Emotet Malware IoCs 2019/03/14

## Emotet Malware Document links/IOCs for 03/14/19 as of 03/15/19 03:00 EDT ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 03/14/19 ####
```

http://109.97.216.141/@eaDir/sec.accs.send.com/
http://122.180.29.167/landx-test/wp-content/sec.myacc.send.net/
http://13.127.68.11/newstoot/verif.myaccount.resourses.net/
http://13.127.80.82/ClvW8ZSqo0icX_OiB6Mv8/trust.myacc.send.com/
http://132.145.153.89/trust.accs.send.net/verif.myaccount.docs.biz/
http://140.143.240.91/yfwta7q/sec.accounts.docs.net/
http://142.93.56.178/wp-includes/company/RD/Operations/EcsH-wrV6b_nCPVA-uI/
http://159.203.191.166/wp-admin/secure.accounts.docs.net/
http://167.99.197.172/utou2km/sendincencrypt/service/Nachprufung/de_DE/201903/
http://211.159.168.108/wp-content/Telekom/Rechnung/022019/
http://222.106.217.37/wordpress/trust.myacc.resourses.com/
http://34.73.24.125/wp-admin/secure.myaccount.resourses.biz/
http://35.226.136.239/US_us/verif.myacc.send.net/
http://3gksa.com/temp/sec.myacc.docs.net/
http://78.207.210.11/@eaDir/secure.myacc.resourses.com/
http://94.191.48.164/hf9tasw/verif.accounts.send.net/
http://95.177.143.55/wp-content/trust.accs.resourses.com/
http://agtrade.hu/images/trust.myacc.resourses.com/
http://almutanafisoon.com/42mldks/sec.myacc.send.net/
http://amlak20.com/wp-includes/secure.myacc.send.net/
http://anorimoi.com/wp-includes/sec.accs.send.com/
http://apollo360group.com/5dcipv1/trust.myaccount.send.com/
http://ayodhyatrade.com/ww4w/verif.myacc.send.net/
http://barbieblackmore.com/wp-includes/secure.accounts.resourses.net/
http://bashheal.com/eymakax/sec.myacc.docs.com/
http://bis80.com/mwqw190/secure.myacc.docs.com/
http://bluehost.tv/testbunder2.com/verif.myaccount.send.biz/
http://cedrocapital.xvision.co/vckej2kgj/secure.accs.docs.biz/
http://chigusa-yukiko.com/blog/trust.accounts.docs.net/
http://crawsrus.com/css/sendincsec/support/sich/DE/03-2019/
http://cskhhungthinh.com/wp-content/sendinc/messages/question/En_en/03-2019/
http://cyzic.co.kr/widgets/trust.myacc.resourses.com/
http://decospirit.com/sec.myaccount.docs.biz/
http://desite.gr/rglxp-2s4lh-ytetxsc/secure.accounts.send.net/
http://disal-group.kz/cacheec916813e9047d94e78f6564a70a635a/sec.myaccount.resourses.biz/
http://dkw-engineering.net/purchase_order_2018/verif.myaccount.resourses.biz/
http://ecofreshmarket.com/wp-admin/trust.accs.resourses.net/
http://emseenerji.com/wp-content/sec.myacc.resourses.com/
http://eventpho.com/wp-content/sendinc/legale/nachpr/DE/03-2019/
http://filfak-online.su/wp-content/uploads/trust.myacc.docs.biz/
http://firemode.com.br/1021blindagens/wp-admin/sec.accounts.resourses.biz/
http://firstmnd.com/wp/wp-content/verif.accounts.send.com/
http://fondtomafound.org/wvvw/Telekom/Rechnung/022019/
http://frankcahill.com/wp-admin/Intuit/llc/Redebit_Transactions/jadCs-eSSV_UTVcl-h4/
http://freezard.com.do/enjoya/trust.myacc.send.biz/
http://g20digital.com.br/SN/verif.accs.docs.com/
http://gcslimited.ie/wp-includes/js/tinymce/plugins/wpemoji/Telekom/Transaktion/02_19/
http://generalwebmayhem.com/2k11/sec.accounts.docs.biz/
http://geologia.geoss.pt/wp-content/verif.accs.resourses.net/
http://getdripfit.com/wp-content/sendincsecure/nachrichten/sich/De_de/03-2019/
http://glampig.com/projectx/Telekom/RechnungOnline/02_19/
http://gruporc.com.br/imagens/Intuit_US_CA/document/Redebit_Transactions/Redebit_op/eNHUB-zaH_kxleMk-mG8r/
http://grupoweb.cl/wp-admin/secure.myaccount.docs.net/
http://gvpmacademy.co.za/css/sec.myaccount.send.net/
http://healthwiseonline.com.au/wp-admin/Intuit_US_CA/doc/RDEB/MIJa-L5fyv_pfF-O3c/
http://hepsiburadasilivri.com/wmxm8d7/secure.accounts.resourses.net/
http://himappa.feb.unpad.ac.id/images/trust.accs.docs.com/
http://hitme.ga/cgi-bin/secure.myaccount.docs.biz/
http://hostech.com.br/img/verif.myacc.send.com/
http://hubcelab.in/zga0bip/secure.accounts.resourses.com/
http://hyperbaricthailand.com/wp-content/uploads/sendincsec/nachrichten/Nachprufung/DE_de/03-2019/
http://i-genre.com/wp-admin/trust.accounts.docs.com/
http://ineteam.com/lalineacity/trust.accounts.resourses.biz/
http://informacjezkraju.pl/zoh1cdr/verif.accounts.docs.net/
http://instituthypnos.com/1sxuh6w/trust.accs.docs.com/
http://irismal.com/ecsmFileTransfer/trust.accounts.docs.com/
http://jensnet.se/wp-admin/Intuit_EN/scan/Redebit_op/9889612330/dDOc-eFj_Jupye-Ck/
http://jerryshomes.com/vendor/US_CA/info/RD/UifUK-Z38jO_YZRyw-LWk/
http://jimrigby.com/FM/secure.myacc.send.biz/
http://jjcole.com/wp-admin/trust.accounts.resourses.biz/
http://jmduarte.com/wp-admin/trust.myaccount.docs.biz/
http://jornaldofontes.com.br/cgi-bin/trust.accs.docs.net/
http://jpmtech.com/css/trust.myaccount.resourses.biz/
http://jsya.co.kr/@eaDir/trust.myacc.send.biz/
http://judygs.com/there/secure.myaccount.resourses.net/
http://junctioneight.com/resume/verif.myaccount.resourses.net/
http://jycingenieria.cl/images/trust.myacc.resourses.biz/
http://kamir.es/controllers/trust.myaccount.resourses.biz/
http://kannada.awgp.org/wp-content/uploads/secure.accs.send.net/
http://kaoudenaarde.be/mail/secure.myacc.send.biz/
http://karakhan.eu/grav/secure.myaccount.resourses.com/
http://kelp4less.com/wp-includes/trust.myaccount.resourses.net/
http://khachsanrevungtau.com/f7wmgnw/trust.myacc.resourses.com/
http://korneragro.com.ua/wp-admin/secure.myaccount.resourses.biz/
http://ksafety.it/awstats-icon/verif.myacc.docs.com/
http://lab5.hu/wp-content/sec.myaccount.resourses.com/
http://lala.si/wp-admin/sec.accounts.docs.com/
http://larissapharma.com/fobn/secure.accounts.resourses.net/
http://lawsongrafix.com/webdesign/secure.myaccount.resourses.net/
http://lawsongrafix.com/WebDesign/secure.myaccount.resourses.net/
http://liquidigloo.com/scripts/verif.myaccount.docs.net/
http://lisergy.info/images/sec.myacc.send.com/
http://lopxe.itvina.co/wp-content/uploads/secure.myacc.docs.net/
http://lswssoftware.co.uk/Accounts/secure.accounts.docs.net/
http://luisromero.es/cafe/verif.myacc.send.biz/
http://macssnow.com/downloads/verif.myaccount.resourses.com/
http://makrohayat.com/wp-admin/secure.myacc.resourses.net/
http://manaku.com/images/trust.accs.resourses.net/
http://mangaml.com/jdownloader/scripts/pyload_stop/trust.myacc.resourses.net/
http://maravilhapremoldados.com.br/imagens/trust.accounts.docs.com/
http://marcojan.nl/webshop/trust.myacc.docs.net/
http://mezzemedia.com.au/En/sec.accs.resourses.net/
http://mireiatorrent.com/wp-includes/secure.myaccount.resourses.com/
http://mistcinemas.com/cgi-bin/sec.accs.send.net/
http://mistransport.pl/sass/verif.myacc.send.biz/
http://mj-web.dk/administrator/verif.accs.resourses.biz/
http://nealhunterhyde.com/HappyWellBe/trust.accs.send.com/
http://netcom-soft.com/eng/secure.accs.docs.net/
http://nexusinfor.com/img/sec.accounts.resourses.net/
http://nitech.mu/Scripts/trust.accs.send.net/
http://pefi.sjtu.edu.cn/wp-content/Intuit/llc/RD/Operations/8060122705/HCnO-Wf_PTUH-2q/
http://pefi.sjtu.edu.cn/wp-content/verif.accounts.docs.com/
http://pji.co.id/iug1iha/sec.accs.send.com/
http://pufferfiz.net/spikyfishgames/sec.myaccount.send.com/
http://sidtest.site/cgi-bin/verif.myacc.docs.biz/
http://sinding.org/cgi-bin/secure.accounts.resourses.net/
http://smartchoice.com.vn/data/sendincsecure/support/sec/En_en/201903/
http://sobyso.vn/wp-admin/secure.accounts.send.com/
http://soil-stabilization.ir/wp-admin/sec.myacc.docs.com/
http://somossostenibles.pe/wp-content/trust.myacc.docs.biz/
http://studyosahra.com/css/secure.myaccount.resourses.com/
http://sunkids.dp.ua/wp-admin/secure.accs.docs.com/
http://tech99.info/wp-admin/verif.myaccount.send.com/
http://teknotown.com/wp-admin/secure.accs.resourses.net/
http://ten.fte.rmuti.ac.th/wp-content/verif.myaccount.resourses.biz/
http://test-lab55.ru/wp-content/Telekom/Transaktion/022019/
http://textilkopruch.com.br/wp-includes/sec.myaccount.send.net/
http://thetourland.com/wordpress/sec.accs.docs.biz/
http://thewatchtrend.com/cf8zrq1/secure.myaccount.docs.com/
http://tokozaina.com/wp-content/trust.myacc.docs.net/
http://toyotahadong5s.com/wp-content/verif.myacc.docs.com/
http://triodance.net/at1uzmh/trust.myacc.send.net/
http://triton.fi/trust.myaccount.resourses.net/
http://tutranquilo.com.co/wp-admin/verif.myaccount.docs.com/
http://tuval-mobilya.com/wp-admin/trust.myaccount.docs.com/
http://umakara.com.ua/icon/sec.accs.docs.biz/
http://v2sk.com/bpvipsg/sendincsecure/service/nachpr/De_de/032019/
http://vetah.net/signature/Telekom/Rechnungen/022019/
http://vitalacessorios.com.br/cgi-bin/sec.myacc.send.biz/
http://voicetoplusms.com/wp-admin/trust.accounts.docs.com/
http://walburg.pl/cache/sendinc/service/sich/DE/2019-03/
http://waverleychauffeurs.com/wp-content/verif.accs.resourses.com/
http://webdemo.mynic.my/school6/Telekom/Rechnung/022019/
http://wessexchemicalfactors.co.uk/css/secure.myaccount.send.net/
http://wpgtxdtgifr.ga/wp-content/secure.accounts.send.com/
http://www.buzztinker.com/wp-content/trust.myaccount.docs.net/
http://www.cbmagency.com/wp-content/trust.accs.docs.com/
http://www.gifftekstil.com/wp-admin/trust.myaccount.resourses.net/
http://www.gym.marvin.tech/wp-content/secure.myaccount.resourses.com/
http://www.heldermachado.com/wp-content/sendincverif/service/nachpr/DE/032019/
http://www.la-reparation-galaxy.fr/wp-admin/Intuit_EN/document/Redebit_operation/faq/346178436/aDTP-Uhktd_wHV-Hr/
http://www.majoristanbul.com/cgi-bin/trust.myacc.send.net/
http://www.nhadatquan2.xyz/wjf85ri/sec.myaccount.send.com/
http://www.urschel-mosaic.com/ajax/verif.myacc.resourses.biz/
http://www.yindushopping.com/wp-admin/verif.accounts.send.com/
http://www.zhanxiantech.com/google_cache/secure.accs.send.com/
http://zendenweb.com/luckw96/verif.myacc.send.com/
http://zoomphoto.ir/thumbnails/verif.myaccount.send.com/
https://apresupuestos.com/cgi-bin/Telekom/Rechnung/022019/
https://arcticbreathcompany.com/wp-includes/verif.myaccount.send.biz/
https://arinidentalcare.com/files/trust.accs.resourses.biz/
https://asociatiaumanism.ro/wp/secure.myaccount.resourses.com/
https://blog.adflyup.com/wp-includes/trust.myacc.docs.net/
https://buyecomponents.com/0sdnhcx/sendincsec/support/nachpr/De/201903/
https://catba.goodtour.vn/wp-content/plugins/adventure-tours-data-types/assets/fonts/Telekom/Rechnungen/022019/
https://eptq.kz/blogs/secure.accs.docs.com/
https://eventpho.com/wp-content/sendinc/legale/nachpr/DE/03-2019/
https://expresstattoosupply.com/wp-content/sendinc/legale/vertrauen/DE/2019-03/
https://firemode.com.br/1021blindagens/wp-admin/sec.accounts.resourses.biz/
https://fk.unud.ac.id/wp-includes/sendincencrypt/support/Frage/de_DE/201903/
https://gazikentim.com/wp-admin/secure.accounts.send.biz/
https://getdripfit.com/wp-content/sendincsecure/nachrichten/sich/De_de/03-2019/
https://gvpmacademy.co.za/css/sec.myaccount.send.net/
https://huskennemerland.nl/wp-content/Intuit_US_CA/llc/Redebit_Transactions/Operations/jWPSM-cjbW_pUb-9kk2/
https://informacjezkraju.pl/zoh1cdr/verif.accounts.docs.net/
https://jerryshomes.com/vendor/US_CA/info/RD/UifUK-Z38jO_YZRyw-LWk/
https://kcxe.net/wp-admin/verif.accs.resourses.biz/
https://ksoncrossfit.com/rylawpc/sec.myaccount.docs.com/
https://liblockchain.org/wp-content/Telekom/RechnungOnline/022019/
https://liquidigloo.com/scripts/verif.myaccount.docs.net/
https://myphamthienthao.com/wp-admin/sec.accs.resourses.net/
https://nhathongminhsp.vn/sendincencrypt/verif.myaccount.send.com/
https://oxyfi.in/mmcv/trust.myaccount.resourses.biz/
https://pefi.sjtu.edu.cn/wp-content/Intuit/llc/RD/Operations/8060122705/HCnO-Wf_PTUH-2q/
https://pefi.sjtu.edu.cn/wp-content/verif.accounts.docs.com/
https://perfectradiouk.torontocast.stream/openb/sec.myacc.send.com/
https://pji.co.id/iug1iha/sec.accs.send.com/
https://qualityansweringservice.com/icon/trust.myacc.docs.biz/
https://slickcoder.com/wp-includes/sendinc/legale/nachpr/DE/03-2019/
https://sobyso.vn/wp-admin/secure.accounts.send.com/
https://somossostenibles.pe/wp-content/trust.myacc.docs.biz/
https://sovintage.vn/wp-admin/verif.accounts.send.net/
https://spirtnoe.org.ua/hf37pan/sec.accounts.send.biz/
https://sredamoney.com/wp-content/trust.myacc.resourses.com/
https://studiomarceloteixeira.com.br/wp-includes/sec.accounts.send.com/
https://sultrax.com.br/wp-includes/verif.myaccount.docs.biz/
https://sundarbonit.com/wp-includes/secure.myaccount.docs.biz/
https://tapchicaythuoc.com/cgi-bin/secure.accs.resourses.com/
https://teacherlinx.com/uploads2/trust.myaccount.docs.com/
https://ten.fte.rmuti.ac.th/wp-content/verif.myaccount.resourses.biz/
https://tnnets.com/qchaxx2/sec.accs.send.net/
https://tokokacaaluminiummurahjakarta.com/cgi-bin/verif.accs.send.net/
https://tokokacaaluminiummurahjakarta.com/cwflfmf/sec.accs.send.biz/
https://tokozaina.com/wp-content/trust.myacc.docs.net/
https://totalbersih.com/wp-includes/sec.myacc.send.net/
https://toyotahadong5s.com/wp-content/verif.myacc.docs.com/
https://transloud.com/wp-admin/sendincsecure/support/vertrauen/De_de/2019-03/
https://triodance.net/at1uzmh/trust.myacc.send.net/
https://tunaucom.us/wp-admin/sec.accounts.docs.biz/
https://uander.com/Javascript/verif.accounts.send.net/
https://vrfantasy.gallery/wp-admin/secure.myacc.docs.net/
https://waverleychauffeurs.com/wp-content/verif.accs.resourses.com/
https://webinar.cloudsds.com/js/trust.accs.resourses.com/
https://worldbestinternetmarketingworkshop.com/wp-includes/sendincsecure/support/vertrauen/DE/032019/
https://www.bollardsolution.com/bin/trust.accounts.send.net/
https://www.esteticabiobel.es/wp-admin/sendincencrypt/legale/nachpr/de_DE/03-2019/
https://www.gokmengok.com/wp-admin/sec.myaccount.send.com/
https://www.heldermachado.com/wp-content/sendincverif/service/nachpr/DE/032019/
https://www.kelaskuliner.com/tyoinvur/sendinc/legale/Frage/De/201903/
https://www.la-reparation-galaxy.fr/wp-admin/Intuit_EN/document/Redebit_operation/faq/346178436/aDTP-Uhktd_wHV-Hr/
https://www.udhaiyamdhall.com/images/trust.myacc.resourses.net/
https://www.voicetoplusms.com/wp-admin/trust.accounts.docs.com/
https://www.xiaojiaoup.cn/wp-includes/secure.accounts.resourses.com/
https://www.zhanxiantech.com/google_cache/secure.accs.send.com/

