API tools faq
paste
Advertisement
jroosen

Emotet Malware IoCs 2019/11/11

jroosen
Nov 11th, 2019
2,388
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 61.48 KB | None | 0 0
raw download clone embed print report
  1. ## Emotet Malware Document links/IOCs for 11/11/19 as of 11/11/19 23:30 EST ##
  2. *Notes and Credits at the bottom.* Follow us on Twitter @cryptolaemus1 for more updates.
  3.  
  4. ### Document Downloader Links ###
  5.  
  6. #### Epoch 1 Document/Downloader links ####
  7. ```
  8. <none>
  9. ```
  10. #### Epoch 2 Document/Downloader links ####
  11. ```
  12. <none>
  13. ```
  14. #### Epoch 3 Document/Downloader links ####
  15. ```
  16. <none>
  17. ```
  18.  
  19. ### Payloads per Epoch by Document ###
  20.  
  21. #### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
  22. ```
  23. Creation Time 2019:11:11 06:31:00 (Attachment Only - Doc based - Enable Edition)
  24. SHA256:
  25. 042d184c0e47366ca3066ef772fd3a7ecd2865741541393b74b36eb69e059400
  26. 0502e41264ab7a51f06bc0e10746c3845d4c4d56a41074aba7447f6269dd2f15
  27. 0c61ea8d3f78890860f63bfc7525767adc6e3b1656211cee6f7a624d0f2c6151
  28. 0e393d742ebc659c689137a0e0cc6157df220286ec3c5aa03977d038a71fc16b
  29. 13ef3f7c0634962f63279a678fcd09df5530c703f7c0385e679295564f365428
  30. 14b0d9f2d45f6e79a6ad6f86c66d559fe2004acf7ecac1a6dabb55993afdd498
  31. 17c0bcf9e8593c340e4466602195224d2c9d42a8f18942ddee8bedb0cf947196
  32. 1a22707d34b96fea6b00656d1d898804f927d25335e44b9ed748b8d209255bf3
  33. 1bf89bc3e3449a5f5119854d43306cee06d48b590a4d54a234bb0b8cb0c57a84
  34. 1cd79b01b3ac5cb58572aa20f7b71e6274d8b472fa0b95d8ffb125fd13d9d072
  35. 1db7a42793015f66436e9152429dc68eb576d5a453faf5aab2cf0ee92f3f2b8c
  36. 1f4ee74b8a3457c3d5f656e7722a6a9c4892a42ed83423192cc859914531aa92
  37. 2524ff32ac24d785f3bb11ad87e3f970fabf8224af9bea111a61ad15c90490da
  38. 2d9776951344b011e747e1861ad70e59cc4ff5ade7cc7b59bcb9f7255f660f88
  39. 2fee9bf6fa8c15f0a3a9fb62f896a7906258cfbd55fabe8b5dbe780cb356e622
  40. 392f5309e626d13661c9b8d0967c463dc25c2e5c9df76a7e7627e7ab2a037426
  41. 3dbc9dd883e66e1ec6083b54f3941ab3990cfc9d66467e3996691906cb9da2b5
  42. 40cad7fd90c1ca8ebb2b221f1adf50ec63e8a0e1d02f2211c420c6a69086a135
  43. 44fd78366e94be76d00ac352287d675aead7ab9bfc4e750a4e40bd1ff2f7b4d9
  44. 4770e3e19b78ddc0ee724ce6b400dad498e58087f03c8581ae6e4d82bd0b881b
  45. 4afea9d2f2e43d43478e37c21768e590e45f32755c21666f14537d748e066da2
  46. 542b71221d7b7a33ac160df7ec88d64dae31bc7484dec507811007ada5b771d7
  47. 559232c722a82c1037aac822da878711ad766132fc60f269980a5f16edb73857
  48. 5656d06c45ef6f5ed08efe243e36c18b321332b3305fd9f177979880804e2f80
  49. 56ce12a8e5913dda3d9a7db69d4b0c680d24c20e4e686c92f14d370a13adb20d
  50. 5ba33c66b6bd32678bedd4c5f489dc58fea409fdc1b14e729880184d0d24ffd7
  51. 5ee9759e1bedcc33a07b2da865e21afbacaad8e55d59657bb090336a3e7c1712
  52. 604064e8733190ebdbd4c805c34eae515874f927bcc3b8d7cb83dc75bef60d63
  53. 6041ea76ab32911417c01e8c94a6e0c8224f4975fcfa2df4b93031a6f69e043a
  54. 66fe4bac9d731b8d2a585c0e2e5b9ea1c694859b2991e6ee4c593ad75f575f3c
  55. 68200ee9ef7ab087a3c0d3c5b54ffdf004f70869f054e8c9ebb387abe6045a29
  56. 6cdb7e95bd817b0fa0a6804fcd7a7d830db0ea5c8180798bf8b6212220cf2235
  57. 6fac18b7a350ebd606ace806e932de77d401e42616c09b771efd301a7578c897
  58. 701fef4f4bd4b0208ba6c19552429a695d668e37d17e85ec691aeec5debfc556
  59. 704541fcddb02c2e304944dc32c9143cd33c7bb0e83c621423d1c1d59fd7db03
  60. 72924d1070d11ab06c8dd550c8d6c1c2bc04b0fa645f1f2b5848bc44d7239095
  61. 72de79b05f4e84c1fc2bcb721be59f9fa9237e61b7501da67b0d82495d7b9e4c
  62. 7322d2978f2ca983653091e281fabb5f54dbf617040c207d73975f6002839b8c
  63. 75e9a36a127dc72df52ce1bf19c60abb02bc5738417c4fea2fc37cf5e6056ac0
  64. 77fc1c4bf6c1cd31ac5492a9041715a55d58621137e4bea3269828a81337a35f
  65. 86713fa640e9281e1297d5ffc77d25629362cf417aaaf8a972e1b0c3e5081643
  66. 8886e64d65b76acb4816b4f7c10730f6fb7c80a258fbf59e14642fcd18c6457d
  67. 8888d6ec3dfa661e52f8fae037999761fb3d67a6ea7f9a51e5b67c6825e7a789
  68. 8d3dc336e1c2f45ad71e615c2a85d15eb57cd7ac2a4a9643e090771f56ab366c
  69. 8e75b4c2175d474d91a13636b8ca1392cb4a7fc0909f2d34fd4e3c61c8f9623e
  70. 8ff43353647f35d889fc29412c543afc7169ff4002e71e8d7832d7a72e04173d
  71. 9367074a6124fbf42b229424235c945b566c1f2bc8619fb22de1c28a91e732e3
  72. 941a4ce8b5ac57089055cbdd1e1541ec93f35f5a33b1f72fb22bb1e7b0fe02f3
  73. 977695c7f0c1d637dfc418b0f31d0b1a9a67fc418de5f256c7206ba9277c6a6d
  74. 9790296d8db20979ad1a841a9f33a7f0b5745d86e1c6e7ce16d2ef1fb633dd96
  75. 9fef6b5540ace2dce24b0f8ab03f00fc0b7bb207095f7cea87c71e03b25002aa
  76. a1e251de28a595e96019d1038aa800cf599053c2f8dd8369fe01447549a0a528
  77. a24f8135757db53451d744186e13aeb0f1dc8579981b8729930d33850aef9f05
  78. a28e9304221d8913cd24029dfa79950d5fe70e660b351175ffa05edc30168725
  79. a3c02ef3327aa819a8695901fd16d785037de2c37b9aeef1c026b9bce3b4c5b3
  80. a4e0c0a6164c0e21225d964e64a06ede815cc976d6a7adae51a50b8f452467d8
  81. a515c47dfa04ca882333c17af4e4c491198022568c2092244b2dd4dc2757e973
  82. a5389cfc5d0172ba75559debeb2f47534c2af241981b98a32f169ba38c5bf686
  83. a559a5da85511c762763832ea015df51ebe7c480ae222fd4566f96cd443c5c11
  84. a9701dd70d301ae73f57e75f68e34c2b0da89dffbdee1cfcc79974e89cf23e67
  85. aa6ef73bf0015e75fba0c2d193f994926140a4e44c8db29128e14c48fe0a456e
  86. ae432c7648a66603f6e0f9ee0389bc8d435621bef27bfd64a0a0ca1d89bd3702
  87. af522468167672b6798851bf410c435e7ab106924a43e5dc58471f1a8da39527
  88. b1deaf0e0538f5a84f0da2b0b0d2acbab573bf8b5000fccd5c16a5f4b614f7fb
  89. b29ab6ee65d90334b03d6186faa958cc9edb6f817eaed47081e824537ea81533
  90. b370d6146adb92cbad8edf11f03a04743639db6c00dcb32034816f72233a6378
  91. b602655c1b39b137e3bbaa34a42d2dda0a053db021238590c2fc58682c8fcc9d
  92. bab0bed3be4608ee673b92f0794991f3af8ff1ef2826366ca768bcf7e8e795f7
  93. bdf340cb253710414dd457b96c79b6a6597b8a47708c4d4534489e338ede0536
  94. bfd202139574b97395c6ea1b8fa61710235245fcda05162a141f6a81eb298528
  95. c1d5c9214a5179007f19f788f0e67fcefd65bfdc95eb8facc6a839d647add0f4
  96. c530ab8e437abd3ae0529f7257e51c8c3418fbbeac96d33b2208f91ac8b95115
  97. c72bf04a5055263f57843cd7ef0886b443bd5ddbf9a4ae90a52f621c0b1147e7
  98. c9026ba3fc7c4bae31628815ce6b5675376c2b6f0e26ac03d12064c723f9e581
  99. cb8069e1673495079bed02e515af1c11ca550e5fc37c36ec96aca214521fc99f
  100. cdb22624b29a452b29fd8bbe1e7dbfb7c095d7f177a8b03055114813a6bed0a4
  101. cee90161ba24c06a64b2739ed26a1918ac6042f51c96d333d827cbe1757e178e
  102. d201ec3bad4fb2387627ccea9fd816a9d6d5b7a1c70b55f8a8b7f646c6f47c12
  103. d30ea0e477536b3e325fd2b7153a74dc79b47f210e7e93e761d14b2dcb20d231
  104. d3fa6bff89d3ab17a2dea7c8dd58ee34dcfa103d3b8b45d92d9f04d738dedb3a
  105. d7df2a5c4766635c8e4723fe2605e19854fddfc9f23104066b685a6f863a7ea6
  106. d845483236610e388a0f8d7ba9b234b1096844300a32451a3b644dc9945dd636
  107. da84f2569d9c0734f6eb2455da95278157f332b1d79f21b58d732a39910dba46
  108. e2514fe262d314d7ac0b739b14dcc6863f4821b1bc9b7203429d4bc567e0954b
  109. e3f0db94f884e2097ebde4adb35066ff3ab8308b3857062ac7f58c1f0243c825
  110. e407dd54cfb6fc6aa7b898ec31f4a7ef70908384526f1e005960c82c7875e176
  111. e86b003a09810d979573f274351108ee0522fd7eef30608e564b3667bd840bff
  112. eeec325e518bffe160de7ba0b2ab77459a7b23a45d4bcbc8c6a0e0f17af3f86e
  113. efa58a27f49fd682e6376c7c2ede7ee0d3902e0c27701a8f33b02aa37d1881a7
  114. f619d5e4a62f1b9ffcd8d8a5bf9225270747a27c580b14e2c858a9eb20a9d5a3
  115. f6cd43b7fc23d43bf9b3a5f6d74a05946988c65b3c2ef613a55acd2dc8e2d864
  116. f9729f7a7434219e20d8f426c3a5d2fdb4b006f878e1ad80bb67e36f196e5788
  117. fa15dbf50592d06bca2cacbbc929d2cd01596de644ae134d7d3b5f3ac92e4094
  118. fa230dab8278c741ecb3432f69cc367f86ae2a4577e40643d0c5dfe3f80d1145
  119. fbcc5333cc6c28f19bdfeee60b9c8ed7f8cbdd63d43290c719d4ac675ee551da
  120. fce5b37efb7f137c6299b793481a2a087e062322efc90c4fb6fb69bcaec17dd0
  121. fd06b45aac63290388d5baaa8e0580c53dfe6a5c7ba9cbbec35645e7eb378387
  122. ff006d5131972d2993470a863085ab8fb44569809241cac01160976bafc4c5c6
  123.  
  124. http://suprcoolsupplies.com/wp-content/63689260/
  125. https://real-deal.net/wp-admin/hb9wsr487/
  126. https://mifreightbd.com/tignjh/pr5g399/
  127. https://glkbio.com/promo/7ul9jr81/
  128. https://lamartinewebradio.top/cgi-bin/sg6/
  129.  
