Emotet Malware IoCs 11/29/18

## Emotet Malware Document links/IOCs for 11/29/18 as of 11/29/18 23:59 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 11/29/18 ####
```
http://0539wp.ewok.cl/wp-admin/images/En/CyberMonday2018/
http://5.u0148466.z8.ru/En/Clients_Coupons/
http://715715.ru/En/CyberMonday/
http://acumenpackaging.com/EN/Coupons/
http://adrite.com/EN/CyberMonday2018/
http://aglayalegal.com/EN/CM2018-COUPONS/
http://alexzstroy.ru/En/CyberMonday2018/
http://ambiance.selworthydev4.com/EN/CM2018/
http://animalrescueis.us/En/CM2018/
http://annefrankrealschule.de/EN/Clients_CM_Coupons/
http://annlilfrolov.dk/En/CM2018/
http://aol.thewirawan.com/En/Clients_CM_Coupons/
http://ard-drive.co.uk/En/CyberMonday2018/
http://artst12345.nichost.ru/En/Clients_Coupons/
http://barbararinella.com/EN/CyberMonday2018/
http://bemsar.tevci.org/wp-content/EN/CM2018-COUPONS/
http://beritanegeri.info/EN/CyberMonday/
http://bestgrafic.eu/En/Clients_CyberMonday_Coupons/
http://bisgrafic.com/EN/Clients_CyberMonday_Coupons/
http://biswasnetai.com/EN/CyberMonday2018/
http://blogs.dentalface.ru/En/Clients_Coupons/
http://carpinventosa.pt/En/CM2018/
http://christmasatredeemer.org/En/Coupons/
http://corporate.landlautomotive.co.uk/EN/CyberMonday2018/
http://dat24h.vip/EN/CyberMonday/
http://dharmadesk.com/En/CyberMonday2018/
http://drraminfarahmand.com/En/Clients_CyberMonday_Coupons/
http://eco-pur.iknwb.com/wp-content/EN/Clients_Coupons/
http://en.worthfind.com/En/Clients_Coupons/
http://evaxinh.edu.vn/En/CyberMonday/
http://exeterpremedia.com/EN/Coupons/
http://fishingbigstore.com/addons/EN/CyberMonday2018/
http://ghassansugar.com/En/CM2018/
http://g-steel.ru/En/CM2018/
http://hospitality-industry.com/EN/Clients_CyberMonday_Coupons/
http://iantdbrasil.com.br/En/Clients_Coupons/
http://ilovestyle.be/En/Coupons/
http://intranet.champagne-clerambault.com/EN/CyberMonday/
http://izsiztiroidektomi.com/EN/CM2018/
http://jurabek.uz/sites/all/En/Clients_CyberMonday_Coupons/
http://kroisospennanen.fi/En/CyberMonday2018/
http://lalaparadise.com/EN/Clients_CyberMonday_Coupons/
http://lawindenver.com/EN/CM2018/
http://link2u.nl/En/Clients_CyberMonday_Coupons/
http://littlesmasher.com/EN/CM2018/
http://ludylegal.ru/EN/CyberMonday/
http://maravilhapremoldados.com.br/EN/Coupons/
http://mediaglobe.jp/EN/CM2018-COUPONS/
http://melted.org/En/CyberMonday/
http://merriaminsurance.com/EN/CM2018/
http://mexathermal.co.uk/EN/CyberMonday2018/
http://mezzemedia.com.au/En/Clients_CyberMonday_Coupons/
http://miamijouvert.com/En/Clients_CyberMonday_Coupons/
http://mikeryon.com/En/CM2018-COUPONS/
http://mireiatorrent.com/EN/CyberMonday/
http://mnatura.com/EN/CyberMonday/
http://montrosecounselingcenter.org/EN/Clients_CM_Coupons/
http://moosvi.com/En/CyberMonday2018/
http://myunlock.net/EN/CM2018/
http://nexzus.com/EN/Clients_CM_Coupons/
http://ngengifurnitures.co.ke/En/CyberMonday/
http://nicklaslj.se/En/Clients_CM_Coupons/
http://niteccorp.com/En/Coupons/
http://nkadvocates.com/EN/Clients_CM_Coupons/
http://notionview.co/EN/CM2018-COUPONS/
http://nuagelab.com/EN/CM2018-COUPONS/
http://ohiovarsity.com/EN/Clients_Coupons/
http://omartinez.com/EN/Clients_CyberMonday_Coupons/
http://omegagoodwin.com/En/CyberMonday2018/
http://organic-planet.net/En/Clients_Coupons/
http://pagan.es/En/Clients_CM_Coupons/
http://pcgestion.com/En/Clients_CM_Coupons/
http://perthblitz.com/EN/CyberMonday2018/
http://piaskowy.net/EN/CM2018-COUPONS/
http://prakritibandhu.org/832911NIWNHOK/EN/CyberMonday/
http://qualigifts.com/En/Clients_Coupons/
http://racorp.com.br/EN/Clients_CM_Coupons/
http://ravenrivermedia.com/En/CM2018/
http://ravesolutions.nl/En/CyberMonday/
http://ruslanberlin.com/EN/Clients_CM_Coupons/
http://s18501.p519.sites.pressdns.com/EN/CM2018/
http://shannonmolloy.com/En/CyberMonday2018/
http://siteme.com/En/Clients_CM_Coupons/
http://soton-avocat.com/EN/CyberMonday/
http://stickerzone.eu/EN/Clients_CyberMonday_Coupons/
http://student.spsbv.cz/giricova.el15b/wordpress/wp-includes/En/Clients_CyberMonday_Coupons/
http://systematicsarl.com/En/CyberMonday2018/
http://tabb.ro/En/CM2018/
http://tande.jp/En/Clients_CyberMonday_Coupons/
http://telovox.com/En/Clients_CM_Coupons/
http://thelitts.net/En/Clients_CyberMonday_Coupons/
http://timohermsen.nl/EN/CyberMonday2018/
http://tom11.com/EN/CyberMonday2018/
http://tom-steed.com/En/CyberMonday/
http://tumbleweedlabs.com/En/CyberMonday2018/
http://turulawfirm.com/EN/Clients_CyberMonday_Coupons/
http://twilm.com/EN/CyberMonday/
http://ultrapureinc.com/EN/CyberMonday/
http://ulushaber.com/EN/Clients_CM_Coupons/
http://warzonesecure.com/EN/Clients_Coupons/
http://wpthemes.com/EN/Clients_CyberMonday_Coupons/
http://www.anink.net/EN/CyberMonday2018/
http://www.biswasnetai.com/EN/CyberMonday2018/
http://www.fhinmobiliaria.cl/EN/Clients_Coupons/
http://www.getrich.cash/wp-content/EN/CM2018-COUPONS/
http://www.ludylegal.ru/EN/CyberMonday/
http://www.nwdc.com/EN/Clients_Coupons/
http://www.potens.ru/En/Clients_CyberMonday_Coupons/
http://www.soton-avocat.com/EN/CyberMonday/
http://www.spa-mikser.ru/EN/Coupons/
http://www.weloveanimals.net/En/Clients_Coupons/
http://xadrezgigante.com.br/EN/CM2018/
http://zh-meding.com/EN/Clients_CyberMonday_Coupons/
https://fishingbigstore.com/addons/EN/CyberMonday2018/
https://support.volkerstevin.ca/servlet/HdFileDownloadServlet?module=Request&ID=42467&KEY=2D48D02F-3A6C-4F71-9C03-95B8B6B39F01&delete=false/


