Emotet Malware IoCs 11/30/18

## Emotet Malware Document links/IOCs for 11/30/18 as of 11/30/18 21:00 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 11/30/18 ####
```

http://162.243.7.179/wp-content/themes/alveophase3/msf-files/EN/Coupons/
http://715715.ru/En/CyberMonday/
http://acumenpackaging.com/EN/Coupons/
http://adamenterprisesinc.com/EN/CM2018/
http://afifa-skincare.tk/wp-content/themes/vertikal/EN/CyberMonday2018/
http://alkonavigator.su/En/CyberMonday2018/
http://ambiance.selworthydev4.com/EN/CM2018/
http://araty.fr/En/Coupons/
http://artst12345.nichost.ru/En/Clients_Coupons/
http://bandungislamicschool.com/site/cache/En/Coupons/
http://barbararinella.com/EN/CyberMonday2018/
http://beritanegeri.info/EN/CyberMonday/
http://bestgrafic.eu/En/Clients_CyberMonday_Coupons/
http://blogbbw.net/En/CM2018-COUPONS/
http://bobvr.com/EN/CyberMonday/
http://bool.com.tr/EN/CM2018/
http://bratech.co.jp/form/EN/Clients_CM_Coupons/
http://corporate.landlautomotive.co.uk/EN/CyberMonday2018/
http://dat24h.vip/EN/CyberMonday/
http://dev.surreytoyotabodyshop.com/EN/Clients_CyberMonday_Coupons/
http://ecosfestival.com/EN/Clients_CM_Coupons/
http://enthos.net/EN/CyberMonday2018/
http://evaxinh.edu.vn/En/CyberMonday/
http://exeterpremedia.com/EN/Coupons/
http://firstclassflooring.ca/En/Clients_Coupons/
http://fishingbigstore.com/addons/EN/CyberMonday2018/
http://fondtomafound.org/wvvw/En/Clients_CyberMonday_Coupons/
http://getrich.cash/wp-content/EN/CM2018-COUPONS/
http://ghassansugar.com/En/CM2018/
http://gog.joyheat.com/cog-user/html/EN/Clients_Coupons/
http://g-steel.ru/En/CM2018/
http://iconpartners.com/En/CyberMonday/
http://interurbansa.com/En/CM2018/
http://ismandanismanlik.com/administrator/EN/CM2018-COUPONS/
http://jurabek.uz/sites/all/En/Clients_CyberMonday_Coupons/
http://kevindcarr.com/EN/CyberMonday/
http://kronwerk-brass.ru/EN/Clients_Coupons/
http://kulikovonn.ru/En/CyberMonday2018/
http://miamijouvert.com/En/Clients_CyberMonday_Coupons/
http://myfreshword.com/EN/CM2018-COUPONS/
http://ngayhoivieclam.uet.vnu.edu.vn/wp-content/EN/Clients_CyberMonday_Coupons/
http://nowley-rus.ru/administrator/cache/En/CM2018/
http://noxton.by/En/Clients_CM_Coupons/
http://omartinez.com/EN/Clients_CyberMonday_Coupons/
http://ruslanberlin.com/EN/Clients_CM_Coupons/
http://samsonoff.com/En/Clients_CM_Coupons/
http://shofar.com/En/CyberMonday2018/
http://shreeconstructions.co.in/EN/Clients_CyberMonday_Coupons/
http://siteme.com/En/Clients_CM_Coupons/
http://sociallyvegan.com/En/Coupons/
http://stamp2u.com.my/EN/Clients_Coupons/
http://stickerzone.eu/En/Clients_CM_Coupons/
http://stjohngill.com.au/En/Clients_CyberMonday_Coupons/
http://syca.weekydeal.fr/En/CyberMonday2018/
http://tabb.ro/En/CM2018/
http://telovox.com/En/Clients_CM_Coupons/
http://tom11.com/EN/CyberMonday2018/
http://tom-steed.com/En/CyberMonday/
http://t-slide.fr/En/CyberMonday/
http://ultrapureinc.com/EN/CyberMonday/
http://ulushaber.com/EN/Clients_CM_Coupons/
http://warzonesecure.com/EN/Clients_Coupons/
http://watteria.com/EN/Clients_CM_Coupons/
http://weloveanimals.net/En/Clients_Coupons/
http://welovecreative.co.nz/En/CyberMonday/
http://whysquare.co.nz/EN/Clients_Coupons/
http://wpthemes.com/EN/Clients_CyberMonday_Coupons/
http://www.getrich.cash/wp-content/EN/CM2018-COUPONS/
http://www.weloveanimals.net/En/Clients_Coupons/
http://xn--j1acicidh1e0b.xn--p1ai/EN/Clients_Coupons/
http://ziplabs.com.au/EN/CyberMonday2018/
https://ercancihandide.com/En/CM2018-COUPONS/
https://fishingbigstore.com/addons/EN/CyberMonday2018/