  130. Creation Time 2019:11:08 21:17:00 (Attachment Only - Doc based - Enable Edition)
  131. SHA256:
  132. 19af5bfb8decc32253875836c39031a7e8258d167af7d0332527d0bcecb0c2b2
  133. 1a762540a795a8daa194322648a2d0072ed65da6e961989b284c31cb57f68405
  134. 226a36d5c22d1222e1a29d9b1eb8a072e39c5901c7b34654dc303ee6aa19f577
  135. 252dc0a071edf76775a0a954287fc0cc7ebb45e6f6849f210f747027d5cdeaf1
  136. 47699a9bb49acddb8c3ccc90dd7059d9677c2337878972d289fe8b656d44119d
  137. 56524c7f2264ebf2f309fc400eac6016df092c75c6871669d141fcab966fdb10
  138. 66f0b3b78d41b0164d680f850808ae9133b8f01746662292209aa32588e5db08
  139. 839a893e623639710a69c61de7bb0417c255ac802e0db11f9a1f8aa74d41364d
  140. 872e9f66d27895a16d84e9c2ab50708693dd85ae47ad01ccd62b884bfbb2ad56
  141. a35c5cd847e920a0655e99c9886aab94c91a190b3d0ef81d077e91840aa7c17b
  142. a3f8cb08735b481402bbe20ac0b2acfb827feac8f62d9d37db3aee0ae03c826f
  143. a9b18b8eb2f84bac3e831bcead88b525e623e0a3b7c71fc54130b99b3c12969f
  144. b6e62040ec8b2a92762f654d7f561c761235d6cb688e476c45e96b5355154759
  145. cb1418e28836dca5fb61a788ce324e9e4d1c3b1e4de6cdada721786f4ea8e12c
  146. e6d81855312d026966d95dd51dc09a23fa743d21bb2edb4f8943d767fff54a25
  147. eaa809f6ebdc3ddceba5b7d61bfe29db87f098a4c7bec05243c59df51406dfa1
  148. ffa68a8f6da85239d67cc3900d6ec7c573ae607cd9061389b260c2f5034dd4a0
  149.  
  150. https://namafconsulting.com/wp-admin/r6602/
  151. http://keruzhub.com/wp-content/d0lk27/
  152. http://chexdomiki.ru/wp-admin/yjmtr1k4/
  153. https://vendingdeco.pl/wp-admin/yg8g2/
  154. http://seraphimadvogados.com.br/web_map/6zvb720914/
  155. ```
  156. #### Epoch 1 Payload URLs From Unknown Document ####
  157. ```
  158. none
  159. ```
  160. #### SHA256s for Epoch 1 Payload EXEs ####
  161. ```
  162. 064ba47ce6e7beae955fff6c6d22e2c5451b9d4361c17fdee805022be6cd45b9
  163. 079ee00495bff6380acf421bf2cb16925b3d35bd4f81d889bd308f48dcf31bfb
  164. 08395473e2a0c0fe3a788a2fad30b33b3153b138c558a7218bff3482a32039f4
  165. 08c653e5358be58d13725863c9bac2a71a923000a4024753e66153c465c7aa54
  166. 0adbd19c32e58dbd0d0474336e902c61770dc1888e594337f3475be45920f479
  167. 0b2090a471fb0d51cc0cee7932b4505c634d391876e9035d04cd8df3c8842f88
  168. 0cf013d316e5cc7d6636f73fc3e8edee51432b0886bc0e5bda3be65d7b48e19a
  169. 0f7ebcd7704b593e68a45198a2c8456ff16785f53c549eac39a45cb72e108c7e
  170. 108e3d6db7d5ec23c2b1b0fe0a1ef88826ae8f2d9d9cd73c40b85c9e9e96e3e3
  171. 16d5037459e816f1aa29a83af8e26a693f1085e9b6e92cb9fe920575e93224bc
  172. 1a875910d89599a94faf1fadafe609a809d6750e2bd3e4545ad876cf0869b43a
  173. 1c644d3c850030396879af67b23bf0c97fa048f0257e1dc489bb53610519fbcc
  174. 1cbcbecd7becdc5bd602edc74435f85100c4538e991cc86b797c85d1f0afc45d
  175. 1d34514e807972137d4c8f9b7bf2d90350da82fde83e5ad50d3e63f63cbb6881
  176. 1db53ffa0c8936c24c3c404b12f4c0bef4795b914fa6328cdb2de3a0df62ee9d
  177. 23e7c997a0750e025b90eab4db3241d83369123813736f4f264acced9bfe4dcb
  178. 2a78c3267b8b968c8d4bedae1590bb65cc9c10f525efbfcdc97699472b7ad78b
  179. 31ffaa228472cb3cd51462685344590e4b3a213f6e749e3c50b45563b2db5552
  180. 33722f78e4e3cee0a118e12ed03899a74e39ba327d92c383777b5ec6b236c5a1
  181. 33c15537acb1d02606ed0ae85a371cf0df905eed487116ae8cc754f46e3bdae1
  182. 346caf911f3648e5e6e5a7a05578ddcbd055ed438f1cc0ca3cfc40d31019841d
  183. 367398e4eed1cffd8b7e2e745d547ef8a9c6eecd864604505d56f3522bb46941
  184. 3885c787bdd2996417777dcdf94aa150475b88087796ec39bf5fbb3d18450ee2
  185. 3a15a05f92625f530260e3941b005c47df2b938f9d4dee1e458945f55a42ecd9
  186. 3b7386d68b83118488a68114dfd4b93edf1d8694170e45a63a8113094b53232e
  187. 42dcf815bb488b7532f0e8848de226d9fd416eff9849285a8a57b3dca8fc215e
  188. 42e01af3b758f50e75d1d700e26180dd17f1fbde437373bd0131b2dd35e09357
  189. 466e94647146be28a2d1e718d077ae5a00b7ff3342c0a0f38e9cd2b65269f89b
  190. 4691d59339f552970a39784dad5e1dce574595cd9263dca01d4f43e24d60452c
  191. 496b6a990e9cece3bd8037faee1446b5f9a6f6e6e5412a6591cd9ecf2289c3e5
  192. 49cd71151e0607d2b40940a698b20e4c9bec10ccb00281ad1bcef7e542c6caf8
  193. 4bfde51b7de497461c3a2bdbb62847021a03e5c3790e6cc5f3eed3cef8cda850
  194. 4c92ced5e2532500b8536b2d0f06da5ad2695ade7586f8c2aafc59b47a1ce1c9
  195. 5551204b5457abadd7fd0cee216f83bdb412b19479de14b7539f33c82aa748a2
  196. 5596adc70f94df198d9c7b333b896ca8c1fa1375c32382570b5a8fddcaf8acee
  197. 599d3702aae4afa5031fabd8c46c79d296bc303f36b8e99faff779f7cf4cca98
  198. 5b5744b1818e68e0d977d93217622b3f4232f476930e25db189776e894131a82
  199. 5ca5291ca32ce2b53b77cc7e2a0a56b92ecfb6edee6cac950990a2714a499648
  200. 5dbe63f6f292538b18a099bffb571fab2f572f37576fc2d0eb4a35792308f0ef
  201. 657a1dfd83a39907c4b2973ae4e1f49075bab94e88d86cebfd546cf10d9e9063
  202. 675e3ffae07bb4777efcebd852154db92a8913e8d58df6be79d0564b3455307e
  203. 6bb14f3ec918d465d5e6d87d8264f491b5b2b69810485f267d35b6ec6689371a
  204. 71c2c72974208a79d383872a4b8c208293c7b0647ad996d5f78fc540c55e0f3e
  205. 735e2776da380eb661310e6ad5dafe60b10cd9005b4d007293d4b2375633b711
  206. 73f8687bb44de2926772a6d4b307e0086c1305825e302f76d38a1c0ee82ec886
  207. 745e17c51b3c828d5d7d0e33272a6984f0b671077577ea7fbd483a47f9689cb6
  208. 76415e9a92eb104bbd0ac53d6700d14cca2ef97e62c0acdcf848d0f074cb221f
  209. 7802260ab42019fd529c17fcdbfb6355fc152510f28ce1a28bddcecce8e3464b
  210. 7bb0b7f526967e0df8407411cba248501a827f7fbf8be66d8d47aa1f5804787b
  211. 7d3831d0d9bcf6e2a636d57cf9b3cdb33635b55bed5e6c1d1eeac6ef98b6921d
  212. 84c169b152f72d691d3067c4dd5dbebd65bd5b7207d05d0a2e6936bbf227d5a1
  213. 85606ecee5b07ce51ff34679af0dbfb61197b9d6005d9050724dd7a5a8fc7b3e
  214. 888d4d7c72facbfefeb87170a8cd34bb698a9989f7291e4d7d2a13d2677956da
  215. 89e0794baa0e6f920c8cc37d7b04eef44d47f2f7da4a32f01cbef5fbc3b945a1
  216. 8d28d6f79aa14b11f52199df78c5f4ea33b282b8d534e1b22ba084c175cbf034
  217. 9a8a080d14bec6bfb72cf26ba7da3e8736708719b121b594bab236a42e0da7bd
  218. 9af9e88d8259374f5d1c4185339cef39230663e519331ff76081e2dade99ae8d
  219. 9d601dda5ace3bb82847d18f55ad34b5dd3eb2771d0e3c6a8077d602ddacb592
  220. a27eb643cbe0d89587de63949b715c149907d2e58d0d59e6ea0277b6c8705fc7
  221. a6d42ca409d3b9cf64e686ae3128efb1c40c69a20d01b7b80fa836bd4513ce32
  222. a7ce752c48926a0a91bcc633ad4c3c29deb015eb8be1c5b2ab9061c3882226b9
  223. a87b30775c08fab67e47690165049f857f175524a32b18c4d6aa7e8efeaca20f
  224. a902f7db5b558d1de69c68b9e1cb2ce317fd1ef266ca51abc9feb2a4485ace72
  225. aaddad3057ff17b862f3408560bef95b7562ad519e9d6bb9859a90b9ce89e094
  226. aba0564c62ba188c09fdfffc84aa8123c93a6b361aa59622691d3087ebe6077c
  227. aba6c8577e06cb0591dbf0cfd081e691514ea61d15ad1f2e54a1f5c8c71ab20d
  228. abe27ec65f3abd4c0ecb9fa0974cab24e4d0e8e84e21afeddc8dbf4320bf5c48
  229. b066bb61a8bb1babdd8c787db3be9fef48a233fe6d560acefaf9d0eaffe99eac
  230. b13987f37453da98f8810069cb7b105ce12947089619f7237a37ac7f31f3e949
  231. b1ea41927b616e753698bdc887e02bc951e12734071f46a8feb7b4fd2d2b2009
  232. b39c8d2686e220c46042f759d902674b75e00335a79bb25f5bdb8f468c724890
  233. b77ebbd3dc74b9d801d2661eac839e5e8ed16640372c552558cfc68124d71d07
  234. b8a0e5595193d6d27b44bdc4329af634c925cc0eb2ceb37ca160f3cd923a692d
  235. bc9b00fa6e4d893db751d1ad669d86f7fa3fef62c6662c28f2e9244466678886
  236. c9fab6e76b2991eac7bc7e562a67c6fbd80551664adb501fff8e10452b26ba78
  237. cc17b50952e6416af1e5126cea4e36d9536573771db5ff13ee89d89538b1b880
  238. ccd09a1553fadcae83ef96dfe60726d1afb271dde2f88a679e5b92baa3403011
  239. d06afff5bb50b44784b7b1c1a5f5473f84077288051484ead847632bc3537128
  240. d14c51abca09e467ac39ea00c65c1499f0113c33580d08201a4c622e8e427c32
  241. d4fe0784bc2890f639bc702d717561a1cb514cc7af16354618c17e9706713594