```
#### Epoch 2 Document/Downloader links seen for 03/14/19 ####
```

http://104.155.134.95/verif.myacc.docs.net/s3uz6-lqqzt5-rnqphv/
http://1080wallpapers.xyz/tvcgyma/uic8-ujxza4-awofezlm/
http://114.115.215.99/wp-includes/6ymw-hzj8t-yziswqr/
http://118.24.9.62:8081/wp-content/6gow-h6cnn2-aabkaz/
http://12pm.strannayaskazka.ru/wp-content/ay2pd-8w3h7o-smomp/
http://13.124.23.174/wp-includes/9sqe-q5ekv-zzaqzzodo/
http://13.209.31.54/wp-content/5aj8-kuztfk-eeiyg/
http://140.143.224.37/fb5sreu/tkiy-msnwm-ocmfz/
http://159.89.31.29/wp-content/bx6n-83qbbx-aejixm/
http://2bebright.net/a4inhdw/frsh-t8vphw-tlhak/
http://35.184.197.183/De_de/c7cjq-0oo748-iwfcs/
http://35.221.147.208/wp-includes/ss740-w5h1jg-tlcz/
http://47.75.114.21:83/wp-includes/l8cs4-3wxc6-hbki/
http://47.91.44.77:8889/wp-includes/i6dw-l2vt2c-wxlad/
http://66.55.80.140/wp-content/6blqn-hrx87-nqlgzrrnv/
http://6connectdev.com/bots/pnlsj-rzti93-sapdcuvq/
http://84.28.185.76/wordpress/lv6rh-4i2k6c-rtnoiuzz/
http://aasinfo.hu/images/euxo-jo6h1u-efos/
http://akashicinsights.com/absolute_abundance_files/1mntv-bjae9-oxdaqbh/
http://allitlab.com/config/8wabt-0430e-razmbs/
http://altifort-smfi.com/wp-content/uploads/1dcrb-2fqwe7-pkhlbrku/
http://altifort-smfi.com/wp-content/uploads/1dcrb-2fqwe7-pkhlbrku/)/
http://annual.fph.tu.ac.th/wp-content/uploads/yuo3-k2nys3-hucb/
http://arendakass.su/wordpress/fq4r-5gkg7w-eejk/
http://assistenzacomputervr.it/wattcalc/less/559c-y2fnnw-dgmcdmg/
http://ayitilevanjil.com/wp-content/sbglcn-5kvu4n-uoyb/
http://barabooseniorhigh.com/En/bly1-g42zf-bsrqkaki/
http://beloa.cl/application/tests/q0ue-2vdud-wuxrgil/
http://bergdale.co.za/wp-admin/jejxy-dzb24-ljqqgzz/
http://bernardlawgroup.com/wp-admin/g51m1-4mdty5-vksht/
http://biederman.net/leslie/7kth-xlspp-zwejfxp/
http://bitbuddybtc.com/btcbetpal.com/8ad91-oltcg9-cbon/
http://blog.almeidaboer.adv.br/vo3mynw/egrs-vh2a03-yhqn/
http://blog.ariamusicstore.com/wp-includes/uz7el4o-41x4lv-ecvvi/
http://bloodybits.com/edwinjefferson.com/lxxiw-nt5b63-hoirtvgsq/
http://brandconscience.in/css/usutk8-aa0ic-kgtlub/
http://buckmoney.xyz/cgi-bin/g0wwk-kjrlcd-yayjxol/
http://campustunisie.info/cgi-bin/zy3r-412rju-zhifdmrdt/
http://canacofactura.com.mx/factura_admin/fx27l-5dqbqv-wppohrnyn/
http://carlosmaneta.pt/29hvno0/4pp8-pvxa3-zletb/
http://carmendaniela.ro/cgi-bin/5wll-3hwdlb-ibytq/
http://catamountcenter.org/cgi-bin/hgcw-r6i4j-qjjctshs/
http://ccontent.pro/psmc9yj/8x6u9-ak8gj-pyywgjplq/
http://ckingdom.church/wp/uc3v-6id4rl-wbrul/
http://click.senate.go.th/wp-content/uploads/2019/5kf9xg-1ew5g4j-ajij/
http://colbydix.com/simpleSiteBack/ty9fr-r5jsv-unllqudn/
http://colbydix.com/simpleSiteBack/ty9fr-r5jsv-unllqudn/)/
http://contabil-sef.creativsoft.md/css/7tj2-xp81h-iosiqna/
http://crabnet.com/admin/ph3mf-471clb-ocgyeqbze/
http://creatoruldevise.ro/img/3skh-pghlwa-lnrd/
http://cybernicity.com/xbmp-1v7a03-kbgng.view/m79j-h4yuz-lqdeuogc/
http://dagda.es/cache/f6u1-m0uwhk-pefhin/
http://dda.co.ir/wp-snapshots/2z98bmn-kbupwz-laaqn/
http://demu.hu/wp-content/upgrade/vf9o-03vfw4-hvll/
http://design.ftsummit.us/wp-includes/ya1w-nhg7bf-ljopsa/
http://dev15.inserito.me/almumtaz2/nkh6-ngcm8q-hxslwk/
http://digitaldarpan.co.in/wp-admin/ew3ipb-qrj30sh-hpavn/
http://digitalprintshop.co.za/kgyhf1s/jg9iil2-dp5he-jixh/
http://dimeco.com.mx/factura/3nb3-hhzecy-ocjpluefz/
http://ditec.com.my/js/ymcc-99rnr-mqcfoc/
http://divacontrol.ro/images/var3-grecla-cfoqykg/
http://dogtrainingtips.me.uk/YAHOO/i1dsjp0-efshv-javen/
http://dotpos.in/fwqkese/l6m9-9v47st-jykp/
http://dqbdesign.com/wp-admin/6qyv4-9tq8s-zzarro/
http://drszamitogep.hu/_BACKUP-20190208-HACKED/mz58-5k5jp-lxiv/
http://dtk-ad.co.th/r20yp8t/speqs7y-mngn1yj-ugzcwuf/
http://duncaninstallation.com/images/yptss-ia6pha-mgohqoeep/
http://edtech.iae.edu.vn/wp-includes/4dj9-k6eyn-vhznya/
http://elevituc.vn/old/csom-9kdwt-rvpgjwouo/
http://esenlives.com/yyvmbi9/ear3t-r5slea-zbdvcqlb/
http://estatecondos.com/blogs/xy73ab-tuq3j2-vlbug/
http://euforikoi.xyz/application/wzoo-k6txu-zyjfxokwc/
http://ewoij.xyz/250iox-6ww52-uxrgzcd/
http://farstourism.ir/wp-admin/tu7r-bygz1k-qvozx/
http://fgmedia.my/order/to11-j9r1l-bqrppyo/
http://fictionhouse.in/wp-content/v5v14-mcb8h-sfpd/
http://fisika.mipa.uns.ac.id/icopia/files/fyhwj8-sx526d-ngfto/
http://flikh.com/flikh/6718-yp53b-vlpzyo/
http://fpvnordic.com/img/jki0k-tqeal6-dgsyrzsbk/
http://frtirerecycle.com/images/4uia2-5dur1-qvjqdz/
http://fullstature.com/mid/udt1l-5amos-vzgvmcwye/
http://gamarepro.com/plugins/x3qs-c607v-norfdkxa/
http://geecon.co.uk/autochatbot/1280e-g24o98-dqjqsh/
http://gelatidoro.sk/zrdgo4p/9n2q-riojg-qtdzm/
http://gisec.com.mx/expertos/xcck-u6too2-uhrnpotz/
http://grameenshoppers.com/old-site/ba9u-emivu-pxcedhq/
http://halal-expo.my/wp-admin/g7wn-vqjivi-iaflnb/
http://haru1ban.net/files/2xzy-klugix-bmhtibiu/
http://healthwiseonline.com.au/wp-admin/g3h8g-2rfkqz-tttvtsip/
http://hillhousewriters.com/images/vjjz-erxqi-kqkbql/
http://horseshows.io/c2nkrlt/wm1f4-ozg75-eqdvotudf/
http://icpn.com/shawtroop342/873d-oo9v7-qnxh/
http://id.launcher.mankintech.com/wp-content/uploads/d8rk-yyzib-ckwt/
http://idealjackets.com/wp-admin/6vap5-1igm7-oxxxjh/
http://iextant.com/1zmraii/xbyu-a3ttxv-bbtf/
http://ifilo.com.tr/old/4uyga-bykhf-mlxikab/
http://iheartflix.com/wp-content/wta5r-8hi2k-pnddqitf/
http://ilcltd.net/eienbsu/p41rbi-h21yh-qenkt/
http://ilgcap.net/wp-includes/v1ts-pdvdy-byjps/
http://ilimler.net/wp-includes/ouen-arhq1a-alhko/
http://impro.in/components/wtv92-h7574-etbff/
http://impro.in/components/wvzvl-si9qlj-jsgorld/
http://indirimpazarim.com/cgi-bin/b7zw-w4pv48-koow/
http://infomagus.hu/wg5/yrm5-bl98hh-pupq/
http://itpractice.com.au/wp-content/6neg-zq2h5m-bsgeeo/
http://jabalnoor.sch.id/wp-content/60yhe2l-mn05v-jcojd/
http://jargongeneration.com/Gambia/iuhz3-mi76u-idqrwi/
http://jjsdesignandbuild.com/tw34yvw/3ymrs-jt8451r-wijgvjx/
http://jobspatrika.com/leoloka.com/89jd-783cv-qxsbocsn/
http://jofox.nl/stream/ksyh-b2xj6-bckuuqc/
http://johnclive.co.uk/id/zv3pc-3gtms-wlehkhtmd/
http://johnstranovsky.com/96t8b-z2ns7-galcijo/
http://joshcomp15.com/old/server/ppjxi-li0pps-mqppir/
http://juarren.com/css/zb53-kxrcqu-moxwb/
http://junkmover.ca/wp-includes/k0ls-mfrxg-axfn/
http://kadutec.com/cma/aoi8-f6v6x-fybuwfng/
http://kamel.com.pl/wp-content/jee8j-r6t06-kkmaz/
http://karenamme.de/sntfy-d5u7rd-icbooohpt/
http://karl0s.com/Amazon/6bwc-utf4m-apdqm/
http://kianse.ir/svsvbk/ppcf-pvdu7z9-nkghe/
http://kitakami-fukushi.ac.jp/wp-admin/8x324v2-zlz81-djrtueq/
http://klasisgk.or.id/fonts/ad10-xbqpw-rxto/
http://k-marek.de/assets/egxv-ii7ihy-yazagvls/
http://kndesign.com.br/css/gpji-gkxndz-ldzz/
http://koatz.com.br/vanbora/29cl-x97c5y-vyys/
http://koehler-cosmetic.de/wp-content/a244r-y9ohc4-mbbeo/
http://kosmoverse.com/games/ue92x-phk709-wdxiy/
http://kowil.com.vn/wp-admin/lpmj-855ev-sgveuhw/
http://kuy-ah.id/megabusbandung.com/7mbn-byibei-cuptgwv/
http://kysmsenivisual.my/wp-includes/8lcj-aq6gr-poomjlddr/
http://lalaparadise.com/ponytale/dk44m-cp1tp-cbtmooz/
http://layoutd.net/aukro/270p-f03urt-zudsp/
http://lemuria.sk/ww4w/vr1h-kaegqe-cxtp/
http://leoloka.com/89jd-783cv-qxsbocsn/
http://lgubusiness.ph/wp-includes/2kc5-j9la5-rfra/
http://lifeguidesinc.com/ww4w/fzh1-vsmia1-xsgkcrwpl/
http://li-jones.co.uk/css/0nca-tf09q-nhdmsfn/
http://linkmaxbd.com/ww4w/4s87-ame04-jholkr/
http://lloydsong.com/wp-content/2f40u-e0cur-uamjqz/
http://lockedincareers.com/stats/izsx-w1jh7v-dldxpuhf/
http://logologi.vn/xo4875d/ynfcc-nnq1or-sbidwq/
http://love2wedmatrimonial.com/webfonts/niw6-nh3og0-azltpi/
http://luacoffee.com/wp-content/uploads/z861-utcyb-qpcrmi/
http://lukejohnhall.co.uk/wolfehall.com/ulxfn-5gi0cd-huytcym/
http://madbiker.com.au/logs/2sxb-8mp0q-xmheeitd/
http://makson.co.in/Admin/vjnf-p4m1a1-ksgqvtp/
http://manorviews.co.nz/cgi-bin/vm8qb-0u8iq-tzhtjwxg/
http://markelliotson.com/css/3b83-5zdz5-umii/
http://marketinsight.hu/wp/l0kc-5xkfp8-tayrwjmie/
http://matefactor.com/go/bhooq-yxo50-tacnfk/
http://mcbeth.com.au/nick.mcbeth.com.au/59xr-fvwj2f-yjssgad/
http://mdtraders.com/wp-admin/cse4a4-00xuo1-bjwr/
http://media-crew.net/bao/wxfuq-8y5cr-zebw/
http://mediariser.com/wp-content/z1iid-2eem68-iqngc/
http://mlewisdesign.com/AT_T/br0j-rgl2t-ddbyl/
http://mnatura.com/photo/9tn3f-rjkal-frshoo/
http://muacangua.com/wp-admin/ddmp-77o87-uuch/
http://mukunth.com/shop/hqg3-jrufu-zbwgg/
http://multicapmais.com/js/l3qj-lwh0g-eorjnwag/
http://multiesfera.com/wp-content/814et-buyfq5-nkahh/
http://nemnogoza30.ru/ugqwuiu/2dgf-242z2z-giriqqqu/
http://nfbio.com/img/upload_Image/edm/pic_2/h1te-t8jpu-yadpky/
http://nguyenthituyet.org/wp-admin/nger-xhkcnz-dywfrio/
http://nhuakythuatvaphugia.com/wp-includes/wnw7-psnv4-pjhk/
http://pannewasch.de/Artetra/pf6f0-vlkuko-dcshgay/
http://pasb.my/videos/v48pu-rg7di-llwdp/
http://petite-pop.com/wp-content/e35d-msulvg-bnquh/
http://projectconsultingservices.in/1/p8ncs-egjpf-guuy/
http://property-in-vietnam.com/cgi-bin/vxzb-3hjug-midvyu/
http://ptpos.com.vn/wp-snapshots/t78e1-nb06m-iwghnhe/
http://quranyar.ir/wp-includes/7fn9m-vd7do-ifllme/
http://raccanelli.com.br/cgi-bin/1bfsm-3scphyq-oinr/
http://redmiris.com/wp-admin/219mi-m1uzz-jemdgdap/
http://research.fph.tu.ac.th/wp-content/uploads/4qbxx-tvwu0-exphx/
http://rmhwclinic.com/wp-content/0jpz6-5ghbm-xdnbyf/
http://rozhan-hse.com/wp-includes/deo7t-dcaum4-fykaarrdt/
http://sannicoloimmobiliare.com/s5v4bzr/kg5em-8s0zg-wyrk/
http://semicon-tools.com/++install/s6mnx9l-eiyrz-bcqdqms/
http://shawktech.com/shawktech.com/91nw-hd0kc8-ingjmpx/
http://shoppworld.com/migrar-wp/u9esy-5oz3f-jmvlvsw/
http://skulpturos.com/wp-content/gu7lcrn-24dpp-jaxojrr/
http://smartklampindonesia.com/site/1o46-ic4n0r-lptrxge/
http://smblouse.com/cozayg4/9xwpi-0kekjp-fybn/
http://sohuco.com.vn/wp-includes/yl0a7-sv25l-ubbkqwiqh/
http://sorwar.online/wp-admin/75np-ualbr-fcqixhfl/
http://sosyalmedyasatisi.com/wp-includes/vf7ai-xciuvf4-qnghg/
http://straightnews.in/css/3klo-6mtta-cwmhox/
http://t3-thanglongcapital.top/wordpress/gkby-mqn1k8-oqxoc/
http://taekwon-do.gr/blogs/u9b33-068dp-jetkznhvq/
http://tanphuchung.vn/cgi-bin/qkadt-tmizk-nmoc/
http://teatropamokos.lt/wp-includes/sa3v-oq8le8-eabfkbmg/
http://tem2.belocal.today/beauty-house/1ja10-cuvei1-hvvjkdgrd/
http://teo.solutions/icon/r6xqr-39bq5-hfqpiohxh/
http://thaddeusarmstrong.com/wp-content/txxwd-me7gh-slgzwqla/
http://theclaridge.org/wp-includes/blol-1795ky-xmdpc/
http://thehaidars.com/cgi-bin/l1tc-2geoc-juulely/
http://theitvity.com/wp-admin/43hi6d-d8xjykp-oytc/
http://thepennypocket.com/ikpfcip/vs8f-6qgqxq-ihdkadmj/
http://thongtachutbephot.info/wp-content/9cx3-i2cxt-xfcwnsp/
http://thunship.fi/wp-includes/gd947-2buw1-cvsh/
http://todaysincome.com/wp-content/7h8nd5j-2ssh9-jcuyc/
http://topsystemautomacao.com.br/Produtos/3yih-qhhauy-xgzixh/
http://total.org.pl/wp-content/eydpm-exlyx-rjxoa/
http://trainingcleaningservice.com/waerjqd/laq7-p9uy33-cyjhvgada/
http://tranhtuong.top/wp-includes/nfjrbri-kps82at-inzynzk/
http://trusticar.lt/cgi-bin/smc1-dgtz3-gnslysvn/
http://ulco.tv/1v7wu20/8ke0q-lxmwr-kwxn/
http://umshopmall.com/wp-includes/ofq3-8jf01-lcbziwfc/
http://upwitch.com/wp-includes/l0tqz-kpj8u-wbnrochs/
http://uscsigorta.com/wordpress/h9nc-6ps0e-yfqedxqfe/
http://utit.vn/wp-includes/0bs4-l1c5x-ypgzxqk/
http://uxconfbb.labbs.com.br/wp-admin/pqfuq-gs3qw-qrfxnsv/
http://vinhchau.net/ngocvan/qxwa3-90zewe4-mvjpriy/
http://vldk.life/wp-content/1fwbw0-vrhqsga-dqgcfdo/
http://vnv.dance/wordpress/ukkb-od3d0a-kvugekta/
http://wedowebsite.ca/y0r06fd/a7lj-x02nz-lfmlhw/
http://weisbergweb.com/lxPU-3j60nDONL_Sy-66/gzlvc-m1nkv-naxyc/
http://woofaa.cn/wp-admin/q9mv-ofau9-fukesbx/
http://wpldjxxxua.ga/wp-content/7r5u-w654yw-lefjakrjb/
http://www.1080wallpapers.xyz/tvcgyma/uic8-ujxza4-awofezlm/
http://www.donghuongkiengiang.com/wp-admin/cdxm-4dmlem-apal/
http://www.handbuiltapps.com/wp-content/w3tc-config/oinz-ejykf-cwltfngf/
http://www.hotels-vercors.com/stats/97vgeb-78jzwj-oryjrz/
http://www.i3program.org/wp-snapshots/e05o-2xz787-owuimq/
http://www.idealjackets.com/wp-admin/6vap5-1igm7-oxxxjh/
http://www.irqureshi.com/wordpress/wp-content/72ww5x-i3e1zf-uhjxwce/
http://www.karaoke-honeybee.com/ztbr/d5bbc02-8tze05-dthg/
http://www.koehler-cosmetic.de/wp-content/a244r-y9ohc4-mbbeo/
http://www.lojasereviver.com/cgi-bin/1ybe-q4x1u-bqifep/
http://www.monfoodland.mn/wp-admin/1zgq-1fibo-fzaqgxh/
http://www.psc-prosupport.jp/wp/zb9qa-alzmbw-urgb/
http://www.shinespins.com/wp-content/7088-fn5aye-hekldt/
http://www.smilefy.com/it3fqqo/lcrsd-d2qpq-yixdwk/
http://www.webliu.top/wp-includes/wr5bmyx-fernh-tidwmzn/
http://www.ysfweb.com/wp-admin/5ghq-d48en-igkode/
http://xn--bp8hu0b.ws/wp-content/5t6c5-6mz2wz6-qibv/
http://xn--nmq177o11e.xn--6qq986b3xl/wp-admin/gymbg-obdbf8-avkf/
http://xploramerica.com/roct/ny9rr-d21r9s-moxqao/
http://yadep.ru/wp-admin/xuhif-2rds7-zrpwq/
http://yallagul.com/wp-admin/t4l1-vq4xf-inxv/
http://zairehair.com.br/wp-admin/dlc51-7ws12e-cutccjm/
http://zakatandsadaqat.org.ng/otycixa/rhu6-2g4lgw-jfmno/
http://zona-h.com/wp-admin/r8bx5-69sc3-xigws/
https://1040mfs.com/wp-admin/8fd61-zjg0m-vkyo/
https://abi.com.vn/BaoMat/8bklf-t2r3z-bthqpzsyt/
https://ahmadrosyid.com/_layouts/jrhgs-8u7bdp-fejrzkotb/
https://amaiworks.com/wp/tn7a-opg7l-rstfub/
https://asis.co.th/cisco-sg300/8leo-kxoz2a8-msiq/
https://asis.co.th/cisco-sg300/9tiw-qr96pq-ngmxwrj/
https://boymockup.uteeni.com/nbrm/3hzxf1r-25x9y-mmkio/
https://brightervisionsites30.com/wp-content/0opr-elb0mx-mkzsjmt/
https://ccontent.pro/psmc9yj/8x6u9-ak8gj-pyywgjplq/
https://click.senate.go.th/wp-content/uploads/2019/5kf9xg-1ew5g4j-ajij/
https://creatoruldevise.ro/img/3skh-pghlwa-lnrd/
https://elevituc.vn/old/csom-9kdwt-rvpgjwouo/
https://elmatemati.co/wp-includes/prei-h65j4-xnbao/
https://etprimewomenawards.com/apply2/uploads/2v2n-rpiiw3-zsrbujpsd/
https://euforikoi.xyz/application/wzoo-k6txu-zyjfxokwc/
https://evytech.co.il/wp-admin/7u6y-7qmp0-edbhdoj/
https://evytech.co.il/wp-admin/7u6y-7qmp0-edbhdoj/)/
https://ewoij.xyz/250iox-6ww52-uxrgzcd/
https://flikh.com/flikh/6718-yp53b-vlpzyo/
https://flikh.com/flikh/dqmlb-a671a-tcak/
https://freshradio.cc/wp/z0em-mvp0s8-hmnvtn/
https://gid58.ru/cgi-bin/vhr1-q7gt6-fbfwgg/