```
#### Epoch 2 Document/Downloader links seen for 11/30/18 ####
```

http://221b.com.ua/scan/EN_en/Invoice-4704985-November/
http://2d73.ru/files/DE_de/DETAILS/IhreRechnung-MPO-23-91687/
http://8.u0141023.z8.ru/9575GZY/SWIFT/Personal/
http://adap.davaocity.gov.ph/wp-content/Mf9UvStZTy1Yc/de/Service-Center/
http://afifa-skincare.com/doc/de/Zahlung/Ihre-Rechnung-UJ-12-38458/
http://aglayalegal.com/default/En/Scan/
http://alexzstroy.ru/files/En/Summit-Companies-Invoice-07675315/
http://alindco.com/sites/US_us/Paid-Invoices/
http://almasgranite.com/wp-snapshots/newsletter/US_us/New-order/
http://alphasecurity.mobi/INFO/EN_en/Overdue-payment/
http://amerpoint.nichost.ru/7372TOIVDXTI/identity/Personal/
http://andreaahumada.cl/sites/EN_en/Invoices-attached/
http://animalrescueis.us/xerox/En/Important-Please-Read/
http://apsportage.fr/39TZPAQRI/identity/Business/
http://artebru.com/Document/EN_en/Summit-Companies-Invoice-38363359/
http://atoz.com.ng/wp-admin/scan/US_us/Paid-Invoices/
http://auburnhomeinspectionohio.com/3734YEHMKLK/PAY/Business/
http://auburnhomeinspectionohio.com/AcXZkW/biz/Service-Center/
http://auladebajavision.com/Corporation/US_us/Past-Due-Invoices/
http://ballbkk.com/egSsf3v4hDETgFY/SEPA/Firmenkunden/
http://ballzing.com/newsletter/En/Invoices-attached/
http://baobabmadewithlove.com/xerox/En/Invoice/
http://beldverkom.ru/INFO/EN_en/Invoice-4639069/
http://bestautolenders.com/default/Rechnungs-Details/RECHNUNG/RechnungScan-ZHP-56-51422/
http://blogs.ekgost.ru/sites/En_us/Inv-538884-PO-9C045976/
http://bobvr.com/jNKNUhf/DE/Privatkunden/
http://body90.com/3BL/PAYROLL/Smallbusiness/
http://bookyogatrip.com/FILE/US/Paid-Invoices/
http://bosspattaya.com/INFO/US/Invoice-Corrections-for-92/55/
http://boxofgiggles.com/Download/US_us/Open-invoices/
http://boxofgiggles.com/files/Scan/Zahlung/Rechnung-ZD-23-38364/
http://brandsecret.net/wp-admin/images/8NYJXOHGJ/SWIFT/US/
http://burlingtonadvertising.com/63415Y/SEP/Commercial/
http://bygbaby.com/jTHevt54K/SWIFT/Privatkunden/
http://bzztcommunicatie.nl/Nov2018/Rech/Hilfestellung/Rechnungskorrektur-MOM-46-15565/
http://canetafixa.com.br/Download/En/Invoices-Overdue/
http://car.gamereview.co/doc/EN_en/Invoice-for-b/r-11/30/2018/
http://carminewarren.com/5CHIXS/BIZ/US/
http://ceatnet.com.br/0I/ACH/Personal/
http://childcaretrinity.org/Download/En/Service-Report-9264/
http://colegiosantanna.com.br/756045DVIUPI/WIRE/Commercial/
http://consumars.com/LLC/US/ACH-form/
http://cooprodusw.cluster005.ovh.net/Corporation/En_us/Scan/
http://cqconsulting.ca/FILE/US/New-order/
http://customedia.es/9NUPBQL/WIRE/Business/
http://dat24h.vip/741XLQDQG/WIRE/Personal/
http://denisewyatt.com/P8Vnk05jbY5hO3WTfs5j/SEP/PrivateBanking/
http://djwesz.nl/wp-admin/2560389FLWVMM/SEP/US/
http://djwesz.nl/wp-admin/6865JKITDQ/WIRE/US/
http://djwesz.nl/wp-admin/doc/Rechnung/Zahlung/Hilfestellung-zu-Ihrer-Rechnung-TD-52-51926/
http://draalexania.com.br/default/US_us/Paid-Invoice/
http://drcarrico.com.br/files/US_us/Invoices-attached/
http://dutaresik.com/default/US/Paid-Invoices/
http://egger.nl/doc/Rechnungs/DETAILS/Details-KK-91-00137/
http://ellajanelane.com/Nov2018/US_us/Invoice/
http://emltc.com/wp-includes/INFO/En/Past-Due-Invoices/
http://enthos.net/8973304EOOWIAZ/SEP/Commercial/
http://eogurgaon.com/wp-content/uploads/2018/Corporation/EN_en/Paid-Invoice/
http://ericleventhal.com/EN/CyberMonday2018/
http://eventoursport.com/01635CCB/WIRE/Personal/
http://fenlabenergy.com/492182SA/FILE/US_us/Document-needed/
http://firstclassflooring.ca/32NNRSRAM/identity/Smallbusiness/
http://firstclassflooring.ca/8253TM/com/Business/
http://fusionlimited.com/DOC/En_us/Invoice-Number-27356/
http://galaxyxxi.co/Subtitle/doc/US_us/Open-invoices/
http://gerbrecha.com/scan/En_us/Overdue-payment/
http://gerove.com/FILE/US/Past-Due-Invoices/
http://ghoulash.com/77OQYFJV/biz/Smallbusiness/
http://gonorthhalifax.com/6BYELM/PAY/Business/
http://gonorthhalifax.com/ffmoJjv8/de_DE/IhreSparkasse/
http://greenplastic.com/FILE/US/Invoice-Number-73617/
http://g-startupmena.com/Corporation/En/ACH-form/
http://hellodocumentary.com/hellosouthamerica.com/3HTMCKX/biz/Business/
http://homeavenue.net/FILE/EN_en/Invoices-Overdue/
http://iforgiveyouanitabryant.com/177095GI/com/Commercial/
http://iluzhions.com/Download/US/Invoice-85037731-September/
http://imetrade.com/4652J/biz/Smallbusiness/
http://inspirefit.net/4747UYRTL/WIRE/Personal/
http://inspirefit.net/Nov2018/EN_en/Important-Please-Read/
http://inspirefit.net/OG28W96yNND1lhwtZ6Uu/SWIFT/Service-Center/
http://ipaw.ca/7344YHP/identity/US/
http://ivan.pereverzev.com/doc/En/Scan/
http://joaovitor.io/default/EN_en/Outstanding-Invoices/
http://khdmatk.com/Corporation/US/Invoices-Overdue/
http://kinesiotape.sk/default/EN_en/4-Past-Due-Invoices/
http://kiramarch.com/files/En_us/Important-Please-Read/
http://kohkjong.com/Document/En_us/504-28-388593-710-504-28-388593-493/
http://kosses.nl/8428686GIE/SEP/Business/
http://lacroce.com.br/DOC/EN_en/Open-Past-Due-Orders/
http://lotusevents.nl/59883LZVKVYGL/SEP/Personal/
http://louised.dk/DOC/EN_en/Invoice-Corrections-for-27/55/
http://lumnus.com.br/doc/EN_en/Past-Due-Invoice/
http://micronems.com/6477CBCCBK/oamo/Smallbusiness/
http://mint05.ph/s2pFbTFDG1wsb/DE/IhreSparkasse/
http://miracle-house.ru/xerox/EN_en/Summit-Companies-Invoice-50143566/
http://mktfan.com/Corporation/En/New-order/
http://msconstruin.com/newsletter/En_us/Past-Due-Invoice/
http://neilscatering.com/Document/En/Outstanding-Invoices/
http://nesstrike.com.ve/xerox/US/321-85-611234-741-321-85-611234-481/
http://nowley-rus.ru/administrator/cache/MSF8syjz73/DE/Privatkunden/
http://partner.targoapp.ru/8166J/oamo/Personal/
http://paulofodra.com.br/xerox/EN_en/Important-Please-Read/
http://pibuilding.com/default/US_us/Paid-Invoices/
http://poows.com.br/Nov2018/En_us/Outstanding-Invoices/
http://progettopersianas.com.br/3XNOUEVK/com/Smallbusiness/
http://progettopersianas.com.br/4891173RASHZ/SWIFT/US/
http://proizteknik.com/xerox/EN_en/Question/
http://radiotaxilaguna.com/files/En/Need-to-send-the-attachment/
http://rectificadoscarrion.com/LLC/US_us/Service-Invoice/
http://rhymexclusive.com/2LNiLHF/biz/IhreSparkasse/
http://ridersa.co.za/sites/En_us/Invoice-7860794-November/
http://robwalls.com/newsletter/En_us/Overdue-payment/
http://rushdirect.net/0800FFF/biz/US/
http://rushdirect.net/400279M/PAYROLL/US/
http://rushdirect.net/BHeTf4AzhDgeP0NtIC/SEP/Firmenkunden/
http://rushdirect.net/sites/Scan/Rechnungsanschrift/Ihre-Rechnung-FO-87-61168/
http://s18501.p519.sites.pressdns.com/default/EN_en/Invoice-Corrections-for-86/46/
http://sandbox.leadseven.com/528BAXUXSNF/PAYMENT/Business/
http://shop.irpointcenter.com/23289HBKXSWO/com/Commercial/
http://shreeconstructions.co.in/737ZDAS/SEP/Smallbusiness/
http://sindia.co.in/buxiUN9LHl/de_DE/Firmenkunden/
http://sitemap.skybox1.com/xerox/En/Scan/
http://spb-sexhome.ru/INFO/US_us/Need-to-send-the-attachment/
http://standart-uk.ru/files/GER/DOC/Rechnungszahlung-LJE-56-49726/
http://startgrid.be/doc/EN_en/Paid-Invoices/
http://stinkfinger.nl/FILE/En/Outstanding-Invoices/
http://swimupstream.us/newsletter/US_us/Document-needed/
http://terrats.biz/default/US_us/ACH-form/
http://timlinger.com/4095658F/biz/Personal/
http://travelcentreny.com/7KYWQO/PAYROLL/US/
http://venturemeets.com/wp-content/sites/US/Service-Invoice/
http://wasza.com/default/EN_en/Overdue-payment/
http://wazzah.com.br/files/EN_en/Open-Past-Due-Orders/
http://welcomechange.org/FILE/US_us/Service-Invoice/
http://welikeinc.com/scan/EN_en/Past-Due-Invoices/
http://wessexproductions.co.uk/FILE/EN_en/Question/
http://winnieobrien.com/doc/En/Past-Due-Invoice/
http://worldcommunitymuseum.org/09OXMIGBFQ/com/Smallbusiness/
http://wowter.com/files/US/Invoice-for-i/w-11/29/2018/
http://wptest.yudigital.com/sites/US_us/Scan/
http://wrapmotors.com/LLC/En_us/Paid-Invoices/
http://www.anvd.ne/wp-content/50NQAGCV/PAY/Personal/
http://www.kosses.nl/8428686GIE/SEP/Business/
http://www.kosses.nl/gok4FP238PI0kZzqL/DE/IhreSparkasse/
http://www.lotusevents.nl/59883LZVKVYGL/SEP/Personal/
http://www.mtcinteriordesign.co.uk/newsletter/US/Inv-31353-PO-6W877946/
http://www.nowley-rus.ru/administrator/cache/MSF8syjz73/DE/Privatkunden/
http://www.popmedia.es/default/US/Open-invoices/
http://www.progettopersianas.com.br/525WBOY/ACH/US/
http://www.rushdirect.net/0800FFF/biz/US/
http://www.rushdirect.net/400279M/PAYROLL/US/
http://www.rushdirect.net/sites/Scan/Rechnungsanschrift/Ihre-Rechnung-FO-87-61168/
http://www.split-sistema.su/administrator/cache/xerox/EN_en/Invoices-attached/
http://www.standart-uk.ru/DOC/US_us/1-Past-Due-Invoices/
http://www.standart-uk.ru/files/GER/DOC/Rechnungszahlung-LJE-56-49726/
http://www.test.stylevesti.ru/077406J/PAYROLL/Business/
http://www.vdvlugt.org/newsletter/En_us/Overdue-payment/
http://www.wilsonservicesni.com/Nov2018/US/Service-Report-77668/
http://www.w-p-test.ru/3TJPP/BIZ/Personal/
http://xn--b1agpzh0e.xn--80adxhks/Nov2018/Rechnung/Rechnungsanschrift/Ihre-Rechnung-WUF-33-02594/
https://customedia.es/0API/BIZ/Personal/
https://customedia.es/9NUPBQL/WIRE/Business/
https://insurance-truck.intercom-mail.com/i/o/88503657/f1fdf377cbc5d0797ff5fcf9/contract.doc/
https://mandrillapp.com/track/click/30505209/221b.com.ua?p=eyJzIjoiNGRYZm4zZG9yY2k5LVVBRllNV1RtV29LWlhZIiwidiI6MSwicCI6IntcInVcIjozMDUwNTIwOSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvMjIxYi5jb20udWFcXFwvc2NhblxcXC9FTl9lblxcXC9JbnZvaWNlLTQ3MDQ5ODUtTm92ZW1iZXJcIixcImlkXCI6XCI1NjY3ZjIyY2I5YjM0Nzg5OTc2MzEwMWE4MWYxNzc1YlwiLFwidXJsX2lkc1wiOltcIjdhNTRiNzBjMjZkZjg5MDY2YTIyYmE3ZjE2NmMyNjIzM2E5N2E1NDVcIl19In0/
https://url.emailprotection.link/?awijIQK7hYpp1TbxmFEJIIIZ9Utqx3N-OhfHL-XyvtDbNOIqNDKZxU0dnlHleFgPFSqSgENdGSdEEwdeliLMXifigZzDxem3wjilOymtjMz6hihbnspNc050UEicr0eEr/
https://www.vdvlugt.org/newsletter/En_us/Overdue-payment/