```
#### Epoch 2 Document/Downloader links seen for 11/29/18 ####
```

http://2d73.ru/files/DE_de/DETAILS/IhreRechnung-MPO-23-91687/
http://923oak.com/sites/EN_en/Service-Invoice/
http://acupuncturecanberra.com/newsletter/En/Invoice-Number-92090/
http://admonpc-ayapel.com.co/doc/En/Invoice/
http://adrite.com/files/En_us/Sales-Invoice/
http://aist-it.com/DOC/En_us/Invoices-Overdue/
http://albertandyork.com/newsletter/EN_en/Scan/
http://alexzstroy.ru/files/En/Summit-Companies-Invoice-07675315/
http://animalrescueis.us/xerox/En/Important-Please-Read/
http://artebru.com/Document/EN_en/Summit-Companies-Invoice-38363359/
http://arzpardakht.com/Corporation/En/Invoices-Overdue/
http://bdeanconstruction.com/362004FPVH/biz/Smallbusiness/
http://beluy-veter.ru/47694UUV/PAYMENT/Smallbusiness/
http://bestautolenders.com/default/Rechnungs-Details/RECHNUNG/RechnungScan-ZHP-56-51422/
http://billandroger.com/6Ms0BMgOUrKsprM/SWIFT/IhreSparkasse/
http://body90.com/doc/Rechnungs-Details/RECHNUNG/Rechnung-fur-Zahlung-OR-18-76752/
http://bookyogatrip.com/66OF/SWIFT/Commercial/
http://brandsecret.net/doc/Rechnungs-Details/DOC-Dokument/Details-PEG-25-43182/
http://bzztcommunicatie.nl/Nov2018/Rech/Hilfestellung/Rechnungskorrektur-MOM-46-15565/
http://callandersonvb.com/files/Rechnungskorrektur/Zahlungserinnerung/in-Rechnung-gestellt-ZJW-66-90983/
http://cooprodusw.cluster005.ovh.net/Corporation/En_us/Scan/
http://delphinum.com/6112Z/SEP/Commercial/
http://dewide.com.br/52389TFB/oamo/US/
http://divelop.nl/p1tugEEgLDCMrEE6/SEPA/Privatkunden/
http://djwesz.nl/wp-admin/doc/Rechnung/Zahlung/Hilfestellung-zu-Ihrer-Rechnung-TD-52-51926/
http://drcarrico.com.br/files/US_us/Invoices-attached/
http://duncanllc.com/3598OQSXEA/BIZ/Commercial/
http://dwellingplace.tv/doc/Scan/Rechnungsanschrift/Rechnung-fur-Dienstleistungen-QX-61-43869/
http://ebayaffiliatewoocommerce.templategaga.com/6001203EXJMLQU/PAY/Commercial/
http://en.avtoprommarket.ru/Document/En_us/Open-Past-Due-Orders/
http://goomark.com.br/default/Rechnungs-docs/Fakturierung/RechnungsDetails-OGM-46-34540/
http://greenplastic.com/FILE/US/Invoice-Number-73617/
http://ipaw.ca/8SFUJKW/PAYMENT/Commercial/
http://ismandanismanlik.com/0869BXP/WIRE/Commercial/
http://jimyn.com/49793FYK/PAY/US/
http://jsplivenews.com/wp-admin/297028KAJST/oamo/Business/
http://kenshelton.com/298862WRSKLGFX/PAY/US/
http://kevindcarr.com/0GXMPKI/BIZ/Personal/
http://lunixes.myjino.ru/41RUC/PAYMENT/US/
http://maipiu.com.ar/INFO/EN_en/Past-Due-Invoices/
http://mcbusaccel.com/FILE/En_us/Question/
http://miracle-house.ru/xerox/EN_en/Summit-Companies-Invoice-50143566/
http://msconstruin.com/newsletter/En_us/Past-Due-Invoice/
http://narin.com.br/default/US_us/Need-to-send-the-attachment/
http://neilscatering.com/Document/En/Outstanding-Invoices/
http://pcmindustries.com/xerox/EN_en/Document-needed/
http://pohe.co.nz/Nov2018/En/216-94-321060-766-216-94-321060-198/
http://poows.com.br/Nov2018/En_us/Outstanding-Invoices/
http://popmedia.es/default/US/Open-invoices/
http://projectonepublishing.co.uk/DOC/EN_en/Scan/
http://radiotaxilaguna.com/files/En/Need-to-send-the-attachment/
http://rebobine.com.br/Download/US_us/Service-Report-88539/
http://rectificadoscarrion.com/LLC/US_us/Service-Invoice/
http://ridersa.co.za/sites/En_us/Invoice-7860794-November/
http://robwalls.com/newsletter/En_us/Overdue-payment/
http://s18501.p519.sites.pressdns.com/default/EN_en/Invoice-Corrections-for-86/46/
http://sandbox.leadseven.com/528BAXUXSNF/PAYMENT/Business/
http://sindia.co.in/buxiUN9LHl/de_DE/Firmenkunden/
http://sitemap.skybox1.com/xerox/En/Scan/
http://swimupstream.us/newsletter/US_us/Document-needed/
http://terrats.biz/default/US_us/ACH-form/
http://tomorrowsroundtable.com/files/US/Open-Past-Due-Orders/
http://tonycookdesigner.co.uk/doc/EN_en/Invoice-for-you/
http://traffikmedia.co.uk/FILE/En/Need-to-send-the-attachment/
http://venturemeets.com/wp-content/sites/US/Service-Invoice/
http://wessexproductions.co.uk/FILE/EN_en/Question/
http://willyshatsandcraftllc.com/default/Bestellungen/Zahlungserinnerung/Rechnung-fur-Zahlung-YU-74-56369/
http://www.beluy-veter.ru/47694UUV/PAYMENT/Smallbusiness/
http://www.popmedia.es/default/US/Open-invoices/
http://www.rushdirect.net/sites/Scan/Rechnungsanschrift/Ihre-Rechnung-FO-87-61168/
http://www.standart-uk.ru/files/GER/DOC/Rechnungszahlung-LJE-56-49726/
https://customedia.es/0API/BIZ/Personal/
https://divelop.nl/p1tugEEgLDCMrEE6/SEPA/Privatkunden/
https://u6324807.ct.sendgrid.net/wf/click?upn=c-2BRB98m73FhIst4xX6N7HyOIzKNDcGzyZwWv8B8us-2Bp4-2BVfGSlWtgBfSdBm-2FI1hSVjPcFlG6IiToO6W-2BsmYklA-3D-3D_mPjhUx-2BYnzRIHErlPE819USCyZx5ZNNkibyFZyqzBNDBT3cyS0ag5RTgnjkF57JNrgz-2FeTwMC9UO-2BEN6CMGEcAnP-2Fp-2Bix-2BiUhYjCzRlGo-2FjKcj4RbPwL-2BduN7qaD49dsaXozLlzWmpKUbRMfuyxhfLSNxkfJG6QRVlFZ2S0MlRK3Qpt57QjH-2F9e4k7-2Ft-2FTRzWCnOldOgBZUma5oF41ZHZB8UJjMFmukGdM-2BUBUn3rPA-3D/
https://www.vdvlugt.org/newsletter/En_us/Overdue-payment/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-29 19:59:00
SHA256:
5771afc72dbfa0c3dbdc1b9ae00eca3e4a73310362f95431bf16761c77baffa2
4819ce39980e4401a1ddb04d95f473f32dbd65634b6708ae08e994095cb7a1fd
0a74a0d005a3302d8a163418e4230c27b440513d92fb48016203a1c0943372eb
b328e54a5c09c66f1ea22b8f57caa55d209932906dab7d26fcea36318d7a5a7b
e45380976881690306eda1a67298f69976992c82a5e07a19cf36198ebaded26f
99fe0a8026b18155e7f51d95702befd6107afedc3d025c12283e84105ce947f5
212b1e9b081302509810dc6e001bcfdf090eb5cfa4a78807e53037e1c15cf541
e480655bcf96ffe3189605607daa1167a1a9303dedf515a84992a74916c71bd0
755370efe90de442adf6f3998792e8238be1aaca88ad4f25cb05161294a88ac7
39eac99ca6b533d59d8220114647760f44d5bb0c7a6bf597f8171e975ed2d87b
b4033f3f4620675a74913758e494ba6af14f99f60cafb805413762dc3d47d337
e822e44319949186286f4c43f81fe69a113553a6e81c18f19488603bbcecbd13
8b48d516d4164553b74c156c42461e49f62c4a923f0ae9f7bf04de74991c947c
481a9d7955b1c011aa9ee26a9c78685b458d67eaf519bbada1b6b0f81a4a31c6
9ad00475fa74215419981a47b21a776944f2bc4a6a330daf140481682ba84796
db7735ce88088fa4207cc05746fac84522790f7a5df5aa08d1751b661c7f0e2b
bafb152079e5a0c4709e961a6258f0390922d7a96f32616f06ef35fdb6467210
63f8826fe8ff24c1ad91265714fe0d6e9aa486bc6079bf674e0b69edbbe739c8
49eb43e0155563289c0a835305724e26606f6b5f9defc7feed75c5931220b193
61dd98d15387444e1ae49b97540de88951ad9eb3f970ab62def057c92911867f
7102877d70ad54f07bdb5baa4c9a995962b6c7b93b10455b1c118a40954dcd22
c7f540b7667722d8ef6f962eec154671ebdf7e156104f6b830c9a3ecc29efe7a
6488e877c6b6e8a20f44b90d23ddfc53363f443530969ec1927269c2e5c84644
c3ec370f42fc7caa0bc784de54aae32fee4d869ac42cf75c8b42631cc5dd30a2
132b91529a30ec3bb78e13c56b25c41f9cdaae7852feb52b74914f904f190e46
d935b68ef229e3fa9cec85ef442cb8875aed729e5dc5272fbfe1d822e3575524

http://tunerg.com/eygUEU2A9
http://camelliia.com/Futu3fgt
http://triton.fi/Bz4pEqDQw
http://intranet.champagne-clerambault.com/NjmYMSA
http://tecnogestiopenedes.es/ewBNnYs1l

Creation Time	2018-11-29 14:01:00
SHA256:
087e01b5b6edc3a11118eac9a5cf46e2daebd72c0ef9c2d58d8d410be82aa3ca
d22178dd6e4d3919925e0e7d6c87a5901a998ab640a9da2938a4f82205ffa4aa
709df640d4e5c37cba49471eeac34ee4c210dcbdb5e505f0ef4d674a0b89480f
38a2f5371165ceb97f5b98b77c453aa0112ef545dd99b448ab02094e22b9b8be
7d2fcdf937846f5f7c8a2c1f4f893fcff0ea13194e00b91395543c3c4b008e6b
bdc998c268eaf0ff6c3e9d895a1a232a663896c0f7dcf133f215299c6c733e09
73b1487c98bd757b2c7f08434379eebe16d732bb64bf4852c67ce3b72493fafb
c5a221f1e12a02437f734d89b8e024501d041507be71da22a252b42a2df7d9e0
1521923f1180cc3df8c4e59f983ade853e2031986b3918e8aad6cf2ad6d6ad86