https://gilsanbus.com/wp-includes/vvdav-nxbrs-umreykyl/
https://hangtrentroi.com/s/g5a1-4zuh28-emygdo/
https://healthandenvironmentonline.com/inpiv6s/tcw4-s7l0x95-ywzy/
https://hjemmesidevagten.dk/wp-admin/l73w7yt-w4yf6b-vtotlko/
https://horseshows.io/c2nkrlt/wm1f4-ozg75-eqdvotudf/
https://ieatghana.com/nycm/lgv0-si28jw-jjxcis/
https://ilimler.net/wp-includes/ouen-arhq1a-alhko/
https://informativohainero.com/admin/owttd-vemyo08-ciie/
https://intrinitymp.com/site/163qa5i-cw6oj-ngioh/
https://jerryshomes.com/vendor/667n-m3xe8-ryzeegmp/
https://kebulak.com/puppies/7y17w-6mb1ih-hucpj/
https://kitakami-fukushi.ac.jp/wp-admin/8x324v2-zlz81-djrtueq/
https://k-kyouei.co.jp/peosqaa/a4i7b1-u5o45b-rcehr/
https://knsgrup.com/wp-admin/k034-erx2n-ohfjdxvgv/
https://kovar.sbdev.io/xhol/yr38-j1tvm-iuotaujr/
https://ksoncrossfit.com/rylawpc/7ys1-3pc4x1-lhezgcfmo/
https://lab.ydigital.asia/steve/uees-g2v0eij-dxxj/
https://lagucover.xyz/8agtetk/hp6jh-umij6p-rdxg/
https://lockedincareers.com/stats/izsx-w1jh7v-dldxpuhf/
https://marketing-mm.com/wp-includes/h3cz8-yyppwy-hxmpprdw/
https://myphamthienthao.com/wp-admin/w91c-njm03-hrdflnasg/
https://nhuakythuatvaphugia.com/wp-includes/wnw7-psnv4-pjhk/
https://projectconsultingservices.in/1/p8ncs-egjpf-guuy/
https://rmhwclinic.com/wp-content/0jpz6-5ghbm-xdnbyf/
https://rozhan-hse.com/wp-includes/deo7t-dcaum4-fykaarrdt/
https://rssdefense.com/wp/ndkd-vz3emo-vnlfoxuec/
https://sankaraa.com/our-customers/kbw7-6j5qw8-nvjphhk/
https://smblouse.com/cozayg4/9xwpi-0kekjp-fybn/
https://sukmagedoan.com/files/0ef5-p22er-djded/
https://tainhacchuong.online/uploads/rvltq-bt8plw-pqjydib/
https://tanphuchung.vn/cgi-bin/qkadt-tmizk-nmoc/
https://taynguyen.dulichvietnam.com.vn/wp-includes/js/tinymce/priceLib/8ix7-f166qm-pfkgwtql/
https://test.danalaven.com/bs24rqv/3rk1q-hwh25u-ymtshbhc/
https://thaddeusarmstrong.com/wp-content/txxwd-me7gh-slgzwqla/
https://theitvity.com/wp-admin/43hi6d-d8xjykp-oytc/
https://therecipe.co/ec/tevnw-kduad-jxqqjy/
https://thongtachutbephot.info/wp-content/9cx3-i2cxt-xfcwnsp/
https://thoughtchampion.com/wp-admin/hv2f-wgw5o5-pbtnfciwx/
https://thunship.fi/wp-includes/gd947-2buw1-cvsh/
https://time-goldisnew.press/wp-admin/kklk-o6nh6-bkqe/
https://trainingcleaningservice.com/waerjqd/laq7-p9uy33-cyjhvgada/
https://trimkings.com.au/videos/k6qj-emjl3z-kdvxbzec/
https://utit.vn/wp-includes/0bs4-l1c5x-ypgzxqk/
https://vinafruit.net/dckd4o0/4glcc-v7lx8-tugfjo/
https://vinhchau.net/ngocvan/qxwa3-90zewe4-mvjpriy/
https://vldk.life/wp-content/1fwbw0-vrhqsga-dqgcfdo/
https://vtr.kz/vir/h7tgk-jzsjb-hvmnmfvn/
https://wasteartstudio.com/files/le3lc-yfgxn3-sncdgk/
https://whimerie.com/crop-image/pjt6g-p8gbr-jemsli/
https://wp.radio614.org/wwscsei/ceuq9-ardv37-nuejjn/
https://www.grameenshoppers.com/old-site/ba9u-emivu-pxcedhq/
https://www.handbuiltapps.com/wp-content/w3tc-config/oinz-ejykf-cwltfngf/
https://www.idealjackets.com/wp-admin/6vap5-1igm7-oxxxjh/
https://www.kuy-ah.id/megabusbandung.com/kq6f-p7168w-brnlvtpz/
https://www.lagucover.xyz/8agtetk/hp6jh-umij6p-rdxg/
https://www.la-reparation-galaxy.fr/wp-admin/zdw1p-m4hfm-gymmip/
https://www.lojasereviver.com/cgi-bin/1ybe-q4x1u-bqifep/
https://www.psc-prosupport.jp/wp/zb9qa-alzmbw-urgb/
https://www.studiowideangle.com/wp-content/ptpu6-2jhhjl-kuqvxtvhm/
https://www.techekt.ml/backuptechekt/t0df-behcd-wyfamraoz/
https://www.ucuzbitcoinal.com/wp-includes/molc-kwo5f-ngzw/
https://www.webliu.top/wp-includes/wr5bmyx-fernh-tidwmzn/
https://www.ysfweb.com/wp-admin/5ghq-d48en-igkode/
https://wzydw.com/wp-content/uploads/bu5z-9y1uo-xaoifl/
https://xn--bp8hu0b.ws/wp-content/5t6c5-6mz2wz6-qibv/
https://xploramerica.com/roct/ny9rr-d21r9s-moxqao/
https://yallagul.com/wp-admin/t4l1-vq4xf-inxv/
https://zahirbanjarmasin.com/wp-includes/iv7p0-qmpdja-qjhytrqb/
https://zahirbanjarmasin.com/wp-includes/xebl-ndtt0q-livk/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-14 20:31:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
298405314ab2b46b80efda533ffcf2b5e92584baff5c87b17fbfd3b5b7093b3f
6987ee92b404bf4dfc698ed37c4d6547b577b65658edfb6ce5fd68558f369a11
e7cec0c1e38ddd872cdca6da84ab406daab78cff6a250b7213e7b9596f3ecfc2
e8c39618254a95178165840c0526e7392e89732bbf8e0753cb8b3f14165f3bb5
3ada73c610cef94aa2e3ef6b6a0d9ea835895f4bc19ec32f6e3508c5b43e84c7
4668b7f974f775d249b8be01939690872e95ad042e329d57592aac2b825c6cd8
c2814811582584f19e9c0a779354149bb7c334bd12ec7b6dfc7300b6817c3557
28022a215b0f681b76943cc9fc6f9e1f2c64cc67b9b75e70aa444d226a00eacf
7fd654a123f117fb2c1c0827b25c52b4147aa880111399fc6c05fe11d1a63299
73c754c33b47e9e4295b6a035b55cab8451855e5a3df5f33042087d1440b09ad
7f06200e6d8a88ab22aad92c2860a6b4751a13a997a379785ccc5413af273b46
dacfc2496b0464d3bc29d95c0cf3cf67560d631c769c7a0692d10edc384da835
c1623d2b2e1fdca5a5bcdf4f52905072f4d78b2194c7d65d5ab85e2fc71284f5
71b06b15649960e7540ffc5c8ee111d3522e969c8d2207e967fc009e2c906321
2a0abc135cb7e2b2131b838babfbf4cef210ab2609fd0f964ba92bc14e69a6b4
b063bfd0b93101229534a7ff69e1bef6ead5f51091f0b0ecea450deece99e2db
1b382931218e4adee9bec367b378dd97983695af76e0e195e62fd52064c82727
db344ee03d043efadc48cc86f6b675b07dd20cc7252e9adc59d52a95b6dea95b
ac9e016b1771afbbcae60da0e2393354c46bb8c4918716c510da50357894ddb5
d9906755f505fcd060c4672d7977e82d21863eb023b58fbd82954243c840118a
03bb3621b7ec92fb8f86111e1d77b5f42e2cc77ffac76860f368ea20676ac8dd
2b1299c5f8decdff75dc37ef25e7abebfed25e9287e2ba37177d242c6667696c
beaf5d744c87e53630c8fc5095678775a5786de350538409b82ebf3181a7d4fa
f17281896f0814a69d2e68a99f95d2d48003da959cd798735705bf2fc4d030e8
b630ac19071b35931abc47fb04f0a6ba6ecba18bd41e2ab461db7491ec0ef2f9
de5f54d25e4820856ab34b7394561937ad365efbd712c4c090b0cff6a11e0e6b
db12bd01917d9d2395c3c5b37b344c542975062850b3828876c9fe6a2e0cadb8
3a38e8a5483c9fcf4c1698acc4e1b174c14b55e16403f8134f71ef8d89353726
4d475b91d09d23a122ecad9f46f648e5017ab569ae705682a1adcc6c22df794e
3f4cf74bb6b1face65af2e5b2f7897072a59dd10b2dea2568327098de5e13ad9
00c1ed0fb173c266b5a3135fb548b3280477d5f712dcf8ee6a6030927d804270

https://tuvancondotelarena.com/z18rrbu/DQa/
http://toolbeltonline.com/wp-content/uploads/368n/
http://territoriomapache.com/wp-admin/bEkL/
https://www.thebakingtree.com/s75ldvl/NW7Zz/
http://tgmsc.com/0t418lt/NIq/

Creation Time	2019-03-14 14:54:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
032bba8fc5b50e983cf7dc3a026a6abc6bdcaf836a3db80201bceb8389131a1a
9185132f689a984dd6a9af9d071f5fa70ba158b72421eeb8b5181814e04cc1e5
6082582f55df7baa2e1556ecef332c817cf4f7fa6f63a25953f7423c4a76721e
190a43874e8c841b9aeb4c134e5c16958f476d82b5bbd0781ecef7b236f18814
ae6b0e3a3c69dfd01719ffef807998fd369ce35cec86d8c00d58299f52ef6a7b
85eddd3f6f7d4ba988e290107a5fc3dd1227e5b77fa83bdce67f8b5259052ddf
6e8b7dafb2026f4529e1a3e1b346a9216ffb695a23d9cd1d643778f1a7fd2192
a4f6139816fe7a7fd9be197afa83463f88f8d716a0abcd1a936bc6ef9fb5f23d
103ad4fcc7e9d7c0ee8258fa53b5fb2cfd52a7cf73fd3639e5399b8b8cc95322
72f28b1b69d7c9c10d73bc79a8991e135ec73a51e1987bc425dd0166e2cce668
fe851abf4da0f483927bffeddbdaa5ebd5d62e8daa7130be2a098acd718d914d
2119eab2db52a7c73a2755c84f25f11b591a336f3754d3c0e4153d3c12e6bce9
736e6ac877fd4d043ee8572a7d5a73ef7d1cf3b1d6719e4cb69eac62a975adf5
f5b0ac70e785424496eadc9329962b5b6fb37c67955b9895f4d186ac9c26b868
a47ae1cfff2e1905c52e0b003da82c85a31888f12abaf0529aa6e2e6ed12c79e
c4b8cdb793a5ea94bfa5dbb4e1fb8e6876df9b2842c8254c6d51f6162c5e25b2
ac391132c0e2baac63c838867214a0c45345e82fbbb3ddb765d1a8a7dab7a034
cc3f692f3594f6db8a0727f7199169535ffbf6227f7936a72b6b0ca1ea8f1a47
3451a2d2ed99ca9bb02ef7c05d80b389b08d351071f9e87c56dffbfff6199b8b
dabcac2bec47c9b62ecea09295ba36ec63f7718a359ecc363c72312ff964d22b
c2cccd7fafc6e21c7d024602be8ed99c6e0d6cde408fd301eced81ca16e3f6c3
dafd680c94d3342d03a839cc2426ff30918e9e5d635982ffb276cd15fde54824
f271048a6fb8212fe50c42bf9c6608d97a1de1b2c8b1f9cab9f1962fbedc3312
a82ac91e904649134fd6f8849bfb21b13f86311b8896313dc046b4b430a1a52e
92b0e057ab6db7ec683f589b00a79316c0691784e1db38188d3fa57a18aa3169
788ec3f0ba74bda45a6f9539c50166eade8ce6d4f98cc2f4ea3b3bf1d5ec090d
ebbe02073b2dfc4be3d39adc3081753e7b9c45e84cd7d4d0e8faffb61c38dff6
ab4e8bfe934a99a4233434006a3ec80afd25f1855c6003472b7b4da739eeff20

https://www.yanjiaozhan.com/wp-includes/f0c/
http://uzeyirpeygamber.com/wp-admin/nH4/
http://navewindre.xyz/wp2/wp-content/ktVWQ8/
http://superschoolstore.com/old/nuB9/
http://iryna.biz/wp/7E8gM/

Creation Time	2019-03-14 06:50:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
a6310575fc2e5dd38f5bd09f3a48d0dd2a78ebbe8490faeadfda335b1ac29e69
45618c5e559c9153454d0418e3d8c5f3931eca4a21ffcab5839055bccdfa9c6b
02fc347726000148699c3e29a51adbc40c141d64c57b2044ea381bc76f03a49c
c7d754e69ffbe5b557be828ccc20b2f542322d1c621def297fa7485ac1f0c1c9
8130a41e0a62eacc0edc4ad4e23fffefe9e2afc3002a8831545c6d9d595e2048
1f737773ae72828b7b2ae8bd5344a0a6283b2f9208bcef9ad866fff60812beb2
78d716d01aabc6f5978edb1ef7a9009fc034662abf02a9f97b11ef7d34f9cd26
1dee03b761e67dff40fb470afe9a57a935760631c47bdb14c01d6aa9d28c4a6f
ba201ff8308d6c6dcb1d57c3d3b7ba41455a5ad8422364aadab1bbddc4cbf4c2
d9a76c693ca85c2a01a4626a3154a67ae6e3120b5243ccd92d0f0d780896cf65
b1c5275501caf2b65e812161116756f115bc7147719ff9089e712ba997cbd5e8
41649b8bd47f27848977ec9ac4d56f5c857f9bd73821867658762192ea97d8d2
2b51843fdd85f5e217aea090113149464ad2ce5953f06867ed6d6fe0a2b473c8
28c42f05f014b12a1649fd7813f3105ae4358a0facc8e8b95bc982a67c8f8f57
7371b0d290cdc3e0e91452b1b4a72c6976b5ba0340b1cb219f7bfa7a5aa386ed
afa6a91d56b2b7ad44ddaa388df8f223bac04f5d9e2cbd71cc5b2c1789348150
a81db02bf914f53e9965b7a96b734b224ba9e91e871c14c4e2d1eb442859ca2b
b373066fc3a462ecd0d0741d335743cf9cf6e8d6ec7a575dac81f5ce3b855072
20f4d7bb58808c0ef7d6dfd9b899e5170999f94808700b7e4bdac25fde87e9d7
1bcaabbe07c8ec65ba643402271b2c248a997fa58db616a1388ac4469480d402
9e61468767b57da2e1d5063bf0c51e11259c84ed11600cfc2621657bb0e046b8
04baa92a5b2f81cc2888e6966f77d9b707b37d029207888d28693e9e4c7b3b63
a7d335913445ae1807fdd9f4664b7d7e8cf9d5b9abe70ea482e0280fd197b97f
eb24bfed85d8ae692c935de4dd07f4a409057aaa49774a2d2d17b648fff18034
61cd65890ec3a1bf8c5d5d93f8e5e7463246c281d9042dc91d0c258c22c6d72c
008316b843e229cd893d0a6f2a497e69fff4797ca6ee8ad41782a7db0757ddf7
1da577cc36113f342fb1d47d9f75056ca7792c1cc40aa38be150f4554c0cdf65
1da577cc36113f342fb1d47d9f75056ca7792c1cc40aa38be150f4554c0cdf65
34dd1fe0374ce3e969229223ea1692a1c0d345d92a186f54e310ca4952fbac3a
5f9566138e350135ffa42ea776ef56c5c73488d0b9f7604adf3a52e679dc8822
83453db0b74fdf3f9381e7ff66c2296e0368ff2a86e58b940cf4c4de3382585c
7f5b8f1002cd444403a0ade885d50a1fd1e1ba3d2e36e2f79c46c6f9778965d9
f732d4683d065e2d367cd56e0d297e145f8a282bf68a5a7399bc4ca2800161ba
af878f53830935a89349e7b26dc0a8d2b3f8a1edfb66783ab7a0ce0bc8807805
e17456b3ba80a732e848481b3142fc332f08db3db7135d80cb29eb6a355c09c9
67142a582216486df7ea2c9b01f81af08c342bc34daedeff93d4bc8c9b5d3ee2
220b22b969d2b92cdc53d74baf8cbbfd82d772eceec10004ef683f96d66fe1be
ca99260e9f2c08cd1bcfcb817a8e5897402615415a2e7c195f008e6bf5b4a335
685ddee079e74a549c0c6784a626b7c065cb26d9a9877ecabbf524dd0702c5d9

http://ngkidshop.com/wp-content/Vtm8/
http://cnfamilywealth.com/css/pu/
http://159.65.47.211/wp-content/uploads/suhn/
http://dzyne.net/jzahb-pnzc6s-oydtsbquq/2a6A5/
http://118.24.109.236/wp-includes/4Pu4/

Creation Time	2019-03-13 20:55:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
459397a134b2b4a201c2855bbb2ed4d1eeda9cc7637d7c65201e0a78217a8780
c060ca7e926c137d2a9b90d0182b288b86117430f8a7614a1bff92b722ee1fa6
c060ca7e926c137d2a9b90d0182b288b86117430f8a7614a1bff92b722ee1fa6
f8218ee2327f0a0d1a545aa4289a62547a4f5c186022939b8e7b7300f5dce0a8
d1c7f942134f76263a65b79372b15eb5c0e2f48d4842c09105836c4be4a8be76
5bb87a0173b861f7790dd1489c31c32f4a5757ddc5186976e06b63bd7ef6c46b
21019fdba804009eae5d26e4341954a66178838fcd0987bc4c5fa6407cf02ea9
561b5e6ed0be4a0d73063bab95cee962c10dec9d0df889837d7cfc9876f2d8d3
c2cc283b1dacbd7b0adcbe069aff437c1fc7c93ffd2d3bad152333301e1ca913
649bb7107a06b05284c26bbddcf1ac7b7178081cfa5fe6555cf3a36ff1fb6856
a97fa9403745a0870ce9825e8b6d5591b53dfa935e52e09d874f9118a661207f
e5cccae034b70600078ceffa36bc978f093a812398bbe75ad33b057ae3f50d49
d1f2d6371dac7d666a0286551b68bf5bff6fd0c105a36c602272b7a33a8f90ec
a4b0538364ea5b39b92022bc5a4ba0dfc73e17b407e98d29b2de968586f1b42b
99886b194a90abc88812eee1fa28a9a4fc18c103855fc8d972766524c7c6ef5d
f307734cb3bed7d13b9a497d3388eed0aba98bd1618c2419a4c72fe609006c06
8de3f82c3775e3c0b38daa26bc3f7b7a6cc6a67ad8d99b02f92bc5e0da60263c
984e46e8b29172a632f76dbeaa82b0188a563d25e9862f6d8d725ef4e1823a85
9f121e7e36b53ee05c9514868ff7bf9ac111bf4c37d39e00927a50417d6e042a
f856dcad62f7192f9fc5bf924ff8a7bdefa1036c5672a9a6d5b1052bbecd9ebf
f3ecf08abb0b2523b110c78e58e554a0e0acc75f83af11326b628d068aa58d3c
000476cef7ce5d5a1cb3a1ed4f4d8f261cb2394df4a759f9aba2c6be58164331
dc2d7d84c882fbcb016241f24c84e12a57310517357d87b6733cc697bacbfa02
c818398d17982116d2a5d29d33c44c5af6feed867a8caa639c78aca1c1ba362b
807dcf4834bfaa4587ab4cf4ae71fd1c0d1f64b67dfc9341e001b1efb6b1e949
9688017da94967bee0abaed3a776532c84aeef410c40dcdfb477c2060b05248e
8481adc2004a97bbc07bbc47f6601a7e7639b6e037e797686dd1a8d159264b2d
78d791edc7d71e6fc275a9bc93e66a58934f4cd2ad6b5468cb021d1fbd0d13c7
dc87d93d01f22c38de94079e6eb4fe5e97001b37753be5a5c503fcf36ad4f528
312ffe5cf618e82bbe2ab1a4425b6c2927319b52c0d440721a97f3eda519f145
8f03a01f8f47e53607f1a6a9297a246e336df4ea26d62a8560652bae569a3fb6
c4bad470544e10dd6cced30cd7401a15d69dafb03d07c65cc08f4d20d4b5bf58
2e93e7c34ebf56a7df68553db3978fe84969e0689f6df6fd66f04209d2a6efa8
04e5044ec07d08ddfcf21f295befc3a633824c74a62aa8ab701a8a1928e95cd2
a51704c674881ecea35f356a5752d350beb4fd262fd2d497d12632c7e966681b
0d5981ea8f3a35516b953b2a7388228ecc2f89da80fec3ac5b13dba11145edac
42a2583e3e1d624482f525e388ca5aa9a13f7f9759c10712879280a105b0f47d
17afdf7759ed22dab50bc59c3577df7d3ede2098f7d1cfeda4d52a34b6b0b00a
1de033897656da4d0da38e639e78de54d3a98a93d3439787fe2eea65024cd960
baa05ce9d41917c1998e4d992ade31e001f94bbbeebd941c8d0f4b9b37176f8b

https://webalanadi.com/u2go5i4/HIoJ3/
https://heritagemaritimeservices.com/wp/pKKS9/
https://webspeedtech.com/i1kk0xi/lv2/
https://pjk3indotraining.com/sendinc/vDRz/
http://turkmega.net/wp-content/8po6/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 03/14/19 ####
```

