Emotet Malware IoCs 2019/03/05

## Emotet Malware Document links/IOCs for 03/05/19 as of 03/06/19 01:15 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 03/05/19 ####
```

http://104.131.105.124/wp-content/sendincencrypt/legal/ios/En_en/032019/
http://104.155.134.95/verif.myacc.docs.net/sendincencrypt/legal/question/EN_en/032019/
http://112.196.4.10/client_demo/sendinc/messages/trust/en_EN/2019-03/
http://119.28.26.225/wp-content/uploads/sendinc/messages/ios/En/032019/
http://11bybbsny.com/56uoc1i/sendinc/legal/trust/EN/032019/
http://13.59.117.80/blockchain/sendincsecure/messages/sec/En_en/03-2019/
http://140.143.144.178:8080/wp-content/sendincsec/support/trust/EN/032019/
http://159.65.146.194/trmpmao/sendincsecure/legal/verif/EN/032019/
http://162.243.254.239/Addon/sendincverif/messages/question/En_en/201903/
http://178.236.210.22/tKMrxvGkHP/sendincsec/legal/question/en_EN/2019-03/
http://178.62.21.247/wp-content/sendincencrypt/messages/ios/EN_en/03-2019/
http://18.130.106.226/wp-content/sendincencrypt/messages/secure/En/032019/
http://18.216.255.14/wp-content/sendincverif/support/question/EN/03-2019/
http://192.241.218.154/2c3a-bpnq07-jjde.view/sendincsec/messages/trust/En/032019/
http://1pisoflight.com/wp-content/sendincsecure/messages/trust/En/03-2019/
http://35.184.197.183/De_de/sendincverif/messages/ios/En/2019-03/
http://51.254.37.159/sophie/sendincverif/messages/ios/En/201903/
http://68.183.84.3/vp1lzlg/sendincsec/messages/trust/en_EN/03-2019/
http://94.191.48.164/hf9tasw/sendincencrypt/sendincencrypt/legal/sec/EN/201903/
http://9jacast.name.ng/cgi-bin/sendinc/support/ios/EN/03-2019/
http://advancespace.net/wp-content/sendincencrypt/messages/sec/EN/2019-03/
http://agnieszkarojek.cba.pl/wp/sendincverif/legal/ios/EN_en/201903/
http://aikido-yoshinkan.if.ua/wp-includes/sendincsecure/legal/question/en_EN/2019-03/
http://alignmentconsulting.co.za/wp-content/sendincsec/legal/ios/En_en/201903/
http://alijahani.ir/wp-content/sendinc/support/question/En_en/032019/
http://amazon-kala.com/wp-admin/sendincencrypt/support/ios/en_EN/2019-03/
http://amigosdealdeanueva.com/mail/sendinc/support/sec/EN/201903/
http://ammedieval.org/wp-includes/sendincsec/service/question/en_EN/03-2019/
http://angelareklamy.pl/cgi-bin/sendincsecure/messages/secure/En_en/032019/
http://antiaging.org.tw/abm/sendincsec/service/sec/EN/2019-03/
http://ARENDAKASS.su/v6yq8qg/sendincencrypt/legal/ios/en_EN/032019/
http://arendakass.su/v6yq8qg/sendincencrypt/legal/ios/en_EN/032019/
http://aristaphysicaltherapy.com/ajftgdrpvw/sendincencrypt/legal/verif/en_EN/03-2019/
http://arvd.begrip.sk/upload/sendinc/legal/verif/En_en/201903/
http://autocenter2000.com.br/cgi-bin/sendincverif/legal/ios/En_en/201903/
http://azartline.com/wp-admin/sendincverif/service/sec/en_EN/201903/
http://bembelbrigade.de/de/sendincsecure/messages/trust/EN_en/201903/
http://bgelements.nl/xrd5yn6/sendinc/support/sec/en_EN/03-2019/
http://blog.atxin.cc/wp-admin/sendincsec/messages/trust/EN/032019/
http://camionesfaw.cl/assets/sendincverif/legal/sec/En_en/2019-03/
http://cj-platform-wp-production.mnwvbnszdp.eu-west-1.elasticbeanstalk.com/bin/sendincsec/legal/sec/EN/032019/
http://cnr.org.br/validacao/sendincverif/legal/trust/En_en/201903/
http://codedata.tempsite.ws/wp-admin/sendincverif/messages/sec/EN/032019/
http://com4t.store/wp-content/uploads/sendincverif/service/verif/EN_en/032019/
http://concretehollowblock.com/wp-includes/sendinc/service/secure/En_en/201903/
http://crmz.su/joom/sendincsec/service/ios/en_EN/2019-03/
http://cskhhungthinh.com/wp-content/sendinc/messages/question/En_en/03-2019/
http://dangky.atoaivietnam.com/egee23r/sendincsecure/messages/question/EN/2019-03/
http://destino.coaching.interactivaclic.com/kaxxyhobkw/sendincsecure/support/verif/EN_en/201903/
http://dev15.wp.ittour.com/site8/sendinc/support/sec/EN_en/032019/
http://deverlop.familyhospital.vn/wp-content/sendincsecure/service/trust/en_EN/03-2019/
http://dfydemos.com/cgi-bin/sendincsec/legal/verif/En_en/201903/
http://dicampo.cl/wp-admin/sendincsecure/support/sec/en_EN/2019-03/
http://diypartyhome.com/vusialwaar/sendincencrypt/messages/question/EN/201903/
http://djsbejaia.com/wp-admin/sendinc/messages/sec/en_EN/03-2019/
http://documentation.enova-immobilier.fr/3jq49gy/sendincsecure/legal/sec/En/2019-03/
http://dodoeshop.com/wp-content/sendincencrypt/service/trust/en_EN/032019/
http://dsb.com.pl/pub/sendinc/messages/trust/EN/2019-03/
http://ebd.bbz.kg/wp-admin/sendincencrypt/messages/trust/en_EN/2019-03/
http://edybisnis.com/wp-includes/sendincsec/legal/secure/EN/03-2019/
http://emmahope.org/inrong.com.tw/sendincverif/service/trust/En_en/032019/
http://erufc.co.kr/howe3k5jf/sendincsecure/legal/sec/En/201903/
http://eurofragance.com.ph/wp-content/sendincsecure/legal/question/EN/2019-03/
http://futurer.co.nz/wp-includes/sendincverif/service/verif/En/03-2019/
http://fwpanels.com/t9ajubv/sendincsec/messages/question/EN/201903/
http://gardeniajeddah.com/wp-content/sendincsec/support/trust/en_EN/201903/
http://geracoes.cnec.br/wp-admin/sendincsecure/support/question/En/032019/
http://globalhyg.com/wp-content/sendinc/legal/secure/En_en/201903/
http://golden-birds.ru/wp-includes/sendincverif/legal/ios/En_en/032019/
http://grillitrestaurant.com/wp-content/uploads/sendincencrypt/messages/question/En/2019-03/
http://guojibu.hnfms.com.cn/wp-admin/sendincsecure/legal/ios/EN_en/201903/
http://hsoft.ir/2UmJPdYAct_LIK/sendinc/messages/secure/en_EN/032019/
http://hydro-united.pl/catalogs/sendincencrypt/legal/trust/EN/2019-03/
http://iboutique.vn/wp-content/uploads/sendincsecure/support/trust/en_EN/03-2019/
http://icentre.omega-bv.nl/wp-admin/sendincverif/legal/verif/En/2019-03/
http://iitv.tv/wp-content/sendincsec/service/ios/EN_en/201903/
http://ikea.gofluent.com/wp-includes/sendinc/messages/trust/en_EN/032019/
http://ikramcigkofteci.com/wp-admin/sendincsecure/legal/secure/En_en/032019/
http://ingchuang.com/YMITC/sendincverif/service/ios/en_EN/032019/
http://insanlarlakonusmak.com/wp-content/sendincencrypt/legal/sec/EN/032019/
http://jfdibiss.com/wp-admin/sendinc/messages/verif/En/2019-03/
http://jorgesalazar.net/wp-admin/sendincsecure/service/question/En_en/03-2019/
http://kienthuctrading.com/wp-admin/sendincverif/service/verif/EN_en/2019-03/
http://kleinendeli.co.za/oilysgv/sendinc/legal/sec/En/2019-03/
http://kose.online/wp-admin/sendincsec/messages/question/EN_en/032019/
http://lab.naturalcoding.com/vip/sendincsecure/legal/trust/En/2019-03/
http://laptrinhwebcoban.com/wp-content/sendincencrypt/support/ios/En/032019/
http://lwkb.info/cgi-bin/sendincencrypt/support/sec/EN_en/2019-03/
http://moeasy.com.mx/d2g0wjq/sendincsecure/messages/sec/EN/201903/
http://monochromeperformance.com/monochrome/sendincsec/legal/sec/En_en/032019/
http://myshoppingcarts.in/wp-admin/sendincverif/support/secure/en_EN/201903/
http://nottingham24hourplumbers.co.uk/howe3k5jf/sendincverif/legal/ios/EN_en/03-2019/
http://organiccalabarzon.site/cgi-bin/sendinc/support/verif/EN_en/2019-03/
http://originalsbrands.com/extensions/sendincsec/messages/question/EN_en/03-2019/
http://partage.nelmedia.ca/wp-includes/sendinc/legal/question/EN_en/201903/
http://planeta.kierklosebastian.pl/__MACOSX/sendinc/service/trust/en_EN/201903/
http://primeistanbulresidences.com/_notes/sendincsecure/legal/trust/EN_en/032019/
http://project.hoangnq.com/tour/images/catalog/sendincverif/service/secure/EN_en/03-2019/
http://pueblosdecampoymar.cl/wp-admin/sendincencrypt/legal/verif/en_EN/2019-03/
http://qcingenieros.com/howe3k5jf/sendincverif/support/secure/EN_en/201903/
http://quora.kamleshglass.com/wp-content/sendincsecure/service/trust/en_EN/032019/
http://research.fph.tu.ac.th/wp-content/uploads/sendincverif/messages/question/en_EN/201903/
http://saraweb.in/oztrendy/sendinc/legal/ios/en_EN/2019-03/
http://silecamlikpansiyon.com/wp-includes/sendincsec/service/trust/en_EN/03-2019/
http://smartdefence.org/cgi-bin/sendincsecure/service/sec/EN_en/032019/
http://test.blocbeatz.com/wp/sendincencrypt/support/question/En/2019-03/
http://tewkesburyrecovery.ddss.co.uk/wp-admin/sendincencrypt/legal/secure/en_EN/2019-03/
http://tglobalkw.com/bhhslegacy8/sendincencrypt/support/question/En_en/03-2019/
http://touchartvn.com/wordpress/sendincencrypt/support/ios/En_en/201903/
http://vanstogel.com/wp-content/sendincverif/messages/ios/En_en/03-2019/
http://vinihuber.com/wp-content/uploads/sendinc/legal/sec/EN/032019/
http://vipstar.info/vkurw3y/sendincverif/service/question/En/032019/
http://wordpress.fantreal.com/wp-content/sendincsecure/service/sec/EN/03-2019/
http://wp.10zan.com/wp-content/sendincsec/messages/secure/EN_en/03-2019/
http://www.domacazmrzlina.sk/nhoise24jt/sendinc/messages/ios/en_EN/03-2019/
http://www.mihanpajooh.com/wp-admin/sendinc/service/verif/en_EN/03-2019/
http://www.quora.kamleshglass.com/wp-content/sendincsecure/messages/sec/En_en/032019/
http://zamkniete-w-kadrze.pl/wp-admin/sendincencrypt/support/ios/EN/03-2019/
http://zimerim4u.co.il/cgi-bin/sendincverif/support/trust/EN/201903/