5f63aac7a4343d27a4b47387a2da4d7186d79a9a3429dc5273f42847a7b3755b
94be099e60d391054ad11e072de3420d628d8214305f5767a18c5e73b532066d
d7da0c67b18f2e88d111c4962146dbb7539d9ba412459ff5a02afe5dad61401a
0bfb031ed6199783343838a4a604d5231a53f868b28c711ebf76329a1e8d7f83
642f25c5a1cb40f4ae23be503d876e1acd0fef051e6098a4b97ed5b00fc44b38
502d2aefea387fc28ed5fc4e2fa53a2aa89f725077214145dc99d8ad958d384b
ebd6199abf4b107c32001d6e7cb5761e5cd6e734581bf1c62ee7954065ac6276
88a8c969a2e6b4abb43ec45ef39bf5d90da81f041222be8bcc21a163390e5003
41a9c394784d4d4e4005222d3b8e3edde4f1575c82a802f485c01ce568278e01
b103d07af621bd243ae60e6cb8aba407c1e855faa49bf1d39673296f4ff601cf
f7ca4dadba0c15887442bc7d5adeb09af49804f795291fd944ea48109b3d31c2
78f5478fac633a6a4467dab1cfdff7cb14c1fde90b4dd39ece78ef0df0fda540
90ec7aab789b40257ffb0f94c60e8fc488432cff9a69fd220582a68d0aa4bf31
99b7fbbb4a2ea3077fd25efa46fc12800c581db138fdc822af0c4560a03764cd
f4236ed085600bf0816f83f675b6e4a79cd140e40906ab9d2596a7c6f84c9f9b
831f3b7598342d0c9b8cf851cc1c34861c56e1186026303fe75ca229021304e6
c749c130dd92941a638b95641dd31238028b1b9a5ec9a017b7185084ad4d99f6
72c6bda647e993f30305ffa98b464941cdfe240607bce1b622db88f6368ea024
85c34b37e487d25cda5bc5733f9e399a3ad25cd972d7e5a6f7b2183121871bc8
cc4fc7eb16bbbc4e789fb2f1f71184e9e1c86b4cb5d6b261895e1992207947aa
4147904afbb761cc01588fc349f3603b8958a50cb564f5bfccefadf3cb18b021
224e6f5fc5d36819658175e0feb05a9d026590935a38d4e493e10c13dc67419e
214213813d4d7115638f1c97c2fd149990d9c4c64dd9df321d824ef30b2da1e0
a6004ccb9235cb04a0c1bdd6dfaa2956e534bf9a8868c77f27fa79f583adb68d

http://rabinovicionline.com/GWBhWrqx0
http://reflectionpress.com/mm7GGS7ie
http://tccrennes.fr/n7KoD5DB5W
http://sevensites.es/NhG0JMO
http://symbisystems.com/PL9qSNRM6

Creation Time	2018-11-29 12:20:00
SHA256:
77fd8d158be78694378644782e185fef876628629b39cea62bb4f4d1e4789af4
ce1c189a1176cefeb7c7674600247016d5ce3c209f6c04959adf0ff9956f3920
dc0a4dd8a890ba155b585d2ac1044a978ee52d8786462936df08a23b110e0b13
8a984ff18b3642638fd3f624872c1f18da890919eab1beb639be543cc4643fde
02dfeb7ab7dd3c864d6fc2dd24249ac471f6891f4cfbb5c48c53d99454c8e420
ce2a59952ff7e16807d891c85f68005b8309070e93e66932e595ea5f5ea469aa
75d1d2079d169893ee3f73f0fee5dc62a7d7d088226501f3208645d80ef4c3df
2e81d6b820ce6bd6fc972ab88e13c3e4b60af5df42daaa2a911b9301a59c184f
d4fe65f343d34605434bb3d14ba0b9fb1db6369f3b503853760695999d3ff95a
6c9701f48f40734e048b60537898e48d5bc051efe37f6f7725d6f22fc350df3f
302d111df88971a8852fad6dcfc4463c0ee7cbddd465ac127c0702c59d2757cb

http://marewakefield.com/BWQeMskFp
http://marineboyz.com/GTZeEsRqi
http://michaelmillman.com/rVhfp9El
http://mcfunkypants.com/gqO25LS89k
http://magicalmindsstudio.com/OSx1mXXF

Creation Time	2018-11-29 07:17:00
SHA256:
c264c24c5883032fbaf5ffaef6d2019239bfe5bc7e9794f80e08de4f1cc0a06b
5aecd6626c504962738ff2ce6afd3ae21aa59c2cc8e125d7a70a3266a29ed450
8a3dfb7fa142536d8a3fbf69c93c68dccb0f02846081d2bbafa9650af95635b8
ead8066f40130213ababa7aaf141414ef7dd5b7ffa644758c1e9cdeb504edb65
9f12742aaed4afca095767d57f3e6fb6f972019febd3afdc0e9d8263e7e37b4c
34445551d8f56de7e6cebb1e709b626d69530b59a5c75c4a193c8520bdd6d8b3
b48b8151cccb6efda678bd62faf1cc005de4347b0db0e0e4010994a267daf771
e2a5dae490e57086323dd5aeb0469ee2a3800f8ea4bbdd62c101edf62881a38e
aef352b338ec165156c57569386f24e9c90e82eb2ee9a4b8fe72500cb00f6e54
6169d1941bcd68853b49219ac28f0fadaf5cb2ad216f67849105f4536f69d9a0
3644c5ff8498ab5d5e11443f2b00c7df7dc163064e58d24fc7c926d2b026019f
db72dd3bb9ea43659a6bb7c714fdd85a6141e685ae0967e90e8627d1ae029280
4205b4222639412e9667e49e923a5df097e4ede5909e1a3ecf320e6124898ea7
8c37e7de534661c54c078f5cefdf30dfb446937d3a038512fb8849adba00c635
cff4e8492d23559105300d570dea8062134fc6867c111cac226c0091899da1ac
722a8015415f9b58b682515d4e2ae797c02a1046ebd7935d0347c4c29acb3530
e65f9da0cd22fef12ff08150025c0b1cd264a2584454807440941e36ed73696d
b56fccbb1d234b713c5b69d13405c6e041592a8f1f220a9104547fe6fe1d5391
73aa89ffc8dd1efe4cdc14cc2d490ec27cb55ffa76deaed64fba689ae60de6bf
37e61b37bcea5f47bb8cc3b300f1fd7f54b4473c3a8610ded59b298cdf163fc5
daabd70418d276767c8fa3437d83a1caca1d555884d13c8c76eb2234208dd939
b9dfeb978eba06ff45753978fd77a8d32c3340adf80b3ae723d2336be62b565c
24bef8a3a1cee1e9548b1e0beb9dd0ee9f43734128d1c2b6a05b2e3df955c18c
d7ddeceb6ed14a18327b08135e5f77da101e09de75e2da8dc1bf495c8512aa5d
4df7f83ded6efaf5fd6696ea64cdd5095734526b177ba3ae3c01cbcc1ddee3de
62deb39287de2cec6f666e4a3ba8712e7c63d52a24f044a97bb591171f36dc17
1d232f3c4136f79ae8d348b506e02d60329c3b37a1e0204f69ae7b00d624e63b
81a5e85c8a26c6620c35142774e8536ec7133fabedd1acf574707ad7c54840b0

http://dkeventmarketing.com/3M7oxT7
http://1000lostchildren.com/9JtlJJV
http://cybernicity.com/63jvP6YgU
http://norcalfoodies.com/qWlvKs7c
http://www.treasuresiseek.com/RzTwNBNpqn

Creation Time	2018-11-28 18:53:00
SHA256:
60b476d7c315f53d241abaa61fbd8fd8330079287874c67e076dd190ecd2a45d
57bdfd0d35a28e126912f3938b263be4b76f70c5937c4e0096c48529e8933494
2b9708ab40d7258c07d239e5f990c24f7961d9a2b976e9e7d75784d8fa59529d
1003af2e9037aa6b9e4445db69d0fc25efa1101ac39f9a001bcffe20474cd0f0
a8b1676b1ea846c6db6f417d3db3a8edc6528e63b9036061d9b48011312b1766
e59336bd89fa0feb5f90e1a03437e13d8d30e491d1a3aeaa0d49e5917ee33907
0760a8f38da649d140a6b9e45e27a1a4282bdb224c57b63534958517c53bf744
67450884d2888c2a95a3f37b75727f9ded92307eb4567da59c19e707ca2f7c3e
e61a5ea32d75a7fa934724802d3577f8ea2a535e4210735f32d2236b09a0d40d
0c5330f8788fe693abe7b0fc4399039d5fc19d5d03ac04479edc0951ded13658
a6019b434836d2d6b76d197928a565d130452d0687623250737668cf663a73e5
fe194df78bfdd9d71ec0e0d35469446831741a7ddba69e62dd217a27946b7010
87f2808da698efd7606556429bcadd5da85f52130affc747f537f9c5d9c35ad1
561a3a5269e77e0789555a8791fe2d0b51f4e43607fc58ad02c60cf3aad8b5e1
e2e6631e2a244973f067e54428e355c5c5bc1d29dfc158464f4c229e92db33d1
3868c51b316804b167758c63436b83d9d9a04bcefaec0dcb1ae1f3b76c188beb
4e56a0f0981eb01c8e38d5a2fdf68a87c352391b80a04086dc5523e64b33725c
827f677f0525c6f6db13c8c2b9c0bb8b030e141ec28792d67e8b62fda46ee7a7
05ec329ef9368a7e00c250d9acbad63ef5a2eedb024ef73785502d548952ed33
f215698262264822540c81b6a1626fcc1caef22aea78a1cf2f4254962b2ca795
380d8f4853dd162e233a42ff2258531237bae388af31ed15de509465eb841ebf
05b2a541ab2dc3b35a1907ac695f92ca50fdf7011f303c34c53e8de893d3366d
60b476d7c315f53d241abaa61fbd8fd8330079287874c67e076dd190ecd2a45d
fadb738630eaf7b0c85eddfc50aadc115a069a8e0b00372ce35098d21f909eb7
3d3b99ba8e79d5dd676d986266fac31435b718bf35ba87cc8f39bc614a59c627
1a2cc6e94edfe6f1ff317c32e1819bc208e3355ba54a12f355768f7cc8a4fdef
b8462a7f2fc00f6dcbf1626862b2faa49fc4f6bfdaa22be16c5e4546519544d7
0edd663ae8623b791a1efe5e6c73960ee4bc47e8e78045e5f140baaf1193dc3e
020e9c41b54a3e1f37d089de3644d1bcf241a1a47440572cda8a7ad3ca19ad41
31cbdc7401361fbaf59d08b79d2081527147f61d2b951de1a9477648e5b218a8
10f8e75e2c4aa59ceca6d0f272b80bfb2898b8797d275b9aa6a42278074ab711
46aafe312eda24511a2335bfceae83087f505d054e384d0737c035d078c813b9
987c6ffdb14cd076612cf4d30cb6e505f62c74429eb887ca5fd25f333debe1f1
5465df0ef31196b9004310e1d28e8a91d9981f1fa7d7e3ba72df6304c3497c15
68d4120d2473366be68e9d79cc4c197cca068e8268672f2540c0ff615b74e649
04ae3026fc9502f115794757e29bef4a6ad6cf3047fb7b444b0ddbed9504c631
e5c7c3711a12550d58af06c573c99e8f9f8ec611c4a3bae0e2d00efb12eeac7d
dd850a2d509783d8550103d4ab78474d137fc6b64849f8c5f00638cb4dda1886
d935b68ef229e3fa9cec85ef442cb8875aed729e5dc5272fbfe1d822e3575524

http://levifca.com/y0tYhnWQ
http://mfpvision.com/yAkPNiSmm6
http://haganelectronics.rubickdesigns.com/C96xSAAy2q
http://catairdrones.com/sMQ0n8nNun
http://radio312.com/mp0NHN4cHX