  242. db5e0321c2b5ef23d365a43bae365a04a35ab7d5e60fcbee6e9a5ef1104bee99
  243. dc116254c18b139dbe4a0b6979dc388945e1bc35458d45fdeb7565989d4b150f
  244. dcf1851f5c5f76dfd779a6374cb02d34c7885f99056d2aebe3abe20988391178
  245. e0c4f51888243699cccc802d3440f15c9ad5fee7edabd59fd6e7acaf9f4d0705
  246. e1a94beaaf6f39dfabf4ea7eed5c47b59009e0be426156e8d0d986f763c42cb5
  247. e68691a67a350818cabb0ec0a752b5fc28ed1cdbd8635659fb703fd8cd607e0e
  248. e78daba2bbeebcbac16e19fc403deaab421066b4ba17402c477a8eb4f3ccce91
  249. e7ab10e128c5cb103ddd7246cb8a335c02878cb7d63f8788b0d81b631cf87552
  250. ee4a69b385b0e5d861e321420ea93c60e60505cd7f9b984aa1404fcd1998d099
  251. ee837a519761d55b49a37e8520e84d7a94245adeb7815fcdffdc993496509855
  252. f671c7a4b6c7711c1704d8f745ff4e27b3bf7956fa3f074f1efd530c82ca84e7
  253. fa5f0a6ae2c1add01f6088cd40a663e6e44999ee6ebabcc3bbdfacafba6409e2
  254. fad5d1b7096e0d5db72263c56dc8a1fb93dabd5dda75a3fb20ff4202825e5032
  255. fb72bf6aa80cd3cbd36c88f7cf1d1bc3716fc25f4a392fe997d68d50b49f1c78
  256. ```
  257. #### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
  258. ```
  259. Creation Time 2019:11:11 06:21:00 (Attachment Only - Doc based - Enable Edition)
  260. SHA256:
  261. 00004777aaaea3c5c634ea4e5ec095c1fc4851fa6928d8791744428dcd8f31c5
  262. 02c8fe03f74895f9d6355abe0858ced23a8977413e8da2aac59c0ae78e4edf56
  263. 062dd56d1d898dd31019644753cc0c9792540eeca916fe560c55ccd2ccdfcf61
  264. 07a4865fcedf2ddd23a76898c197400138c17de22384437bab81a6b6e1e67321
  265. 07e90ef564b7553c204c2bae8a72a3f9f0d0bfd1e3485b77f0372f93ae040464
  266. 08877555d7ec8248dead2071d55d9e166580555bdf90a6aa71dcf4b5bf653dd5
  267. 0b9695301303c390c20e71799b10f740489013f67390f6b4954fdeed1b870b61
  268. 14845c2d7616a6acdfd468b717b41badcb2f1d6126c4cf0e54cb80306c80d09f
  269. 16ad150ffe17f87d7cd6732f561d890883393316206d79afb64cb69703b99059
  270. 1d12baa2f3aecae36283bbcfa5e3d0dbdfdabcd1366b49d22b3b3f0bf1a16656
  271. 1f2b5487f420a93420f8769b4a8a47b662dcd20c1c2ebc3f3238ecd5df65be58
  272. 23440ff41f79060c47e9585093f4c5fcee1b476d9c7d307b479b6d119e444a20
  273. 27671acf5f1a995256fc4c4b8fd50b06af5a69ca9ce35416119cbaf1dbb77d22
  274. 28d97a86e5c2dd05dec3a79de7209e74eb364846939e0f4d862e037d5b9774d9
  275. 28fb9da7a0a5533c14319f8bef41c9ab18a34edab83a372ca99c89f1c1bf2856
  276. 2a48d187f84228829338ff2e4fb9387eba45e0dc7db3051eb3cd12d4acc7975f
  277. 2a71abfeb4739dd40c01076bf44c6ac4a97b5e8f42f625547857677d29f1544c
  278. 2de759e246e01a22e19e93a4405119e462f70676cd2e11d828fc5c5188e917e4
  279. 2f3c356a6f714deab5fb79d85a81a9c3245199ef71fa6e5a7a6cc5c39b552494
  280. 3221944ed4e133939626fe8fcbf05b26888878f6e37f286127311be786c7b000
  281. 33d19b51734fd8135441b5aae250a2122a9659be14b6176c2afe75c060d77c29
  282. 34008a75ff43ffa3b6dd8f0c2485e051928ab6a20a6dc3bc9aa0e6b847d5104b
  283. 34c9e181cfe1a29e3fcb1dfd9cd1f9bda4eb7c47ea2fd79969ad4582f3d8ea96
  284. 3910bf88adc9f99c74206796fcfb2ddf1e9918d38f9caf34264a10a07a7b9192
  285. 399a1d9f752d83b09c67eaacfe544838ea4c97f7312a4c3d1a47110016dbe7fa
  286. 39caaa4d0fce8a8ffb9888aba839edf57600c52147e95fd848ab78c72b2b48eb
  287. 3abbda55ca8e55952b6b218fab50205d2ed572ca2056005e891c7300cc59fba8
  288. 3c1fe45970177c1bd055c8a83af945880864c269f3bbfbb9bd640d4b158c14b1
  289. 449459db5e4e0e7df47908af76f37b6f715ae161c11086d8422b1d705f43a6e4
  290. 45332e3c53da75f5f5b39af9f3252dd3d091f3476610d729b5230426b39f2b53
  291. 4592be6fcc7731e27bf654b5345e394655c002ea609a456ac599b4d1de6828d3
  292. 4723f6df55a93bf57344cfcb76bf64027865d6e5d1afa049cefa819388444a0b
  293. 480557261101c4f4e336de968225fb1d89307f1b339b3972b0cc031554850bd8
  294. 4b94c1adeed767b66526d0ae81ca7682cd69188acb7dedbf41c6f33555079ea0
  295. 4ba72b036f5016827ac392d8b732071c76323b7eadf17b7bc53d412c93c4ca9d
  296. 4e258547ecc647c244c00000d9f42831ee11ce8eb21f7952dff957f6558bdea7
  297. 54e1f5b5b95a9b8a43f1e90d35b8935d4365e4922e9dc784ecd16b52e0ca290f
  298. 6299b448f057c560991be3b461951fd741ceae8f75f36db5ef14044f0f1e60d0
  299. 638e49e9d4360a66af6ca9aac0b2993720323e59613faea89d1896cdd26afe97
  300. 6854acce662862cb760440ab01c1721f9ad42e966c677075b5420b72c697a90a
  301. 6f03d49024eac6312b9ca11dca0b7b64d3c8fa26dc564c853efb95d57ed50059
  302. 70e1f9dde4a4e2f9013c8b26c482fdc6aae8fce5b7d9926bdce69db3f3fe4fe7
  303. 71e5f78d2fb5a63cca8b34a871cdca77063927fa663991311bbcbc374245a5e4
  304. 7318c13d23721feb5ed6f12fd0ff2e3029c4404a1303bbe3707043e88e47e0f7
  305. 732d6e859c63bdf15c3ae374a4224eb7be67ae3b7f63a10f749ad4ebd037ca78
  306. 73f12a331735ab4cb348cb264b84127ab3c4e6b9e0fdb8e04b1bc8300c798952
  307. 76b1f046c9441d2a5bc16efe6bd90481b2db7230e079e17568b2f733eb4d9123
  308. 7a771e76df34406ccfca6b2c775ccb3d9582d67c18fe4c2a086d5a8282b39bf6
  309. 7f021359595415d740a8112fa0d6504b05b1b360336913343729861f9b973ece
  310. 854673e3442eb90a4275bc64b6b9cdbc31a6a47b7ff3a2cdb1568c11b0a0a795
  311. 87df3aa32e5942fd05f5cae92ea3dd917c3448936bc32bf12db57e6a313b98e9
  312. 8bcbc5c017d456feb56cdd4534061cded7b98f0ecf682ac4cbea40d15d12b910
  313. 8eb161606210eb1b3a3441dc93bbe8862bb7cff01dd98c2b8a5666265e5a4a85
  314. 8ee70d07547013afe450d0c89699800c250cdadd0cb685ceef819ac602f76102
  315. 94636b1834b458e85a4ab684a912a6ef6f78bcf1cf714c4d73f9dc799bfe716a
  316. 95c5efaa769aa01ff3739f4696f8900c78bbde5b3fec8a4b4cc334a6acd33c82
  317. aad6b77d74faf39254c05b849e1b67ccb48b8ecdf5995290ea43240b7f27e994
  318. adaaf86a370f9e56ee69a30e372e85d2fd969f3a1c844651b3ff6fd72ebd1429
  319. ae6fd419f3ad8daadc11c4c10ad45f30fe12d46270fe09122402e45fd886b9b8
  320. aefb4f253d0963f6fd846f224f738be16e2bb708c0768eddbb60659eb5a06f28
  321. b3598132c18ac80408c8eda418b564abad2106657868be208eed2d928d6c125e
  322. b67c4d26bb83a8358af27f6637afa8414a7b6e5e1622ce197b721716a5bab038
  323. b6934533248c98c4824546bf76a28e90e0a646c009b4cce991af3c20eea8c31c
  324. b874ff77f2e6637e10cf7e55d009726b615a8ba5fef52534f312e4c9a7803028
  325. bb1f8728db3c7efa4bf5b720e61c31a61d1f43d101ad173a4ba454a5fd768ad0
  326. bf9d788c16a0286618655056701b11ba2116223c29e9fa2f2d01ec8340f3eaae
  327. c2e9333ab5cf706f3fcfe03ed5094c1cb3bbc90477a947886012a454a49794f9
  328. c3a8a671883f0d4414cfcbbec464c7de375095b8770ab82c9a1c63a8af8e86f9
  329. c4c8f697f5a4460224f03f14b265c7892e90f29a3f0382b637c58d8d1c44d66e
  330. c53de0442a0b5f50d7a127953258c2e0f9d2636b829bb56dbf6266f1eae6ae8e
  331. c6e9b2c103652d8797cbccde8b8b32e76cfb01e5333d21838a950a6a3aabfeef
  332. ca3d45ae93a674fd6ce84bcfb342e36bc1d698419ac562cbb8d2d1fe9fb62bfb
  333. cf2f59fccf9b693189a1c1c0cc5da33b3c373c4ce9618555c7ba6440e2487fd3
  334. dfd10946e9bbb1ebe90174f7e38438476d59be75255e53bfd3d134f3fdf20e75
  335. e0a0bd12af1b90ad3fb39de398209dbe141f25cbcfccc67774485f04d327008c
  336. e41b78df92b111db580e1d87dabfef10bf4cd821cac44b6a471b274e2f8bde67
  337. e770b81d24b19ee16f7aca7c723e0bd4e413a4073c406284e409499b221345d0
  338. ec05a1778008ca413f4bfc1e6221cfe5fced50243e284c077c094a9a7e4c0fce
  339. ec5aa397a1891a68dbe9b1ce746898d51b31ea547b3927965bab06dae827f719
  340. f2c68438b34ba17994a4c5523d427058b75d2bd6ac0fb575cb37363d2602961d
  341. f34efbbc547591ac02add48318bb283231cd182b8186756e90dff9155dbe80e5
  342. f6c9c8b9f5b28ec59f0c5e610858c1e9ca048bd543ac5a3dc32e5e1b1aea8efe
  343. faa76dfe081465a712cbd212e2e0d2873d518df5eaa457a4b7be9191d10a9ead
  344. fcc2ee413e0064d7b9ebc3018af2ffebc1d3ed4c9c26b2a82c38eb76fbde2e1c
  345. fda5546b04f5866ebafdf9f0b781e24e82e513be0b15507da9798e1894738322
  346.  
  347. http://biosystem1.com/wp-admin/wzkv/
  348. https://www.talos-hr.com/wp-includes/NIwZerXG/
  349. https://breja.net/wp-content/c57m/
  350. https://36congresso.socerj.org.br/wp-includes/7g/
  351. https://holapam.com/wp-admin/7w71/
  352.  