5aaa7b47e03b4883016f4cc54e0ab908beee8a54e5a2058f7f9cde3dbe893aca
d5c3adafacd86bed9c4f02aa3d0ec14ef79f81767285f4dbeaa3e86768d65b5a
7f75052b03d64fa42d05ed0afe34247b8d7122c2eb317ec1c499952d0a69dd58
5f7a33f4423f9d255a64709e2fdd1008f9462cc83dc3d7c29f33603b38f604c9
a1fbb29614204c6522b44e0c6541d89671d8a407aa6e0a223a66b7d4a3061439
bdb0df1774c43298c4ead8a5fd6e73e62e81a4eb7070526e606ac57d493191ea
8cea750307227cb351e8680b08edd3c4c57934cf3405757ba69b7ab77d68221a
c13d7fb43e01e0a5a9db03ff31e2060990a3f8a068a42cb0c63a05e1cdc119f6
ead850aa18cb6b4f65fc961e7d157b3917f989b50c48398033cb741eeffc6c4f
7bbf64c60d03945808c53da3c09cd9e48991d6b38d2b3f36851ce457a6d18ade
1a95968467012cbed7e273be5b9c93c6e199f45fef88897333b116ab1fd29819
60e9ff9466569ea2d3b27fcda1a780a51413642915c936e41ca407dbb7312095
2fd1d071496ae46e9998181e2c6a77a20a02928cc0b2e665cc9217a0573320c5
90436a23d3340055ff4b5b7f0d7cbf7ff5d3a87ed9e0a6d74084790547860d51
02fe87450fa1c53f9c0d97a069f6438310a7c92cc16a282df40f398c1b0e0be2
1c00d7705c6aeb1c97869618b82b39bfbfee7f699c2fd1f9d3e997754f71256d
c0aeb3c739809532ee9d6eba5a6249028a6a9b008da486df06c3af9befbf81fd
72bf1b0aaacd8f97d9c5251dce3a7591df148cabc28cc3d99599149ee71243b2
b19c3a9f5839637fd33694a7644217ad0c5a73321b2134a984fdb2238317bb6b
4e32cf936d187fc07378a1e2bfa756d507f0575d91e621495c15f531542be2ec
2027e411aaaa85f4d0cb98d739ad0bb9d3dbc7e7c9961812c6335bdcf1c55d88
5ea41afbf36bda52eec99f60d043fc61fdb4c77f615a4feef0a7bc8096f3f504
5e1af19ef1065505856a16915992b31cc6681fa39247b0093b58775d8a790179
5275875bc80d5039328232d24cfe60e4db6e1e31e606abf1b38d00e13f4e155a
8dab1b7e92c2bbbcb29e524496fe4e864edaa98b6bfd9de78aee6a70c97b187c
1160f1fc02dcc1e28087f1d0ee5aca2566cca0e28d0faa012fbfc770b3dbe98d
a778e64999ded84f5d332da7c4ed428468a6d1cc9585adc03481387f9a534a00
61cd250b58420a61a5c2adf579cd796c1e3c8416e2cec30a4efbb1aac439c1b6
0370730dcec45b388dbcb80ce8da090bd53990f5f7fe8b5c660bba0d038bdcc3
2d681e9ae8e35eab12a1549d2bb598c738d92b74f534ec1c6c7a34baae3baaa9
ffb7934ba175c0e1fc6090aa36dc8b03e990b723ea7f9761239382e3c49f6afa
2395efa3f93f82665d2657bdd72bd8c442f4ad810d0ce73d997555910e8ccdbe
9e8ec93bc3f5ab1bb4eca9876a262797f94ad21ddb1858509d3b80e0505bef8d
9127e72a6fd697f54f4cf38bbef340e742804be39d87f67d7ecdf2b0acb6274d
a8f54d7644cf81ad16b72bde5786c496f21b282e68d957fb70c4b51f8b3b9bd7
51b9c2ef31ae9da4a16cfdd4e165c5e4ccc121aba285787515a638568af6341d
b8602812959cc580b32a878d2a1b5334ee22f39578751334e0413916d7aec80f
0aec6477d1623452d7e485a1d29d3a77508be32345e6f15aa100f30860bfdded
71c0c2b5ae203d0215810ca271a1c248f7c3d2e811fd0ea8cc0d48b1bd070179
030d73649424629f0c686b346b0fe1e0dc0a3349649c16ff1cce57e462b5a3cd
27236b6af1e0676f381c9a917c7d870099fc4a0e133dc9dba786792bdc1433e2
8e2dc1eba135283c0fef8ac425e413bd736773d16442bd33050db10a9d1a056e
dab64cd58b4bd5d9baf41bcb992d5f5943770646a3b0b6151f8f4a89ffd1b1ea
e44d3dc2a07fc182396cd0dd54e76908d076883be4b19ae7a7d67e8a9e6fc640
c801f9e3fda6feef6baad75fdafa4c8b83c17d40bb0a584501cbdb2068f596b3
822343a777a3ccc4e465fd21dd293ccc5da7495c69a17dc7232d8759423087ec
3f3b36e9c66399e90ed1c03fa188b389bee6263f10ad0f7e9d4b3670325ee612
ba208748f1181f2afdb705b78b8f2875f9a864c22df66f3f44d7d7ff7f1e417e
6e3d925170c3b4b498101df88b189cd435ace2a327a5847525421886278addd2
76d92912030b9ff18e3fb7b236ef1bff8933b631e328b6223a7300c3a56af713
29e96fb7e2925da29fa8850739cc2a23416408474a441bed6096e85bfd70121b
6d36997229a280149dc09d14e8c95c0c69cf09d97d3cad285cf2c3edee46d6bf
2bac99c686a7e6b7be41fb39f218855e9c93eaf5ac20197c0336dfba3542aa73
ab4414564be6ac8f5384d8b02255f3fa411f4393d89092bea85f6fb35aaf53f8
63b9d2e986f7375ed96c5da213a1167ec2cd2faa1c028bc94b5bf5cfd4b2a54c
5625588feaa885413bbaff92ab2aafae80c6f4fe35d02782b73a8fcc7a5e6b08
4072c0e6df9b00c247b6e40d12b45ab957d0f8fb5e063a83945f0cfd374db685
e87335918aa7699ea21163fcbb5c092cce2c3ce315339cd6f1a5d2b49f40ee23
4823687717c31a6f14e80682a94c38a7b8303c718ee6ab343640c1c4cd5a8c78
5dd59dd538bcefde3d3f914a7834dc374b97260928d08720c33f0419c7c5c365
0a6c48266af7944520300d24beda4e41a1781fa870e701c1e19aaa8497d0852d
5539544fff769e075e1e4001241bf99f50ae54522860820d927f5a70046a49b7
5d19da495343e56995bdaf42243f586cfc2d0fbcd0083a0723a673f6d505bfb0
7218993e1163f824a450cd8f997483ead16982e89c82000f3c3a90731dc0320b
37e629ea5097b81c5e0a6de546003955ba56f2ac46eb0d125dfba2b1887b6a51
09160f0aae57d08465220b38564145642c38e99ba27174356eae3229922ed187
894086b75688a1108d0a73f49ad12ca19f718c142222836980293422fba1c172
b3a8a530b7c7e481d6516e001dbb9f0caafd8b0efaa368a1fac142a6ff8517ed
6e6a3b2182069da78680c31ed30cd55d029da68551c2db6d26fbac103b04eba8
4e3faf451041d8a03cbe71e4a05a9fe66cf87a4f22ccfc6c108d5425e8c7191e
130e254a13742a3a55eb8a0b6ce6cad6e3f7f70b170fb051be4b14b41f0e41f2
08953d60d21080b41946415c0f5a3a15b0630a0b20339f4ab88cfdb0ff31560b
de3841cd0ab0001fdfd28a4f3fd15d5d20c09629f7857642083e95fa9b716364
ee21917b1596852818813250aa9a5ee37e87f7ca43120e17f09f940d058c1557
895ca7a117fba8a710ffa11055df4b88a73a44dec199ef1973471701f5f17726
d626aacbbd26f0c7d5baee7fd6e49ee8ae2aed7c6352d39ac25134e9985400c6
d86584f92b6af0bfde4a4720878d5ad64f6d8c295b61f5cc345b2fcfa952758e
ce02af48d799e21d832c1dca0607e583c5870ebe179b3c096c3a54d7431c7ca7
98d752dc5874bfaa2739aeb0b83e5ca0c00624d86db827422070a9da9b69d866
022d00d614338ac8e437fd735dab85097d2743a0e4d4e2b9e7e3f1727fb73e26
1e7b0711ea10e083bbf4ed19b798cb4016a8d7cbcb61b94e56290c9ea954e66e
5c5acd7e82fb19bfa8a9759c1fc51e93acffb579661fc9b4455fa2f87fd05089
f75984cfa2bb3c33629e71565da34a8af4b087acf91a19b1dca7481d7adff22b
7b124522b276e8e7ac3e7bf332b7d153902b257119c33082e5fb97f529635d8d
baffded947b9179545a8792871fae5a0b57425cd62a94e0d7dc16b7b2525a5c8
60234752a28355b39c1fee9788bbb22b9e257e56d9a178b28b4f1c6a71990ed4
77a5bc84a5be4def68a699b95364a83fee890182b9ea786dadac7843af047c3c
863f875586afd75b34c38ad0451959ee648c870a56ce97b392391e7eb25274e6
29d971f790f31f3749e8b82b80b62b8f528f28174f2923b58c7032abb13da07f
ef0bed98d6f616aff66f9057a7539fcd9a610e9b84ac0f2ddd583e3ee77e2939
9de3f30a6de4e1bca82b22f12982f6600764be38fd29f2ecf162c79bcf977dff
8cd8922d29ea60faf1076082815611ce7787d8cd36d954dee45ff20b170ee52b
d8199db09a16c0f851cb3dde4fc06183d23650295836d1a24c4d868af5acc7e3
49901c6e92224c150f8ee2a3b0ac070994b8c2c0b983c8d570b689227af501bb
065f32411db332bb6bba294bcbc7ff3250fcfaa8626648d48b67564be9ed99fb
0597f7ab25ef6f29165e7d6485828342f282bc2b3b0ce7308e08f83df1e0a597
516efab4a4db7b95341c6a561b3191e4e2ad6ed63b2305724998a00f2ad95860
b681565893796b7147bdeeabae464bf847ac52118ba86752f9b4e31497f7d088
23366809d729f79d799bdeae6c1ac940acea3b44d3938c5ee24058adf7092dfa
a23ec414050101d59d86882af4b08352b69127cd2cec22b9037ee2d5468293c5
42aa5262d90aa2674d92cb7983c3fceca8f1d7858980012567d713d0a0052462
3ded6a6d106453e18c0b9e105c2958555cf9e64d6a385eae9288ea4c9382dd7e
206068cecaf6cbae480d5e78586f631125463d8bdb108e6f00e021afd8f52f5e
21784d7b810861d07345f96a144a80d1cc8772220f5eb1ca3d858c6f74403d13
a1a218d04238e14c5d1c97cb539a6f1d105e559fd6fd1ba86aa3cccd1af1e6e5
2c885c8bc6710f04f7da80ce7b16afa847e0126e6edd0a6b4dcd3acbaae84149
48955b9c5bc8171e00950576b342500551009fcb9bfceb7c2ee8726340f1a05c
e77b28036819813a8ac3eec8ea6ffef7494bae2d6c77fac2b40a39e71c510828
9796b197c3fc64060c3ef127d761efea85d5c5141de24fd523f983791bbbdbe0
d84f1c8a95d3032306ed8b289b8de4ce66d210633ad5c9775c05a77779547d93
312526f2b4a6f7561b36909208e72938479336fbdef8434ae7e7f90cf691f81f
1d67bf77fff4a7689a2f47b09e9037990975e8d9a0c4662a57e9289887080941
252a3fa3034c996bab274046262306d95ce8021fdbd608ba239a61e4a66c2fea
bfb98b4f11a67d318b673334bf7f2f570fc9f19f21109936ba89759ccc221b48
5be0baaf0ceef97d164ab686096e0282b965e56f5bc3c590d6e42d4e4ee95437
1b9bb27fd2ce4f34b73fdaec6fc1ee5f7e38256dff436f8e4f393eba5cf4934e
8561d2615682a30cd8878916466e049364bcf2adc26b7aa8ffe1f6c9b09d3dcf
f8dd325d14c667b9d4fb85cd47836ea85b10bdb30abefc3c490e07039021d465
01f4ec155adcea5c0aa4351deede7e6556f6e982f97b0fe3a4a5022bc7fdbf90
fdabe7455451d59a87941a18817e7ef18e5123ec40f807810e2b1a71be0f4fcc
52eebc92dceb5fc2efe24323ab1414066765e67145dc156a1891c856a0105951
c33e7531f5b70f6ff5edac77bb0988ff094660a8550b4911a2eb8c06f9107271
95b3cf9bf25f806a6789a12b5be21a319c0b8f2ea2592105e5594d6f44b6246c
9a077b9e0c7b01350684ffd0687723d9da6912a8c932a4bb513931ea7fe50e2a
93809ef370a8c557997ccdf2259931ad877b69d11a6598201cdc01d4233415db
b89e531b4bf91686edc75f4f80d0decc551e10cd987b40c592f7e250825383aa
b79a56d3f02dd636fe5a8f1c07a05d397b838780bc190d2b9b249f41fc2b08b4
e6451730e64a72210b05e2ae85cf1160cc0994bb78b8010c68e3cc61f90d3494
ffa0cb5b45df7a33c92c8fc64d1ab1ec6ade9d7abc8aafed71c3917a43a6af4b
b17bff4e87d5bf46816a04e212d36539813ccfc6c2a1aa77fde3e19d777403b3
485b4259e2a0c5931d399e898de23e2ad58fc8dc4cc3952370916f0ab4bed161
1648bf32e8e643b1626ba8a73b8c56e3dfb61a91698f1fa7f264df59b8572bde
ff05173d0a417d53e0e9bcc6576dbb0725beb6cd12fa271834f78b383ea3a134
27b3b1190fca97a4e8c138483ee10bc12b885573c167385d881b6877590b2fba
17fc94c0dc5b96391cf4d6219a210555487123eda20869d4785f5527c7c1c71d
d0944f15e7e3c4f285faee9800f2c8ec5069f34682e542dc7f1d5be160f0c823
d5b35baf6a04d1769100b03189183090c099c33fc59080b9b95af5eeee3f64d8
b03c6d154b9c6e32b442243138b8236b77255fe70f6aca19dd6718ab3556cc28
9ca1df36a1a600ed5b3f7e2f2dc53729527ea137d39ed7bab80afd2945463946
76cad0defa19f8e06284e63d07a6f3f2c990f807175bf26b5d63758cdc0fa5f8
055af7e2d0cac8d13d090d9667081dfdd32807019f8ddee0aa5322703b331928
7f9ee8370e6d39cd4f3903d8e88b41ece6e802024f4c48f226576a2e254adc14
d0a4279f9b3dc07944d267d0707b9b272e2f06f56bf63d67c7cfa7df198c574b
c928843f5160c6302cd6e1310337f3c9ebf84dd9c8cdaa261ec58fa829e22b22
408a51b513b872ebde98767cfdeed93c63f3284c220d5e5840df6640d13ca1f5
b576ad87762a60e9127381cec5a5f1ea61a80fa858f430d90b74cd60af993562
3a5617e9e91d8bc6d0a680cfc3e29bcd800b3e8c1d47fe40f513995802933aa5
fa2de97d91259dd478d504f1b419677b44cf82ac7f627a7c1e1ce0e3d87867fc
7f65770b8695a9e2561a2bd0593cb06572babf1ae2baf249aa73d6e621eaeea3
2f0552c1daf1f5a442039c27ec9570246e500ad323acf63d9b8999d61135b0a9
cb53e1ba3eaaaa724b0bb394a0c3985f7c03befc9a73c5dc41c9e72eee369e15
a81782cb92c2891e16cbc615b99948c53964397afb98ed7b645e8802ce7e3e3e
0847501d8e8523051d54189afee8f4245bfb23b83bc5437e817a0924f22672f7
57fd2b8f603bd19a0c09f22f6d0ae6ed8f2c21b3bd83019c95ce4ea52f32abb9