```
#### SHA256s for Epoch 1 Payload EXEs seen on 11/29/18 ####
```

fed26308ac3f6c6a4f8dbe3782f5133ee9a17e0fd0fb333949306b0aa2148561
6880e0ffe1fc8c611b63be21f3c96aa5feac0f80bd2c36967ca14107843905b6
ccf7bfa3703db55628c5a910f0c7de0e75d90f687d6592f0a38a34b7d3ef3445
a3d128d3853d0aaa405193d5e873f3bceb94745069def6a43935e1fd85496544
9802664d335e9a72485af007d91a513cea7f04a0dc040a7ba33c528ac77bdb8c
005cb826c3afc6a1eae89c351a789c8d43d691eba6b3dbd528e3ca9a1a8ce5fa
021fcab3ec4ff37f8a87fa1258f099f291b02db6f93afa74d9062a0862ee9e95
13190c3188cf097d41e39e5fad5f87405774d85d9f7cd916425cd73082fffcd3
3f032383ee4c187851c53a9786424f41e26b02c21e3d49955b5b6067058f9082
283f20857cfc19a8f14729eed61a7d6550182dd93242bc9fed4170f893c5314d
d7291055b1baf03ff8bc48bd0444a3311f97998447ef9b99346e7396c0e4b066
68d27ee84a09414459cbd880214ddcfdf5a48f36ebe8d6b79389ac9a56a6836b