  353. Creation Time 2019:11:08 20:04:00 (Attachment Only - Doc based - Enable Edition)
  354. SHA256:
  355. 025c852be30cdffb0d2341fb08964f423cb4662c3e25fe80159927d6f463d204
  356. 032e812faa3302db8ec286689aee2ce3029466843d6e8a08ae7cb5e6ccbe1284
  357. 0d88c012b86edbb181b8d9b2f4211c524898aebef9c33ef2ea3af6cea9722972
  358. 0eb39444c717fcf297104beefc3264832ded418553276bd89c72f2bdf73736c5
  359. 1691db15e966fbc705f955f2163bb4f23a8c22f60ee1557dce8655c2604624df
  360. 18da4c97f21fb7e8748c3dd74381f16d2e5286f2bf9ad53cdbbf35851f7be1a6
  361. 1cff6b361d7b072fb781c73771eeb206c957c58d30c9cf804c80b5f241bbd25a
  362. 1f26f4137ad059ce51feff2e2a8cb12bc77fefba441d1945341c49f659d1b887
  363. 2014e8120be3e4bc6063327bc08ada9eb3513b9f27ea9c83b4a0880c6ecc8549
  364. 298026740b97b96e5bc2beaf7236e104c8ba9025f52aae28ca26f836a74f2e77
  365. 2e3a6d2a091ba9f6dc48dbbfe7a496eaf8c187a60ae06939de15d99105c9c69a
  366. 31a9884df9760e44d00f1dc7097834eb89009748ac50d907a434b6a25f016036
  367. 36344fee06be5c55b10f370cc02780fb9eefa38bad00760e117fc6375bbcfbdf
  368. 38606f0122dcb241ab29bddcf61c1ff5076b8feed71506c3fd5f9b6f541b8cfd
  369. 3bb18e62f81847a0528f0586fd7a8a02e76307e0ce1816a0377fcd8a1f43a19b
  370. 3c05c753950f66e5f4d29c47f38b0ecc6df164130146a410627016683a2c9040
  371. 401fd892fe54c6bfe34190b78bd32024d1e882e4a5b45446b0e147e854babdcb
  372. 409f4d22b742141db71aab268325c9df6ba2f5172ae277f2883a87aef9d766d2
  373. 43389a3474aec0ca102af071d757692b435d6e3b249b8244c579abfeb054feb8
  374. 54bbee87f0f4ee7e9d7ed2a75880f031dc079d24231caa7e4442ababfd3f78ea
  375. 569ddfd16d462e0b15e19e6dd756246bf9399cb07e7ebfed425d38bdda4b60d4
  376. 573c78c9dad2a39656085774837873f531ab74b511abc6d2f86fea9f633995f4
  377. 57ad225a178933bdc999e28cc653f9a8fb2c8c7acb4cc81e015311ab5feea1a8
  378. 5833e6c9a12b22e666cac011b992c8fecf04490f32b552f4e0e8393a4369f681
  379. 5ba274531a2bb7c97f7d0287b80b20c1fb3d0d0ce8201bc8aec8d498dfd42ec3
  380. 5bdb83b5bb6f2998e80633afa5a42c92b9e7c901d866da7f11f79af54a70ea05
  381. 5fccacb625b71f31f67b5b7a03d6a62ccf2ac08df14594ddc4774540abbe0c9c
  382. 615c616b4bfbaca2d03ecdce38d0a25870ef6705c53926db2be09c452975e0bf
  383. 638b4fac1a3f3e1280dba001fb3f4092211c01efb13dc09930627b4790ce5c56
  384. 64892dcb15b29b97d66f6d44ab8350c587e0d6129ad6d2812a39c5d06ac9ce8f
  385. 65875ebb05f16b7cf05a359fc208ab98c457b1ed0c02022f9ce57ea6c822298d
  386. 668065fff9b2997064910e0f287c44f141a4d1f047f6005e48c36f2e7c893c02
  387. 67320068391b6c3abcd21ec9fdc4480e3a014218f98d3890f87a7bc4e0f2ae24
  388. 6929f44972fe10aaaf526306699cbf4b99a6f65d0ec90f7bb20daf4e4b1df756
  389. 6fdda3a0115396b90cf88d05ea9c011b4805fbace65b51eb37c7d5f05c4cfe9e
  390. 703f1de3892bf50f7962905ebb3d60b56586c7b913eb82f83c367bd34b00759e
  391. 731e86ff27f7ece877ada55ff9006c410044f97aee494397cde306430b256e36
  392. 756748457cffc48ff11714ebae7b82945909b4543ef8a8f6d0d891feb1d81dda
  393. 763ce56666762863ad1e5039e7c6160e43df369919ba9bf0b8bf41eeba3767b6
  394. 779ea8230614050c35108aefc6216dc14b1fe58103bffceb9afca128197237c7
  395. 78fa45dbde3ecf2e701fa78085a91345d6796fc3014f87bf8f9074df72dea22f
  396. 793482d382a18c360d532dec71236fa95539227f69a655c21b4023439bc6123d
  397. 794a8f4fb8484bb2d7ae770d1228a6cd8b034ee10af2ab12821023d702bf7fa8
  398. 7e86a7bb6e24a2b564d552edb01f965e3223ccec807c0205c696e9c80424f824
  399. 8152be47255838efc4aec1ea98cb3132fd905bd629563339fddf52de8975a133
  400. 81f2434d4d6226529c4c68464026f6cb9bb37d1b5a2b9eb7796dcb30a069a797
  401. 828c8256fd1b6d78a782895b3b1585276542ffeac97347a616df5a5e40c4ac94
  402. 85f1973551f9f64a07ab98a77b2c6b3b542a023a9da7ec8d6d834eae322591a4
  403. 8676a3393ab5ba99764ea62d76a6ab9b77a1e36c8d6dd9ae2d6b081ae2197c8e
  404. 86bd16226bd33078024dbd92b6a36d0428714b7ddc904ba855115437e4264493
  405. 883ada284d4cf0dc69385f2a6692d8b4b94db02fb3e7817af0ba3efa2d139cfa
  406. 908c07b7d3b25a6ea7de67bbe0b1160d70b13210b8165ffa2f11ee0663e97e0b
  407. 92b67cadff621b7ba71af72c539c61fed3622b299dd1197051555513a6d9fc8b
  408. 95692f41ee31c71eb1fd4135fc096c23a383e764741fa03120903bd97cb36857
  409. 96eebec8b6d6716892e5e4d2f0a45cac3f1b559316f39018ba725994e1634682
  410. 96f886ac6f2efb3b23f277b64c6f86efdc2ddfeff3b68e82cd77ca9ce81d18a0
  411. 9ac11e290eaf90bd1c0b9f920ad41a16f7ee8c38750aab2aa0f3e5d4918664b4
  412. 9b13c8b8160c76f6119ef76337ddc02e767ee33da1e16f2767a7a5de6b61ae37
  413. 9b15ed4ee67600dee86e79021edd623d4ef889309b4b63970cedcadb5e9fb8c5
  414. 9b742f6f6544228f1e88502a14b81cbd38608cc24c98f11f5b1f0231146028ee
  415. 9d04254da1bd8b942deb4c941819cd12c349262e3fa130c5a3825d9e3ab61a19
  416. 9d9acf26020b83364ed4b8c122444533bb2037eab0c394d33adcbdc87dcb9dfe
  417. 9f5e15daf76ae3433681822fd1ff9f9d1e2cd62e80eddd82a5b58a435a75c883
  418. a0e8b2030673c9670368b41a3dc658d6a2a83ae8b64eafc53d91d57622d8b337
  419. a45a10f968fe11a7934af418968df2e84dacba71ad0f2ce4bf555e2c10cb1d3f
  420. a496aeadf7cdf2c7c2e11bffaa58d07596657327710060912935c29304ad62f2
  421. aabf27e4d35192ad1c96a876f5d754d4669e73db59708539f18f54da3d7f9467
  422. abbf23b34a28b6a2f264a4d0e21a8994499d310980d989d036e9aaefb1faba80
  423. adad2bd8f0193fe73a0fd29aad996031e9a0e2fdf01433a0cdb29f85edb5560a
  424. afd4759ac5506fe90e617590074133f9029ae2f2905fba3e26e56a5be2008415
  425. b2e1be4bbb4434245c07225789dc60889889a1797108ab8fc6d5ae276bc51c3f
  426. b5e8f1cbbbfd013ae74ca0a14a044429734b034718e590aba0afb6c6f4bb5d25
  427. b7cc2ce1b84baa4ac6584f971987af03e779e37d5d25f330bc4974a577658c2e
  428. b89f9a96647d7604ca95cc78fb5780574a04a563ea48e61ddd36e2d40f6ba3e0
  429. b92183e1b984ca10d8c6f7c02332b0317e576aaba8480956b41a5822d20909fb
  430. ba3d4e531da9bd397184ed8743c6d2e930df1e350a68f4f3ff29cb853d86773b
  431. ba5528c61c7fb3a340a4f82af71e3d87d1aa1e05c4a8768a1e0031af336b3387
  432. bd62ed2b6c6d3f0c16d7ebb2e6eb033e9247bf18065883e38b460954635d9bf0
  433. c045bfcd3559f181ac4065a9bcace5fdd36593f9a19979bc858d5413d1d667b0
  434. c045cddfc991c99a344845b0c7475a90bd7632c1bce593e8df10ea0662862c05
  435. c223493ba16e62aca71cf05fb81402b1d3d553324d11ee1b0e2464a94e74dcde
  436. c7c50eae9fe62b1bf287e59cfb5c3f62d11c562ae4e96132619852dd1fc61ccd
  437. c7f6c8ff957564f35662882696cd0a5a19f3acd4c975ea7cef4e2124ada4b820
  438. c851c87ba550aebe4a38d75cbd91dd179a1534219e54ff0d78c6d6f7d7d03633
  439. c9edfa0d403431224f6665095a4c86e69d684e66b567d6a7b8b81bf2c1bf090e
  440. ca42dc6e5e9166c958daf9bceaa6f614415c6d4032fb92e0289cbfcc26bde926
  441. d0877b1e4da4f50324a18d46868c5b83ae18df443fbd0efd5a126bfdff085c4f
  442. d125d0fa2c922050210d8c1a0d7396a60d234e0800f9f8998b06d56f5116a8bf
  443. d46af81127b1ac8c75c18a4d690e57772464a9e1b5fd7a23e96a9a4182805980
  444. d93268c3636c9a15d4daf92588d5e5dec4f9f37654d057b584b01d01614035a4
  445. db15a9967d75391702caa9a90a4af6acb380c349497597dd2238edfc39a9ba34
  446. e34e2ea410becacc2366c5b3254e32a4411a0f865465cf07b808761347e44434
  447. e43716c1c845fd544ccd698a4b79e77f464f8bf954a04712d5dc61a0969e4c67
  448. e8cac5aaa416cbad6ec67a5891187a46c3982837789603bbe9e3bc992f81c2bd
  449. eb61bba16032b2497e4bd497d478784931cd687212a248d43534ef70aad74693
  450. f1787cfd0e80f214aa098397d08229dac9416f207925992673f31ec500c4d354
  451. f6fcace92a80236c51b68f5b7e2d98aa976c74b7d6b79a7d515de7f25a46d753
  452.  
  453. http://maiecolife.com/wp-admin/3H6O2DE/
  454. https://ninjasacademypro.com/wp-admin/bnx0/
  455. https://asmahussain.edu.in/wp-admin/fdfrUXVj8M/
  456. https://yekdaryek.ir/wp-includes/cip/
  457. http://experiencenano.com/wp-admin/R/
  458. ```
  459. #### Epoch 2 Payload URLs From Unknown Document ####
  460. ```
  461. none
  462. ```
  463. #### SHA256s for Epoch 2 Payload EXEs ####
  464. ```
  465. 0210bf216b5345904b3b43c007c325939c99c3f5c3612b152ff49a6e2c8b8967
  466. 047c01188146cf94030b05f3c9b744facc651e60894bae3abc686016449844df
  467. 068c4f01daf90821836ef785b8e722fc0899c6a8feb4db56b0b222ec2f8ed092
  468. 0875a006d7d047867bf91992b6b39452d5637f041c6e181677a29c0d36f5ef72
  469. 0ab6e0ce77d032326c2c044c3fca2b805705c5cbd4f3abbbfa9f8c8db49f165d
  470. 0d056498bf69c9f91a08267eecb2d1f786e4392c27828cfd83b9399c269831af
  471. 0f548378e60c3399182143e6895e11c0a54c179e747565b00192a1d190f17847
  472. 12e573774d3560c4167ac376a2443b5728a778bc4ea6caaf35502302f3c9804a
  473. 131c4818567868182c49adad2be1848d7d239e0e0ce3bdfe07ae24578e775d65
  474. 1422fe4a7f2bfa772324c5f7149f26d05de43731e9c053a478b8bc511475e558
  475. 1671448f21c7de4a5186e6c51347e19d7b6a06e08f99606aa4fb7fdc97b5837d
  476. 19015cca0403197364028347f2fd1e381d14c7398def9faa1b48944e10b377a9
  477. 1cb470e39fcdbb85f1bacfa52d954fc6af071a372e132fb1e7cf8370e8acf485
  478. 208a37cc330cc059c7d7dee8be3d6843a29199e8bd6aad026fe19d4ad1e93e91
  479. 23b3d7df28b94f2d057caa3f7a419226894df4f16a8ec95fa141d643c24b0d4f
  480. 2662b5fa87edcb4bc24d74e2b6f1697b76978f44020719421c911df286216cd1
  481. 310886099c39a79472ff3fe57cb8d6a2c512843a9c41ab1856d06922132b5646
  482. 3152c09ec34910478ab760fa177e9bea8761f7748dcd742619007374282eba32
  483. 33b9e3b859782df55d60b9a2c7dd062fa1dc2a625440cf71387e4da9728e21ab
  484. 35c81ca419c1ed661487a243d1aefe348a303d08cc24b56a28f52306b3e416a7
  485. 3943b94c951742f18e688b8208e94e5a18df3ca8d05db41134904d14ce0185b0
  486. 3979a04288e5612a052d0dacd360367bcf67dfb74885819b949fad791e0674a9
  487. 3a1bd85b99cdab03372392caae9184428e8d757c411c84e350616ab3ed408248
  488. 3b926888158f3c558a34335955116ea96be9dabfc4c39971c2e4cb8e24529e11
  489. 3c9a3fb024d01e294ebd5bef3e8c943e5500165919dfbdd479efb7784ae7dc09
  490. 3d6750fe7cde56fc25b2084be8fff33ea86b44542cc011cb9a0893e2d8d5df4f
  491. 3e6cd5e548d371c2212009c1581ec26cdef9e218093517cb77000c402f4792eb
  492. 3e8002c711b6957806aa13ff583eb1e607cddb40edf320240d24b40eee1e191a
  493. 3ee824063c2f81804102df3bb713abd0dbaffc728df19db8ece1c56e3a21bb6d
  494. 3f763b6df79a88d8f5885e5ddf35956a9ba3de431c12aeb2455c09b408d52fa4
  495. 42223a22596a38dc956ccd2d1c6c62535e7db38a5593d2eaca5621bd7780da1b
  496. 48f191eab3e99e04c10b6bfa1d2221d90e4e9e1cc3addc3277c8f5dafabfe8b9
  497. 4cae5dbb942dccb5428bb57358de297a08e3742b4434e1f23d51244637da6c7d
  498. 4f7a45ea099fe90fb8c8c550849db633820dbe94e6d56c8e1cc43995eaaae036
  499. 5079fbac00fdd8cae73a6e90763d2dbd7b7688274cfdfeb2b1ae81416c71727d
  500. 508b05bd4d59b0fffa5901c035cf733ada5335aafbef793da3ad7d5c6e962d60
  501. 5405f887db71360e982a66d0e176528f936f7e0b16c6bb56449b3e8c27cb9b78
  502. 5f78ab5585218ef7145680fad7e93a71013eae5139db485ef3ed1d5a5d62a1be