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-14 20:23:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
74a8910000d81c657beb26f73a668d649c30c6ea1e9867d7086e00d08a1b0c77
cf262f6b2cee7e95b3900bdc19ff12a06a01f262694d0c99c827687556f7b5b5
bd6b0a8c2ba7dd51fd2816f8f4b588a93dbf5f89f52bdce125e309ddb1858433
e9e4cd2f2128f1782443cd369f130a08f0098b21c4abb4ebfcffe9849dbe6d6f
b90e38df9762ced356dcb51126bbc6a51532947e1b1f04f12203679068bf514b
ff40bd95310cba92effbe22a1eae2fc9e198224624f6c590aeefc283187b2e28
25a3edf18876053ba37f18681bc0d32405d0bce2399a7e76f7251e05633e4c88
05f052aca11ad0d1d2dabea4ce046669131b23c30347e864e373bf2f02a84606
cedc85b1d669256b90cb39373cb3c355863f662e49a1bfcc8cca893d2c5efa76
bb8f603dc0e356ac1c4ab5e9c6b8005ecd39a392e681402ad40b5d0cd804f668
28b4db9be8b5f8420b7e6a2129f73f525d6124bb0a009c12eb22e6eedd1584a3
562d5b97c79d21bf2f6ab0bc588c8ee6c2754257451cd48986c86f389f21116c
bcce04516238a62408668fad8574e17813b890503a3f6a79d15c218ba90232eb
b807cf6ef14aaf1772472560882a29022118ee224c27c1500bee0a481539d76e
ec6c34b5caf9381cd07ac2f6ed1320707e64e5ab77b19751d89116d1c81fc00a
32ba942cecac3d19ec25037356f984066cf1d22d609c9eda6765283a237e57b8
76764d3d22bf183e62a16b907edf2a7381571cc7386a39e37718f2643de55ff8
569c99524164a9525b2180f21451f80d90e91098965dcae3db1e854a5c4b8f23
092fc30364d1bc30ba813c65589b8974581b1f13fca93a44c979b67f3ef2dcf8
e44af298e1fb69027db9f6ffcf9b20791065a1debb1809596ab7f9ebca2166b4
1a9e9a743e6cefb2d374a535fc46324207185bfd7825b4b48a941f2652517d7c
720321e902e4cab3268d63dbae83f164286a7d12aa73e6648278fa6b3bfcf644
4313abf129ec8df85b4405839b7d38bcad07414890ce78da5dbf5f56aa496a59
b386e29b91a22090f09e821c0aeb8b171d2b693116d8d95f4a4596788bb59f45
70044d8dc58309606a693e0f5f9dcb7586075da46da06a69def13a995a37489e
5cea0075a5a75595d2b75b84f651fbe3c69241c40845e85452037a03a90c5359
3c3b87897819b700ec830e317fdb2d79448f4d7af9c7b7f831aa554a1989cabe
1bd75b896c0b24b407b13405a901c84eacb952dafa5565c4617777d436417d68
388ca94d387497a4ccc6c2d6df665fe3ccc0e6e57bbef45d64ef654fb2c11a18
6d68a290585c0c8c14872708dc770c050331039ca3e18aba84e769e032171277
4690378f78e894b2f9669c0b86cdc1528e663d77a8987938b70357cd962b3a36
0342e996472cd13ec651c008a23bfaf4728784cf17c726f17d92f6db4f7beb67
afb618b3e57391c0a07ca2a2e8c9080fcdcf2331f4790cb47c3352abab9e8025