```
#### Epoch 2 Document/Downloader links seen for 03/05/19 ####
```

http://024fpv.com/wp-content/rrbqs-o7ebn-qqxh.view/
http://104.238.165.39/wp-content/7f5x-su0tsz-acbw.view/
http://109.97.216.141/@eaDir/hahf-4qgen-cnix.view/
http://114.116.171.195/wp-includes/haab-lemgsf-dtiy.view/
http://118.24.117.137/iolfcmx/1qbo-p40of-tgor.view/1qbo-p40of-tgor.view/
http://118.24.9.62:8081/wp-content/7pdqe-meosgx-nlcd.view/
http://119.28.135.130/wordpress/sebd0-6x1yfi-enjtc.view/
http://119.28.21.47/wp-includes/xfuh5-gjkdr-wusbg.view/
http://128.199.68.155/wp-content/uploads/66v1j-c9x0f-wjqfp.view/
http://13.127.68.11/newstoot/o4uru-eo3pzk-vynva.view/
http://13.209.31.54/wp-content/6qto-7fcem-rmkwe.view/
http://13.232.106.114/wp-content/txty5-u9wii4-bwad.view/
http://13.59.135.197/wp-includes/fqhw5-6k88r-dgufy.view/
http://132.145.153.89/trust.accs.send.net/mjyq5-im28a-nskow.view/
http://132.199.249.30/os17apr/lrgr-f2qgb3-brsg.view/
http://134.175.229.110/wp-admin/9iu35-2jzblr-ojkz.view/
http://139.59.64.173/hlMSx0fm/8o6fr-fewutr-ujbd.view/
http://140.143.156.44/wp-admin/eqtp-2twd99-shdsf.view/
http://140.143.240.91/yfwta7q/4svp-i3jpgw-ugcu.view/
http://142.93.186.144/viilqkg/tfji0-eohmts-tzpv.view/
http://150.66.17.190/wp-content/y6hiu-noa482-oxhhd.view/
http://159.65.145.44/dup-installer/waehf-mq5lw-skwo.view/
http://159.65.161.169/image-optimizer-api/files/3qyd-va1mj3-mqku.view/
http://173.249.54.12/wp-admin/8rxqz-n1fc3-nrss.view/
http://188.166.10.228/nniyuva/4asp-6m57v-iwhr.view/
http://191.101.226.67/magazine/vg9w3-jmyts6-palxs.view/
http://211.238.147.196/@eaDir/m1t4-qj2out-omlts.view/
http://222.106.217.37/wordpress/c5kr1-rsapyc-wsep.view/
http://222.74.214.122/wp-content/d9met-gtpgme-snbla.view/
http://24hsuckhoe.com/wp-admin/7smti-alojh-euwg.view/
http://34.214.148.51/tmp/pids/hfqr-6b32d-ijhu.view/
http://35.185.96.190/cronicasModa/y2vb-47cmeh-wfmb.view/
http://35.221.42.220/wp-admin/ze8t-e1lwt-yhdn.view/
http://35.237.105.248/wp-includes/ga3y-0ek0ia-tqqrm.view/
http://3dpathology.altfactor.ro/cgi-bin/5e6u-ea1n4-imact.view/
http://52.15.233.13/wp-content/cdsi1-1saoz0-yzcnp.view/
http://52.89.185.189/wp-content/0sey-jmcru7-lctka.view/
http://54.172.85.221/wp-includes/loj9-oe8wzk-jcwc.view/
http://54.211.128.16/wp-includes/hgio7-6d8df-ftpi.view/
http://62.234.102.53/wp-admin/s5f9-cy6ph-sqlzu.view/
http://94.191.48.164/hf9tasw/wo807-befeji-vetdt.view/
http://94.23.59.214/install/4jm2-pxjv94-ltnx.view/
http://9casino.net/En/nynz-sgi3od-cxumc.view/
http://aaasolution.co.th/ctzqbwg/grmf-butvr-jsmt.view/
http://abpferidas.org.br/wp-content/jj9x-kydn2e-crscm.view/
http://acc.misiva.com.ec/wp-includes/ft78v-2hzi6-rmmj.view/
http://accesspress.rdsarkar.com/wp-content/b2t7-bsmba7-zgiql.view/
http://affblogspot.com/wp-content/770ee-1c4t9-fooy.view/
http://affordable-funeral-plans.com/wovinur/tnot-scsi9-epnwc.view/
http://affordablephpdeveloper.com/blog/iqjix-3288v6-mxdjr.view/
http://ah.com.ru/wp-admin/w6lv-rtzva-dmwr.view/
http://alacargaproducciones.com/blogs/2zqus-znbvo1-kxxaw.view/
http://aladieta.cba.pl/veih7e3/qdfsf-2tef6-fjlh.view/
http://alazhararabiya.com/css/erq1d-k28hoa-xjfwk.view/
http://annual.fph.tu.ac.th/wp-content/uploads/r3hdk-skr8qq-agpby.view/
http://antoniomuhana.com.br/lckftgv/u9sym-46nopg-svvmr.view/
http://aplusrealtyinvestments.com/wp-content/dnfy-hegua-wciol.view/
http://app.koobeba.com/wp-admin/w4ja-8wz27v-kudho.view/
http://appliedhyadrolics.com/l3jelba/j5ea-kwa0j-lesf.view/
http://archidoc-med.a403.pl/wp-content/b8i6-8lqj4-wekcf.view/
http://arportfolio.rahmanmahbub.com/cgi-bin/whvgl-rhay33-yskan.view/
http://artecautomaten.com/wp-content/lxll-1rg5j6-sndi.view/
http://artgrafite.com.br/wp-content/328ay-h34tc-tmvi.view/
http://ashoria.com/xsobutvdys/vbg8z-xt7gn-almx.view/
http://assi-gbe.com/dev/bmh0n-wl5ylq-khdk.view/
http://audiservice.com.mx/wp-includes/zfl6c-3kopj-cidhw.view/
http://bahisreklami.com/wp-admin/1lbfq-c0hi5k-flvhw.view/
http://batalhademitos.com.br/Producao/dxz9i-a0qt7p-kfobw.view/
http://bazarpolymer.ir/wp-admin/43bgx-k7luf-wdpdm.view/
http://bebendog.com/css/crca1-joqorb-zlmfv.view/
http://beflaire.eazy.sk/wp-includes/jgmh-hwm1v-xhcar.view/
http://benzelcleaningsystems.com/wp/ihq30-h47afh-ujdne.view/
http://bergkom.cz/www/wp-admin/zuj1a-27e49-dueq.view/
http://bichhanhzeroslim.com/dyqxpqn/ba2d4-dq9l5-veal.view/
http://blinksecurity.org/okoczwe/s4oz-rbu1a-ybhbx.view/
http://blobfeed.com/wp-admin/87bto-q9pn99-ixpgg.view/
http://blog.concretedecor.net/cgi-bin/p8xgf-x2rvdr-glwt.view/
http://blog.powersoft.net.ec/wp-includes/b79x-p2tchf-txna.view/
http://bluesw2014.synology.me/@eaDir/Februar2019/privacypolicy/1sj43-6x8bpq-gjxs.view/
http://bondibackpackersnhatrang.com/wp-admin/c1esz-wwz34-wakk.view/
http://bornkickers.kounterdev.com/wp-content/uploads/zvf4h-gyebjr-wqfqj.view/
http://browar-zacisze.cba.pl/wp-includes/irgt-y76zek-wpplf.view/
http://budedonate.press/howe3k5jf/5bxl6-iyg6n-wwhr.view/
http://caminaconmigo.org/wp-content/uploads/cnq6-selg7-nrsf.view/
http://carfacil.com/cgi-bin/noh1-ybi0f-yregp.view/
http://catherineclay.co/wiki/1udqw-sj69g-ofri.view/
http://circuloaeronautico.com/blog/d5be2-rct09-ydac.view/
http://clinic-100let.ru/azrzwlfzp/7v2x-ysogy-wyzc.view/
http://colegiodavinci.pe/wp-content/cvqp-ca5n4-ieav.view/
http://contabil-sef.creativsoft.md/css/j195-lhmlz-iynwl.view/
http://cordwells.com.au/wp-content/0vq5g-5rblc-hjdwv.view/
http://cqconsulting.ca/FrontPageCQ/wfv1-detq11-mhrv.view/
http://crowdsource.oasishub.co/json/e8wo0-ammpj-nrbz.view/
http://cuanhomxingfanhapkhau.com/wp-includes/pomo/rj49w-g38zfi-frfn.view/
http://cultureubridge.com/wp-content/uploads/2cue-etan58-ujvja.view/
http://cuturl.us/x/7fs3a-26josb-hvpj.view/
http://danimilagres.com/wp-admin/rt6bw-bq2k5y-qrjhi.view/
http://dariojucker.edelegation.com/wp-admin/zit4e-bjspo-xyibz.view/
http://daythietke.com.vn/vhoadon/3agex-gcqza-hcph.view/
http://deconmit.com/sanpham/p1f2-0u85e-hqir.view/
http://delightrelianceservices.co.ke/wp-admin/j1hsd-hkdb5-kepp.view/
http://demo-progenajans.com/icceturkey/fjow-9lkosn-dnam.view/
http://deshifoodbd.com/cgi-bin/fvb97-z7jcu-fqyc.view/
http://designer.ge/wp-admin/4bqeq-odcmt-xixs.view/
http://dev.vivaomundodigital.com.br/zugman/a520v-il0i7-brlz.view/
http://devlinux.gs2e.ci/apiV2/ServiceApi/var/cache/s69o-8xlauw-gnpax.view/
http://digibd71.com/zzjobjw/sg5d8-86w3f9-qlaw.view/
http://diztechs.com/wp-admin/e05wc-q1hn3-kyre.view/
http://doanhnhantrehagiang.vn/assets/q2t0-cmvk8-tbgy.view/
http://docs.crazycafe.net/vggcb7z/rivh0-ybpni-nbwar.view/
http://dodahanghieu.net/wp-includes/rzm9-32yqps-qrhyz.view/
http://dorubi.com/lnoubt/vvcmh-ia9u1-hhtrd.view/
http://doveroma.com/wp-includes/9yfp-mee157-mfhf.view/
http://droneandroid.cz/test/uhpv-zkyod-rjcdb.view/
http://drsarairannejad.com/wp-admin/41kce-z57zlk-ahsy.view/
http://eagenthk.com/wp-content/zmf12-thxt4-bpck.view/
http://elofight.com/osamacut/prz42-1eaq6-lcdi.view/
http://embraercssguide.com/wp-admin/5zglz-kgww7q-xvsi.view/
http://escoteirospa.org.br/ueb/sjhmk-xghxp-wlwgm.view/
http://eutopia.world/dup-installer/638k-ecucd-nkai.view/
http://faktorgrup.com/blogs/1fcm-d5dwr6-hdwxv.view/
http://folhaibiunense.com.br/wp-includes/d5r1-deent-idyfk.view/
http://fridotest2.de/wp-admin/skhg-uopa24-sykeg.view/
http://fukuland.com/shop/0dvjx-lh4r1l-umht.view/
http://gabama.hu/libraries/yue9-w51pr-mipoe.view/
http://geecon.co.uk/brizzy/facr-hapmg5-kmvo.view/
http://geshtalt.mk/wp-admin/84yhr-z8mlc-pbaly.view/
http://getmax.com.br/jm2jlmz/qntha-a3iic-htumn.view/
http://ghhc.demoproject.info/wordpress/axag-hqgbnb-ujgv.view/
http://gif.portalpower.com.br/x/wp-includes/df83u-yjtae-ajton.view/
http://glamour.rosolutions.com.mx/blog/wp-content/afho6-x3mch1-rcbri.view/
http://goyologitec.co.jp/wordpress/2u4u-2kv21m-mrsbi.view/
http://hashem.co.id/www.hashem.co.id/l2to-srziq-jedlt.view/
http://hepsiburadasilivri.com/wp-content/zrrvs-lvnij-qnzqv.view/
http://hkvp.amexstech.com/wp-content/myw05-1hucls-anav.view/
http://homehomeo.in/wp-includes/3v437-f74qaw-rggg.view/
http://honeygico.com/wp-includes/tj5c-zagzee-dbfah.view/
http://hos.lwdev.nl/wp-includes/s2k0-zw7h4-ldmnp.view/
http://hourofcode.cn/IQlWkg4lU/tloey-sycfr-ukzxe.view/
http://hussaintibbenabawi.com/blogs/qpn3-3jpkp-ulkgr.view/
http://hypotheek.net/wp-includes/kbmv-hdz17-zfko.view/
http://ichecksale.vn/5oh4pvk/7clv-roses0-bruj.view/
http://imitacionsuizos.com/cgi-bin/1l0q-dro1p8-lisn.view/
http://india24x7.zeecdn.com/bq1yj4a/ci2c5-v7tem-buyjy.view/
http://indiantours.online/cgi-bin/5jh6w-66g7tr-uxnvz.view/
http://infochannel.be/web/ap0vi-af3h7p-jfma.view/
http://instituto.romonever.com/wp-content/bo99n-4yjk4r-qork.view/
http://ipanemaseguros.com.br/ipanema/88ev2-g4h80-dlnzg.view/
http://irmao.pt/wp-admin/6fj89-ahltg-ldwx.view/
http://jamais.ovh/awstats-icon/t7upq-9ilre-ijsz.view/
http://jcpgm.org/wp/bjyd-psalu-saxc.view/
http://jsantunes.pt/wp-content/9neen-f47s18-rhvq.view/
http://kaebisch.com.br/2018/wp-content/uploads/qsfw-dssyxe-gpwer.view/
http://kafacafe.vn/wp-admin/i6n7-o4gthq-szeh.view/
http://kalpavrukshhome.org/wp-includes/6s0e-lrocr-rwgfc.view/
http://khachsanhoanghai.com/wp-content/pc43-r265h-fjbro.view/
http://kianandisheh.com/wp-content/4mhw-g6mhex-ksgp.view/
http://klicksystems.com/wp-content/7624-9qm3u-jofyl.view/
http://kongtiao.cdhaier.com.cn/css/8qdfs-0jf7b-kfvs.view/
http://krishnendutest.website/htaw38fovf/rdn4i-6wvf5-eiswy.view/
http://laineservices.com/howe3k5jf/hh06w-sf9gdl-iioq.view/
http://leadbankers.showu.co.technology/wp-includes/a0g0k-x00p1-ocxg.view/
http://ledor.ru/vendor/6ea6-d87h9-qqkr.view/
http://legitnews.hostmc.pl/wp-content/5p05-85ehrw-uwla.view/
http://leplan.mx/hidden-rhino/vtcn-nt8ndo-ifmjd.view/
http://maerea.com/blog/wp-content/cs2pp-z70zv-xelky.view/
http://martynchild.co.uk/wp/7x3s-riww0c-fjtn.view/
http://masdeco.com.ar/wp-content/r1sr-omc3q-mfnta.view/
http://mediacomm.tv/htaw38fovf/7qra-bk8j0y-wnkv.view/
http://mercuryhealthcare.co.ke/dev/jcbu-sdi2a-rfel.view/
http://mohidigi.com/wp-admin/woic5-n2xz2-qjlnc.view/
http://motevasete2.samennoortoos.com/nldh7rl/cn2wu-8sop8c-sssp.view/
http://mylavita.net/wp-content/uploads/2019/03/crvme-t5w7of-qsckn.view/
http://ogilvy.africa/wp-content/uploads/de74-ne37w-olqg.view/
http://ooliab.org/cgi-bin/td6q2-gzi2o-eqzpz.view/
http://p48.lublin.eu/tmp/496y-08yvu-xrbva.view/
http://pantone-iq.com/wp-admin/kboh-1vr6p-jzks.view/
http://parenchild360.com/site/yf2ph-0or1b-oxsb.view/
http://phong.d5host.com/if7ccu2/4gwvc-0x2fs-kcihf.view/
http://picntic.com/blog/wp-includes/jn71-u09lx-jauk.view/
http://pikkaly.com/wp-includes/dxvx3-tn9uw-vqcz.view/
http://pollyunnionsree.org/wp-content/l6yc-6kobe-rnzd.view/
http://pornoros.club/wp-content/iaj1-wr4md-ozqw.view/
http://preventis.fr/old/site/IMG/qdh2-cbxv6j-wwlu.view/
http://punishedbratsblog.com/wp-content/3kjx1-jn3xni-jgier.view/
http://rclengineering.cl/images/owwky-ckdo1-jkys.view/
http://rema-technik.com.ph/products/ml2q-8h2p81-ycxsc.view/
http://riman.lv/templates/k2w5e-21t99i-welou.view/
http://rinchen.com/wp/5ui7b-hfvyq-bflzp.view/
http://robinpang.com/4gvnl9k/papr-6uoro-yxhfs.view/
http://sacviettravel.com/wp-admin/i9oto-mkcfc-accd.view/
http://santeshwerfoundation.demowebserver.net/wp-content/uploads/cqy78-p89t1z-ghokj.view/
http://sccs.in/web/ithe-50eg07-szdh.view/
http://smaknord.no/wp-content/820n-5th5ic-sfnua.view/
http://smartchoice.com.vn/data/zqaq0-0u0aj-rsvwq.view/
http://spc-rdc.net/blogs/13xg-peof6n-qczvf.view/
http://srt.skyworth.com/mediawiki/f6br-7gjdc6-cknll.view/
http://stimunol.ru/wp-admin/vkk3y-t92q9-gfnk.view/
http://stmhs.edu.bd/wp-content/r2wzk-8i7aiw-zvncy.view/
http://suaku.com/wp-snapshots/odkb8-l14rnv-mfrhq.view/
http://summerdays.me/tcopxci/ifyh4-e0u7ky-xnkc.view/
http://tarunvashisht.com/cgi-bin/7wcwg-ue31aj-pczz.view/