  503. 6110cbe622ce7711064aa7b92dbdac1bbb932d3bbc92636b0885367a1ec0c8e5
  504. 61e0cc8bbe4809cc64c684b9c4cdc719894cf0ad38af59006e363be3dcd05cd2
  505. 666e0ca5ba690e277189f61ba2ca5982e1bd498c9cf3ca37b64a0891b7a42605
  506. 675782f3e07ab4ed3c1e554838fb9b922a44b8823e46fcb900433f4b3930558c
  507. 683b1f70c8567102c9e4f1201268f6b2c07b7cfe5c4fb1c77c0cb7000486bf0b
  508. 6a9ce59c4a04439312043b195108c1e3a3110d94d063f10c3435d70c623d021b
  509. 6ac5a3d6963a2266665fffabae90be457d22dd44792e1e3733cf8a3eb01872d0
  510. 6f3346072b375a0039aa1aec037c5d175652d5f91ef218c5ace6eb792abf5e2f
  511. 7283b2d69f97aa75f41b18a60a7908c2952b9985d9d94ba96c3f79a385387211
  512. 7358843bbf42bc661aeb7d734a91d736e547c36ff8e67e8afb78b55e8472ab0c
  513. 7770f91ec3a557f98ee951119676563152e6aa51a1074af1c0bf6757be825f21
  514. 7773e0cdaacb3fa18ded02e8b8f016686e0a11da50494feaf62578957d7d551d
  515. 78ef11cdbd4cc97fb99feade0e87c9e714a1777678f45142936157403429d49f
  516. 7a22e5acf4221248a43f403629034ebc53ef5e4a772076da6534d5449f0e5778
  517. 801e74d4691b07343621d520eedc9574b7a25cc844d7415f2ae540959e70d067
  518. 80bc687ca954efd56793f47d7307a12a554ce0556ae0ed47e9bbd152055b8826
  519. 8417143577e93e81f20e43eacd272a963295526512f035cc23670ec24a8ff440
  520. 85c2ee6504fc91c2fe95ab3af16338903be802efca466cc8bb6e973419c84639
  521. 8a89e96c66af748026db2a7ed36a9e2016e70b56002de41128566b00ebc02b58
  522. 8ad02fc31907bd1335f042ed25d34be113d282639c136871cb5a469249bf493b
  523. 8ce29d4c97ce82f385d2f682e3f9c3168f6d7e7b0522891142353262cc1dac35
  524. 8f66d8e61167acfad92f0d643733a03a11de0a06b6cc59001d8a3f9fe09c9ee5
  525. 91d90dd4a272a00ff2ea5035a63aef2dbe57d501db0b2925cacafd0feb74e566
  526. 92805d912bdc2454fb7ac9d92748b37028e1ab2edac9831714820d9371874d56
  527. 97918f972d14881ef3082e1ebe32ff8b6d4579412badb7c9de220bb5a862290f
  528. 97a142dcd4ec22ea3a19cbd63b17833c4f874b4664d17dcc974934f4c824d0c9
  529. 97e7ec958ef9076687aafec1b490ab4cdef178a4556fce1524518709af505128
  530. 9a7ce1813f98dbffa85adb0985bbfa6fe6edecb503afe93d321b74839c7c243b
  531. a5ace4051491f85f8e2520d15623a74ad1509512a1921d60ad81b7e2ab6347ad
  532. a63da72e1f62fcce60a4afffc8c68cf3c451dbfe5c2ddf4530b52ab983982657
  533. a7349b76cc0dcd11abfb86859c8d3ef51ecf601183e2baeb09f9eb4a89f67b38
  534. a99b6ee2be57d8d0e000029a23cbfb0817060079ec4e93ffed296cc40629e1c3
  535. aa7f18757a26a31f05750f003e4c7ec08a6dc2a4f12d9b7b90fbafdb3f724452
  536. ab53467954cae0a0a64e23192fcfa73ce768a8f937315471d3fae95ebd757495
  537. acf552802541b7c956f915da2d9f0bf15a1e2c3bbb11ee4f5590f3cf024b65d7
  538. aec18f9aee43b468cff7a9803c51e07d061124fd4674b17f0f6c2b85d7343e05
  539. b3b652612b3f558d623e19bc90bdd9bb76387022ce5c7749049b12dab9df4d55
  540. ba65ada4cef87739bb4e6c86516f70db7b15a80f31557a4bdf38d26350fd7bfc
  541. bc186eeba836c4dcddec5cd2c249213938f5f898d4bb43414f02d2d6c231fdde
  542. beb4702c81f1748bdc8d629a5d3cfa137a66b2eafb4a7ed06036b2b6067d41a0
  543. bebe39a23604c4ee3acc217bef3bcc4a6ba6d9b4e9b15ef3f9a08ecc6653bda9
  544. c67284552ddad872544f3766f5f826311742e6815896c6c2655cc4ff531b7892
  545. c6c2c140b23a1181f32b842814e7697152791c7f485d714a9512cf27aa941b14
  546. c7a41c9a767f333af18e854f5497bee9f56c8ceb3bf308bbe4c8d92e78bd5dad
  547. cc1b9eaa946f27727b03b0af90cc19e04e515a48b149f6ace3646ec30c3c967b
  548. cff0d33a4d92e57df1f563e71e3d3becaaa27d7e186986ed59d5518aea5370c5
  549. d72ccd78b66845f8bedf3fe7b1fc8dfd7558940eb99b5f4258e8372bbaaa3611
  550. d7a61b47bac658ef4d88577a38b85def44d118496722b277226f39b5178d969f
  551. dabde27ef3ab943cdb23107e5ae5d9884c9f8e150c10e335ba07801139a4ea34
  552. daf630e5239aa72b6cc26e5c2f47509042f23175ea620793195c569004e4eebd
  553. e0862ae6ef52febdd1987a161c99f644d32499c5673704b4b1775f06cfea68da
  554. e1133fd5994a23af1ff4b6dc1026de2e3504325db8d00e5796e8ef833e19bd82
  555. e2678a9b1eaee58848ebdebd5b2ffa0d3ef56ffb628854d808e86c89f1a31272
  556. e269088270819c56fa740eaf65e35d6ec7e6ad20297c8af42777b47a9bc8c6a7
  557. e4c4302d94df9a03eacb1091e9faec334720de62964c54e9c9126768461c4099
  558. eca0821818ee7ba19f2541175f9ec617db1b5ecaf70235ed0f96b98986c640da
  559. edceb4ed3634637f23eeb47ed6182835f8ea2d5600cbc86e12dbf5f3f951f48e
  560. edda230089a9df712c4fdc8125755ac973a020e57c243d716365443a04bf8b7f
  561. eeae44951445c6eef95199f3313a972005b6276209e65ff40d2ef073d62f59b2
  562. f0ce5f8208a87ffb26146ddbfab572558a0326e2caad719d9d82f2702bfd7e63
  563. fb9ad4a66f6a6651b13d3c5dbbe870647cc6faad2d1bd95ad0429e0862dfd4c8
  564. fc2b09261ff6c9bb666dd7dd75c71ba85aab9af56c47526f5ebca7a1bdf7d63a
  565. fd5763ef01557716534ec2f62ed4f2170854b5afa684274d6804e2f25ca58a7d
  566. fe5357fc5f4395b4dac83a47478ed43d80398d6d95b12c98fcdc7d8561479afb
  567. fe87a9ac74533b99af01625a3cc16a353fa9a481e15f9073fc7fb73e32f56534
  568. ```
  569. #### Epoch 3 Payloads by Document SHA256 - All Times UTC ####
  570. ```
  571. Creation Time 2019:11:11 17:42:00 (Attachment Only - Doc based - Enable Edition)
  572. SHA256:
  573. 00c106816e34fab223f3a06e4da453b98a99d0eb00293f77e3a3208c1e050c0d
  574. 0212e9494a159d08f8f9d09df72110fc4c17252d275f034adc980abb30d8b801
  575. 03b8b5fdf9c4d8e7f2401399f0cb1ba03a70fac4936d6b67ae25a287d24ec942
  576. 05bcf7222178522438481b00128fc1ffa3a58dff86b20e78caa0a5d5dab0c95d
  577. 079affdc636760da8562949fb4bb46e43715610d20769880700b416c6edeae62
  578. 090500986ee13f0d45cac73e06c6ce263a3bb8ecdb662d9220f69ccca8a543a7
  579. 099f3fc294fb17b4b4a7c49d5de56b8848561743400f2b94bbc351d6d1be0d2f
  580. 0a1349e3d1ef34a6aa97296674452ed74a4c8d121da0129688af817c87f968c7
  581. 21fc9ff176bd1f11a78930764e7abfe2ec6526deca9bc563e63dd32e907155ba
  582. 23de42bf7e91f0448e4b84b369e259fc93f85d16a65d3a45ca6da2c8606932b9
  583. 248cb5555f59e7e91aab3ee3be1e359de012574e65077e656a358e172f22f8cc
  584. 34cc9327fe423b6bae0ec5d71c1101910330a095fbbed12aac135c9acee05aaf
  585. 3c9984e60c3d6dc3905512d9bccc5b1af194fcac28c91163f7de83b51a22fe79
  586. 3eaf23d102fb78575c43c6090c36ca5d5365dba7f2ae83da998223d809efc79c
  587. 410c137d722ffafac4ea71fffe59f9605652057b5932c3f3e106cddd64212a64
  588. 41b73bac55830a5611ad9fc87898e20c6ff283afbe8f6e71585dd7adff443699
  589. 438e41e073d56e5c5568c457d8199da06561da5248416ace58d73c5c8d46ff7d
  590. 44477191aacebf93c4a1d03c24819ee962a9ab31c0ac2570fe1d152ac0e54cdc
  591. 44caf44f37909a47c3ece5004b46e845d3006c950dc9d4a7e042bbf229de321e
  592. 45dccaf331f175121fa6ada55c35f0ba1a1a7e10043590a3711bf4957eb520e5
  593. 49117c5796a2f2b9917d1629af40a308d4348ad39d2fdf079f841b00a35a5705
  594. 4937c9ada54861d11585f74077fe237274576b9806de39145586eee02bb9d951
  595. 4b54384255e1ee8af70ed7610404c322275eca4ba035b644519bf47c89590966
  596. 4de245ea2758ca31c3d6271f2975d154d577463e8ad2b558ccee382ec8ab9a1d
  597. 516aaa35f105330147d3a8ab204734e1ba66738c56a0b44b4185689379ba5b14
  598. 52069fec5ce8f260d15e90bf6b6cf68e1652e5b23fa6a217f10cefc9b61622e5
  599. 52fba817b573a6e7817fe34ca8bd683c675df5b717e02325bcd5018426826ec4
  600. 56dee55c84ee8889ab0b22dd4f52727fd3f4a9fc507cc589aff489a58614f377
  601. 58169f6e794c040bf50360dd34216056f531324525ca7ce5324833200b6f32bd
  602. 5af902010baa8a3a407b8ddd24042540ff1cf38a968a9ce32b9b0141be15ef74
  603. 5f10c29452040add3f8f84b02b9574d28bf601eab4ec5783709a62477e8f8281
  604. 5f8102694fa0cf8b0ea1283520efee7d8004c3e11b625c3d4bd4bdb4300b658b
  605. 651eadb987cff8f34751d2f17de8bb1724500261f53d1159fde4ccb61c2d4bce
  606. 6644a214e7e117aab8c6eaa57ba9de55e19ab0aca56d54e257f43a9d383ab1fd
  607. 6f3585ce4dc948cb2baf331d0b818c6fd2abb91d734d611298de43fcf17e1f28
  608. 6f74065825fed72252c891e43701cc6f94ff69b9492f440160b2bd518c85fdc8
  609. 76e4723aaa20a3787bba815740510afb0f0d93925852f62fce126eff22123768
  610. 7a7982e7f2d24338d2ec103a348fb29ffd28abc28b5773c0cd99e90d608127aa
  611. 7cd9c1b00fa79d216875d7edc5db7be3aeedd7e91d37a2dea17ec8fdc6853174
  612. 8169868af14f44058d2ac798aff90cfc4cb84ff2a5e6589bed7c4aa278d7238c
  613. 83ed192272b0a1e2f11b6406d498858944e737223815dcbd68cceb501396ea1e
  614. 846e8f9dcb89ccab884a2159475e1abfa824993176da3487afa6572471fe83db
  615. 8630cc012997660269ed503cb77543f328ee46ac57a57e1ce673fb8947f66547
  616. 87e62a77a8ab451fb277467e5f29a80b4cb5e6124e0d5dde160352535d92263f
  617. 8891e93807c8b69d0f1ee932dd0d174916c30967e9d1aee5f062c32dc373b7fa
  618. 88eda2a165004b6ceeeee3a207a760825821827b942ab9c3f0839c167470fbf9
  619. 89c4e7782e48d162c9f3b7ff89bec07752bdec70ab1fa92e6da25c5e38a3ee60
  620. 8e7e3a6b01e3fcf2bc52f93763ca8e1fa04962e395883af56d23638e2e5805e5
  621. 8eedabcbbd4f2deead097f99649f18b68ca44beafffae501416b92a1cafafb21
  622. 954f9838cd98b764fd73449b2c5df44dc7bf66eefbb5e5cb6e069a288043baf9
  623. 969c7157285d9203526b06a8bd8d6240e05206a6f914a50669d3b37fb260fcaa
  624. 9ad5756dc73fea1446e7348f1416f96765ef2945a64d996a82f0011df2da86df
  625. 9d110923bc38f3e86edc2ac10e932f17cddd9a0f57377e180b0f4923c2a01206
  626. 9e2c4cd43ecf704055acef83b7b9f78fb15dc5414ece00d641e47482b803afc7
  627. ab850b6327696db1401e65a414fd5c249f8830b12b577e23af3bea10a272b72d
  628. ae43cff40d3d611b47251f5b8226118be17d5fd693c2a5a05b296a058e438a50
  629. ae54e0bda246ae331595426ee2df64588a6dffd869597741ff0286bfaba8a8e8
  630. b957490379335c8ffdf3323d6e624b98aeadb1f8eae0614455e6c289585f2cf3
  631. c5f63e3e8d996b27417b0a9a03fb928b4cf2a00a0d3917be1a057ac118e3e25c
  632. c9c45f10cc9669e97f59d4e363b09d885d309bb46c112b4fe1e6e63580bf0c8f
  633. cf359fed4aa0a5a748fe240b28c5eeb166d3d1ca70e291828750031be9df2649
  634. d0c1aeff5bb4bab96536593f9c2f1a43d63cb2b12ccb649d50e4ae5fc06e3c5b
  635. d3c0c2e7b0325f04590f80326e3ee44d65639fc6ad5ccd7e1a30c0c0645d6cfc
  636. d4ca03de30c10370eb47c1ab41d42cc580363a788143490d5a87b1b01372025c
  637. dd0db44aa95bdfeacdb0998ed641b5156b224a3078753fcaef1ef461bcfc87b3
  638. e02bd6743bfcbe705218976f22e3906304501ba6198e199236df5017064bacb1
  639. e46aa355a8d116482f9b88c8ad55205a79bb227914a50a2419a170dceb4ed178
  640. e5f9b83ae8f63af6d43d62de57e558230517c20dc58159a10814b3b5f4bd6934
  641. edfb6ca90eb48e747cea696d90c9e7ac2123836fc7e92ecbe27d9885098e0546
  642. ee6e6ac3387769bdeb5efe4a7f6c9a25d83c2cd2d7f39bedefa9aa997d67fb4b
  643. eed133d2cc9cba7778df1fca2d15b8b4538baf10eb66ae3a842e55a3662d6672
  644. f0c3c782e52e3b40fbe5eb935e42d33fa19e6d23a2e06f6c4c81f332efa86e82
  645. f2eb19a2bc53500e6a8eaa198b527c15b8c40ceb5fbba8799d300074ca0d1b53
  646. f5cd5fb7829394f4eae828d0613431d5c80fc537faa1b2cd5f4d95e203fd1624
  647. fe52cf0eadcd55f56d93252f6afcf0ddb1585c16f9ddd6d74c39b0835e20e133
  648.  
