Emotet Malware IoCs 2019/05/08

## Emotet Malware Document links/IOCs for 05/08/19 as of 05/09/19 00:15 EDT ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.


#### Epoch 1 Document/Downloader links seen for 05/08/19 ####
```

http://7min.eadmax.com.br/y8ww/service/Nachprufung/2019-05/
http://8bdolce.co.kr/wp-content/uploads/legale/Frage/201905/
http://absimpex.com/images/service/sich/052019/
http://ackosice.sk/wp-content/trusted.En.accounts.docs.net/
http://acttech.com.my/styles/vbtd-UnKieXrNYjXjRwl_HFDjpcyfN-0sJ/
http://alexwacker.com/nginx-custom/public.en.myaccount.doc.sec/
http://alliancelk.com/kiffsnew/wp-content/uploads/open.En.myacc.docs.com/
http://aloha-info.net/OLD20131103/secure.ENG.myaccount.docs.com/
http://alphaterapi.no/verif.Eng.logged.public.biz/
http://altituderh.ma/wp-admin/eruvB-uyUPfVtVAdOVSn4_bUVeNruMw-s64/
http://amis.com.gr/css/bootstrap/secure.eng.myaccount.doc/
http://andrewsleepa.com/pandarealestateflorida.com/secure.Eng.myaccount.docs.net/
http://ansolutions.com.pk/US/secure.en.myaccount.resourses.sec/
http://antravels.co.in/calendar/secure.EN.anyone.resourses.net/
http://ascendedarts.com/gravitymtb/verif_seg.EN.accs.open_res.sec/
http://austad.no/images/public.en.accs.docs.biz/
http://automotivedefense.com/wp-content/public.EN.myaccount.sent.net/
http://azedizayn.com/26192RX/verif_seg.ENG.myacc.rep./
http://bachch.com/3gokushi/trust.Eng.accs.public.sec/
http://balancedlifeskills.org/wp-content/verif_seg.EN.logged.rep./
http://barguild.com/8192/verif_seg.Eng.anyone.docs.sec/
http://bdsdalat.vn/cgi-bin/verif_seg.en.myaccount.public.sec/
http://beza.at/flash/open.En.anyone.office./
http://bkdd.enrekangkab.go.id/awstats-icon/nachrichten/vertrauen/05-2019/
http://corehealingmassage.com/wp-admin/open.Eng.accounts.open_res.biz/
http://csw.hu/aspnet_client/IlFoU-GU9ZBAHQ1M8piAC_unVjCcgz-pHI/
http://dance-holic.com/2shot/ODJF-GWd94pNQpGx2OGn_nZwJuQBvv-qz/
http://davemacdonald.ca/wp-admin/AGPNC-EobLceRZDko0T4H_ygPYrFjf-f4a/
http://decorexpert-arte.com/lang/nQYKT-7FkRRvZJTYNWxXr_nbxxbouHA-ME/
http://dekormc.pl/images/adwRp-R0oVcX7Ck8K9Hb_OJXOXuZe-fvg/
http://demo.careguidance.com.au/wp-admin/support/sich/05-2019/
http://deskpro.kayakodev.com/wp-content/uploads/service/Nachprufung/05-2019/
http://digitalmidget.com/llama-speak/RpWlt-ALzUMvZjjTWZJ6i_ilUpaplU-7np/
http://djchamp.net/coupon/WQpL-5Z3LS9gaeO7gGy_HGweCRESF-3a/
http://docecreativo.com/LGaFw-R7rrN7gcUTBFlC_mXnZVFbZg-sO/
http://dog-mdfc.sakura.ne.jp/cgi/oHlFa-Qx6IqhJXMvrYptk_BvhRlauGO-YTE/
http://dragonsknot.com/cgi-bin/pSHdT-OIOMETuraPjRrIS_yPPHorjr-DV/
http://drapart.org/Prensa/GeAoV-keRXiwXqbdRBEDU_ihaAxuUPT-Vg/
http://esmocoin.com/wp-admin/ifpmx-anyf9smjxfpdvg_sspmknapc-bfm/
http://extensive.com.au/wp-admin/trusted.Eng.sign.office./
http://gawpro.pl/cgi-bin/secure.ENG.sign.office.sec/
http://grasscutter.sakuraweb.com/wp-admin/legale/sichern/2019-05/
http://hada-y.com/WWE/legale/vertrauen/05-2019/
http://hbk-phonet.eu/wp-content/public.Eng.myacc.doc.com/
http://healthnwellness.in/ynibgkd65jf/aYux-YjrhYcmLhj3DbE_TQeYBmfs-9W/
http://hoahong.info/wp-admin/trusted.ENG.anyone.docs.biz/
http://hotelsaraswatiinn.com/views/verif.EN.logged.send.biz/
http://iyfchittagong.com/js/NdorI-YX4m5pFq0C7zDlg_xqWVcqykE-mC/
http://jiajialw.com/membt/sec.EN.logged.resourses.biz/
http://jumpmonkeydev2.co.za/paeds/uVtI-K1UQf4BZWbi0HC_jPCNQrGHW-2Uw/
http://kaminet.com/topics/img/sec.En.anyone.rep.sec/
http://kitkatmatcha.synology.me/qzp/open.EN.signed.doc.net/
http://lampalazszelidito.hu/wp-includes/uuDj-mmn9aTcvJumewGX_dvSeHLsgc-r5/
http://laserowakasia.pl/wp-includes/secure.accs.send.net/
http://mixolgy.net/play/support/Frage/05-2019/
http://mnonly.com/faq/cNwLk-QpBILVmN2JGiT5p_txWIJPari-Xt/
http://ogilvy.kayakodev.com/wp-content/plugins/easy-instagram/cache/nachrichten/Frage/05-2019/
http://patriclonghi.com/blog/ZMkbS-fD9rCuattgP6xck_NKFzawwT-ahO/
http://planktonik.hu/menu/BQAPo-AL7DfJPOLgqqE7_dCQuvGVX-nfN/
http://psicopedagogia.com/glosario/kWedR-BfltnVQjS3yedn_vaUFUxqx-iE/
http://ryblevka.com.ua/wp-content/sec.EN.anyone.resourses.sec/
http://salondivin.ro/tur-virtual/public.Eng.myaccount.public./
http://school118.uz/wp-admin/uGnr-MAYlNw5DMi9ofk_XpHLtHhZW-kZ/
http://seriousvanity.com/cgi-bin/AgNVd-UYRDcuJKBBKr3p_HQlYRtyk-ro/
http://servidj.com/cgi-bin/sPjSE-RHEF89sZMILmV1R_rzwoPSTte-TpH/
http://skinnovatelab.com/partner/uploads/legale/vertrauen/2019-05/
http://sooq.tn/g435goi/TYour-jRyJLxUzq45NFrS_MwNRNosoz-TQO/
http://spacermedia.com/wp-includes/support/sichern/2019-05/
http://tipster.jp/counter/qCUgZ-WYspb9LhhgK8mte_ffgltQweO-3Ki/
http://vancouvermeatmarket.com/wp-includes/open.ENG.accounts.office.sec/
http://vcube-vvp.com/cgi-bin/verif_seg.en.accounts.public.biz/
http://vemdemanu.com.br/wp-includes/sec.Eng.accounts.docs.biz/
http://www.digitalmidget.com/llama-speak/RpWlt-ALzUMvZjjTWZJ6i_ilUpaplU-7np/
http://www.vemdemanu.com.br/wp-includes/sec.Eng.accounts.docs.biz/
https://acttech.com.my/styles/vbtd-UnKieXrNYjXjRwl_HFDjpcyfN-0sJ/
https://austad.no/images/public.en.accs.docs.biz/
https://automotivedefense.com/wp-content/public.EN.myaccount.sent.net/
https://kitkatmatcha.synology.me/qzp/open.EN.signed.doc.net/
https://ouropretocultural.com.br/pdf_espanhol/trusted.Eng.signed.open_res./
https://psicopedagogia.com/glosario/kWedR-BfltnVQjS3yedn_vaUFUxqx-iE/
https://www.jiajialw.com/membt/sec.EN.logged.resourses.biz/
https://www.salondivin.ro/tur-virtual/public.Eng.myaccount.public./
https://www.vemdemanu.com.br/wp-includes/sec.Eng.accounts.docs.biz/