http://themes.kodegeartech.com/wp-snapshots/kmszl-1hdq5-wxsfh.view/
http://tolstyakitut.ru/wp-includes/84usm-gqu7i7-urga.view/
http://tpkklahat.id/howe3k5jf/17f0r-1ni2kz-zkll.view/
http://unifg.edinteractive.cc/hotsite/klcc-zy7gc-opwt.view/
http://vaaiseguro.com.br/wp-includes/805n-7bnnty-ptiaf.view/
http://willricharchitectureanddesign.com/wp-admin/4y19-vmgm6l-qcawz.view/
http://wp.mediana.ir/etude1/wm3vy-827ep-bpjm.view/
http://www.51-iblog.com/wp-content/uploads/on805-7pdzzd-jfzl.view/
http://www.aamjanatabd.com/wp-includes/tym9-s9r40-mmbkz.view/
http://www.alacargaproducciones.com/blogs/h3d4r-89km6e-crlhz.view/
http://www.albert.playground.mostar.id/5y1eyyx/swqcl-i94yq-uznn.view/
http://www.cbmagency.com/wp-content/lh0eo-5b7d9-kocnp.view/
http://www.chinamac.cc/wp-includes/7rsu-pokka-egeh.view/
http://www.dev.savillesdrycleaners.co.uk/wp-admin/y6qj9-jru5dl-vefv.view/
http://www.fatortowers.com.br/wp-content/vsev9-mnmkm-frbv.view/
http://www.hotelriverpalacegb.com/zp2ohqc/8253z-5drz5-llsn.view/
http://www.jtg.com.tr/css/8ayd-hr4nwu-utgr.view/
http://www.luxuryincontri.xxx/wp-content/uploads/7tf9-basfl3-axqa.view/
http://www.rrshree.com/wp-admin/q2q4y-ywx16-nlko.view/
http://www.sonmoda.net/wp-content/tn0a-okk3j-lsss.view/
http://www.steelkar.com/verify/qwa4z-yi6bz-sgyt.view/
http://www.suteajoin.com/wp-admin/r2zr-0a2evy-hnhwo.view/
http://wxx.xn--6qq986b3xl/wp-content/2q3g-93v2y-baqaq.view/
https://oktober.i3c.pl/n7wavq7/t4i8-w6a53-lwny.view/
https://picntic.com/blog/wp-includes/jn71-u09lx-jauk.view/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-05	22:29:00	(XML Based - ENG - 365 Blue Box)
SHA256:
2a941920f3141a6c6ddb1323715ffed25a53eec27ffa855291abd696c1992108
2bd4fae72d3ab987b9304454fb8f23e8f8e84fff0dbcdd898ddf3f561d184f42
93b87fd97dc1f524a337da95daa190502cf93ced35624809bc57ea7c60426b97
ff87ffe29a1101bb418ff247eee1f92bba3069c973d461895682b71ec9a14c23
5df678afc8e67909d8f14c0ab430800f78ada119941787a12dd2a524c2ddfc5f
ed167edd35014427009ce66f1cd3de7cf48460b9b64eb44dbeacd789481d8b68
a2e04e00b1dad83d59a31ea0490d796eea1368e8b18858d4b3da470510e22423
2a5cdc81579e952831d63d0cedb38c32ba3508d7f67589374db9ca798691783c
3277461ae2957c556d00eee879ff9e1046c3154441c11241b8c92a41e425c592
4c99c56a7f2070edb3436f7d502f465d4670e3b5960d67e124e5acb2838113a4
fc237196ce5cc7ffd5e4f7e948eab74dd5b2c55715537d404377cb219be5b557
1ed979dd6f2a973c269bc18268a3ba787d83217159b90d0f09c011532eb3da60
8c5a4a398d1752740912d7331ecdde2a58ac078cda456afbd44c66fb2ccd26fc
09a3878757ed1498317469051f8720b8b2a1dac1057b8495f70d581cc121e5c4
5b15b2f8ff2090def26c29db9ea04ae33acf97d689162a5ee08adb65341c2ec8
d8160686e205ec2a48a9c20802839473f61d5e9ade929fff0266cf664bf2074a
823973bc199dc16b01c9daa63a8f376ed0f6bc5978beff7ee39e244858eb516d
84f68f7a16f091cfb89e9c6c938d5a5cee9ac159deaa86c91a13f581eaaa02c8
da1e9461b88c53163e82f2f8b7ae6cbf232cb1f863a597661c9141479e33109a
b974213ce7e33c2574a323197b57f79cec5b1992ac127356fde3b2d7dfd32706
19a4b301cec70545b88f8381e4eb13704a563519c80027dd63e135075632cd7e
27d61ea3a3c3ecdb8b900b4f5d08bf0aa70890c006348e7def1441126c94535b
1c833fc82050ef8299050a69aedf206793f8643a835cfd76b85eeee3681f657c
bf50846da5fc65f41cd13158d498dd2a5a7f107347e49648c91739951075e67e
06a844a779d676fda6336c5906b4649b32d85815821fc00ad91ade39ed039d48
7e06307d2307e4d355f60b1667d42f6abb64b3d5ca13c4eeb85bb19b3fbc676b
eb0b09b8783c1c1a703d8221cf8375d6d89d7468011122bb1941ad95ccc8e6f1
3707670361f6d9370f4e37b60e30314013242dc3009338556d4008bb89849dc4
4028136afc0bd4f5addda390fd1a90e4509336d753f7836f9313bc38dda460de
174e0aef21b128cae8d0f481f7e711613c1fd59ad58f11a2b54480b88a26e324
ef8b13f956b05117ec9c9d334da3abe4110ea70a6ec3433f4dab8a9658b1572b
776bbc72d7a1ee931fdb088d4d5c8c0b1d2b7184f3937f285fc885f036787f21
a4ed2c043354b7a3221bacc8fcc72126901e94c22e721266a65baf085663e69a
c5cc86004a67d4cbd2ea7a86c23b50418b3d19d7fb54563dcabad4264463029b
cd62c54034e3c62cdceb28ff26289551368a99c9edeaef6e2d9b51314a8d641d
4f76cf4e36ca9219901c98b94ba2823a5b2f0e18f64f90dd735d7683003c7f0a

http://kasebbazar.com/wp-includes/KGbQIc/
http://118.24.81.160/wp-includes/a3w/
http://118.25.25.201:8081/wp-content/jzU/
http://211.159.168.108/wp-content/uuZ6/
http://demo.dichvutop.net/noithat12/JMQ3/

Creation Time	2019-03-05	18:00:00	(XML Based - ENG - 365 Blue Box)
SHA256:
031909ad3dcdb9e5c21d119790735bfe66bb24275a84183b7578758c2628c511
4223f8363ce4821b508d246450a024b021710bdcd3ce11378133f5ff45547fa8
3ee17ee4d40df2f447cdd1ee321a76ef7bcdb2ce6ef2b5156127b7e210166d72
35c8f6b9340b7bead5d2bddf31e41ed219979f38aae97dcdbd13f5044e1e2dea
6702303ad9bcb34d10758c825c5cdf64d8751837375010518c6d32911c2e98e8
e47817abb68ea52332f0ea2226c8833b9b55761ec0f756ddc472803b6f839f24
b3df27f120740ca92721aa4d13fc6f8bfe0c68d9fddac96c6c5007648a20a31d
822b167aa905fae24e6efa890655948729794d9ab21ed336a6808cb68b084aff
4e5858fb78e1863fa034ef4cc24a2baab3c75cdbe6b6b4f1434046e9706fe2ce
ee6c1c7c4ec9971833b84ee519cdff0c3894d2aae0329f7ff4e61fdd6f1f8e5f
439543c58438b69e47805c5a0f47d6559c5d105711ecdf3c62c50e36633052c1
7a9761a06a2d295752b1764cfb5bd3f81937d221e5a6abc041484188ecb6fc86
b33766b336c9af26155287384905b07d855ece1deee277133d5f9df5fbe23cdf
65b6c70ce2093bb7fa9a86a97d0e5abbf589fb925e10b2c692824758934e405b
cbb539f84e0199b37005e840f65f379a16daa2653a65d14a4a0cc5c2dd7b70ca
f04e93ec6a33e431a50f791ba2b2c643cdc1d68604c348088b11af1a6904ff72
f39e39f68e86c1fc95babaa2497112302a21ad7878eb47185767232a79798581
e9d365304f49c68946f9d2519c3b900b22f3be12e7ed2f42d16abcb20a013ce0
6ee3e6458edc572056cc7f23f7d41c2940c0c8721fa893968b63c2dba48558de
04efa951a9e07feedef52063d3425b15523321a2e0ab668b94dd01b95bfa456b
ac3802f8d0a21206952bf61f556fe5f991c3687e99e1f24196f355b3c148c22d
5d54ee171b5f925adbf3ebb7e8dcebe86b0a84ced4b75254dc0763cebe6af733
8cfbd8eafb934304ded93dd7829ef28c6a21af86ac183dbdfe9ede2e056c1e9b
9901fbae746b50725c856fe9ecfcad824628a7a9b72d0fba170be5fd5f55b717
6efe08408ee501c2efcdfb3d839a8c2f37f1dc14466e09538f04730406e9e8e8
a1ee70822fc5504d76ca180867f6f446109aec8aff6b31d4ad7f615a2b16cdff
80cb2dd214260220ae4ce72294fa8a556a20b16c5061eb41d31621a40dc52006

http://mantra4change.com/wp-content/uploads/C5UDxJh/
http://peteroszlik.com/dist/KFP4imImNO/
http://13.127.49.76/demo/0tyYvxJi/
http://www.gym.marvin.tech/wp-content/rmsJlXm/
http://79.137.39.145:8080/wordpress/wp-content/uploads/Ecu6NxP/

Creation Time	2019-03-05	10:50:00	(XML Based - ENG - 365 Blue Box)
SHA256:
2745ebc10e0a8a0fdf3393fe7df3ca3c1e9edbbe9f2bc92d73e2789639d073b3
75163f2940b68d995e8673aaf0432ca0cecac8429e37a50432dc233e8d451d1e
5924e14aa179abbd793e257c246b917e368f0a1200ecd18917b454f91d85b771
8de342a69d336ecbc13f2ec4c386abd40268a7b5853616c89c037bf20bd05109
0863f970480339c30e93bf2f70f1f81bd65ba0f70f05f41c5d0fdfd18230f672
aa4f94609bb54a3b148fb9216d0f672e2c052a9b05d7ce52b73708b623f47b03
8303b2b2aed24d64771b69e533acd9e31c7c3f18a3d54b0d2bb2e3ff244197e5
4bacfbc7e157ad250974353665bb83de95b75e6ab6a738e8adb61ec63689b56c
b94100c0eed7bd2ceff208cf48a7ae964c69bcb84d30cb1d97f4546920803072
ce779810dca87d0a871b5625b1f94fe32092b31cafc763b25ce099c6239f3414
e949480d691ac9920b06649654c3727395547494daadb59b23725b48d2723bd4
b4eccb4c60601c1f631cbbfc1646c31c568ac09ac6adcc1db93c3bee3aa97fa5
c4c1b8eee3bf246dce3e480a0eb89f7a80f1b22c034e125eecda84e252a51d67
07929c237a731be16cf4cb6b64dc8768ced5479ff361f7df6da23ea81bafa445
b9ddb06b8b25d4852fcdaa4d9d3d4f8f8e169c56ca22751081f1dcbdbc0b4c44
cb8ddf621adf2a752a957d09dc9951251e4ce042da623dd03703ef563aeb8556
c5aa52fd3de607271ae5dfd7b50da9a27cfae5a73f4eb07f99e89f05871e6c79
010b8d8f295a3d55288d379e97f23cc28c23e201da1493a573e85999c550e1ed
ad0df01b1fb2175ce575177cdb9db52b514c13030114d9b553e0bf51d0266ca2
a8e0e8e9fc4bbec3aa446d5877d91fd68a1ccc59113466c3d94421a94564f074
2d4fbc88bfe75abad6366c8646799f9e3f6eb92f65ca3e055779f36e2c8e333b
17f20ee4e10b59c2f6a5ef0afa3f0d6756d8a617a61aeb3c8d89cea465fba31e
ae886185c7fae7f094e81f3a47d25607299f3c72e723c67d62c8f8595c9be2d5
a65b2d2b9e3f090a36888e75b18f6ba2f44943fb5e0763b72da590569a3c83b1
f3ee65fdc0742b8bba2926abda390ac4f438b2ece7b7cb0953984d879812152c
2ecc53a0a6346e31492ef2d31550db6a1100cbd1464a690358c6adace2cb5f77
6a9d1275005dbfec7c5aed26404e181a5e5889f8f2673d10d8976f190febb430
d51d9f27718c18876b71faa58ff2340c2b869c24834fb08e5a816c6a7fa303b0
63ed2d82abbe58e9877b7ede6049794c2189671baa34307c040db7f1d012881f
061a5eec9ee496b06126aa47d64c89e342afa37ed4a544295adbaa097dd9b281
4d7086a80b0a7a49e06908f064c41e63f30cd8b7f7e72a825f010af1c773c81d
f71bf778b203da9f9058e970900decaba983add0bd492f9c249dc146394e542d
213d5726e35f28ccc101be3f87d499ea16f4c4a9b1e373295864c25ed46a922e
493438ecaac2c03a34284de8c97ce0020c11df8483588113b1334aac7b7f655d
842affceab8a40541b4aec1b747bde45bc2711c4ad8a19dc045dbdb0b5e8b4d4
cf0649ebd59773088eaf195500090b15f9e7039ccbd54fde07287eaf0e1d7fa5
ac191f2ce122f43b10153377784aaad628473ba2d0bf43e385710e3958260bc2
575ef83ef856d6c2002da1ca7ea3562da367f4bad60fd63526761b138058ce0c
e67cf2896cad6b2e759af9877e1957b98ed2d43f88609d270e28e5d1394c00c4
db981a8b998af5e9075ee77178abea83354e28f3ddbdd10923b703676f0147e4

http://emirates-tradingcc.com/wp-content/5SsxyFe/
http://fikresufia.com/cgi-bin/lAvxmrt/
http://bonobonator.vishnja.in.net/enebhpf/wzyeYGgB/
http://wordpress.dev.zhishiq.com:8000/wp-admin/OuZ3gMpo0t/
http://18.222.235.155/piwik/jaA0AYB/

Creation Time	2019-03-04	21:30:00	(XML Based - ENG - 365 Blue Box)
SHA256:
8940048820f6964f24d0a91beaa2c1c5941a165367eb206950897a2f34a18d78
09f9db82e4c636ee377019ce43f0539cab8103df3173f985b3fd95cb7e1564dc
8faa6501b2ad11f9114b85372f8a7ba685cd3f32dcf9a2cb62bef50bee57bda1
d67c668a823f5f76b40c131b8e094acfdaa5076e3d520a4b5f6c0bf1fe05a842
29653edb9c91aa2e4f3561e502d30821ac1c2f4c4f1d1f0caaa7af9d2e3d109a
546a3069ea0163496a399cf6a5df93cf5ef17835590e0e9ca5bb0e34a98c2839
d45007deee13a3f20c654b5d65c20e4e349f96b2f3175614693f3b838a400ae1
a7b11012689a692ee87a2a801667d6b56a51452d52d6dc7f3a329b6539e13fd4
77df89932280b178270ad23fe18e04532cfb2fb8e36466720d567598c4b6ad4b
74186544f17fc4cdefb9fad76da86528555eb3bb464461cf8b5d5f11ac11c78d
96b4d231c35d3a2400736f7358bd5e438debb796dcebecc46d2a26f6d463b10c
093b8c79d469840b972b214a111ed940e689fbfdfbea179ac074c0158c91e8ae
d4cf1866f833908fba462d9ecb229b53f2433d2352d00f68ae3848a9ceb7c8a8
e1e081c505d8f13b50c50dc20bd6442a6c44582bdbe9b98735f150a9c13e8e16
a7c7feb14ef88da2e2c92fbdbbfa1b0625e08ad4a323767580375d4d1132f23c
2b4cbf1a30d45ddfe426d3362549592e238ef8ae96172e16da969134c0e96d4a
7dfa14d09bc9e38e9b97fe017b1f804550b4a923832a34c9cbf2f531d40bbaeb
d85eeb5a1aa8bb60445816a758fccdd50fcb9aa78d68180cee68391216ae644c
b60b23e796a4a1a441dc8340128043d75a354eccced2ec88df1b5cf9da79bbbe
3f603e317b624a36a81412f9eb7e6d52ebe148e7e8dba6cb02a88ba0c6fe3c12
20cdba3f97b248e600f059cdfc3348103b4782e14a486aedf8ebe87ec4a65cc4
645b647b38adccf74c9d4323071045ae4d6e0bf53ee88ed926be5b56b568b8a4
7e5c691a612516b1b60538d24484c4c05f3d838ce4aebdce9d49bc01648fb81f
1ba3f4b0927e152f00568ea0012f799d140f45f32f9a5d3cef776e80a05e7029
b545ea518a8f06e1e01142ebf9b6debc0628eb775b9edb7682cbf6415e9b6306
23c435f5859091ebe71a1b294251bef3976a26579375a5a970f0c4e828e791c4
4a500214111dfdaedfcc9dd344a6db08ddaeeb90dcff46b67da5035c7264cdc4
612ee319e707a93926b6ee619ec73b2148218adeeeb5c7213cff0bf5b82a8400
a715b8946bea717b9361dce3eeea5077e442b0517d8902773e827b016adefec2
b5d96821148785074a315e8a865a7378e701cc35dd79b152c13e0a5666120484
721bc6d7349adda9662cc639b380a5e32b6c8aa34cae30ce3c20f7d5f6136940
cbfc5f646dbd53e05b933195f13a1b138cfb3266c653b1f5a45b63f4b38415cc
5b9b62af431435dd164d3011840156807d12a82b221b217bcb29296145db47a8
bddcfc5fd3bb0756e3eb3cb1802a1baba2e9eb5328eb9c5d3f4c5608660c58ac

http://santosramon.com/examples/DwrtApdrm9/
http://digivietnam.com/wp-snapshots/yHL734TZk/
http://buzzconsortium.com/pkpdf/3v86myR61k/
http://efotur.com/surecc/FEcSA7T/
http://evadeoviajes.com/assets/aR6DQCdTHU/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 03/05/19 ####
```