  649. https://wp.ellatech.net/wp/wpellatech/uSMDYJE/
  650. https://randevuyapp.com/5fhbu55/vehzu82-kia5-39703/
  651. http://tumcashturkiye.com/test/ssi/typo3_src-4/EAgswSzX/
  652. http://terratacuara.com/ebldis/ao6i3fv26z-2uqx4p5p80-202/
  653. http://webizytech.com/cgi-bin/f6uk8ie6-orsj6d170q-8480136699/
  654.  
  655. Creation Time 2019:11:08 20:21:00 (Attachment Only - Doc based - Enable Edition)
  656. SHA256:
  657. 00089c049b7f3b6b7a9441bc09fcdf63d9f45d4283667cb93d7defa423669314
  658. 008a7232733849e34d8f3beb67b81aea2b365b6ce1ed6482b03b28e80c8cf2a9
  659. 034515435a63b60f42ad0dd78bcf3475d72462d8474aee24b9b1ff9cd849e21e
  660. 0e6aba27d10828fac118e427f1aa496c25cbc9ed46a24a3e712332138c121876
  661. 0f43ead66cda9306d3af6504ead062b6b62ad80b2ef4354b8e4472af588f03cc
  662. 10f7200542d42a9309d6d12fa7face742c0696a03fc7ac2484b8fe533b2d2b96
  663. 138322cefa511d0af79059fee1a7f993a0473ae58a1febcb971f843881ecd70d
  664. 176c2c0c7722fcd25e0a857c4ff996b899c6661cf4bdf211e49c45402f4bdce3
  665. 177c315bd73fd63d0851787d04062409961f4226a0d07c7a2db84be661a83601
  666. 1bb97922f10f7b9ec79c114d8c45fccd03e74c720370c5bfd7380b243b8c664b
  667. 1db950f7f0f1580dbf1bd94ee6a96058d538c8ef2c564a3ce1be89dd4f7dc1da
  668. 1eae7afc943bd45625c045d01c9e0e1803e9c2b18f8e461a88686096b1f6e99e
  669. 1fda15bc850f532d4a6a6f64c8e4f0f5645769c0f57b352aef18713446eaae85
  670. 2a4307cd28ec3a5c938eca17d523979656c4be65911c8cfe0212ca5d2ea3b6b6
  671. 2c8daac944d0d2279eb94b478834166587acb9873d07132c80f2435aa1298f94
  672. 2eabf99fcb13eff053025f864900ed8eccdebd5b92cc56a054fb3628ed428288
  673. 34387b445d92860ede6653bb37aeab7fd1559fe52afa78246830fbc4432a5eb1
  674. 36f7d2ec01107c0667d8a8b19bcbb1654fd17f48407c67ae6a5c31a7386655d2
  675. 3ad49a17a67a282fcf8a73ddbbc5efed679cb8bb3ee04f44b57968cc3aed3f84
  676. 3b9ba8a33acf4b994863af6795541d7c1f39cc8ba898dd1c0571e5a90cadf13f
  677. 3cb74b00e1851fbff637017771b6ece1b9e2dc400835f1c92e7333e07d0f599c
  678. 3fa37591692b98a18d4a195954b884eb460b654567c9e5f3b6c7e99b09c1ddc4
  679. 41540fdb9831ffbeb1245b29859f9628a481e261c32d89958de574bb6a353832
  680. 4185a65a8b3d0761444fb9e66cac6cb523b600b94cd9f8f8cb95cf57730f8c2d
  681. 42d5438716aeb5cad08b37a7bc52b7d3b4cf7552c5560c701cfe27d7f3230d93
  682. 455596e2606349873ad68c6b080d0d43eb74dc314499df465a72ec0e0fff5400
  683. 45a30ba3803ecd4c5fedafd79d75618f9eb0c374e143c03ec5f441b10d3edfa7
  684. 4a53abbabc4ecae8506469b5df093b2384838d76742e81b68ae299055a9de531
  685. 4a5e0f9c62a7852e2d99758b823117320e8bb2fedbe2e5613ddcd89073f9274f
  686. 4c12625a90c84124572cf5ff53cfce02c0eac7665d111400c80e68592dacf4c0
  687. 4c63eae6ce37ee0021f63857f88f5d06f044931a9cd8d792f5c856034a3093df
  688. 4e32b5c7808e75c06b0527d1247a2d57867751bebdd1366dc5b1799412249b8f
  689. 534954c600e240853d7ba5d0729ad14b8fde161749d1bad5dbb16a368c23eec2
  690. 543e803c83804767dacb3a68a0bd79b49456b0da5f06afc2a80dbee1bb877060
  691. 5c8ede7d6dd970b70c87bb6ee8c760755bee4c213a4e40fc5de02ddeb2f2a372
  692. 64f1ce453561e8a945815668462e8680d82bf7ee0226259781feba247e5db25a
  693. 6617b0a27ff6a4f10a9a4e08f2b2491ca365700aff727caad215f3090c0eda39
  694. 6c06d64fd971f507d5116eadb62fd17e21d5b940ebed90f137a4cb4d3c81b15c
  695. 7187931b36e719f0e10ff5dfd0ef447a28ca02fd123810af8d10cc8ea40c5708
  696. 72ec40f6e42e81419a7a0936fef73d71b647417137817a420d17b5eae3f56a42
  697. 81caeb0fc23bb7734eee8991f1964e0ca2e20c0b5f0ff47fe53dfd013bd602d5
  698. 829d7b4a2cf35ffeb0dee1411fc3227c4c0c7fd99ab5814cf1d73fd3080a8afa
  699. 86aac63bd8af82a8a5f860ee29b8a03c5b65ae98cdfbbd9378fc158d6b7bd82b
  700. 86ad47e8c65b74ac84fec01f1e68350dfa9d6d8dc2cad83887fcf662f2b4eed5
  701. 8c3423ffd42b7e1e0bc10fc8be6d7830d0507a103b591bf25bee2cc5861c602a
  702. 919ad6c3dcfd22eab9f1b14ec3b41b4792b8acf8bace52a08350893c29bd134b
  703. 920525227e61143f63d4ae4f584b934872663b1118f69fc6b3bed0e95b43c67b
  704. 938e6920ad29694b9c0d0eab73f4764d845eb9d576661c2da7273d3ef70c1827
  705. 951b59342daf7a0fe2fa71719afeb099c65060b05a53685ca023ca0c1fa6d2c7
  706. 979dae7ec01086d5dd7af835f5e39ffa33c7589382e2dc9774b95a7f0bc61a64
  707. 9894f018de4c66ac99eb80aa5653472a51d39d85728dd78c503b3d6257e6376d
  708. 9b426e10fa1eed23bc6672f9ce589eebb3c933dae76a5d53f8ab2bf7bf00b96d
  709. a336cf96edf7f30ddd3528ec857a2b8082fa27eb5ca63f0372ac22becd4f4278
  710. a4772329d097cb406bda339561a159d28dca02fb0f0114d7addbe6a060dd99e7
  711. a5995a00d996a5a57f0d38ac9b1b01bac7403c67c4bb56d3de4f28c3c5134584
  712. a928b2fd33fa23b96b370581c060e385463528c6d26295d2ac05709ca4a5a6ec
  713. ab7fda0aa6238c2c1fa644837f44945ff0a9a4ef3208d83c3a366c2976f528ed
  714. ace0d9b84ba0509ac5eb64a8a191cb63e049d423dee72a8fb885f661fdcbdeff
  715. ae4fbe6794db6d4933a971ffba2735e022b27a1a64a594f68c4b89bb4be956f6
  716. b173e9013b1bed1f3eb60f452e9feb8bf7e1e820857c9f2d84244fcc3d57a213
  717. b9491fef576bb800e3c26497e869b05e40bb1e0ab1fa97271bbfbf39b1a44857
  718. b94cc1b1e7c3366e845b57209208533b53f9dbbcb04e6b202c57bbb64c13b9ae
  719. ba3ebeb11c886eec6742e324f74374e7c57293713c397b7a831853e51415a517
  720. ba453d482888809ece7f999fc2ede7bbd40ebbb0487ddbc6a9a1de53dd55d77d
  721. bac6bb0aa192d8f66dd1588e164becb32acb12dd1a72c6f39d1e933f23395e67
  722. bd3b2f3177d318cc06314b5a112eafd492c86076cf3951caa12f2c1b97103d76
  723. be56df0c671e35f622a3dedef54cb5f0d9155df2313b4b160b24e92ddaae67a6
  724. c0020081ad98b980daa1ace6f8ab2c7343844db302de9d8cfd4682fdc2880491
  725. c427cdda061c0c56f9bf1ae928a3116ef14c8ee8528372c295cafa0b8d7bd3c5
  726. c6c4072c15be642141889655667918ef4121faf43eb241807753f80069a0a78b
  727. caa9d7b3fbe5ebf3f1011849acdb63dad4cfc26d27c840e4bfb848778bc065bc
  728. ced896ddf147d8b352ac3ec97fca78f24a50aa4d2b37e8f891e768cee6b53df7
  729. cf562d0b34c8c65f22b6379e811ff031af4675b0dcdfcf4401c5ba5c81b1a2cd
  730. d56390b25ee1d02c051f1c00a5e29fb099404d1943a28bdd854fba7e3317bd4e
  731. d94c247f68c5a20bf5175b32b491c9ac70a1dfc963c2217dce57a45a4c79d34f
  732. d9715d9af138879d5ca2c574ffd60e4f0e9c9f4e6354e075d4e2eba3d01b0d8e
  733. da5264632b654ecdd85287b4f18981a27835933e39ab5f6654b897142e8cbcb6
  734. dc90262ff25f54b4611db8a4b47085a94c0c3f7c78bccfdf4e5fd0c7ddc6209f
  735. dfb6966930dd340ebdb200bcbe46ed09104cca190df39b73c02c87dc68c1f060
  736. e4c23e11e810aa88fe76084ef7f5595528ebc397ab6b52d8ad4c74a2d4d73386
  737. eb97edc7e53484553a1269fc5c720f745f46052cedf77b03599712dc7b7d6e74
  738. ef120ddafcb4ef06212b18f805b075451a1148851037fa82b0bdb2a9b418a569
  739. f4688ea07fb6c07bb3c5635f425d267fb26fc8cf7bcccf8480d6b3e86f1eaeea
  740. f592182c36e341d2dd98c115f4bb20ddd0faab6097e29c82a0bfbf614733a7d3
  741. f6a94047c1b8549b87555275f2e6a7192e2c090fb20b50a6c7f2d96df1c8a5b4
  742. fccb0c13ccd04cd500d14a50a8f225832b87a003b3754ac634da4b934b789dec
  743. ffa3a9efe47a35a1c93c3965f05318076f07d2b4131d101381dd665352acf6f6
  744.  