https://thanhphotrithuc.com/wp-admin/3bL/
https://www.gcwhoopee.com/cgi-bin/t28/
https://thinknik.ca/wp-includes/FY3B/
https://tinydownload.net/wp-admin/1r41/
http://tr.capers.co/xjoma8v/jb/

Creation Time	2019-03-14 14:23:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
87d748238573658dc6e3fbebafafa3e22006d4f73e6ed60197b70f94d7d662ac
f9380a52275a0b8661bfbdb17992ae6e15d8053f3ee937f2bdaccaa9aa0987e8
742d2d3cd5908d4c5e7730e43181b793512c36df2dcd1e9083e1cc834a885bb3
2c7e6bcd1ca2520a87053ccd01b210a850e6846eba5cf291a53723b75e3e3cf5
dca4d945c877cb761af0260da5444b51786fdfdb0eb4f3fb749ece6ba86bcd80
fec99d5048f8de769828b7bd914c1f3e0598dff06a102ee328798dbd58e22466
f536195233656e0eb03b82aa5ebf58dd17af4aad1aed47d149837a26b93eefca
be50454383891b6b4c8c99bd70bbfcbc9595b2e56ae77d0619a4437dfc4c4ce6
168399973502212b1938656d770f7c8197c3cc6cd45ec9198495a1ccca08c90c
851560c9049919208b320f946eba01ed7133b402ac40824d8039094a45f73719
90b389ea0ad281d78c57b8002497b12c3665f4ecf533785b679a75583bb729ca
6463b40e63fdb8fe75bed1c9c568c990dd6c52c1a772b81a02c9f4c827bf3b2a
7d3089cb9930a9d0c0fdb7d4e5909ee4a9b470476cc9b99e57bb1eefba7cf7b7
3a5cb31558f8cfa9e3d0bc7517b7df7886963cbe63757d308507464855948252
3eb82a4222e85a3bf961d094c19520e14f28142b9b58cc0ad165aaa219c788b8
e2db4bb6197ceb3f7f526b90f798ab50ae9da76d3bb73613d099762a4d9114fd
456159e926a54ef47b04b71e38c1ce18f61497e88eb7d9543b7274cda809018c
b4230f9bf711e4e1e28421129ab0b7933dcc2b9c99d6026e2b74a16d782e6078
2e265dcff1e52fdc87ef63d5fb75575f8521388a4801b770a502dafb4619b229
8b3c8e2a58bfb217575976153da622a16080b631a764aa9c6c0c8d49b4a20f7e
7f601495b0e3cbca55b2019a759af31ae1628ef4cb9706b73322e6640c861e0a
d255e5211b7cae6180d9afec9663c09d4202e217fd2817ce9a63e8ec4467aa53
154153974d0ecf3c75cc6469f6fd4345cc2e652a7c01901e5ba00f299fc64d17
771e28c10f99edfc9b521781812ba97f23cbb55da672049ee7f3cdeaeb039e07
04ca9621f75adf50a9f0bce9ae46d4bc7d800c7cc92b823f73cbb43855ad2da1
c6cd11d5d0a76acd4657ddc00fca031bc39df67350baeaf8e3714a982cdedec6
b8daa50621bbf387c2cab8d2788eea874f3e178d75bc3978b3bb817aedb6ecb3
6a372b1b2ed89c0a7b5e71a77f23cf0d8ae9b8f315d7b9ad19f3f655ee295806
5f5a00ed2f6f8e405a0800e7d34ac7fec27a2019e2385ae4dc25d9e59f36840d
e34c2e3d493cf67c31fd7adfff5041b773f3a45b959245e62d922e93c1750573

https://vesperia.id/wp-content/TO/
http://turningspeech.com/rm44r5z/usg/
http://zarabianiegeorge.cba.pl/images/JN/
http://strugglingcreative.com/wp-content/M0K/
http://rossairey.com/images/hf/