```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-30 20:25:00
SHA256:
86ddeac93263f0410b5219905c9f63602b1fededcdd5f073fd32b3e0844fbc28
a200c8a17f60a2b73fa0fa5416d03b881953958577a95758de7734753aae9dad
8c4431dd6a7846be62ae44f485be5f9fd386784221ac44f0e66e36da29ee2c54
8f08843b0b5acb6994bd41c325c7673242a628d753d2e987bc7ee66e3c82bbaf
2633ea2ddab94c6b4ca0a1297ccf235ee7713ca639b56335938df599343e5624
28df62c68e31e95f342d6631ed6fd219131bd87c10d34b6f88f1d8bc75572172
a052d62dc5f1557cd24728caa964d53c7c3fa64de7c8bbbdfd6f00f119f4c1f2
d100eba43abe173bebaea66ba0e7eade109d5c77d7c4d3aa210e4b5b45be61c4
438658aeb9b3200b7a18855577739a570b5982bb107511efe7057a27ae761d62
984cfc6589d4a13928ce9991998ae44c148c84ab51263038be36ce58174b771f
afe30c4847162f41cd024ba86a00447ec707f025d33665275d1da16c457f9346
ea58bca06b1128c246a3c4ea00b04b61570e659980c6671ab0748031de6ca987
76adc1c1a71f0ad980118756166acb211e116686083d1056e8e8180824cd3685
db355f995fdf8844c01f57bc026dd9de52184d5d344d6c9191651c9f0688c5f2
50f105dbbbbf649bac0fd63064eefce491be19c1838d7b21a7da86c62868de49
1427f5e1bab9e36d2f6d26e9dc431cca6c32e5a0264ca44bb95a79984582f462
a361cd67fede95777b31fe1ab7b1b4527f17604b1f66beba0213f6aac635dc4c
6a16d72fb32b7f14345118aeaf2b9fb8d05b7b5eb48fde88b5aa1e79e58eea80
586f50e6510ae7e08537a772bc2d2e0a012aed247c85852396e0845e28ee2562
7451da8a39e6a416cacc03f974b396b8007c8b7564709106c92b108f6bffdc37
b44f1b756b4e873c50517af1305cf536093e3d2bffb70b6fa2bfb76cf1f7a452
f9c18e87273080f98f076307f184f3f5dbb57e78aa4029e0c4a23938ca37a53f
ca07363cfc4002d1e05cdd49f3a514a698f24a8dcb89536b1c19bf62ead78120
9f4b4313a9bc8c70f469036648da7f8f7d70722c7f5a196af69bedd83bd451b5
c7fd19b1bb30a260f76d95a9d06ae4d0441e83ab69fffd59f1a6d26dde7a4564
5d0d4bac6e01515ba2b23f53b5ffa6b2db05f81e8b59bb358b745bcfae84ef59
fece35dbf773fe012560ca2b58e8c3d3893483fbdd5fdda74d483525ff52d48c
4e594cc1ec6a34d5c73472f364b68204e4ffc6c1469ee860131982656752a443
8cd9f1668fde789f33e55a00b0b7fdd76e0beb8c845e6096437c4032402bfda0
c4278b39cbdab502fbfc483173a0d67637a131da4296c77568f180bf93f0f585
d8e6e5039383339ad0c82035a91722916ba3435a003761e642296e7f2424ace7