```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-29 23:25:00
SHA256:
cc717e98543d103d85c5b0237d1c9bdd31af0a8f7ed5d3c734986c2df4e3cb8e
edd3e74bce343ce5364ec1842cd8f650ca6a7d5316f9db76a6bbaf3c97ffc4bf
648ed03bdac69318234e5e7ade999db7c7f8058336f1a209f33208eb074122e4
d8d5336cc7c453f0ff0005558b1f39fdc30d6ea7fd9d8770cae19cd9de50b2e0
d1caca349ea33035a4237680255937db2b3b29a257f70e39d15cfaa887504519
ca5cc3e989d5dc2f4a36884363c1970645817dbfff50cf798189e8d6a5206d6e
053abf76599484cc6227db5682d32c117bc75fe5bad4ddf6f4ec151a3241ff2e
11bdab3a7f77838f1cee08ad8086db5a25e595105a7260985cf63d03bb3dfdc9
62adf5828ed7b54df6ed9c0e96c7e665f80372aeca6678ec874b15947e5aad7a
78515fb2f34b4f712612c298a8dc9413869021bff147ba6523a0c1bc886a0736
277669df67662368198f6d44167d0937e29937d9775172be2ec40b5bc525ad4c
aa94fa552d1e691818e7070e8f5b51be58b890be35573d86437d813c7cb5369f
78846d1ce909a85c0203c233316dbacdd92b22cedee894c824a70ce56470dc5d
8057c5627d4cb1eff3e8cf05985d8da766db8d5e829ad93e1772abb7b08eed1a
e4d61b558f4081e194bf56b95eaa853b9cb1bc127c13f03f3b51abee112633f0
a3fe6d0306054ce9d02280f6c21c0d7602b19dff186696b1fb1fb2c6bb9402f8
58e62e8c59ebfc618317160ac3a165c78fd57f7a3a796f477c497cdd3eac3c73
8533ddb5509ad08d3ea76082a31ea23639b941649cc7856674dc68d54c0349c9
a933220a287e941ab18a95687fb119bf11d5c8f82fe0b13506b7b793962904de
cf83d584772e6af110bc35325b63c096ca6435537875f3d02cfb0aab89ff629b
7c87957015b2385853e875bec4f70144d65aac8464bc13532df5dd989b26a7e8
e447bcaa90e4f3db4965ed59e55af92bf6f3c04c085dd0984192fdb5ac6450d5
70e52537a63e738b195e15cd5159fc7b41f5e9f2fad02743ef5e7431e12fcb90
4293ed333d5a02a0740c29caa7fa344172f160035c43c91c96080723b4ca09cf
cb809200f93e08f72b892754e214d2cbfa07469d0eba89caca9e9e9e7b2db486
6c717c9b10a58103e52b5bbc32e9487942732c2e2ee70606ecb1f5db6fa6faa0
17ae1bf16d1f79b4312747b10ae6ffd7a5899435d44e6c7d1985f09977c34c9b
13fab0252207f24b86452e33c08636822c39417e1047fc880aebbb2490baceb1
5c254999b6d350b756879e065b81f23c4fbb0b3100dfe1b216ed2189579efc98
98ec1c5628df7434cb674acf5ae3b70f1e3b4411ea95f99f25a80a2661d3082f
d477aa50117aef94a90a87eadba0e6e2f895e2673fa808c6e7649f3fda98fe54