a0d6c72828b40bd73e9fc5b20bd4b6c0c67e5a2be6ca456ab89de8c96b875b08
5db861eb9e0428413be793b0e931212fa56c903a4b96dfe7767265fa880c256f
f9fc7b33ed036764ef94d327f3ee743a7ffd851971852319bc051710eaa9c82c
f4d1d3b11fb527b82fedd50463c253bfded3515589313f4fed41dd20f2c0b2ac
863fb88e32e5c50c3ed78095db2b5c1e37d00a51ecab5f25426ca91dc56775da
ac6616d52fe82eb0cdb31579c9ec5b6142b290e191b7562eebf61c865c6c5d0d
ca573818582b3c09b566ccd671be24910ccf5176031ca221f4e7b5ce2f5cfbf0
843e67ef911dfa8ffb1ca799d26fb497ffd3f48e467178b976c486345a81c425
282405a7e0adb5e787196d727eb18bf14ab27826291b799b370dcecfccf1581d
d8d8d8cc6ed097286c56afa1258ac05b67ae978ed8c1141f3711c0cbbe8b51e4
66da875d75fed1b4b69eb3ff38d7ed117c499d279e239ef482424d5a8f2dd435
d1ca0c7048bb8c7e85d5bc33107869452103920a4422c36651706ea6ac5cf8cc
699c6b2969e386567586fba332e4bb3271749a1380c26809037a5f7bc6256771
193f878ef0ca39482596f3e65cf53ab7694afba25ad5f03ae0a7d70aecb0af2b
8bb4905622a7aa0404654163904eb1a36331bb1497a9992c141de37eb05225f8
4066afc17690a10c2098bfbc2b111d922c2686171c44b3e5da1e5820f3d17aa6
7ae14f83c17732e51a04daa9ee432109d5c025e249a6c634a247ab88c679bd08
ff19ace7e3338b7b3c92becf358640395822e1a2919e5ae0f116128d673828cc
80bd07340b31f036ae95aeeb9d045ee3d234ff85244bef4934e70acd9bb6764f
abdfd9da6f2d5768dfe191e7b68c4bb059c070e6b913979c322ef8414b2f5dfe
c911a0ff7670f430b82d495c07f8c892bda6c3f2fe775d14538751d882a27e66
3cf7c1ffd5dd407646b7a5424fa9e5a50aa95b334ac50f01f0d94e2596360897
608d007025f1038b117bd39086f8e10f038961fdc82c1f47719576cfe83bcd82
7c608a338c7185d6095953ae6fedf3900196f2d1215cfb3e388dd988c71ed824
9a99a2b78bc87e9e27e6924ed5b3a08fe8e0e503f77d6da29145b34031d6d2e0
b9ff83005428089dc903dd526c42ee43f7b136c6aaf33cd5cd114da0fd6f62b4
81b31eaacde0490d3b4feb4937d08c2b5cd79dec57608b90613a466e3d36feff
651ee17703d9b038ff5e64e1d89a28c5868ac78ff47ec02dd0fe75d06a99f03b
77569fdb03c33b95bd787da1aec2bf44c0b7132c36167a7e0008003dd198664f
9bd4783f18fa3699ad051019f4a75cf8eb5cd6c22efc9824111d06322bb35609
4443244a4b64efe7675b4e58c10476ffb7e4c96e04f7b0e6d3d25bc4e51c2d3e
84174bf84bea98113170601efa0c999e254ce792b8cf2aa5b63d0be7e50275fa
5bb0aca433269bc9d73201a613d77db83b9b2c05d2f0b056bc8ee078d7426749
d0b1c8e9302804ce0ef6b10715272bbfba6d5268d79acbe5b820cea9eb2b05a0
fdb27854fa88cace9a2da8a26b7a1e9cb9bf43a41e06327956dc2cea1c44d84c
cf8e934933161170e4a2942999cf3fc88374c51e8dcd5c3a9d039d87e1b5071a
71cba105d98e13cab8911bbb52d4c9c28e44832fe80e1f9bd16c0f76afc6ee20
741a08e8cb8506d42c64e57f76a5abe34077681abd7cb4c3e26dcaaeb24c0b0b
ac366360a66cc6ca8f37c7bb5cf132cda1de7855fccfad9e5cf30b89e6ce1044
ff45163facfb3ff7a5f280b2b4b3c693d1e22e7204c4381ba36684b30a22ea1d
636fe70246c3257dc419c0234eab3e1254d3313ba52ba95d476b1ca40c2ba8b6
1c32a474822f09925ff96bbc422f3f4d04cbbdd77d21604d8d54f3e028fc2045
7ee2fc0d77a02dbf4d23baae4a341f0f4c80e5fd933751bf5a4deb101eb7622a
35940610b53bbb0bb8da7d4f6656f798d0be8eceef940aff8bec29d0990e7ecd
a5f3b80a7e9d9d5fd71e0b61d10c6153ef3080e74e002e501fda23c313a935e9
a04c85388e86f9a5a22bbe33080e0c638a59c4d18dc242a08d7229989533d89e
5bd6a6a80592d44894df5c9a353e8ff7dc602962ecd7f69d8d872813c8570f19
42deee4f4858760c0c5bfe0573825b46210476ee328340969542cbfd84f3b3fa
9ad7b402ed86801de3aa98ba8bac03bfe9108c8f940996496a667b1da4103116
a1ceca1c9bbf4ee0edaa8b65d0afd91a75ac896951f74a3280c7330fc0e68a6c
496c159f20e62e27c4b7022d41a042be6e56f22a187bfef60a31cda3e403afb1
0d4aae7326451a89b67b646ae120b8b7a4f50a09f24b817a5dd35c953db93ebf
cd978548c06088696904b56fd62dd5efccb2f76516421dd35851c85313078968
c5794f4593c627f7bc72cbe78b022c291d4333a8121746b01ca7963c7d74e298
0f8d953b0d156feb1f66d9dafa3176bd4f48f4c6eadd040a5d014fe0a52f2564
6549d9fc30d4c01a2460fb5272a009bc1e95132695cd8314fcb86b4486b2dd36
b98363cb71b590d9d84c00c512a0ac56c71a594a1706c3f01c8aa6fa52b8777f
512e81b5632ed48239532fbb4e9bf904e5e68bc2e8d025979c5ad1f50f30e1e1
e41d557349bd1d31b26971f1656e478f7de930b6945fdae540fa8087051da6dc
af6e385fa8de3f8cdfd2a16d81fa9aa12304af41532cb448593e3d3494753c97
8e55366a1eb78771239ba1d45dc9a5c3a3d7774bca2703fbb5196c40160f2f54
defd477b793b7ebbb74c01732de452adaa823c4e546ab6340c5b953ed69eb86b
2fa872961ec6638f460a32fa76a2324dc33e6e95c8dd0544c06fb1c9f6d2890d
640feda44645c59eff49a3e6ef256e935a623d357ce5b3982f4723d0240714e3
b1c9a6723be0dbd293099d323419dc7a719211d552ad8bdd0e6642669e84a674
2504b0d3a26e0352a62588a833a6ad201c763962360ed2a0f7c964f1797140aa
36b6a2de750904d3e949d137ff8bc6b7bdae1347e80014194de0743075f81223
058c7582f8b5da7ef92a75bfa5983fc7d96eb51f09f5c2b8f6bdb25d81ce7994
e8ea2485827cf39da12d40123b80f6830675158d70ef54d3a865c75d3936ed57
3145da7dded3a76747fac40158315b5b34e71fad17df86ff24fb73c16f1b5512
3f2d13dd78ddd8618381198a34c77e184d5c4dcef6694b8f80c4b270cfac5d7c
e01bf9995e1a6a47579f9af34c0406f03354c9a3906c56519d4d62a285c744d8
26cdbc863be4cba0ce84e2df5f70281eb55580b47e5f516231a236d80a795993
947a8341b7852aa671d6f04a00d7ae2fa25d79b117e163dba0ce598e18e1ed66
c2d29b68da7f0ca1c1fedbb6c53885590ddea8044ffe889376978b4c1b521d61
e09e0380a687772e9bb2101beead0e3338382d1c381ea9d039b6b9b19e88bec4
3f4c78ee753c76334ecf3aede76fb588d79af1813e831463aa71fb9c2a3c5711
7e605426ed0770f6f67e0a07ce75c92fe2d01f44d8a5bf4fab9428780cb54dc1
db89fa8a728071afc57cc0fab6a64364803731c4636a214be662d5f1a44aa54d
d1501d3ee3ea3751d65b5313a1924e4bd1362b1d031ad01d2f70be8e28018bbd
21a395cd43686a64f5d2a0af96a9ccf992dbcd3713a03e80b50a7f7f610037b0
590fe0c98e1dbe4b693e1eb0ddbf9892867453bdae681775c520101e46d95d70
ffce0e1523d6daa4033c03de34c71afe9a4e0c2a52d063f3acbb08089d5b24a5
c617b5f3fdf7a865b2542e533c8372a9dc4e98294e79a4811a8d03f515e60794
6c45a127f164c41b93cc31387fc4a7e49315203498534b8b39f3ea5c59ff496e