http://imagelinetechnologies.com/IkFYsUsc
http://jomjomstudio.com/aQfv0kOkac
http://gulfcoastcurbappeal.net/NbFX739W
http://btsstation.com/kdp7xNXOu
http://casadeigarei.com/wwYoQ1isV

Creation Time	2018-11-30 15:40:00
SHA256:
9f4c05053abf1817e311fc4698fb506570beb4b3de4c4618fd7a299723913253
c000942eff53ebbee74cdc6b69a8534850c5f2ec3d684324d191d9eb494d4622
7988ef33afc49545f725e90e8f16bba7f0461eb7a08b8c579d829877ab37d16b
30493a8aa470550d2f134f0578a791a33ba73414de015c64ccb4fb33927c6060
69eb525b00f39bf3b66424e807b46c6345dd4e691b99a3eb5b24aa08fda43608
1aae3e5def3e691b9b88cc5388c358c813464e469d14aac5011b006ff8ed415b
7575f70750701900f5398cc18f766fd79dd0dc1fc37f563d8e519f5124e77261
309d8227a299d90892f2e05f800f898ce7c5759e98bf8e1daf06824571f024bb
f3ef4cdef0f47150e36e0fb2720b8c16bbd6b41958a651dc6421f003511c3503
1b65d4be042fa1e8c4e5b172d6a4ae741ead775a2510f9769c89f7b143a527f4
952afad9d4c8e595187f6a2e586ee4bac303672e7e8a0b6d640ec206f8f3e0b1
1da18d0c9905eacce4cb4d069a69f18b1f5ab977ca3d52e11a7f791fd4720ea7
cf42ffa436a95856d4cda888ba212a5ca94fdc491403a382e5955dba130514b2
36c706950d079b0d47bf775f26ed4da6a68785b3541ef4698d67e8fe73e2401e
c88381dfc414451b8d17e0c2acceb3be5ebda06b60f5338b365445c4a0767fbb
d3b69925bcd7883b14db63e2bdc3941c2117f05de8273e39be2f3b7cb3bdf484
f9c921ee291acb60a4d6b8aec843212eaa5f767af797551509c0d793285cfed9
5416ed8a0f4f683a7c2585eeb36f712e9d8e3bb2d633d0bb72a923ef082fa9dc

http://www.questerind.com/sTT71SIgex
http://eventoursport.com/EfZR8DH
http://opusjobapp.com/MfyMXL8nT
http://prokatavto48.ru/xH9klYA7VP
http://iforgiveyouanitabryant.com/J6uZLHa2

Creation Time	2018-11-30 12:27:00
SHA256:
4ff0aac1406faa9fca0984df22802ffec66a523d60afb034a7a4cbe6613961b1
befa8e4dbf824d1e537d2e286b1e044d2f24a6074037775f8087a38e83dc0d4d
f30e2585b1b04a2adf9162aa896f532b1ff7d0ee0c546ce7e22bf4b023d7c111
881e2845c5951324b474d27a12fdab3db3a80307a32564e0cb64893ebe3defa6
5dc6792a5bfd5fde89c06e866cfb7c951d0c7b1e7109153476ef2e592e94e5c3
9659deab80db13a4cfbb85b3b0706542fe97502e9cae74ec7f78f424f7c946cc
7d2cd8f856ca03cb884259fd8d4bb650421fb3480d77b6906dd9cf5fce3069f3
8d5050a0981407adb078617b510fda3f7faa3709bc4c46ac4726efe0ab85dd0c
decff07689de0b6b0ee806a13209fa0731dfdc2d824f2d638928de6a5a55b191
1284092607a87238a9634841d978a24db0d59407e1d63e41d74079671503e487
b7a1ae3d7268aa7522f91dfe73a5e92c87793ea277ad63a60a5741b2a33e0a38
2d5e703cc9ac91416819ad9b2cbd1efd5845ffeeeec34cc1a0cb9c1155415c26
c6c8ea00a4a2eab743427ac1b019afacb7e9dbfbcb55f0dcc2a27baa4f68367e
b712b1513dc6837827ce2d2b11aedac311eab245632a1a034620fb1d902a1638
f93be6df6b1fe5ba139ebf1e6e0404392015c19480e72648528fae1eee86e168
2b2ef66eb38d46a7a7d884d6710b991d54c08654764d68161cfff18795e41c5d
6c6910c2dd36f372874bb4554cac7aac725fb72ba2e07cb1550219c54f147f08
85375e2f9b235906c7a4c3d27c42373db8bb7cabcec62561d39d6c9a1726d3fc
1bd0dc989d9953b0b53a00750e6169d842074a36c0f3bf98c99f26162fc064ca
75957d8be31d9a03caefd7905f96c38bbdb434c9887a6eec627de9a548720f49
ba817ff0c3782731a18eee71e4a7ac9f102a2b4ba9040c4fc3e1f9f026e3d86a

https://bridgecareinc.com/xLmMFIoUl
http://akdforum.com/ILqikoQ1n
http://bestautolenders.com/br2gd8R
http://www.missionhoperwanda.org/dbxNyMud3k
http://afifa-skincare.com/OBXnc8Og