  745. https://alltakeglobal.com/roawk/6cr4xp-3j8k-4174/
  746. https://nadouch.com/wp-admin/rjdvwyq2-sm4j-74525368/
  747. https://www.evdyn.com.sg/email/jcmcsesy2g-8s43-3027/
  748. https://sukhumvithomes.com/sathorncondos.com/keu6-jf0-6589/
  749. http://tokoto.es/wp-admin/8qg88-v69gxquz-5219565/
  750. ```
  751. #### Epoch 3 Payload URLs From Unknown Document ####
  752. ```
  753. none
  754. ```
  755. #### SHA256s for Epoch 3 Payload EXEs ####
  756. ```
  757. 1ff2f9b5b4a9d22453efd1eea2a6be4ad01b676357b14b43445daaa6d09e62be
  758. 288d8b0bd788d985c9eb40a40ff165f58ee9792c70d2a5ab06ccdc54bebdc3d3
  759. 311db52fe33709e578956ddfab1fbc21f9a64b32e50656c4a4186d51b7734f7f
  760. 37141135d731e96f6fd474edb9378770ae42a8adfaeddd156e1acf2b13aec68b
  761. 441b6f0d953041f366bf86297ca3fcf7b1ab75cd29da9f503564aa9fa057393b
  762. 4cdb93d029c183da0e0267580499649151f3a1096e80bbb01cb032016ea5b2bf
  763. 55dfe66f79cd29e7d145b2ac8737753c5450f635660e66b5776e97cbe8c1a76c
  764. 63abb99ec5a685dd385e58c02248544f7151efcc5a0f4acef86f6beb16feec16
  765. a715ef549a74f4fee204d1791926d001a72cb92c6cc74afe7574151feb1a5298
  766. ddf87d1a1e008ce958d3f7ffcf9139fe9382a6f2e086d09e7709a2fe47267d8e
  767. edb05e91970147b4a95c9a12df8ee0d8b28ab518c654a5a42d75acae524569e9
  768. f20340aa88bf75c02039f3fceb8f7ce944efcb3bac45a35b4d1eec6dd66f0775
  769. ```
  770. ### C2's Per Epoch ###
  771.  
  772. #### Epoch 1 C2s ####
  773. ```
  774. 94.67.21.187:8080
  775. 181.231.62.54:80
  776. 170.130.31.177:8080
  777. 51.255.165.160:8080
  778. 45.56.79.249:443
  779. 200.113.106.18:80
  780. 41.75.135.93:7080
  781. 87.106.77.40:7080
  782. 79.143.182.254:8080
  783. 60.52.64.122:80
  784. 45.79.95.107:443
  785. 51.15.8.192:8080
  786. 94.183.71.206:7080
  787. 159.203.204.126:8080
  788. 62.75.160.178:8080
  789. 42.190.4.92:443
  790. 149.62.173.247:8080
  791. 79.127.57.43:80
  792. 91.205.215.57:7080
  793. 46.28.111.142:7080
  794. 190.38.14.52:80
  795. 88.250.223.190:8080
  796. 163.172.40.218:7080
  797. 77.55.211.77:8080
  798. 201.163.74.202:443
  799. 46.41.151.103:8080
  800. 81.213.215.216:50000
  801. 190.146.131.105:8080
  802. 217.199.160.224:8080
  803. 86.42.166.147:80
  804. 190.79.228.89:443
  805. 154.120.227.206:8080
  806. 14.160.93.230:80
  807. 76.69.29.42:80
  808. 5.196.35.138:7080
  809. 207.154.204.40:8080
  810. 111.119.233.65:80
  811. 109.169.86.13:8080
  812. 189.173.113.67:443
  813. 89.188.124.145:443
  814. 82.196.15.205:8080
  815. 200.123.101.90:80
  816. 104.131.58.132:8080
  817. 186.23.132.93:990
  818. 183.82.97.25:80
  819. 68.183.190.199:8080
  820. 68.183.170.114:8080
  821. 77.245.101.134:8080
  822. 190.182.161.7:8080
  823. 220.241.38.226:50000
  824. 178.249.187.151:8080
  825. 178.79.163.131:8080
  826. 190.97.30.167:990
  827. 200.58.83.179:80
  828. 46.101.212.195:8080
  829. 138.68.106.4:7080
  830. 139.5.237.27:443
  831. 50.28.51.143:8080
  832. 144.139.158.155:80
  833. 80.85.87.122:8080
  834. 91.83.93.124:7080
  835. 190.96.118.15:443
  836. 190.4.50.26:80
  837. 187.131.128.238:50000
  838. 190.210.184.138:995
  839. 94.177.183.28:8080
  840. 62.75.143.100:7080
  841. 186.1.41.111:443
  842. 142.93.114.137:8080
  843. 181.135.153.203:443
  844. 203.25.159.3:8080
  845. 181.16.17.210:443
  846. 69.163.33.84:8080
  847. 201.213.32.59:80
  848. 81.169.140.14:443
  849. 46.29.183.211:8080
  850. 201.190.133.235:8080
  851. 119.59.124.163:8080
  852. 187.188.166.192:80
  853. 185.86.148.222:8080
  854. 212.71.237.140:8080
  855. 91.204.163.19:8090
  856. ```
  857. #### Epoch 1 - Spam C2s ####
  858. ```
  859. 37.187.5.82:8080
  860. 45.55.82.2:8080
  861. ```
  862. #### Epoch 1 - Stealer C2s ####
  863. ```
  864. 51.254.218.210:8080
  865. 60.250.141.134:80
  866. 190.115.18.139:8080
  867. 75.127.72.18:8080
  868. ```
  869. #### Current Epoch 1 RSA Public Key ####
  870. ```
  871. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOmlscqbEIhLjVsj9r3eYacKi6C+Qrua
  872. j5TlU+pn3zc0k06qCoahFXBBGnYMotHQc6OwfBKwHWm831LIVg29kEjT8UYxnN5v
  873. fzNGgqXTe25QARf78CsQqqN/ImKdXo+GFwIDAQAB
  874. ```
  875. #### Epoch 2 C2s ####
  876. ```
  877. 74.208.125.192:443
  878. 165.227.156.155:443
  879. 104.239.175.211:8080
  880. 67.225.179.64:8080
  881. 31.172.240.91:8080
  882. 179.12.170.148:8080
  883. 46.105.131.87:80
  884. 37.157.194.134:443
  885. 181.57.193.14:80
  886. 178.79.161.166:443
  887. 190.226.44.20:21
  888. 45.33.49.124:443
  889. 94.177.216.217:8080
  890. 94.205.247.10:80
  891. 92.222.216.44:8080
  892. 149.202.153.252:8080
  893. 190.145.67.134:8090
  894. 103.39.131.88:80
  895. 87.106.136.232:8080
  896. 190.53.135.159:21
  897. 136.243.177.26:8080
  898. 217.160.182.191:8080
  899. 78.24.219.147:8080
  900. 181.31.213.158:8080
  901. 31.12.67.62:7080
  902. 186.75.241.230:80
  903. 176.31.200.130:8080
  904. 189.209.217.49:80
  905. 87.106.139.101:8080
  906. 104.131.44.150:8080
  907. 47.41.213.2:22
  908. 5.196.74.210:8080
  909. 200.71.148.138:8080
  910. 171.101.153.86:990
  911. 183.102.238.69:465
  912. 212.129.24.79:8080
  913. 105.228.98.115:443
  914. 159.65.25.128:8080
  915. 87.230.19.21:8080
  916. 181.143.194.138:443
  917. 144.139.247.220:80
  918. 104.236.246.93:8080
  919. 152.89.236.214:8080
  920. 167.99.105.223:7080
  921. 80.11.163.139:21
  922. 192.241.220.155:8080
  923. 59.103.164.174:80
  924. 62.75.187.192:8080
  925. 138.201.140.110:8080
  926. 91.205.215.66:8080
  927. 192.81.213.192:8080
  928. 167.71.10.37:8080
  929. 182.176.132.213:8090
  930. 173.249.47.77:8080
  931. 173.212.203.26:8080
  932. 186.4.172.5:20
  933. 85.104.59.244:20
  934. 83.136.245.190:8080
  935. 186.4.172.5:8080
  936. 186.4.172.5:443
  937. 169.239.182.217:8080
  938. 37.187.2.199:443
  939. 95.128.43.213:8080
  940. 190.211.207.11:443
  941. 212.71.234.16:8080
  942. 206.189.98.125:8080
  943. 86.22.221.170:80
  944. 115.78.95.230:443
  945. 178.210.51.222:8080
  946. 104.131.11.150:8080
  947. 211.63.71.72:8080
  948. ```
  949. #### Epoch 2 - Spam C2s ####
  950. ```
  951. 87.106.253.248:8080
  952. 91.121.27.119:8080
  953. 69.64.67.20:8080
  954. ```
  955. #### Epoch 2 - Stealer C2s ####
  956. ```
  957. 139.162.183.41:443
  958. 74.207.234.18:8080
  959. 94.76.247.61:8080
  960. ```
  961. #### Current Epoch 2 RSA Public Key ####
  962. ```
  963. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAKl4M80uy0jcxUiFIaJJyxgHVVnFtCq6
  964. bi6f2xXPh/XUZNyN8UXDe5HzhTc4kwon9MBZffNwFOIc61QfV3K3YzEI/ktcyNqK
  965. LS67ONxsVep769QdiVQJXrIaFjMXKz6viwIDAQAB
  966. ```
  967. #### Epoch 3 C2s ####
  968. ```
  969. 181.197.108.171:443
  970. 191.100.24.201:50000
  971. 211.110.229.161:443
  972. 193.34.144.138:8080
  973. 74.208.173.91:8080
  974. 46.105.131.68:8080
  975. 152.169.32.143:8080
  976. 189.252.102.40:8080
  977. 154.120.227.206:8080
  978. 178.249.187.150:7080
  979. 103.205.177.229:80
  980. 157.7.164.178:8081
  981. 138.197.140.163:8080
  982. 95.216.212.157:8080
  983. 216.75.37.196:8080
  984. 216.70.88.55:8080
  985. 189.218.243.150:443
  986. 124.150.175.129:8080
  987. 198.57.217.170:8080
  988. 212.112.113.235:80
  989. 144.76.62.10:8080
  990. 201.196.15.79:990
  991. 181.36.42.205:443
  992. 190.217.1.149:80
  993. 94.177.253.126:80
  994. 91.109.5.28:8080
  995. 176.58.93.123:80
  996. 83.169.33.157:8080
  997. 124.150.175.133:80
  998. 23.253.207.142:8080
  999. 181.47.235.26:993
  1000. 162.241.134.130:8080
  1001. 142.93.87.198:8080
  1002. 95.216.207.86:7080
  1003. 70.45.30.28:80
  1004. 192.163.221.191:8080
  1005. 190.128.222.14:80
  1006. 187.147.152.244:8080
  1007. 113.52.135.33:7080
  1008. 143.95.101.72:8080
  1009. 181.198.203.45:443
  1010. 189.154.130.167:443
  1011. 187.177.155.123:990
  1012. 192.241.220.183:8080
  1013. 200.55.168.82:20
  1014. 188.220.235.237:8080
  1015. 177.226.25.78:80
  1016. 51.38.134.203:8080
  1017. 211.229.116.130:80
  1018. 139.162.185.116:443
  1019. 5.189.148.98:8080
  1020. 172.104.70.207:8080
  1021. ```
  1022. #### Epoch 3 - Spam C2s ####
  1023. ```
  1024. 41.185.29.128:8080
  1025. 149.202.153.251:8080
  1026. ```
  1027. #### Epoch 3 - Stealer C2s ####
  1028. ```
  1029. 178.63.78.150:8080
  1030. 198.46.150.196:7080
  1031. 178.32.255.133:443
  1032. ```
  1033. #### Current Epoch 3 RSA Public Key ####
  1034. ```
  1035. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMqZMACZDzcRXuSnj2OI8LeIYKrbUIXL
  1036. faUgIJPwYd305HnaBS2AfA0R+oPxT32r+3BbayI3KguqAn3E+rbwtLhqhOXOlTnY
  1037. 7yvG4ufmwCCkRzc6Sq8baToxmd6y523AIQIDAQAB
  1038. ```
  1039. #### Credits and Notes Section ####
  1040. ```
  1041.  
  1042. WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch
  1043. because they rock and report everything to ISPs as it is confirmed to be malware. Additionally,
  1044. this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
  1045. https://pastebin.com/u/jroosen
  1046.  