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-05	19:00:00	(XML Based - ENG - 365 Blue Box)
SHA256:
b4eaee273cbfc0bf4f8b15bb98f7c078a661d717bd8cd02f5a899c9282225e1e
234df25dd373a6991a4da5e145114f64999b75ba3484da70ca7b052d39073720
bc38f5c36d5e7d6058e1ae48d9fa4e5050e9885c36fe45f6927d2f535b69aae8
5b40e5409d1ce4230e73dcaa67ca489dd61b8de730b714663c5ba366633b3256
f26bfed1b83be1432492432147ed3b6cb4335b625db4e2c2d808deb9bf8b8685
9029fee585bda620e7e6ab2e07b8046cf06e3c1cfbca7a41cdb1676f3618ba58
018d828e17c564e968fe602c930acc04c34fac03f2b289aa7b1362584cdfe180
275e7e60d0654abab9166fac71553edd726528608f044713d32a53ad69235cd5
5a652d0c04994886a1b7827ab8cdc621724a1381c0c568be49680d92bc5465f7
7b1a981d08207c533d4a4b2f5c2c09624a81d65215687581af47d507abf05c0c
50182d9c358670f53fd1c86a14d81e913e32445e8aed727e216727d33b574238
569f94e9e36d7ae553f469ed523c30725e6ed6e3178d350fc56d49096aa6e628
c5841f92ca99cccd82b839080547786c54c07bed382bc0e25b87171e2ec7d11b
b0437ca86994a45f08736d3e612491e0e0ccb8f6f89057b56e4ade9075c74ffa
09bb76e2b4507b37c0442281d86acddad20be8ef7f179a36de7ae6c63172d02c
6ea5d22807ed611c964355d44aceaa7276d50e27fbd48c661cbe64724e821803
43bbf0afde29b21f98adae2e6a6c5d93701e5e723c19f91bfb3f4531e5e4bb95
0bc1c015c9d2199a089e2aaa89a67dc9a7fa0b51cfd9f7f32b7d9210964ed934
6c5766050c69e210773d3fb9d7115836854decab47bd4952dfad51b7236e87bb
4fcee3fb915fbc5ebf6b9455d5033d4ae406ff7100e3d5511351082cc5d7a48d
433d222899298ae9186785becb3fee9efc501bb9f52469707c05211a27d20399
65c10177b790c7196f78ddc6fa2528cfaa80ef6b3039e6f7fba147d3b6633da1
bd8b04e5817f685b7b1acb62531975319e3b4412b1791bdf4e6bd1c5f51b8810
d8d04334e16e126ecff0f83450d4e141f9ca987e50aff09554e4f76a9ec13293
d5db46b19b771202e09a07f5efd332f875991c359ea5912446f4ea846d9f3f92
83a89cadd6bb2f37235f38e1df37e8bd7f67392e2da50fa4056f99f9322361a5
126b76ff49fa0e4a770b85b4aeca1a90321f135a1f1f272771fc3700e58926c1
ed6f8053949221ed10cd06006f9abb14ec7a5e68ce3e4410a3ae3a7a65c8189e
b5c4f069de45cf6fb4cb93efca890daff8f11116cca078a17a25393462f2a5e4
84af37348d1461733a4d77140d8861ed17e4195b8969ad09ff0cadf54f8e397f
4cbacae502913235ba9844b8077a904a92a79bd87807d2ced4b87a1429dcf10c
7c5df858b49cdd6e5a2a642fabdcf00cd575beec4c62fba6749930fa71654eeb
a1df82894fe0ec2f05370eb3e528c0690a10d9d5f666d2e461225c8cfa2ab955
d13b5ea2761899fe92b4f097f488303f9cbc2f0488d3abd753ad6267ee3c8d8c
b658f6d2637e167db691c2e328a6ac5a0a77fa110ab18dc4aca4fb80b0c413b8
42dc0fed7e73a75497b8a0a7564b46141f6c128de6a1bc64f061766ba2dbc8a3
e7f16d43aa6076188c1426f3d6e28521bdd95893130816a3f92a863c2cfdb540
f9c668acfd272f7559a02786f87a776e0207d2c2237bde1a60fdfe96876d9f9d
3fb1e14af9a89d88a19906e6eca416a6291cdeb86a6fc9049fabea36d54f3509
ca059caef95957d6648e83486e6e53777b0ddb69f6cd7431666c87e0fdf7bf18
b71d4615e0ec6c0fd4ac78377e127e085245287185e25865e5fa9766b910dcf1
6e0ac7c3f3f2e067cee0b1ec0158e20f74ed5037b44af4c1e46f2c40bf4850ad