Creation Time	2019-03-14 12:45:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
4f1e3178082a06256c13dac380d5c33f005296df47a37ad92188added8500589
b0a1885a6c9c9acdcedb5a167dd6ea48a160e9b0a61a49a8d71070f76a5dcad3
52dd153ad00295d51556ebc3221df7d3df1c9d7b9f34f8ee75c50caaee790c0d
7cf568a80f9e6e47a18e36d724ef05e22799ff9458d5b6660b428b2d49553e53
6bc32963aba0c8a057037e33b878d806aaf0d36e768f33407c74a5094d28df26
a09af7559ece9e43da3988f4d5622c1683f655d5cb3048895d30cd93038a6814

http://www.wujingwei.com/yis24.com/NH0/
http://g6connecti.com.br/wp-admin/PWh/
https://wdss.top/qvjrgdk/zoCT/
https://nikisae99.com/wp-content/1KB/
http://visa.org.ua/wp-content/Z9vF/

Creation Time	2019-03-14 09:03:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
36eb851688c4d08e8e913010a08ae48647d9f414f66e52227dbb1aeedf5420ed
7ac8aca9b6b8a0eb21ce982f78784a39c29552663e278570951b0aa52dc491f9
3d6f9d448cf807a6ead21e2ecc9eb419d99222af0fc1c5a4d051857cdf34f189
cad4e4277dd8b18e158d11a07af396c57c831fbd3bd6dcab61389e1bb602d21a
4a8b46e4acf204a5c90e278f8cb6cf7c751c0de754991e64182f7788c081d85e
60ec20a865756d7e13704dc6396fdd487db39763ee8dcdf977f877c8221373a4
8f1931f7bd6758af6a41b0e553ce691acd035b57f59579f5f38ad4ec55b649d6
7061428f52d85d4795cca7d35c8994577c861abe1770012fb5cbfa7a2367f698
a84f577a6a828fa6e52967597d0e9c724d84c368a82f0735b327a6299396da54
55e71b4c09811fe80c49e2ef13f2bbc994ee2a664b19baf0e10b4e05cda923b1
470f6512e929539ded3d53ca7e2391b194aad516b18afa4dd97ce1dc3f6b344d
f7435edefb20ef0ff2f05f5202b2429bf56a72409b19f316af5dcc844ae5e0b4
bf53b0ad2903506ec0b895ea6370af33e2953413cc9eeac79322438f79d24b81
81e394ee6932b58a71c825dff60f4f051d211fe7b215777a6217a139de62be04
71cfcc18effcb5455aed5ad4938de2a2b237c5ad186721bde6a88cf89c09f314
2e358c3b5c303b1e4202d84d134698aab2d3d51fe6201b8dc183da58a089819b
863a4fb4d5684efbddaf88be7f43ab72a8bcf58bf868ae4740139b45bfeec6e8
8b2764644abac68e3c065483f9a20f161109b41580f8a89f1a7f0d99356b7ded
f44eba5083630aaf1b74be5801c80b25617e17b16f91c6d1e0b61918a80cb24e
afc41141baff743549981a8d26c2de01843e31f0bfda03fdafc7e4514012fa88

https://smesmedia.com/wp-includes/dk/
https://tribuana-aerospace.com/wp/q2MP/
https://pasioncontinental.com/wp/mGP/
http://shefdomi.com/ihrbuild.com/niL/
http://georgekiser.com/test/Rt/

Creation Time	2019-03-13 20:41:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
3c6f64a5be116d88b759fc3a625da4265353f3a23de5d03faacad67fb58dd4af
f796de28c88f033d69534752ff49bca27ebd200bee01b952935949ac35f281a5
d4289aa9de0d2c6c43c6e6974a683d035a3028d9bc92721523a1812124489640
a0e00bec8ffa0cf7764b060320b11b6d8695f31202160021412b19f1817a5604
15d409d467034ad2e178a3be9a5cb52145a1bba20e9e9fa6fa1bdfc91179af78
8c77b90bcec1ccfdca3f73dcc1835ec0b99a6bc07abdd01a89ad8d8274e92db1
debf1ecc7c45e8bac881e02196120c8959248527587a5c3b7b88b3fde7fd1288
690e114212075dcffa45e897f29e5bbd8228e50e7c5ed18733cea303953bf5bd
d0f8398e793c3f58f92bdfed9d6e35e7efcddb390e12d27da290ae7337baaf73
2dd867e283fc4339fb8e50e5533a33c54d74a5c7a751f3658d7562776d2d4aba
1682386b9177d40fc22fd1e61811028efea833647e20bd42aac2f5e35447f5d2
7aaae27a6312a6d03986087014cebe564c8c4f8cedf4b03732ad286b66985cf1
7be5fae00a742991167b5c94e8c70fce4386dd1b9edd3809b3b6d6371033ec71
eb3c38dda1056ed44c025d2fe6dfec474763ec1a3c29b53baddf197ccd00d04c
833985e81022a7cc0ea35d711858fe9b13b177447b6af63797582ec791157534
bb9bfb39636c3697663138308ab99ee659921cbc6b6e87967de380ceb72918ab
5d9db9fca3f1fa3121d7abdd1d31c6b6d89dbef899d4fdc8c62dd111b23d7f30
1834e3a7f71294a8d9ed80ecb42f3d267a7e90eda5c3c3ff4114724318dbfe26
1834e3a7f71294a8d9ed80ecb42f3d267a7e90eda5c3c3ff4114724318dbfe26
76821dd9e856cdfba038c71c3cf644f08faaf39727a5a72ae11a062433f9409b
56df2da33e0c69a1e3be5d5e307f1ddbded66836a43b14eb59181ec0629ba7c5
2ee4992b3d273f10d16c3addeff7f5ff6d7f498f542be2522777680d2eeb0e38
08550f8cbf40ac692bcc8dc2a92115c24ca1dab8087eff0576e94ac3e2981eaf
55459e00951738dff222dba5e71e29b2829af68b1419bcfb472279754de86511
daca06f67f177b0e7b659f8c3d954b1ab06f563f2cbda3e1cdababf5e02b796a
4098d536c359dc63d3120c2e1f64870240860e90893ed61c7c560cb4a91eb734
ad0b0ec3287da293ee568e1ceea2e5650da8f9bf26126b0ab62ca6a9f04011fd
4980463e2b50f6fd5cfa08c9ff743e5f6878bea3a753f8b992818723baea9642
0366801927431f9bacb7f9fe7fb45c3060f20640f750b1c930bb6141be205990
70df1c010f3a153732b9d35608df974b997f0d0ade26a4c0ac10b901507bced2
0e0f87407e98baf9c5a00a2ef33319ded224cb30c352208cc00972a3931412ec
dc724e42ec75a11bb8303c163323cc54689a0d99950b5a912c7586d1255ae591
653d04b96f376ee2a1196bd42f741ce2cffb3fb82267a1b84ce8f94a8bf48fb2
5b336ddbad66d4990622940f95c0468875680ed223eb91da64b8f06787f62880
68dce955a6bc3d64ef8e4ec0c45fb667a41d01278b4b7f777b3a82f1065c407e
08aa80a6582dd6738d7afba27bb39ef88b0168d1a7ce656ec02863ca5f9d3474
bb98d6883a5d7169513f3b6016fe927ec6a44d1a5c0b661112175e66e554e719
c8ccd9bccc525a4ee561fcb42daca80c8c4b116579e4bde8197777d416b7e8bb
1228b439b723a9009e82cce1f7b50d99fc24e09a271d5afca9a758ac9fa4f7f8
84fe6397446dd37de37f0bbc598764d696cc11215bb0b99e3b01b1f514dc23c2
e8e0725c73c862428d35807060c04fc4100c753f6bedccbee71bf43953e6c90e
07195b1c470d44d02650b4eddca96698fc79cc91a50f5794cba66ebeb72ffaa8
b05b6104f9cf5885cd0e95d71086b75aa958c95ce56d62f49bc4b9820374acaa
7b6110adbe805d0d96997256f6f302079a2619542b8fb7e16a35c3f263dd2a98