http://eestudios.us/sitezimages/wRfui
http://letraeimagem.com.br/zmDH
http://secretariaextension.unt.edu.ar/wp-content/00002/WYXvv1vV
http://aldia.com.uy/WJ01ISht
http://2.moulding.z8.ru/EGEBrr2


Creation Time	2018-11-29 15:37:00
SHA256:
99581e17542decb545c39d1c2e5e2d11a4dda1e50c7f9a908fba641e43c6e1fa
316f4a0b942371c65df0a9921f49b3bb39c7bc04581d3db46511c230e19907f5
c4a754dce56b200c8104d34f98825dd486d95403cdc39a53242652ba7c08ac9a
2c21f780fa31e5e012fe76d61c600af7fa57067fca6b358198b0f7442b862b4c
83fa16cd3e1e981a811c9594636289e644db2fe04b493fbc1f0c1180a14a798a
d1e81eeffac59953b3a60e90b8508eaff9c62072aa8c55f34bee89906acca397
af95e990a59d2117a381eb8598533b2510892b4c30ace65ba5d66d2c1adc8e51
d57af39d346eda39fbfc7f75c4820c2b60e100dcbaacee19492c010fc4027e46
6f4b0a000df9e6768c73b18d84a776c058b8889b728d7475d221fa2d75bb22cc