Creation Time	2018-11-30 07:14:00
SHA256:
54d6f63dbfcd08e1b9f5766003655414fd96cf9c5874ffc835e7eaa2aa248fb5
84a8b82276393a5afffd2bfd144aac06882f6c45ac8fdc9a45c0f85d2a1a6e1c
b25dfcf1456ca772eb164e3a3ec30cf5784d3353197817843af506be190a7da3
963915efdbd548ca299e3c37baafc873803a0d91b7e45a2ee30b440d2fdebf08
e4802749bccea29e677ace242ce3357b373e337d34aecbf891038d81b25c8371
cd96bac6e004764290c9bf0ac2fa633d2384c1496989a49f2ddd4ea9b8e30259
7eda1cf9d07dce159143140aa305db8bf2253e885f2d1955947620d79daf2be8
9c5e2c5876049e1947a08ac600779f580d2cad32ba4d7973d84e3435487fe30b
aac5e323d9949a2da3d3a770b1d1a85073e716ee00f68ce4ef307be5ec8af881
60c2a8f91074c0e45be5bd357190655868ac95bb5b1e8102717dde3246756652
0fd5b812c302948711d1f790640a5b763671084ddc6fedeeade3e28e7098c19e
8eca2f22a2894d221190c5bc88c1ec094a7f677ad997c7245b0f69b1fa4be575
ab1640b149def9fa3d8d3f9a5f86df9542d3ca4417201c024e68114fab6b2bc6
b6e9cbe34c68a76987de8d1a69e5e18b1cebc6836171620d5ca5a735695b15c2
f7f40fea4a56865ad9fd5efa5505de912f2d15ad453c55de11a18852d181f847
d066823d5e36761509d526d0ebd4e4c5791fd1ae9b641fcce5e55b1c489177ca
aab374720ed06ed4477cdfae2f88032930f3aa5936a5046cd820238749404b76
8868fa1a0514016121ba7891f63c4ad75ca9c0cb1e1a46df05afb49d237c35c2
0e70875b5043d82f6eb5a136db4d1026c8be158cd837a25f5668d0ac6b821775
b3d32f72f9902f6508d6ab84b2db244246bef44e41ffac7f03bb909c3d52a10c
d96fee333c2c644a6a8e5a27705199a3d9bbde47d45223f049cedb071766fb0b
b5914ef7d68b891636ca26ee9de397e955a5682a4aa10aa4bd3bd3450ff3246d
4fdafa6eee3041fe98dd081c5a8e4cfb555ef4400d5ca8c63d052d18d6c76f6c
5f285c38e3a1f4a1b809557568fda3f90d40fc4c17bbee184eaae5b8dd243fcc
8f30fc15dfb977aa8f4b59e77cb3a98067ed3796cc459df1c84fa3dd32d90264
24c05e9704b3caef52e0274c1d02ba0d9403c34ad163ff2b1bc7f939a5c88885
0e52440f164eed392a778886c55fd89132cc3afe62644d2210ca5ff95c8495cb
2df7eafab09b03efad7dcbffbaf3c4743e14901ed6a228e3b8081a62cb38ba73
6c16931dcf679ed9993da882055dbc1d9afecd388b234dc968f623942d7f5541
b74a4a36a97cc6a64a504e0140e28e1be566cc7bec7765ef4f5ea24c7524749b
2f7bfe5c74b9e4cc45d7b1414986b3f8349aec0264c131a8d9c28a1bd84facea
5b6928b06413abeca5a7d61b50b936ad565fe428afa35e079fb16e414c06252f

http://edugnome.net/ifdEQQm29S
http://teknotown.com/kboOF6KH
http://info-daily.boilerhouse.digital/p30lz7AK4c
http://rdsinvestments.com/qOmtaQAXO
http://uncommon-connectedness.com/ajnxxEvq

Creation Time	2018-11-29 19:59:00
SHA256:
5771afc72dbfa0c3dbdc1b9ae00eca3e4a73310362f95431bf16761c77baffa2
4819ce39980e4401a1ddb04d95f473f32dbd65634b6708ae08e994095cb7a1fd
0a74a0d005a3302d8a163418e4230c27b440513d92fb48016203a1c0943372eb
b328e54a5c09c66f1ea22b8f57caa55d209932906dab7d26fcea36318d7a5a7b
e45380976881690306eda1a67298f69976992c82a5e07a19cf36198ebaded26f
99fe0a8026b18155e7f51d95702befd6107afedc3d025c12283e84105ce947f5
212b1e9b081302509810dc6e001bcfdf090eb5cfa4a78807e53037e1c15cf541
e480655bcf96ffe3189605607daa1167a1a9303dedf515a84992a74916c71bd0
755370efe90de442adf6f3998792e8238be1aaca88ad4f25cb05161294a88ac7
39eac99ca6b533d59d8220114647760f44d5bb0c7a6bf597f8171e975ed2d87b
b4033f3f4620675a74913758e494ba6af14f99f60cafb805413762dc3d47d337
e822e44319949186286f4c43f81fe69a113553a6e81c18f19488603bbcecbd13
8b48d516d4164553b74c156c42461e49f62c4a923f0ae9f7bf04de74991c947c
481a9d7955b1c011aa9ee26a9c78685b458d67eaf519bbada1b6b0f81a4a31c6
9ad00475fa74215419981a47b21a776944f2bc4a6a330daf140481682ba84796
db7735ce88088fa4207cc05746fac84522790f7a5df5aa08d1751b661c7f0e2b
bafb152079e5a0c4709e961a6258f0390922d7a96f32616f06ef35fdb6467210
63f8826fe8ff24c1ad91265714fe0d6e9aa486bc6079bf674e0b69edbbe739c8
49eb43e0155563289c0a835305724e26606f6b5f9defc7feed75c5931220b193
61dd98d15387444e1ae49b97540de88951ad9eb3f970ab62def057c92911867f
7102877d70ad54f07bdb5baa4c9a995962b6c7b93b10455b1c118a40954dcd22
c7f540b7667722d8ef6f962eec154671ebdf7e156104f6b830c9a3ecc29efe7a
6488e877c6b6e8a20f44b90d23ddfc53363f443530969ec1927269c2e5c84644
c3ec370f42fc7caa0bc784de54aae32fee4d869ac42cf75c8b42631cc5dd30a2
132b91529a30ec3bb78e13c56b25c41f9cdaae7852feb52b74914f904f190e46
d935b68ef229e3fa9cec85ef442cb8875aed729e5dc5272fbfe1d822e3575524

http://tunerg.com/eygUEU2A9
http://camelliia.com/Futu3fgt
http://triton.fi/Bz4pEqDQw
http://intranet.champagne-clerambault.com/NjmYMSA
http://tecnogestiopenedes.es/ewBNnYs1l

```
#### SHA256s for Epoch 1 Payload EXEs seen on 11/30/18 ####
```

054e8c2e3683b4462f8b207204d5ea17d13420559fdd5fd1023c7ca5b3f5713b
886a874c72541ebc65eb85a682b8dad1b811ab66cd93f4d33334b0b33cd4b811
7195110df7299e15378fbdf82ec0236004d93db3bcff277f5affec5abd99ccc9
a9f0dc6cc6abaa4ba8e6b2d581f6528f0de9d552df8d03c70f89e48d933b2228
9af10d8de8c2e0d7c62d9594c54f64b59102028884605db2429d53cde6ab2f03
ebfe3e192c70c3f134f5ed8a1489d21215a687ed05dffadd3b328780debadb4e
74a474d0e84babc64ea0d3d10be60651e5751a733b901f5fc6bd7afbf14dbdc3
9121c9a61af17cb70a177d1fa3deb887c110c53d0382c6fdb7f4d48d00aff771
d9c815b1bb1e750efed2aa385f9c385986c97f918959cdfe72fa002909e02273
b356aa02eccf99c952e3ce8b9720565db789bed7b2a451beb016c1b4b121669e
6c6f61cce468a1035a1bc20d69774614185e4f6a138a526b229efb80a4bcbd30
4fde5314392545804ac71c662da5f4868c484f7e9c07c1a5ac4892bb48b4b913
f442768898fa1fa5c93eb1f25ac138e76d49f32f24b881241a0c2322bbc9258c
fed26308ac3f6c6a4f8dbe3782f5133ee9a17e0fd0fb333949306b0aa2148561