https://www.theblackcadstudio.com/wp-includes/3T/
https://whyepicshop.com/wp-admin/1YD/
https://www.wl-interiors.co.uk/wp-admin/occ/
http://aliyev.org/ldfkbse54k/oX6/
https://interia.co/wp-includes/a4d/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 03/14/19 ####
```

26b8ca51745aa8ec71181af4279a7464b44366140cd28e116cfddc8bfffc6e93
4c2344880e0b48de7c328973b70b98defb7348983207fb227d2a7b3626c734b8
74d055b9e5c3bc88596a4cbca37402a93cb900c046c82464c6abe8aeb75dc2d5
f7af8930bc835bb12412be7948f257fc247a939cb5a436f19530c6e0e416b2fb
88f54013db739b6e601821986a5c6cb2f0b4c36eec7259642f50a55b966fe646
5d512a8cf32ca4e011ce6af313d9be115aeb20fc4e80d48195f2216db9c03577
91feded3f71e9e6d929481579da8f2268717351728e1efe10b7d0e657249dee4
1d13e85e7ccc79e0101b115cc5f1e1444428c0a99df06427e69b846282c106eb
745b3f844eeafe9a67162dc78f4d6320c233427941eb17b4e42956c285ea2e2e
2884899ca06a447b6998f9bbf1798e768376f8c8816fe1aaeb9a3d435c6a46b0
2f887dd7e01e16269442428f5d6d0941b32c8c4d1cc58338a0c575b03ce162e7
f5a4db3915899085c0b167214b4db2155db1a7a7829b95865dbfc8f62acaeb19
0db26ce8427840ee2f48baeeaf73e119ba471c398194ab4c7dafd80d1af8b4f0
fc797d1a2418425467e658a6cc509b90e209e522a159cf06c0a1d746c70c0077
d10f0495573867205bc8fcf2913a4cd47c4c92ca0381949978aedd8a91e7fc36
69dc68fb562627d250e78a5b3e8b811512458b4f3d41eb17a91ab6abb85c52f5
493544cf6ef9cb84853b8b69d8c45e0e3fe74695fd71b6468f4ddd74b4b69395
faef6d174c3583a087746ce14c2c79a45110120d8042be9f3edc321dd6928ded
1e44c1acda69523aabdb75b22c3c67a138f5343366c6241062e3ee5a44d9c158
f148d054d661d9925fc621ff60604e455eb8ea1ec6efdf5e6071cf8e3de25d91
359a236e7aacf6c4ef2ee11cf625b6f3cae148b31f6bc7b53c88ecdd13680483
7e3195e46ef36afa15f08e6263734ee06fd335f3caf824a81564e3ba4747f8db
3ee6ed04bb5f7e3e3c913575306429525a0f654335d747688ccd7139e740efd6
cc2738184543217e41e8bb9031ce07d6a634cfe675c8813b78cf350b19f5f2e7
54f84264971e19560ac5c98e6898295042465b2c854945d86b7bb0fdcc7573ab
4baa06b4c3c75c623431989780a6d6d6023a2d0b1c20799f934d902e2e8be6d8
e67ba63a5cf54f33a6e8893eab2277b23538a5b33c6924e414a0d8eba3396fb5
5ce9200f1385999b8193f7993c9a4418b34dad851bf20b47bec649d13096cca2
263b15bf420a570e75f76439df22b591fd8e16914fe671371d7b98cd667781df
bd236d5179242c359dda63d838e47a917ab5cde2da9a48f3aa96f761adf601f5
680b60af276d8d35a0452e14a760ab26c6add9bcb58fe2bb026ab94e8ddae198
11d14e11570ebaa756b4083a58a336e0489eec1703012534096131836b4e0519
50efa3e7ffdb398e3af40b581b46a6190abeef3eca61ccc9c7df7bdef626b7aa
c6311de17cc62a48b391fb0638cd411b0b328139693c2c3437e17fffdb13bbef
3334aff96db45f698b00be54cc7d07ee37ad9ed21b35c0c4727b92003cd6e70d
3d0e256fa1027c0eef53f345609be37cec1c9745c432b2ddee47972773e68dd0
b38f37482a4f7e2eafb35df299cc79f2261e2cb29ce94c726db2ed873aec5755
c1d4159650bffcf5210309ef9b9cb6188da372fae46cc1a447ae3b6a4de7bf13
2bf2b5ea4ea8c6e9f611d614c26dfbca28548ddaf6b4a196c07c844a17c944e6
40c2e1cc9a29685d572a869dd62338ce872cfeb4980d2e7ae246d9e0d9b6e4ee
790080870ee232ecb556e58ff19e2277b5e8e0275541e62079544111d76b9d79
4eee4aa4630ae75793f4b6cb3f06d0045288ed7468d2925970bd687c61650cc7
0a15a00a5b5fa7f0e832def0744516d917b48cd14778eea896c2a1f06d2b9621
bca0259a18b10afb354889d25e272272573750e191fb070362092b83093789dd
441373b506a70c44fb9b962fae196dd6f7bd25ae8365474b99dabd5c5b8a6318
4d7ef094f29a1b276d3be868913f36e3a60135c5ae76c535881d35532bcc3778
7296dc6bb3bf63a81bee616166ecfaa9a044ef41bf6fb4d277261ce4626a4d92
1c0c875fe89d9498bbb0f5017fa29cbbdeb0862ea5b459aa84e96e5cd04a4fdd
310e824d0fc7b1fbdcb5c6d7c73ecf27e76c81207ba6c890213fe4a31add73b4
8c114f46da5378542d0eb92434465cf9bf50801370c27ce3beaf0099f2cbf4e1
09ee74e794f6bc25f4fc612cc25f83c396f7bdc93dad8b713296b6c444118a90
b9277328e9263c6b5203d4e4ed88470ff694919af1bf2ae18d786e7bc34db161
582c7b4880dee7268dcfb1171e84bd63dac1eab41a4553b8be09d01103202a61
c5df0bb3c0ea5d0d9b5d71f7e94b84af8778e694c7786a338089c80819c49b1b
e4dff58dfc88abe7fac1250fe36bb51c00bf2676e41c4a5b294e2da3c50f6998
c2462b89d0ac5b0dd4a741dcc69493b1001d0e674fd1928e69020806a9700034
54b72327070ac5b2034cb14629a5dce4138763086872a637a1186226e5f5bdcf
5ccff6a776df70f3db4e0eda7b5bc05f9602dee9d836b279752f1fbce2964670
d0ccf47dfc364a1ecc44887568d71dc0f309b96b253158e1929eff7b56056456
2a2471851e1127875a92bb66f65dd00c41571662fc7250e6a74c66c8296fa643
c717b0aa3df38736937ceb44765fb880c86c4c10bcc43339f9f6449c120c0a56
940afa85e5da60701019a8d71f4d85b5338548bbef6a6db2b6c16ad0f8651f7c
70a12d0d7bb00f878556915a7fc266698f5cc87d3625ac19682f018aabd8050c
9056d3e465fcc6f14163e1a5d90e61fbd5255b4af69dff290ef8142783a30bac
5afea574d14ca4e811230d27e70e570f70d2aa392ab88593eb389fe2e6981647
1dade85a30542adb07e686182ef50a654a4961ea4645bdf5086397fee655a5e7
002126fbba172e396555d57d34903ac572c12c70a9f55c09cd85334306d91fb2
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954
10ea8ad5be30351e201a85fc408e0446a559f00e0d356c34550f0cc189341e1b
eb5e02c68aa470f22900fe1051907a3674f6da6e9be7ebb9792f924056dd8386
952548526257c23e4092480170fb70e9158e6be85e3e8bb6f2cedcef14757f02
20397e555a216e08f40c2b5f5ea074fca77d61a0ab2807115ce5701d6d436ae3
bf301895350bac4b2e0ef38955637782b49d77e1eb12e06f6e3f4d781512f313
8bae23db6c65d5491f378080582bbc9f92231f13e4d390cf6bb545740bbbe205
0daa1c2e8bf230ff66869bcc1f6a781a7809ea5e6ab8bcf736a3fb84cd64336e
80c9feace63d279100ce511b343f0f5903f772610fdd04debd855011cbdfbef0
41a4b259b7eea97003af926184d91ae5bb243157c91758bd8240adad6fc5043f
8c06893c91ffd97b69d7f2fda1ad3e53eee0c9e4f71d2013f28c2fd9481e1bac
a2269ea055a7ea6dfc5065b6f69854b9702d94d97af43f8c2c50342f9cf62195
89de28661560a1886ca0a2073ea40dc29ab0e5f5a39bf01d33a239ebbf3dd5ac
d216233e221ea4feca1e63efa0f6aee086644dd1cbb720e4a4e2638a3b325472
bf96688fdfe86355343cd8cf0fdab6e6563d23ad3bde584c4437e48d3c12434c
7db3dab503f55572b8b336076d7a17a57cdd27f7efce578f2e334161679cd9f0
0fa5840ef17ce9b9ce5aa1c19c6be1acbf7b8eae99598f842903d281583936d3
a6440113028bcf03e1b3157bb94e46a0d91621ac802e39f12230dab0e5ef2297
6ae942fadb3492cde97ef4f9dbf08ab6faee6602de4f0fe1771413691717ed6d
78493aa7c5e4723ebeb6bc77804d23ccc5ea1d5129f39a03170f9e4ad6f703c2
cf0e66b4c6344c94f0170839ba7ac22e48df06b1251bd1085acbc9fde6514d82
dd548ecec987eb64c9bd20f31f7af016f080a8a4ce209549ac2780a35d973908
7f48cbc0a3e02e6b3e02add99b9f5c18015441da29aa8dc16b51f6d6cdceaf76
5a937b9ac2acbab25dce44068e1576a8803f86e04a65d28c9dbe9849479901c4
2ab99f8fd69ddc469a3b7d473fcc7459f5205a1db88f04683f1a9a7766a953bf
0d29f7f4fa52853bd5059a9c421c84a0638e0548086c60d90a07db9ec78fa52b
6bdc24e113ebb4ee8d670236df07c677dc1e5fea9cfe53aae19af5050e40b578
2118e3813ccca10e5efa4b3615ee31227f94637f68fb044959f00f0b0e6efc01
3e20886f4b3ab4e650f32aa2efdb3e8a6cb59945a3936de36d36e2eb8536ab64
2a557afe0f6fcc1737658ce8bfeb96eee9420c3d6be1d0468823ce63db742e51
ce4ad0d11e8b6a900fcdf57d4d107fcac521680de4a2a52e244195deda671e18
e06ff8ceec3345ce209e89224d5f9f005ef81c5f3354ff57307154e0acc836de
a8fece97c6ad2c890bd9a3451f66f9bbb609836c599d074b88cc44357db868f3
c324d916167e5baa999d8b9201794ad447267884a658d76a3df54886e8debcce
48e674eccdcd51c22754aa39fac7d8e7d4e9000ecbf996e8f243b591954b6ecc
012e1d36884b190c7a313cec027114189c5315ca869c5b87e32f20a2552ce572
70e651b3b3d1ce0d07068dc10b5cbe28ff2c8126c1b7d23dc5483e43e0bd9280
e09e8e7bc571dcbef05dce441a7d0fb0fad125d7086a80221b49f676c44fb0fa
8aa9fa4f535f93212aeef8d6eb30a986dfd995e2748cf23fa6a6b3a124dc320d
da84624703ab3bbb68de1e4728a06c9205175fbac7480db45d0cce02f0b33358
1f4fe003474a934dfb368d4d55e03e7132bce6e6e40c9413fcd922810139b6ac
01d7771d458ee4a476486ad9093a613e2a547386b5e43ed6e3651324ee85a103
ef1301bf0b5abd7dbd6e6d7fb9f8069c570e5262958ab9a49408c30a035442e7
774ed85e5246fb8bff22624e7be039edf96198541a5248c49a7cec6a77eed801
3a77906f89902af7c639ee060ead1dc4a8e0f6659cc4d96d17fe3a13ac91ea18
8d1aee8268ab3ec21099ce579b9d390dd7432567de8586af9c519fde025a7bbe
69b7a3ba8bab4bb4d6acc92ea64e24d9e6978ef48b8fc25827be828718546eca
cf516dc0892e8ac2b2d03524c9c358cc8b1256ef3454ce5df260311414741a4c
732c5676581ea47ff9257da4ffec222b48468c7d47ebf94014e879da11299c58
3e9656446cf6bfb91bc55a8e9900430f7734b9b88e485e193bcc9693dd9d00e3
26a5d1b481460ec29e5ec54836a6288300b9eb89a166af25a4a3f907841044b3
7d13a5490d47ec13ffaad274e809ab9c44771b1d6991931fe45dfabb4f2cf841
6a093d0323480ff40d5dc33fb63eace538dad05ab4f4464a3402ae20b4b27425
d4f18a004435158f6ec253ffb05c3fdafe8c52558b14e24eec40c8388d3a7aed
d8009c2f99a61687205ce28dbf366f5cbbd7efaf8b90be6d0cdf80101083e54a
0f61068d8970c6745256f3dfb0512acbf7cd9920238ee0d764e5c3d5e750a8aa
3f36805b076728b1f799b0e2714cf0f839a6d50a3a8b83720dc9abbb834ebe66
c48815718db25607d95341a3890e2cdc3f1fa07f16c010447119e5586cb9da31
88772728d739e01cb70234550ee5bda32bd99de57b248ccb58aa680078281ee6
1c0a72cb35d59687ccbe1eb987538fdb54300fd9268f2b2731e7fb7b19feb63e
956a64b3fca925c4ee31079cfc7f9481c11acbdf1412772fefb7108841f8810c
185942fc55aa9fa99b553426a324e36a57e32a3dc530ad8523961654b01ef7c1
c5a49f565424f532192e9b3b007c05fa7f5e1201e81ad46a792261e8464380c6
2943ab69ba6a140f3b38360601cdfbe8b6577316743801b50437a5e378b8014d
6cb1a0a1bfe3544de8602c0bf14a34ad051b643bdc5559e61fe28ac4e2ba6f6f
ae1a1ca14cd74bff461fffe8cf17a5371df8937cd8b13bdcb7ece1c61913421c
f251d5b1372d7cdf52a0cdbe4e0723e11055e1843c574ffa2f5ac490c7f29346
13b31a115a0fb2f4048483b20e1aee4376d9d64371375913dcc165ec80069ae0
daf9bcfa069de7e37ba322c119ea54f44ac33f25f5d1d418cbb70a93f1b81190
c00a323a3afe63541b8d51d2c93e019c3b03a37625e06b7e849dcd4768a8f2e0
bd0131e7be8f79a014a2b4e12557884465e4c57d6939c3279acc02a43cfc44e5
d6c7339167655af988425a72a41b8a64d3b864c71610fc46cf5248b4fd7b6e6a
640d43358c816f9fb3f18b588dbe0c89625f84f3688ec34fb6085649e8c42326
0f289160ecad13546756c2ca6978bef686e1512494c795a666897b1165ff3c84
51ba6dc5b7b6e43befa8af3632855d5b046cd491874eec72ad0a28f390be6034
c1843642f8de1bc5e17528c1772ffb499c4ca687e8d8cb3a96b13186855f2f4a
3d8dcc6b63bb354977b86cdd7e7063696eb19f5ed4754766433042d543a30952
bb8b1b0bfe1a7e490a68e6a5efaae5d4d599ced3df6686de3b4bfe8d5671c0c9
43b914ad6ca5c855edb4960a200dd2d36e20e03d65c412bc8ab91ddc12d4cccd
0ed0bfbf99797e16ac9a608062338167313a27254118a5e187e20eb6ce5c9a7b
820539873f692489c469835ca41bff712ffa69799940f60c30e62550687f2858

```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
109.73.52.242:8080
138.68.139.199:443
139.59.19.157:80
144.76.117.247:8080
152.171.65.137:8090
159.65.76.245:443
165.227.213.173:8080
173.248.147.186:80
173.94.53.3:8080
178.78.64.80:8443
181.16.4.180:80
181.228.211.100:443
181.29.214.233:8080
181.40.122.122:8080
181.56.165.97:53
181.61.221.146:80
185.86.148.222:8080
186.137.133.132:8080
186.138.205.189:80
186.3.188.74:80
187.207.188.248:443
189.208.239.98:443
190.117.206.153:443
190.146.214.85:80
190.146.86.180:443
190.15.198.47:80
190.210.3.93:443
192.155.90.90:7080
192.163.199.254:8080
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
213.107.110.253:143
219.94.254.93:8080
23.254.203.51:8080
5.9.128.163:8080
50.246.45.249:7080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.184.97.144:8443
70.28.22.105:8090
70.28.3.120:7080
71.11.157.249:80
72.47.248.48:8080
82.78.228.57:443
89.211.193.18:80
91.205.215.57:7080
92.48.118.27:8080

```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
181.168.129.146:80
189.159.195.202:995
190.147.23.76:80
47.180.177.96:80
50.116.63.9:7080
70.44.163.160:443
73.14.76.77:20
81.168.92.58:443

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

108.188.116.179:80
133.242.156.30:7080
138.201.140.110:8080
147.135.210.39:8080
167.114.210.191:8080
173.255.196.209:8080
173.255.250.241:443
178.62.37.188:443
181.57.193.10:80
185.94.252.3:443
186.113.255.229:22
186.4.234.27:443
187.142.0.234:22
187.189.195.208:8443
187.209.46.240:21
187.233.152.78:443
190.97.219.241:80
200.113.185.229:8080
200.50.185.54:80
201.220.152.101:80
201.239.154.191:443
203.143.86.111:8080
208.78.100.202:8080
213.191.168.93:80
217.13.106.160:7080
24.243.101.134:80
41.220.119.246:80
45.123.3.54:443
45.33.49.124:443
45.36.20.17:8443
5.230.147.179:8080
50.31.0.160:8080
50.80.248.108:443
58.171.215.214:8080
59.103.164.174:80
62.151.17.5:8090
62.75.187.192:8080
64.13.225.150:8080
64.46.91.165:80
64.9.43.60:8080
67.205.149.117:443
67.209.208.130:8443
67.248.56.82:22
69.198.17.7:8080
70.57.82.196:80
76.168.149.66:8080
78.188.105.159:21
80.115.91.222:443
83.222.124.62:8080
85.104.59.244:20
86.239.117.57:8090
87.106.139.101:8080
87.106.210.123:80
94.76.200.114:8080

```
#### Epoch 2 - Spam/Stealer C2s ####
```

183.82.123.254:80
198.58.114.91:4143
213.136.86.219:7080
37.209.252.79:80
64.228.72.40:8090
67.202.178.142:443
78.149.210.211:22

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/07/2019)

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
time period.
Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any one time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
via C2 to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```
https://pastebin.com/S093mxcv - @ps66uk
https://pastebin.com/7EadunCz - @pollo290987
https://pastebin.com/NBFVyT31 - @executemalware
https://otx.alienvault.com/pulse/5c8aba971f158a1966aec5ef/ - @SecSome

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch, @urlscanio
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Short on time today so quick notes.

C2s changed for E1 but stayed at 50 combos in total. - recorded above
C2s changed for E2 and decreased from 57 combos to 54 total. - recorded above

Still out of time lately. Will do a better update tomorrow.

```
#### Sandbox 03/14/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-03-15 at 06:45 UTC - https://cape.contextis.com/analysis/48660/

```

```

Epoch 2 C2 run on 2019-03-15 at 06:45 UTC - https://cape.contextis.com/analysis/48661/


```