http://tracychilders.com/G
http://thedewans.com/3Pr2Hp
http://stuartmeharg.ie/n
http://supercardoso.com.br/aOHFp
http://stars-castle.ir/8WzsCrw

Creation Time	2018-11-29 09:31:00
SHA256:
76a7a1f5788d8cc9a8ada504fd303e4664335a76c13ff08a233fa9bc0e2e2319
08aaeb68483d2e17d1fc26b29abec15e97f57b070ba1a3a2c53a0ef82d20b986
81168711fa7afe2b7fabc16dfa66b5e9830119446ad2f86c306658cbd82c367c
9bcac2a783fc44568de7209b0a82c0736f40628b3ebc70a98fbd22737030a6c1
6b64d430d9e5d6e36795eaa6163cf012da05df30e7e8662b57f22be65260a93e
a7e27cd86abcb90afac9e42512d16c3e4454cb4b328e6220ea01c602219f7fb6
b2aacb2c82b294049bf2c543b64badad265a88a7c0740c9e6e3ccb37cc1f99ad
68922efff29eec3c55e1652a7466c27de422c6be6cacdc713339a3e995789771
23647afa4267cf8150da96f53f42441a647a708716821cb4d9a90b0f88e771c0
68f11b75182d6e23bd24a23904a7a67d7f0160a61a1c43aacf5f0cd95c0bba87
762de993aa670361a3f0d85299f0a0d5b52fdbe4b505b98883871ccbd4fecbf0
2d34e0852b4c030424fc12c6f766109b3324596ea143a29d3c597fbcf0274084
20d6729f4e0c1d001fc65955a91b6c9d867c742d1b200766e254ed75f7188c65
853c1bfcd5c37f28acb19ae97ba2b7ea809281e28d03b164aedabfe1ee9ae830
f9ae50eeb178761aac2e8abf60c2a8b33f845256fdae5c32e59924b30fc058dc
f763c6e69b6b660c86a3671642114a53907e0c99b7f19c3a0b82f350e7460969

http://mahimamedia.com/iYwNcae
http://lunasmydog.com/Tl
http://kylerowlandmusic.com/8aP
http://rodtimberproducts.co.za/s
http://lawsonmusicco.com/NJ3Ta

Creation Time	2018-11-28 19:11:00
SHA256:
63fc9e9607e478e36e87c004a1dfe5b854aa5c4c9f70dbe94bac077cc83f0f91
a89ad03c0f3e32ed38eea186f84326ee0f206e69445f33cdff764ae6616a16e9
06ebc1def2a302de926f4634304ce0718990a3794f0753894c69b457376c4064
78b0a85f04520258ce4a57abe133d5532594211809de84eaaf005047c501d288
fe986b51731b9fa9b7c130781222bd3140a28ce57917a2cfa3d6bf5608d287c9
b95f969c45a405878f503b4e346a967df0b01107e396c51906e39845fc0a6818
893bf230a92d22efc2df75456984be38f60554d2d703a7dd35b5b7c19ab22d2a
39bfd324b6212ecd1fce73860501e65f29d5ef52db26d88f4450724b12225b69
daf92bec9f2848b2182a3dba191065503a6ee242302b4bdff64dfc6265f1c02f
970349e79e9d58a9a6396d1f562d5877abfd8092c7d569943465ccd72455dec6
6e4426d0b509170954d62979cc981ae4a1bce0fb5011ff60ce2e7d8b1068f0c6
3cb543aab4681abf2755e320977242765ec5756a2dda5a904fd12ab53c716f07
787f15153a853931e8adf9cbc828896f6cd56add50dd1c1c9914159f0ae20244
eb738ec5150a99c60bb7b9a8cd076a7bc954f1c8a5d1e0c822cf561e381a2a29
3a936152c592116b685e5d0a83dfc783144404ef9ec00f81032fb99083abb469
ac288870f5f2dd94c88de35fb7b570a20404db34e0178f24af2a0f6a7b299e28
3d72e6a4fb8e394a10e7a0cb10d06c679d4fa9d3a9b4106fd1ccbd77f2a89e24
ad80d18bd431f2600c23c0a8371e377829c845b1324f2a46ada9d3771458e078
129fcb58ba2074504c41b444f55a37ed4b5a5355ab23f4e778ece31ca8b10ea7
6b20c4021c01cddcdb9e40ca4824d2193bd6f6b22a9ee467de88ecf034953198
0a1b7fd8a03068233328643985e462769069dc5cd69ba59be77a0769258ee8e8
e1f4790668195b3a49c022614f3a1c8fe95dac4b75e9039f7ec3c982223384c4
e3fbb04187c2592ee9daf62687608e80b694ac8a5d359e2d1532f32ba5e173ff
496cf8115e4ff19b1d246020423865e96a439b2825a98aae31d7364a9631b89a
9b64eb80e2ac4c1b6a75894dc46023480ee9e469e0a4020bdd5136fd9464f6aa
399d814e9a78565366b3ad186b88dc5779b05a2b063e57c1ebb0974ffb3123c0
2c9efb2aef5bba02f78949229203adfea44cafc5bc8971dbd9aa9c7133b58eef
4ec2e7cafa0e8645934b502b053d254413fa7ae84f0b15cf022e43cc85589fe2
47f9c699367077cffd9acde3349e02dbf316ded30e22e61f128a498972c5fa59
490eeacfc2cba863222e3c218c07f38ae55a3fb494ab4d9ddedbd1cf7b005e8c
a43875e884a667212e8ca8c218fe70e436fdd03155f7d1c0717007b313cc8a82
aa14c6e376d9520e8d85aad3530f4b74a9287478c921c4387803f42c3bae3d5d
b77b56b3c27716ef6b7f0ad6d14dc36ebbb025f63acffec3e7fab0dd56caa592
ec4636eb1b30486240176e4ccac6ca8e6081d0614325f49a033baf009e839d56
7bb8383791f2b6c82c5d717efeb5332f074ceacadc2d324beec22827ac43bbce
d39aab4321080093f8fcee9d4418d9618c97506549cea5f69016ab305add3cbb
5996c8879bfc55c9dc2ce129c1466bd747b1fd937954433952d5fb2284cf80b3
eb64de40ebd993dd895e3cb19c458afbe288eb19785511f0b9b3de81c0c1f56d
9d2182a455d12301215c4c7beebd86a840b26cd3c7a3993d3d71f805a31bdf07