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-30 20:11:00
SHA256:
885199c5834fa00100c19f70ac358102b930eb5f76afcb1f2bd833fc06faf6d2
40c221a7cbb55a8f51354611c5e965818fb2427cb0b2f3c56712457295de1aff
9e18657758769845e428fbb28b35ca3bf6eafd2816586fe1651398d616cdd894
777cc667e541586aca48cbad9ed30d81d483150370cb8388bde1537a015fd37f
39bdd3d8e5cc6e92301e111f3eb671dfa937c1caf8de14436dfad655041edc43
cfcc8946da143fa25ac30c8f5bbeb43e1fb067aae6e4ca8fc08ec41f3adc5b62
5c79b69e252cfc34e1544312956b9b37437b3d2424d3857414b621d63c175778
30a3337bb29462b4e9b3533991415cbe47bd707ada5f4ee672d27552c8d722cf
0ea9918c7b8fea29c01ffeec5387dd697024b7ab98a138ee87ff64053cb988f0
5f7619ea427f3f1c58ff079447b1d9ec42c44843838f124a9ba2f4f5e2f7c15c
25b8f77c8d88db986beafd79197057a55aeb32e85a07907d509dbac7422332e8
e9dc3dcb5ca11b59267ff672675c7542e0440bcb4c349574c56d9703c3464a2a
afbe35f4b39a1d3812396618ce7daa633f46bea97ea9a86e8539c87f621d5132
226ecd4532c3770c6a157f926d6fe3ec385786ada13c3d0ab43737c31201e7af
b851916601411df4ab60c58447eb5f59fa64c9e3f0ce22f237650edd92842420
966eddee211f58994b59a207d01299e2c5637c645cf7d51368e33d8ddf9d5965
a3319cc971b441f8f595e99111673a264fbeb81b84c5dcb6eecbb5ecc63ad018
81f21cd0e821c9c1f74c8ae8bfd1b391ed0b5eca1425c62aeedf85a9db3ebe6f
2dad75bfad3c4857e234c76c681388df38b0c8949d87c71c92a7f7d291f28f72
de9642271a70d9c704638cc51232f6e6f568e192e82e17123b7d5b19d77000f2
7e837c533ecf654ff14f225a7b5d05ca17fdde05ba5bc339aea6bf3e123bfc27
8c4854e0d430b55ff269eaf1e2ef7042431ccd1f8a34ebb778da5feed59555d5
a424d2bab60a355183ab9e9534d41f40e02124f3fce2e00dd9b76ef1f00d0f08
3863774f6108f7d977774809adc4f53b5e4c5d16c3f83cc2a8a5d036e15955dc
b8da517912d2ea5a7956514a4665dfb1f407b7e69663b697ee4278a76a1e6ed6
9f2713abb8b29391fd46087c699aacc398ce02cfd647721ae0c4cee2694f37f7
44e484d400a3fe07110e9f49f3048bb1b183ad091289fdfaa98dff237bee0803
7ec1d18fb5e9f96b93f004560a7a09c4b006755216be9ec9194c7dadd77f6d73

http://delphinum.com/X1CNO2
http://krood.pt/w
http://jenniemayphoto.com/KDUMz4c
http://echtlerenbridgen.nl/oRVU
http://sandbox.leadseven.com/HAb

Creation Time	2018-11-30 19:33:00
SHA256:
59bc8a8313ff9f938754d243465705bd9879619f67f1b6cda1e1e43d5228d6c5
4ed5417ce6bdbd49eb9861a0089b945d0d9f6b684b4ce284381ab2c7856c9700
d0a28b28eb566d2b1a8d141d377d298a48e6081cfe918f1b6ccf2635593aebfb
706eea5c9b99098f7e7f006dbd3f65e02fc67c211d18ae518600e22c8cb0ac92

http://funkadesi.com/4bko3
http://garudamartindia.com/Wh
http://gaayatrimedia.com/kc27WM
http://astro-mist.ru/ci
http://manieri.info/3EXokfRS

Creation Time	2018-11-30 16:08:00
SHA256:
ff74358f4de43e67d8a166d42a9b2be4db22c776d4242205cd7b8fe90fcb1bbf
f932751d4e85721514dffbdf008b20e0933b0c81bf519caa8eab827f824304a0
263bedc7136d24fcd4022604c45f41c962c7ae6bedbc10e906261d6033cf05a6
b12ccaf635ee0ce0be7749a1e2117446b1fed86a46a67e6b1dd163d187b21e13
dbdad2525b69342ff1d621fe96e27d3548f49b441a8ab0ba3c87f0006d61f70b
6d4d45ba54a8516033caba851986519a86601ac4a92368659950a6b1815983c3
b9ae9d8df47280c192063eee798fa38c22c51d41f97df504d39a9572c596810a
1b61ba1ba85bcff04ef5a6e20c010bda25c711c41e1ec62e35c458687670a5d7
5332319492685a91e85d14c7ae3870499f5b0de5da7f5f22c4f0f0e8915bf462
f4b1d01e0d9567b9bdb3c3cafa0d140e6156e68949d4e534a757ab14a13d8b27
4e7d4da950e4c78c3d2ff08f7b1918e771fb447d2433b499b6674e8ccccd0660
71e5070cc612226aaaa8a33acd4619f6773cad99f016f57b0dbf6e6be40192dd
a7edb8303e88fbc051aa927cf9af76e3acb68af816ac8273dbffaf7da30ab0fe
3e45e1bf6c8e6e7705607d0e70d0b55a3656669f755ff4329af5e1bbf7809ab0
671a6530c871b816e2da116c4269ea21a7f8dc65b639d5121d55e0cc3503cd60
2ac6dd02e53b9d4885e984f2fc4026fcbaf04134801fa43f3f2c36abd18ee834
7b4343716165aec50c0c5b27b740d523c3da99ffef988e475f1ee299e19f805d
15424f0981abb6dacdd8f996372e284510a32bc10e781ca3be1587178e490b65
133d50daa6be2bc4ece816b8b75e267160d0f321aece6189267c8fcbd3d62c81

http://sandbox.leadseven.com/HAb
http://iantdbrasil.com.br/m9Fg
http://greatvacationgiveaways.com/aMLy
http://progettopersianas.com.br/QlltYOUC
http://2d73.ru/cc6rkI