http://basr.sunrisetheme.com/database/e8mI/
http://bipcode.com.br/news/wR/
http://bud-etc.com.ua/wp-admin/Ycc/
http://bafa.com.ar/wp-content/qs/
http://adeladesign.ro/wp-content/u0B/

Creation Time	2019-03-05	16:20:00	(XML Based - ENG - Orange/White)
SHA256:
7ca1bbaa038c0944f5786d4675dddf7379f11c9372fbe29185c9cdc2c91a5d3f
6c50eb1689a8bbbb9210f6ef6668bde519df36e25eee96d58e557cbb91c955a4
ea13315393bc850b0579ec6af683accf97c8f895605ee5e4cbbf319854f244df
fde208c5960e8f1f04d56302661460d2b8b06a1213641c5e8fca1deecd225e1a
66a18db21f72197aae46dd69009ec87daecca0a6bf164c5a5aedb137989bb7ab
7daa9c558953925ae59529d4f71b90cfe8d36f267566e262ebe38bbb7a5bdb14
30b6d0eff4b6db2749ae420ac9707fa69e5a624165a6d362fb9b784fa22d3146
ee2d5d631ec408d84b7f858fdda98809b53a1ec933f86010d1c65a6f0bea57e4
e2d61daa23a64595b55893262ff9189ac1a8e23b22232a01132d188365867f3d
789b6981ea99b10b29cf1e7add4516891ed483f08aeb749bf4bd6cb86b43a2f9
072b9fa4db8cfa931184d293648b5c5f40f2b8f0c9aca0540159a0383af3153a
85252d2d199ca1c218556b0bb96161b65c0321f77e8f45855093d5f5d423f9e1
5f41944a6ef9348824793976717e70de818215da9d9b90c3f58cbdaf17158e1a
05f5fc2c02a6c2ecbbe5810c13291c246c3878b1392de62b61eabcf74a7ec295
5f24b7ee439fecc5a44b934d285a5d9e3eb4afed96baa4f46ddc5eb194ce4a1a

http://new.vipgoma.com/wp-admin/E5/
http://192.241.149.194/wp-includes/JAY9/
http://95.177.143.55/wp-content/X7F/
http://142.93.201.106/o0ukyxe/5a1C/
http://46.32.231.239/PHPMailer_v5.1/1k1/