http://clanift.cba.pl/f
http://www.yogananda-palermo.org/Ra7
http://www.wmdcustoms.com/R
http://school3.webhawksittesting.com/J
http://eddietravel.marigoldcatba.com/E


```
#### SHA256s for Epoch 2 Payload EXEs seen on 11/29/18 ####
```

47f9b7f01b4233718e90bcbafa8b5136c283b113189f2f1e9e0f3481ff0bd209
55fc3a0bc504be2cfa55b46630b7948f87be3f57b841b57ee13847538f65d2dd
501bf76666b57f372da64d0297b9c41d3df4eda3000cdedc8b2eaa0ebef895a2
6a089da63faf3551d52bffae225066da1ae5d391acf948aa7ddbc26365cafc82
07c1356f8ee8628fadf8d96481762cf562b922a498e52bb6ae6aa695822fe496
8bf5998127f3c9c49159b39e2001a5d15049d0bc9fc5a9d3384db6ceda868870
86e49f2cb9b45c39b4cb86b2be600a04d15607ee4475a025c63949956499f943
5fdaf521b1915fc208431c57d11e1bffcbf8d03ad4baa0809efd96e18b57a4f3
697cc41458c4552f750de7a021305b3235336045726afe6bdebd83705aef844c
10a2f3de8dd05c16beabcfcbfca18f9db0f39dc5bc1c27a7f399b0c901d49456
da9299803689cc215ac326772593eb35632c204bcd67e09375bb83aca26947ac
f134c1771743fcbd2d174b221c918c8f0f00330c7b3670aedd1df4224352a982
d9f027a108069bc29662d37a740fc10e95a7d934648395db8665f17055ccf983
e3b60fe46c471044d46462de8b2dfda807d75b36dc0a6938b6cf20f554042018

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

107.184.201.99
109.104.79.48:8080
133.242.208.183:8080
135.19.206.30:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
162.252.103.78:8080
165.227.213.173:8080
181.228.204.125:8080
186.23.189.192:8080
187.155.234.215:443
189.155.54.228:7080
189.157.235.122:8443
189.210.114.18
190.96.22.93:8080
192.155.90.90:7080
192.237.251.185:8080
198.199.185.25:443
200.52.75.212:8080
200.60.71.194:443
201.196.89.80:50000
209.112.181.206:443
210.2.86.72:8080
210.2.86.94:8080
216.221.68.35
219.94.254.93:8080
23.25.165.74
23.254.203.51:8080
49.212.135.76:443
5.9.128.163:8080
69.198.17.20:8080
81.213.63.109:7080
86.43.125.152:8080
92.27.103.140:443
98.188.200.74:8080
98.5.163.186

```
#### Spam/Stealer C2s ####
```

181.225.227.251
192.237.251.185
206.81.7.25
71.58.165.119

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

107.190.203.165:443
115.71.233.127:443
121.181.5.53:443
165.227.191.145:8080
173.209.178.228:443
173.241.126.78:8080
174.109.80.223
178.95.247.58
185.20.104.238:8080
190.41.82.177
198.74.58.47:443
200.23.18.172:990
202.51.181.50
202.91.43.74:443
211.115.111.19:443
217.13.106.160:7080
222.214.218.192:4143
45.123.3.54:443
46.163.76.187:8080
5.230.147.179:8080
5.35.242.34:7080
50.33.155.172:443
67.204.50.87:50000
67.205.149.117:443
68.58.185.8:443
69.125.80.135:7080
69.198.17.7:8080
71.179.46.252
71.237.186.212
71.240.202.243:443
73.6.157.159:8080
81.7.10.106:7080
83.222.124.62:8080
84.200.106.120:8080
88.247.124.152:8090
95.141.175.240:443
97.83.88.72:443
98.142.208.27:443


```
#### Epoch 2 - Spam/Stealer C2s ####
```

139.162.157.8
24.35.180.220

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture: https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list. I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now. Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change payloads every 3-6 hours now and hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100% sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/cjY7FPiy - @James_inthe_box
https://pastebin.com/p8SX3eFu - @pollo290987
https://pastebin.com/kgkj85LR - @ps66uk

```
#### Credits ####
```
(OC and combination work)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @Techhelplistcom, @pollo290987, @malware_traffic, @0xtadavie, @devnullnoop
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @Bitterman59, @devnullnoop, @executemalware, @Bauldini
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!

```
#### Daily Log ####
```

What a day. I did not have a lot of time to cover this but here is the best I could do. I hope it helps someone on a Friday. :)


```
#### Sandbox 11/29/18 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run at 01:00 on 11/30/18 https://app.any.run/tasks/52c2fd40-5c57-4228-820a-828be17f111b
```

```
Epoch 2 C2 run at 01:17 on 11/30/18 https://app.any.run/tasks/a75b1225-d218-47d4-8fc9-05e42b1e71f9
```