Creation Time	2018-11-30 12:54:00
SHA256:
48173bab24fc77f492b36f074aa2272c549d2ea6212eb4e38e9f455d54f21f1a
26f6bf9b731b6419c7b4a7fc36a028b3fc4da3899cc26a9c70c6c99adcf7caa2
4eac969c676e6031367af9ee70d54d050eef234df8218a42169e40ce6046d273
4b7e5ffc70e864ac9b578973bc6024bd4a91c2bf78fbce37bfbdc752631c76b2
111c86765bb7ae79aed263fe2ab76e1a0846bd2b3cbb15a545ffd98a20992c65
777f579ec58d09e0c55e8b35d5231d3ad668ea1d4cc82fe8fa1911d6e6b164d0
9a9c915f1fafc4f83a40a9c4b8eea2e0b442fd46f25640409fcbf6f0e8742817
3567024e85621ad6cb2af9eb146a0b302da9d0e636c385d3d52b8f2c3a06d3f9
c253b149e1db30055bf4d7535df0f833eda67be2db477f71d2654a08ce37d9d1
492489e4e986d8978a569a1dee0443456740562f907ac46d800640acbf6e07bb
6aec4a4e04b0658876b7ff5e466049c990e7f0cb19aa1960620f042d2023a913
625f08bfb11e32a4ad84afebfa78995f09095a0228e47361cd39b433883f3f81
a6fd826ef81c2a340c15d4749e3b2c92f7223045838a87bf68daf29dc7716bed
fe68dfea5039c52470496e1d97c79c863e26112bf04eaa8765ccc17b6243295d
09fed52d4695dd532474d0f1eeaf00c5e326f08854e1dff4c53708a829407536
1147e076747971920707d92530a4f885d027471a8fd93a5654276d74b3d7bcf3
1bd2761c9c7ec421d3d7d75cb23c2d6dff0b77c10a39cef3522abe678669fa4f
33c03eaab9f281f9dd56ad9e894055502a3122599c1b81a014ca62665d1ec390
773a4277462b186eb892e5cebad33ebe04c25a81618eeb7a1c5d14b70172bdda

http://oxyvin.com/XWB2FL0h
http://bemsnet.com/fxoOxOBP
http://178.210.89.16/VTXawsz
http://ballbkk.com/iOI3NaX
http://rushdirect.net/al1

Creation Time	2018-11-30 07:38:00
SHA256:
40754c13cf7f233db008f7cbd9cf9975d025290479cc015cb1ad3de6926516ac
6cb3c870c34a3ef1bab7d13f9751588e820934c662bb333e0a8ac0577821ab4b
4ea633c88afbc36ecd53148f81ed4264a377c89e7f07f7e8f1317468261666e3
45293f251fb25b84ca49eaa4f3db05917926ffbc9d50c5884c4d7ffaf8d49e58
eb69c6d7128096c4f5ebfb1d6f5bd1efce8775bf2a698acb8292a405c74a2fe5
0f65f3b7f75a127292463eb63bf7a4be32b38faddf42a99ec1f9e540ec676faf
01b1221a90f6fdf452fb5ee26effea8bdfabe08ca2c3352b618b964e320ca629
d4ead96d5560b050d20d3ab70ba0cbc8fe9f71622668c6f475edd2335313695c
e56e6fd00963fa28aaab058329271feb556d7255976579d157fce4901daba0fa
df62074f9201f6fe22b46fd438e1d1c278abfa734c0ff1ee924ace6d8855f5a4
f427648540899dd2946f25dc9386c456db69209d75d1256bdd6581c8098884a5
01ca9a965c05cd83ece37cd06df0e006e0c62336e05c9190fe3289c3be1b8739
2485f2879447da62810e53a324b67e0fc82c0b6671aa0d28df7cc8e3b9c8a5a2
4384758f1202eac41848294be4c9fea74c7c6ffdb4117dcc7c39db2815996f98
1579df027853efdeb1f80a923a5491715673659e9934fe2e3275b19f96bcbfd2
ecb11a8742a1177bf64970ab9e2ab759d466cfc52cb3d4beb1953d53292c4e86
4441c3feadee1c4595982d04372a71ab263873667c65b198cdd78a7cf3c95df6
37bf4bd23fe8ab0747d5ad4b53bc9110a594c09f2341ef346281249417519ebd
0139b505c739d8ecb184b23304e8727642246c95bb2666e030f116e08d1200f1
d935bb5d379d73e1b3c617f6704c5f6d23a9a6909c0c498db911f87d095c6075
6bb7bf4d9bf2b0efd07cc078147f5e3f1e7e6d5c8d1b697256606f8c9ccdc92d
b234f7fe06147504572555b0f9ddc4211a12c33b259e7948beccb551a127f4f2
da0d4c18aa186032715293051b349cb903c825128da212d4ce567547fd86b4ba
b6d3058e363b65703e89c1aeb02325f4a97b80b3644e2a6e134870adba3e86ca
757d3ea2fb4738eecb9e1d5aef27caff8d8597827bc02432b9682d9417fbfa15
d00ef496e65fb3a77f848481b3df8defd5fb681cfad21b8cf3b2ce9086b31057
d4b4601cfc978c22e9dcfecce1c3cadd6a35635186db765bc6290489598a4171
45fe9365c786331ea52949bae26fd31cd74f6f1db3f0067377d22a05780f26ac

http://westfallworks.com/x2daZ
http://xplorar.com.br/VP4vdxIq
http://rmdpolymers.com/TnhjoC
http://metoom.com/wM8Cy5Lh
http://pegas56.ru/MHe