Creation Time	2019-03-05	11:00:00	(XML Based - ENG - Orange/White)
SHA256:
040e88e2695080435c9155f956620cdd306fa7e27c2c3ca3523f75e22fa7060f
2579f29666e0c2740a2bd142644b9bd94d64c25aed204f7222838d8d7bbf366f
da5576a2b7461a0dfc2cbf5042e2bc4ede1881f9694a4c8c8ef1260242e1d3a6
0b852be400e08e93f5d305f1c2151ebfdd8a190392b1b8677e07bc752ec1bea1
a23d8df663c7d207d6f5777baa8518803c24564b0438050ab184e2137c6e15af
cf54aa31a0aa3112e9faa9e6b5db10b0afe5c3d955872b668ee76bb913e8b476
dde36eefbc32a7fff60413cf89cffb0d1bf9fd644370f4e0319b4559a9dd9bde
1d0533eeb2009e33f5926207d3d484f16f20e769285b2a57b10b6ea5d8d9f6fd
78d882b5d4d32ad769dd65feb5b10e5c5211ac16e0ec5b01f031c81d7b8e0529
0adc8c14fe7c27bda68e51a8b1175fa203bde158d8ab11a8bd4cd6cec0f370a3
7422d979d19480b1f1af89e1202f3b255dff6dba87f9507cdc3f4c0168547247
68ef69bad11876fbf67ebfe182edc1cd03586c2312f088cb27abbccbc7c12b8e
36cb60796fe254e786832bb20f8b87046d5c40f838b9512e632f6da84a5a3bc6
967f28049c3eb16bd4f5fc49ea7c9beb5f409b14783bfb85dbf25dcd3e73de19
bc2de87ab185a30adca43b9de34c79d7f83d3c73474172d755dbac52c61ae0fd
b95d8587d244eec64f0c62eb46f356331f9a4e2408145fd05698e847a935bb47
a99c4e7e61b71beba20d2b69787be3b0723db75e73d212f9e66d85d9762c5a43
d6f67dfc7b5c77063439481d1beae836380d80d3811bf5a0b26d8c5575ad882f
bbbc2ae045b908376601d55df86ee3c1448926a7c5492f71b0c380b5474a691f
b20d71f5b4facd3c62844447767339591084dde986f21595d6d560ced643f652
f6992e57e268e227565881886956b242904d72b6e547baf7390762f47edbd99a
80867441104bb7de6c7ff3064eceff35eaa70a11dd439db1f09d6da0edbc83e4
c302fdda05e9dd86d841e625147133e409ded66888317dba60adbdeb95f61197
b8715afaa48d1f8242108fed1a2e71d2f484863fde10dbde9fbc9f853c58b918
66bfc24d91f857bc1d9497434662011f42a4ff687f4847c38c845f317e800086
cbd17796103908fca978877429af31d16469af4ace244d60920ed3ed0c4aa0d7
78ff87c1f8b60f1b1ef4df8f2fc17560ae001f1df136f45366ba459d636ac9db
4aec5c46944a3550089c5aeff9ad171298aa11379beecafb5948b4169a0fbaa8
2bfdb9d1bb7114ab4bf7502d41e7346882b06edfd1411447fdf414211304230c
4eb06031c7cd00540f6b920ed1b793990c0faa28f3d8e1577104963a8d25e7b4
39d8e234497d584ac983c7599fda986ec8fbdd44e16a9b64ced26e65a72e8711
913b37680c037bb565dbc9d5a306700b28212edab723b1c0ee8c8f68183599a2
692191b7874c46c1268fc8865ce56b1bf0a18a3efdb23311c448f4e228a5ed5b
40509f6b4cdf5acb641ae839ac0a431ef1e2bf62dd40e6c48a4dec8426c403fa
eaba39c8b5b75fcd183cb1c2f6a678a1c2af241e2d7a1dace5bfd0d501175803
737aeba0ae9a527862a37b81eae2fc55d7fa7620a97bc6be07fb29839e0af52a
94a3bea786a12645fd32e3c8d1f4583d07594280ae9d83daeb2ed18f4c627a62
f90a0f660ca421a67fd6087878bb10036fa7dcc0cdc7f1def2486b003c6e0722
8a609f141a7fc9173b8d77430306d40a0bed79b2151dcfece3b0ade635589eb5
8a881528b9d751fca1191f7990ca31fb43d3d49a4e809c61939c0584f5b02051
e94f3ab2a7dfcb8121b0550665c68f62d466268fd2da4ea48babefa9865527f5

http://devxhub.com/wp-includes/MtywqDp9AK6N/
http://alsafwalab.com/oldfiles/LVW9MTaKwRV913fe/
http://allitlab.com/wp-includes/RX5JKbRBfBPGo7hY/
http://anapavin.ru/wp-includes/Kk1yeM4haq_KeLsB/
http://47.75.114.21:83/wp-includes/xlbLqOMKDP/

Creation Time 2019-03-04 17:00:00	(XML Based - ENG - 365 Blue Box)
SHA256:
dd84e8e565cec56715a0379dbbf41367172a87121052e627f7c3dd31e97eb710
d9c395ec2dd4b00873642c5e8eabc2faf04bd6602d03e198cc05aac15b426c25
4b124aafca0fc6c4758fbdeaa8951b19b9913864c04f5afcdd43c66693218d76
793177e23108b31070f107cd1421165f72fbb9580384060a0102d6894ad55330
907efde25ae65ee240a6c2bac962bcac7f76b4936e7e614b0d3f0d2b6dedd0e2
da37824c70ff8ca0957097f01bb21c06b874f49cf56cdbbf04e2a0a1a6a31acb
83911a083964e373df597af74791cdded2eef9a144a6bf1b25f323904153df8d
fc745a268fd087044c4df1c4e4ec1a8a7be772497bd8dcf9c9bf24063774c403
6707077fa90bec9c666a9ad69b0bdd5260ea52d7ccc0a3f829a1218850693360
ecb00a829d8203f31370e418d7f1b715f190826b1101ad535af08a924ac20594
b2cc98d45cc7b9feec5dc57989bdca9a19108fb97f1a1c833b82818cefa0183a
665f2fa3fe90167a119646473e3756c6f91c45c67e3ff6a04a839cd914ad4501
215241bd4e5528a909efee3aeb926c7a2821e20f967c10e1e4febb096f9036c3
f69a7423acae99e761c8f1a37c3d4c6f555b8388cc31881deb313e413805ccdb
3a9496e6d54ef05229ee635b66fefc6a9a0580f79681403eb6c90c6872bd9ddf
ba0dc9c63db8d786c7bb4eb62e8bbee2f5971053ca75d49759da9d15c781cbb3
b893b1cb23670ab6caf21fb585804fd06e65e2b3537aa8d62648bfe4a141f6f8
16665730602b8f7b03b1b4d59dafddb330e53663c8fba37b07fbe0750f3add5a
c37d85bf83fae25216cd9e4b11e194751bf36caa8e30dc72d47d88fb63548117
8f2984f94dc67a7381f583f865c42221964735246ee50ad9a509ff692fafb943
9f6f7871acfcdcc3b4bded0fe0dc052bb8b26f977724c6e0b0551ce43f68d4dd
b571e19fd4dd991807a9d23db3a80711333c440604203aca2f61b43c2a7064cd
7ffe0a7372ad3eb762faf6fa44ac17fc04d31170bc56bd0dfe26820f85f06d91
97a975d8757e33b245e29779155cb785927bb90c3925198a85b001725f6df997
14fc2eb6f4e3f3ffbd8aab137f6439826ddc3b1ca5e6cb6929b235cecf6acdc9
67583419c7db3be6e4b9de287848f454bb3fa995276274db8cd7d58452af2286
607241c8178bf4652ea27f356dd7ff915f11b84a70220590016729a92b245953
5414862a9e2a876becb315b91373404c37dc311ee5040d163372cce37eea8de6
082f403d682f05cb97a0338eaca60947f7a87c4a6d45125ffbab9cd036501b0c
ff996384383ff0991b46c52cbb2e501d781d1c97a4d488b45e122916fbf1701d
2f288a79baa414e16d8c7d542681a502cc638d2499bf5d48631a4b6b7e3a441e
87ebaf272068c4cfa043de242add3ac1a93d4932b20fe98bd2ec89ac3a9d4221
858f11067494354fa612b7801fed11732e0e56c43e1a4cac8a85d2d163f82ecc
29aa818e631775ff05196e9c26fe764b7b48ccc52211747a72a5907f3d407e43
1590518d57a929a0b919161b4488fcf7e5e70807244e35168a90a36148cbc59a
05210dc1bf798e624901621c112a02a903cf9ada91d27739587468867322cb6b
0c54dc4bf845d596d410a5ed35fd0891d3b29569b9c750ded775d381d3ac953e
c0ec1ee4491b0535cb00422ecc8015a2fc979c27c12e38cd83a94d65a07728c9
c0d089e54e70286ba01db5f7822003e68bb29509389570a73f76e5462a29546c
aef3290a7dfe817a30e19a5132e072b9c696e6d3630a2f4555e64441c718ead9