  1047. NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
  1048. I am providing them for your benefit in case you want to parse them to be sure.
  1049.  
  1050. ```
  1051. #### What is Epoch 1, Epoch 2 and Epoch 3? ####
  1052. ```
  1053.  
  1054. (09/17/19)
  1055. With the find of Epoch 3 that split from Epoch 1, this section will be rewritten to reflect these changes in time.
  1056.  
  1057. ```
  1058. #### Community Lists/Samples ####
  1059. ```
  1060.  
  1061. https://pastebin.com/DXq580TM - @Paladin3161
  1062.  
  1063.  
  1064. (sorry if we miss anybody, make sure to send it to @cryptolaemus1 in your tweet and we will try to include it!)
  1065. ```
  1066. #### Credits ####
  1067. ```
  1068. Combination work of the Cryptolaemus Team - https://paste.cryptolaemus.com/about/ and/or specifically the following:
  1069.  
  1070. Doc DL URLs - @devnullnoop, @p5yb34m, @malware_traffic, @dms1899, @Paladin3161
  1071.  
  1072. C2 info/RSA Keys - @CapeSandbox, @unixronin, @devnullnoop, @MalwareTechBlog, @lazyactivist192, @papa_anniekey, @Paladin3161,
  1073. @executemalware, @luc4m, @SecSome
  1074.  
  1075. Payloads - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @p5yb34m, @malware_traffic, @Paladin3161, @ps66uk,
  1076. @bomccss, @reecdeep, @CholeVallabh, @papa_anniekey, @JAMESWT_MHT, @executemalware, @SecSome, Anonymous :)
  1077.  
  1078. Spam Templates - @devnullnoop, @lazyactivist192, Anonymous :)
  1079.  
  1080. Special thanks to @lazyactivist192, @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/
  1081. infrastructure and helping out with this!
  1082.  
  1083. Very special thanks to @Binary_Defense, @lazyactivist192, @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project
  1084. https://github.com/decalage2/ViperMonkey, @digitalocean, @mploessel, @anyrun_app, @unixronin, @hurricanelabs, @MalwareTechBlog,
  1085. @KryptosLogic, @0xtadavie, @MsftSecIntel, @abuse_ch/urlhaus.abuse.ch, @urlscanio, @BlackLotusLabs, @TrendMicro and @Virustotal
  1086. for providing services/software at no charge to this cause!
  1087.  
  1088. ```
  1089. ### Daily Log 11/11/19 ###
  1090. ```
  1091. This report was gathered by @ps66uk and @jroosen.
  1092.  
  1093. @JRoosen here - Looks like Ivan and the Emotet team has a case of the Monday's because they had a lot of problems
  1094. today or decided to do very little in the way of distro or spamming. Most people reported not seeing any malspam or
  1095. very light spamming. This follows with what we also saw. In fact, this morning we saw E3 doing a run
  1096. of spam with the last doc from Friday. At this time 4 out of 5 URLs in the E3 doc were down. Distro for E3 loaders was
  1097. basically down for the whole day except for a small window around 1830-1915UTC. E1 and E2 had 2 new docs issued
  1098. around 630UTC which would be considered normal but then no additional docs quintets were ever issued around noon UTC
  1099. and then 1900-2000 etc. Also loader hash busting stopped around 12:00 and started looping back to earlier hashes
  1100. in order of appearance this morning. Later we saw new loader hashes around 1700UTC until about 1915UTC when all distro
  1101. seemed to die again. Looks like Distro needs some little blue pills. Perhaps there is some sort of packer/crypter
  1102. problem and this is causing all of this inconsistency.
  1103. ```
  1104. #### General News ####
  1105. ```
  1106. @JayTHL did his daily analysis of the weekend post here:
  1107. https://twitter.com/JayTHL/status/1193739732825657344
  1108.  
  1109. @Jan0fficial did his daily stats roundup for our weekend post:
  1110. https://twitter.com/Jan0fficial/status/1193816636140204032
  1111.  
  1112. @unixronin pointed out that Ivan must be having a case of the Mondays with his card to him here:
  1113. https://twitter.com/unixronin/status/1193939589561499650
  1114.  
  1115. @ps66uk noticed that the macro changed today on the new documents issues and brought up a fake error with title of
  1116. "Error Encountered" and dialog text of "Critical Error Encountered":
  1117. https://twitter.com/Cryptolaemus1/status/1193814114893737984
  1118.  
  1119. @neoxmorpheus shared a German template for Emotet received today that seemed to be involving a yearly Flu Shot lure:
  1120. https://twitter.com/neoxmorpheus1/status/1194026892837425152
  1121.  
  1122. ```
  1123. #### Drops Report ####
  1124. ```
  1125.  
  1126. Brad over @malware_traffic confirmed what we suspected and showed E1 dropping Trickbot gtag mor41 in his data
  1127. dump post here:
  1128. https://twitter.com/malware_traffic/status/1193973934900822019
  1129.  
  1130. ```
  1131. #### Email Template Report ####
  1132. ```
  1133.  
  1134. Beware of the German Flu Shot template as shown by @neoxmorpheus:
  1135. https://twitter.com/neoxmorpheus1/status/1194026892837425152
  1136.  
  1137. @ps66uk noticed that the macro changed today on the new documents issues and brought up a fake error with title of
  1138. "Error Encountered" and dialog text of "Critical Error Encountered":
  1139. https://twitter.com/Cryptolaemus1/status/1193814114893737984
  1140.  
  1141. Beyond this and what @ps66uk saw with the new macro behavior and error box, not much to report on.
  1142.  
  1143. Some notable things to possibly filter on with misspellings, grammatical errors and odd phrasing:
  1144.  
  1145. "I have sent the new data in DOC format and the policy wording in DOC format to be even more professional than others :)"
  1146. "Is this one authorised? (Docs in attachment.)"
  1147. "Can you please look into this urgently and advise?"
  1148. "there is a older outstanding invoice, I have attached this invoice."
  1149. "I meant to send a doc before ,sorry."
  1150. "Thank you for your email. I have attached all the data."
  1151. "Please find attached the invoice and detailed charges for the month. If you have any questions please let me know."
  1152. "I have sent a request to add this information."
  1153.  
  1154. These are some old generic virus scanners that I think may no longer be valid:
  1155. "--
  1156. This message has been scanned for viruses and
  1157. dangerous content by MailScanner, and is
  1158. believed to be clean."
  1159. "Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering."
  1160. "This email has been scanned by LANserve Email Defence. For more information please visit www.emergingit.com"
  1161.  
  1162. Paul's Boutique of Documents:
  1163.  
  1164. E1 CreateDate: 2019:11:11 06:31:00 suprcoolsupplies.com enable_edition
  1165. E2 CreateDate: 2019:11:11 06:21:00 biosystem1.com enable_edition
  1166. E3
  1167.  
  1168. E1
  1169. E2
  1170. E3 CreateDate: 2019:11:11 17:42:00 tumcashturkiye.com enable_edition
  1171.  
  1172. ```
  1173. #### Link Regex Report ####
  1174. ```
  1175. (These are experimental, use at your own risk.)
  1176.  
  1177. No document download links lately.
  1178.  
  1179. These were revived/updated:
  1180.  
  1181. These were not:
  1182. https?:\/\/.+?\/(administrator|academy|album_delete|alphabet|Apple\.secure|anywhereApi|articles|assets|backup|banners|beta|blogs|cache|calendar|cgi-bin|checkformats|cfm|clients|consultation|core|css|demo|discuss_lib|dhlupdate|direc|domains|emailstory|gallery|GoogleSpeech|health|hino|homepage|images|install.|.*\.init|js|lib|listselect|lm|menusa|newsletter\-.*|old|paclm|Pages|parts_service|phpmyadmin|pictures|popup_index|privacy-policy|public|rmareturns|rising_api|rssreader|sendlogin|shells|sites|sitemap|stats|test|trademark|themes|tmp|uploads|video|wc-logs|webalizer|wordpress|wp-admin|wp-content|wp-includes)\/([A-Za-z0-9|]{7,40})\/(\"|\n)
  1183. https?:\/\/.+?\/(AMAZON|Amazon)\/.+?\/([0-9\-_]{5,7})\/
  1184. https?:\/\/.+?\/([0-9a-z\-_]{3,11})\/([A-Z0-9]{7,32})\/([A-Za-z]{7,32})\/(\"|\n)
  1185. https?:\/\/.+?\/([A-Za-z0-9]{8,30})_([a-z0-9]{5,10})-([0-9]{8,15})\/
  1186. https?:\/\/.+?\/(Document|DOC|FILE|INC|LLC|Scan)\/([a-zA-Z0-9]{4,30})\/
  1187.  
  1188. Also keep in mind, your filter needs to look inside PDF files to find the URI to test against these above. Otherwise
  1189. this does not help.
  1190. ```
  1191. #### Loader Report ####
  1192. ```
  1193. Payloads and C2 report has been combined into this section and it is now known as the Loader Report.
  1194.  
  1195. ---Reminder---
  1196. RSA keys changed on all 3 botnets at approximately 1930UTC 2019/11/08.
  1197. e1:
  1198. -----BEGIN PUBLIC KEY-----
  1199. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOmlscqbEIhLjVsj9r3eYacKi6C+Qrua
  1200. j5TlU+pn3zc0k06qCoahFXBBGnYMotHQc6OwfBKwHWm831LIVg29kEjT8UYxnN5v
  1201. fzNGgqXTe25QARf78CsQqqN/ImKdXo+GFwIDAQAB
  1202. -----END PUBLIC KEY-----
  1203. e2:
  1204. -----BEGIN PUBLIC KEY-----
  1205. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAKl4M80uy0jcxUiFIaJJyxgHVVnFtCq6
  1206. bi6f2xXPh/XUZNyN8UXDe5HzhTc4kwon9MBZffNwFOIc61QfV3K3YzEI/ktcyNqK
  1207. LS67ONxsVep769QdiVQJXrIaFjMXKz6viwIDAQAB
  1208. -----END PUBLIC KEY-----
  1209. e3:
  1210. -----BEGIN PUBLIC KEY-----
  1211. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMqZMACZDzcRXuSnj2OI8LeIYKrbUIXL
  1212. faUgIJPwYd305HnaBS2AfA0R+oPxT32r+3BbayI3KguqAn3E+rbwtLhqhOXOlTnY
  1213. 7yvG4ufmwCCkRzc6Sq8baToxmd6y523AIQIDAQAB
  1214. -----END PUBLIC KEY-----
  1215.  
  1216. At this time we noticed the EXE naming convention changed too. The new names will be 2 of any of the following list of words:
  1217. FileNames: "delete,band,ipsm,sspi,div,rdp,whole,dir,privacy,make,watched,pano,which,goto,wnd,rep,ceip,date,render,bag,vsc,vsa,mouse,
  1218. counter,tech,wheel,ranker,iterate,store,sum,package,timeout,idebug,junos,site,trc,url,coffee,poller,remote,gapa,changes,duck,ppl,
  1219. tlogcm,tlb,cube,hexa,vol,paint,star,nav,grp,avatar,center,cipher,brm,resize,markup,pausea,loan,emboss,vsperf,teal"
  1220. --------------
  1221.  
  1222. Oddly we did not see a C2 change today and the C2s were the same as the Friday report.
  1223.  
  1224. E1 now 82 combos, was 82 for a net nil
  1225. E2 now 71 combos, was 71 for a net nil
  1226. E3 now 52 combos, was 52 for a net nil
  1227.  
  1228. E1
  1229. ..:.. - 12:40 732kb 7579
  1230. 12:40 - 16:50 732kb (recycled)
  1231. 16:50 - 19:15 732kb 7595
  1232.  
  1233. E2
  1234. 06:50 - 07:40 114kb 7576
  1235. 07:40 - 07:55 729kb 7578
  1236. 07:55 - 12:20 722kb 7589
  1237. 12:20 - 16:45 722kb (recycled)
  1238. 16:45 - 19:15 722kb 7594
  1239.  
  1240. E3
  1241. 18:50 - 19:15 723kb 7598
  1242. ```
  1243. #### Closing ####
  1244. ```
  1245.  
  1246. No clue what is going on with Emotet today, so many questions. Was it a hangover? Was it observance of Armistice Day/Veterans day?
  1247. Is this some sort of deliberate trick to set us off track? Is some sort of major update coming tomorrow? Is there some sort of takedown
  1248. by LEA happening? Whatever the case may be this was a haphazard bunch of garbage released today Ivan. I think today can be summed up
  1249. as a case of the Monday's. Be vigilant tomorrow just in case Ivan is ready to drop more tricks than just Trickbot!
  1250.  
  1251. TT
  1252.  
  1253. ```
  1254. #### Sandbox 11/11/19 ####
  1255.  
  1256. ```
  1257.  
  1258. E1
  1259. https://capesandbox.com/analysis/7955/
  1260.  
  1261. E2
  1262. https://capesandbox.com/analysis/7594/
  1263.  
  1264. E3
  1265. https://capesandbox.com/analysis/7598/
  1266.  
  1267. ```
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!