Creation Time	2018-11-29 23:25:00
SHA256:
24fab83c5ac9c5979ab4f29db75f7388fc7049f1d7562f90e2a7f688a981cc99
bebff34c7cbb71086bcb0cdf8dfe4809c41c1a1d74f680af20832576bf4c4ca2
5fd05e7184dd9f5f57f55045f913857c8ba685e6f7437eb4f686b698260e4563
c8d66358275c00c50c623b30f40e4de477d86eda42a925f5d3123ea65079a36c
cc717e98543d103d85c5b0237d1c9bdd31af0a8f7ed5d3c734986c2df4e3cb8e
edd3e74bce343ce5364ec1842cd8f650ca6a7d5316f9db76a6bbaf3c97ffc4bf
648ed03bdac69318234e5e7ade999db7c7f8058336f1a209f33208eb074122e4
d8d5336cc7c453f0ff0005558b1f39fdc30d6ea7fd9d8770cae19cd9de50b2e0
d1caca349ea33035a4237680255937db2b3b29a257f70e39d15cfaa887504519
ca5cc3e989d5dc2f4a36884363c1970645817dbfff50cf798189e8d6a5206d6e
053abf76599484cc6227db5682d32c117bc75fe5bad4ddf6f4ec151a3241ff2e
11bdab3a7f77838f1cee08ad8086db5a25e595105a7260985cf63d03bb3dfdc9
62adf5828ed7b54df6ed9c0e96c7e665f80372aeca6678ec874b15947e5aad7a
78515fb2f34b4f712612c298a8dc9413869021bff147ba6523a0c1bc886a0736
277669df67662368198f6d44167d0937e29937d9775172be2ec40b5bc525ad4c
aa94fa552d1e691818e7070e8f5b51be58b890be35573d86437d813c7cb5369f
78846d1ce909a85c0203c233316dbacdd92b22cedee894c824a70ce56470dc5d
8057c5627d4cb1eff3e8cf05985d8da766db8d5e829ad93e1772abb7b08eed1a
e4d61b558f4081e194bf56b95eaa853b9cb1bc127c13f03f3b51abee112633f0
a3fe6d0306054ce9d02280f6c21c0d7602b19dff186696b1fb1fb2c6bb9402f8
58e62e8c59ebfc618317160ac3a165c78fd57f7a3a796f477c497cdd3eac3c73
8533ddb5509ad08d3ea76082a31ea23639b941649cc7856674dc68d54c0349c9
a933220a287e941ab18a95687fb119bf11d5c8f82fe0b13506b7b793962904de
cf83d584772e6af110bc35325b63c096ca6435537875f3d02cfb0aab89ff629b
7c87957015b2385853e875bec4f70144d65aac8464bc13532df5dd989b26a7e8
e447bcaa90e4f3db4965ed59e55af92bf6f3c04c085dd0984192fdb5ac6450d5
70e52537a63e738b195e15cd5159fc7b41f5e9f2fad02743ef5e7431e12fcb90
4293ed333d5a02a0740c29caa7fa344172f160035c43c91c96080723b4ca09cf
cb809200f93e08f72b892754e214d2cbfa07469d0eba89caca9e9e9e7b2db486
6c717c9b10a58103e52b5bbc32e9487942732c2e2ee70606ecb1f5db6fa6faa0
17ae1bf16d1f79b4312747b10ae6ffd7a5899435d44e6c7d1985f09977c34c9b
13fab0252207f24b86452e33c08636822c39417e1047fc880aebbb2490baceb1
5c254999b6d350b756879e065b81f23c4fbb0b3100dfe1b216ed2189579efc98
98ec1c5628df7434cb674acf5ae3b70f1e3b4411ea95f99f25a80a2661d3082f
d477aa50117aef94a90a87eadba0e6e2f895e2673fa808c6e7649f3fda98fe54

http://eestudios.us/sitezimages/wRfui
http://letraeimagem.com.br/zmDH
http://secretariaextension.unt.edu.ar/wp-content/00002/WYXvv1vV
http://aldia.com.uy/WJ01ISht
http://2.moulding.z8.ru/EGEBrr2

```
#### SHA256s for Epoch 2 Payload EXEs seen on 11/30/18 ####
```

561d36466c3f643700b5912dc93b79e3e27269dcc318b73589ce49cf12850250
823a1d64fc7bb25f14e7509f5b255d5b8ee9f90fe8fd23c0a68ba0fc59cedb4e
8cd6db3d6f04286c7d0b1044864cc2646f41ecd3c4dd0c74c820007d9684934a
198cedc3764b9f212a47a8fb4c7d6d5db2d0f5157c8dc649aeda61f7cb4aed53
1fb2e63c57f39cecedff1f54e3d9601cb252fc21c632823e07aa2f5333755bf8
259225f56bfc0359eb316c4c0e87ea669575693300bd2f4081f240ea1a7d538e
f72213960a380dd022536b2e3da0c0a2ffafa336eec1bf98ce01e7cc664f9c00
e7800c6cc9b4b895b9d76d5729a2678819c0abf4ba334ce6eacda0fad4fdeab4
ff43a7ee91199cf00ca77eb615f6ede1242d1b21e5a9d6cb5bc59190e34acc34
16c7e688c4f182e81abe93a27c37c199b23d3caa5e2aa19b33b5c0ffa4a70880
b9ed2454a22a6795c1afbe3831c9802d3d106ac20b950238aec3a1954f939a18
a6e52e4b0b8c2bc2d91852d3d85031483229432fce63d979d7c121c8236350c5
d3cded230efb0e6a973a4e8435a71c2a0ceb9264e3bfffc052f078bec6064e2b
47f9b7f01b4233718e90bcbafa8b5136c283b113189f2f1e9e0f3481ff0bd209

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

107.184.201.99
109.104.79.48:8080
133.242.208.183:8080
135.19.206.30:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
162.252.103.78:8080
165.227.213.173:8080
181.228.204.125:8080
186.23.189.192:8080
187.155.234.215:443
189.155.54.228:7080
189.157.235.122:8443
189.210.114.18
190.96.22.93:8080
192.155.90.90:7080
192.237.251.185:8080
198.199.185.25:443
200.52.75.212:8080
200.60.71.194:443
201.196.89.80:50000
209.112.181.206:443
210.2.86.72:8080
210.2.86.94:8080
216.221.68.35
219.94.254.93:8080
23.25.165.74
23.254.203.51:8080
49.212.135.76:443
5.9.128.163:8080
69.198.17.20:8080
81.213.63.109:7080
86.43.125.152:8080
92.27.103.140:443
98.188.200.74:8080
98.5.163.186


```
#### Spam/Stealer C2s ####
```

181.225.227.251
192.237.251.185
206.81.7.25
71.58.165.119

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

104.34.29.60:8080
115.71.233.127:443
134.19.217.70
159.118.53.150
165.227.191.145:8080
179.38.83.88:8443
185.20.104.238:8080
186.4.167.166:8080
187.138.28.244:8443
190.128.82.61:8080
190.171.237.136:8080
198.136.49.139
198.74.58.47:443
204.184.25.163:443
211.115.111.19:443
217.13.106.160:7080
222.214.218.192:4143
24.248.202.22:443
45.123.3.54:443
46.163.76.187:8080
5.230.147.179:8080
5.35.242.34:7080
58.108.220.220:8443
67.205.149.117:443
68.103.38.30:8080
69.198.17.7:8080
71.179.135.10:443
74.79.252.106
74.79.252.106:8080
79.130.46.68
81.7.10.106:7080
83.222.124.62:8080
84.200.106.120:8080
95.141.175.240:443
95.155.24.108:7080
98.142.208.27:443
98.175.204.114:8080
98.217.222.167:8080

```
#### Epoch 2 - Spam/Stealer C2s ####
```

139.162.157.8
24.35.180.220

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture: https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list. I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now. Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change payloads every 3-6 hours now and hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100% sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/e3y3zx5B - @James_inthe_box
https://pastebin.com/p8SX3eFu - @pollo290987
https://pastebin.com/uxSQ6MTE - @ps66uk

```
#### Credits ####
```
(OC and combination work)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @Techhelplistcom, @pollo290987, @malware_traffic, @0xtadavie, @devnullnoop
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @Bitterman59, @devnullnoop, @executemalware, @Bauldini
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!

```
#### Daily Log ####
```

I am glad this week is over. Today was more of the same things we have seen all week so far. I am sure they have more tricks up their sleeves for Monday. Please send me any URLs you get for document downloads on Monday morning.


```
#### Sandbox 11/30/18 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run at 20:49 on 11/30/18 https://app.any.run/tasks/2d335328-8dc1-4011-9247-7dbd5392a335
```

```
Epoch 2 C2 run at 20:37 on 11/30/18 https://app.any.run/tasks/0a04c2ef-d0ed-4f07-bc34-6211bf96410c
```