http://13.55.221.15/wp-content/IrcOOUj8SUv_OGCd3tek/
http://54.210.4.79/application-bkl-l/wATfVlOpiY/
http://78.207.210.11/@eaDir/qLGVp5kuazL/
http://ibakery.tungwahcsd.org/media/6XDlt0UHqkra6/
http://qnapoker.com/tmp/4lP1qLllTh/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 03/05/19 ####
```

b6a3a502707c6c2eb598314742e3207b3e463803789ef180eeca01f28e91b7a5
2de1ba0183b3d589c29525d1579a59a05913a71f5e7acf2aab19868bb260d5e9
87a37623cb2c80af8770a5b94a7574eb3f56daeaa164f12134848d7fb62ddd17
b200d1562912adbecc66ae4ecc4b374a6ff846411f73478df6d7623de3bb776b
e302565c1c9aa34882b328300e27f97876eadccf8ef6a0ebe31b0b87d3252543
d4aa05e467c32b0707315ad59053b0c8d8eb055f570983c4b89675a6bfae7fe2
61322fc168bc23d755afc643b64e52736f5fcc710943c7a4a555492d7bc307af
9e0f9a20d278e8528a5f5a50fad9c0c111eb03cd2ea6f196fb03b38b5ff0fac5
8f324f0e2dbdbfdde30a99443aff5bf1c03391cf2ae0f10a57303d5e3fd2fafe
4f70d4517f183e8bdf1bdd79f8848a0aee632dc7594e9eb49a65ee4b946f361e
7559e0efa80342e18c47291d66ebb53ac8980c98dde0188a9678f2324fbb6f54
685e7aa37b40ba0eb8d43871bc94ccafe705b6fd2062434a85df8385d33ddd1b
c6b3e28aa34324c9a6070fb177cfa6ca0d9939303a7e14f6cceff962fca38a6a
1a2281a146581b1470830fe1e9b089bf3b9ece1caf23d4d6e9fa8997b019729e
873315f1e98ce092750c7887dbac182af2d90504887212a843a01d1dfd6af381
d4afd5fbc799175d15177f241333650650de52a2cb93f389f7950bbb3a63a7de
d03a7ba2b22ec755c0b9dc683b8abed487958ec2629068c45b3202d275dcdca0
801a5510b10e20afc480f8702dfd6cee2d676d5efcc20f777b2ea74d04d061cf
27480a68b80b5515567a217f62343f98228c4b3f02bc52d77e5fdc2727071f5d
575b2b1d153fa15ab74b7b9784f281abceec903c84112fbe5dbc31bdffa51bb1
c8860960ff0c48a38c4d9d7f86629e265c6d5226e715d47a9f1ffc283889f3e1
c32b96d720cfef55e71ccf0fa31fa74bc6953fc434d7a53bb1aff1977b340d28
d45d6dc9e0c788aa78f8dd1e6e84513e38108a0bfeb2d03ca4783e46a5d341ce
0cefc8991d5219e119696c9fa5b196882f6edd30504b63597242594ceaf0c191
04323137434e2fbe440f758bcadd290c3926d4f2fd5832c89b0b331210c748c4
20b6fe62c37ffd06de6af9e7cea68c6629582fb49f22f38f10765438a9a1b53c
5e4839eed88483477bee24e52b5432ace4a53c5356f609badefb4ad5b037efcb
b4ff1b67c8c462624c08033b9c907de0348ccfb173b69b5e844e002197700364
d759222100138ce375307a0c8dcffd775dd52b7a71612b2ab9e9aff8e2591fe7
bead134bbeb81f51e2615d4e75deadd4be95ae8c932039f832c140e5c8cdffde
5773efde42d3c0f26b87af2b75463a8727d2730566a3729df272e65645de3f38
57def4c9edd170c805969a315812964b098ea81e07247c07daf3d9d62e263014
d86aa0a6cd5e50ebd3129a2db4bda1a8011b8cd1e6b753ce8cb19b877f927b71
5f6b321d01bdafc970ec0868b252de7a418be1c904450f736816ea477a84370f
62de0684eeffeadd03a8dbeb3ec4bfde4fedaea4ac48e9f14cf66a7a068f0881
7268e2e4f4299c8d5603b197a63563a1664d35ac2cd8e76029415cf831f1cd4c
34f549d4693afbd9b2386bf7f392b6bc3a6d449c52e9b9d0d5fa2259f372c817
a99c15476c8d320b69ea24af8545c45ec83d4466f996bb716f37606ccc6922ec
ed5310fc8c0e52cc9af3de9322c03acf8b787ab52c87031b5412529665d433c9
c27edc76bde4cfab073aa913bb97ee05ad707bbff9ad788b15065924591fed0d
d73d008cf3b82e98b9de1062927165f47c1bb632278d0b01caa6a636167e9174
752821a43701a4d4c8101c5f6c9ba8b4860a5b6d362eb828f878760a76c45895
a56fd3511c7213642b53288895aa7f2017b2b61ea7164b10419a2313b04d6839
44c81203fc2b7eac147ca834c6f64231dd61879c799476663b95f2c39feb8432
0a4962325cf05ea602081647da910866d0d747abbb5d3340dfa721cdd93e9ba5
482d336698634d06de023e0758d37a2580ade59c3d6f8c43d4b3a37d1e2fafe0
df0e7b573581dbf638f4b876a6c6ffcff31eeb18e0f7b9d234ec58fe5987e6c2
9be632e4009ee1c04ebf4918fc49553e4fe71e99fbfaea85ba0d3b494de439ed
f1782080242741a0c01d36a30457f93e1ecb659e4a9713b297f060c59a396de8
04c4d3c7a10ff683bd32a66ef1ebd3a7babd5ec8d7f4a13a982497a4df7d554d
08f6ce2c3cfd91c0305d1c791da63dc97da59b1ac05cac41dfff5962eb4fcbe2
67517d748a28e2003b8a9469b10204162a25524fed916e4e03296722a30204ad
57a929495200fa90ff5f4542437069874e18f001610607d87600f57d144a3df0
b14358c5ead4b500b1065f96eff18a0449cb69efe512993db6ded68f65cff5b0
b241e5b6600c70ff7d339b0c6179fa90d61ddbbb741a3bf9210dd1ea833fb47b
b2e86acb9090ca0bd6cab0f5b5b58b425d4abfe182c24d4d50813557b1d08398
00f76b1476a7a23651d8ccc0d907beb2bc7ecc9d901d98f612e931b832594e2e
217f808cad5b7035ffad8670515f60fd635bbb90d068253d4b01a79168df3e76
4e0c3974c8ef3dc5fd46494980e24a65f0a22e5fbc65990c27603aa099bc0501
12979fda5f01950208540772bb55c4cafae4f517d2e5cf21afb2a81f782860b3
e0e0fceaddbb9c5a0668365b5b0c6e1d55c5c55dd904936f0735e35dc083cb9c
13d2db6d55a0e8fa1dd8ab55fd3cf2c2cd5c930d393fe37fc0f68e4ab2606a2e
550e87efb37e5335fe4728c761564554fba200a8e46c343ef887f4be361c5ed2
d99b621425fe96e46cc46537fea67c719d84f0334c302588d07ff81e3c739b35
cb02dcffeb6a4a1cea9cb72dac862be75238908de9251591510cfcda06cac4be

```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
138.68.139.199:443
143.0.245.169:8080
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
173.248.147.186:80
173.94.53.3:8080
181.29.214.233:8080
181.56.165.97:53
184.161.177.223:8080
185.86.148.222:8080
186.103.141.250:20
186.137.133.132:8080
186.138.205.189:80
186.23.186.99:443
186.96.198.72:990
189.188.140.179:995
189.208.239.98:443
190.111.215.2:80
190.144.66.30:8080
190.171.105.158:7080
190.188.207.72:443
192.155.90.90:7080
192.163.199.254:8080
200.55.136.2:443
201.184.224.178:80
201.213.72.74:8090
201.251.12.153:80
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
219.94.254.93:8080
23.254.203.51:8080
41.60.202.26:22
5.9.128.163:8080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.28.3.120:7080
72.47.248.48:8080
73.115.132.124:80
74.56.155.43:993
85.105.205.77:8080
85.105.215.241:20
92.48.118.27:8080
95.44.198.249:20

```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
181.168.129.146:80
189.159.195.202:995
190.147.23.76:80
47.180.177.96:80
50.116.63.9:7080
70.44.163.160:443
73.14.76.77:20
81.168.92.58:443

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

103.107.27.129:80
103.224.157.244:443
103.53.44.20:80
108.58.73.115:22
110.93.230.101:990
111.91.71.164:443
117.218.17.6:443
118.32.221.23:443
133.242.164.31:7080
138.201.140.110:8080
147.135.210.39:8080
153.121.36.202:7080
167.114.210.191:8080
173.21.116.239:80
173.255.196.209:8080
173.255.250.241:443
178.62.37.188:443
181.140.37.228:993
181.175.60.255:990
182.184.72.199:53
186.71.61.92:53
190.47.158.127:8080
200.116.70.135:80
200.125.28.214:8080
201.231.209.16:443
208.78.100.202:8080
209.217.209.214:443
209.217.209.214:80
211.115.111.19:443
217.13.106.160:7080
217.165.127.223:443
41.87.168.158:443
42.115.105.246:7080
45.123.3.54:443
45.63.17.206:8080
5.230.147.179:8080
50.31.0.160:8080
59.103.164.174:80
60.254.45.78:443
62.75.187.192:8080
62.75.191.231:8080
64.17.83.46:80
67.205.149.117:443
69.198.17.7:8080
71.224.174.17:80
71.91.105.254:80
75.149.91.249:8080
78.188.105.159:21
80.167.67.247:80
83.222.124.62:8080
87.106.210.123:80
94.76.200.114:8080
96.20.94.194:8090
97.123.191.36:20

```
#### Epoch 2 - Spam/Stealer C2s ####
```

183.82.123.254:80
198.58.114.91:4143
213.136.86.219:7080
37.209.252.79:80
64.228.72.40:8090
67.202.178.142:443
78.149.210.211:22

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/05/2019)It has been awhile since I refreshed this section so I wanted to update it and bring it up to date.

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of payload
updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications. Epoch 1 is
currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more rapidly changing version
of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period. This seems to change back and forth
over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen to move bots from one to the other and show similar
behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same time period. Here are some observations I have noted since I have
been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an Epoch 2
document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those being delivered
in maldocs on Epoch 2 at any time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key.
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://pastebin.com/X2gzLHCz - @James_inthe_box
https://otx.alienvault.com/pulse/5c7f0a9ba4f08169aed7ebcc/ - @SecSome
https://pastebin.com/hewVqBTh - @pollo290987

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial
@shotgunner101, @HerbieZimmerman, @Outkast_TI

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial,
@OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Today was a more medium volume day for malspam. Nearly 145 and about 25% was dir DOC attachment based with a few PDFs mixed in.
The PDFs were just for URI links inside to download the maldocs and still nothing malicious. Most of the Malspam was from E1 but the PDFs were
E2. I did have some Spanish based malspam in the morning with attachments and then more in the late afternoon with the same circumstance.

Most of the templates were just typical Invoice Due garbage. The bodies were very simple. A good portion of the Spanish messages had
attachments for some reason. I did get a Bank Account Has been Suspended PDF also.

Spanish Message Subjects are:

Spoofed Full Name Mercancía: invoice FA0966_0
Recordatorio: Factura FA07744_0 de Spoofed Full Name

The lion's share though was the SendInc template that has been in use for a few weeks now. A good deal of the From addresses were
once again listed as the following:

secure@sendinc.net
secure_message@sendinc.net

They had subject favorites like:

[Encryption Email] Re: New Invoice from  V135332
[Encryption Email] Re: Open Invoice from  ZJ3572723
[Encryption Email] Re: Overdue invoice from Spoofed Full Name
(Encryption Message) Re: Correct invoice  117829
(Encryption Message) Re: Invoice due  172350
(Encryption Message) Re: Reminder : invoice
(Secure Email) Re: Open Invoice from Spoofed Full Name
[Secure Message] Re: Correct invoice
(Secure Message) Re: Invoice from Spoofed Full Name GS3852
[Secure Message] Re: New Invoice  P164282
(Secure Message) Re: Open Invoice from Spoofed Full Name
[Secure Message] Re: Week invoice from Spoofed Full Name CD253443

They were all link based. You get the idea.

@MalwareTechBlog had posted an example earlier today here:

https://twitter.com/MalwareTechBlog/status/1102979312293040133

For me the malspam started at about 03:55 EST and heaviest at 07:45 until about 09:15. Some minor spamming around 14:00-16:30 to end
the day.

All docs were XML based again and there were more payload sets today. 3 new ones on each which is more normal.

E1 C2s changed and combos decreased from 48 combos to 47. - Recorded above.
E2 C2s changed and combos increased from 52 combos to 54. - Recorded above.

Keys did not change, we seem over due for a change.

Updated what is Epoch 1 and Epoch 2 section above.

For more FUn from the crime syndacate that keeps on giving tune in tomorrow to the Emotet gang.  TT

```
#### Sandbox 03/05/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-03-05 at 05:15 UTC - https://cape.contextis.com/analysis/42802/

```

```

Epoch 2 C2 run on 2019-03-05 at 05:15 UTC - https://cape.contextis.com/analysis/42803/


```