in German.
*- The injected reply is usually prefaced with the following:
"Attached is your confidential docs."
"Attached please find the wire transfer form."
"Thank you for your help. Please see the attached."
*"Load instructions attached"
*"A printer friendly attachment is now included with each email."
*"Click on the attachment to open or save the printer friendly version of your report."
- Both attached and link based delivery of the maldocs/ZIP/JS have been observed.
- Attachments seem to be in the filename format of *_Month_DD_YYYY.doc/js so far.
- The link is customized for the display text of the link to show the real domain of the spoofed organization.
- These templates are pretty limited in run and not very numerous.

Link Regex Report:

Regex directory patterns - New/Old Regex pattern comes back on E1. These 6 were active today:
* indicates updated or very active. Yes you want to take out the * in front because it doesnt belong in the actual Regex. :)

E1
*https?:\/\/.+?\/([A-Za-z0-9]{4,5})-([A-Za-z0-9]{14,16})_([A-Za-z0-9]{8,9})-([A-Za-z0-9]{2,3})\/
*https?:\/\/.+?\/(trust(ed)?|sec|verif|public|secure|open|verif_seg)\.([DdEeGgNn]{2,3})?\.?(logged|signed|accounts|myacc|sign|anyone|myaccount|accs)\.(resourses|docs?|open_res|send|office|rep|public|sent)\.?(net|com|sec|biz)?\/
*\/(Frage|Nachprufung|nachpr|sich|sichern|vertrauen|([DdeEnN_]{2,5}))\/([0-59\-]){6,7}\/

E2
https?:\/\/.+?\/([A-Za-z0-9]{4,30})_([a-z0-9]{5,10})-([0-9]{8,15})\/
https?:\/\/.+?\/(assets|blogs|cgi-bin|demo|direc|Document|DOC|esp|FILE|INC|LLC|lm|paclm|Pages|parts_service|phpmyadmin|Scan|sites|test|themes|uploads|WP2|wp-admin|wp-content|wp-includes)\/([A-Za-z0-9]{7,30})\/(\"|\n)
https?:\/\/.+?\/([a-z0-9]{4,7})-([a-z0-9]{5,7})-([a-z0-9]{4,7})\/

NOTE: If you get a lot of false positives, try adding (\"|\n) at the end of some of these after the last \/

These Regex patterns are to be used experimentally and at your own risk but they caught 95%+ of what I saw in link malspam.

Payloads Report:

Still seeing E1 and E2 going back and forth between the new and old loader.

Seeing the new loader on both botnets now. Very sporadic updates again.

C2 Report:

C2s DID change for E1 and decreased from 61 to 57 combos in total. - recorded above
C2s DID change for E2 and decreased from 89 to 85 combos in total. - recorded above

Closing:

Not a huge day on Emotet news today. We will see what wacky Wednesday brings for us. I have a feeling something big or a
break is incoming soon.

TT

```
#### Sandbox 05/07/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-05-08 at 04:00 UTC - https://app.any.run/tasks/12670579-cc4d-4b2e-a626-113122ff71b5

```

```

Epoch 2 C2 run on 2019-05-08 at 04:00 UTC - https://app.any.run/tasks/294d55cb-f4b5-42e6-88fc-a6c2130d55e6

```