```
#### Epoch 2 Document/Downloader links seen for 05/08/19 ####
```

http://4gstartup.com/wp-content/gi5jhh-3jrd33w-vxflqgt/
http://5711020660025.sci.dusit.ac.th/docs/lm/gDiyduZVrYbVHnpHuCkGvIuCsHeWjk/
http://912graphics.com/cgi-bin/Pages/ir757gj1824jqv35p6vdk43348xp5_a4gg8-312909601058283/
http://abandonstudios.com/wp-admin/js/widgets/Document/jal7qtcf2y3cqt1vkacms9s16mulyn_fgzv7a5ftg-37987136856523/
http://abbottconstruction.com.au/wp-admin/bhmw-ftvgykj-pcessh/
http://acquaplay.com.br/a/xufdd-2n6ff-gpap/
http://adityaproduction.com/wp-admin/af84go-h63kus-ftxb/
http://adremmgt.be/pages/2ims5-u79kr-hvof/
http://akashicinsights.com/aspnet_client/9cuu5-6488g7-yhzcujg/
http://alignsales.com/wp-includes/paclm/kssnnchth7vght26d3_19adkp-2528384604/
http://allhealthylifestyles.com/9yng/Document/KoYiCtoxcIBmB/
http://allowmefirstbuildcon.com/35rnm2e/paclm/m9ixgkeioqa5y1s_9slxjzpc8-660235145/
http://almondbreeze2018.arista.es/wp-admin/DOC/yeqz3brhq8ybszykftxr_l0xpnlm-287722626590805/
http://alohagift.com/101MSDCF/LLC/2pnqbo52isqd255ervvy8iwby0qagh_xgs8mz-61772365737/
http://alsdeluxetravel.pt/wp-admin/paclm/5d6px5jp0p8eebhdwx5zo5do8vh_c11n10aa1-514134734/
http://am3web.com.br/DOC/gnmwpjvq0hbr3lfle647slkti2rua_5qlz5m-570847870/
http://amachron.com/1e7t86n/iuJUqWwxvtfaqFwoTVKgsJQe/
http://ampservice.ru/installation/paclm/NXuXFiYmnUAJakkKSIzTwvKxKeJIW/
http://andeanrooftopguesthouse.com/wp-content/asgx5-xuq3c-mnduybq/
http://andyelliott.us/AIF/r67g80lujgz0p77gg6ecp8r4_o4akncrwh-465247106455076/
http://anjoue.jp/academy/Document/gMzGtXNcPbLhCB/
http://aprights.com/about/INC/YMCHSQlbZxbaq/
http://arenaaydin.com/wp-admin/esp/yJZlMAcmrGtM/
http://ascestas.com.br/Pages/hpam4mc9u5gg8heyli_f7dh4r-74986951/
http://asnpl.com.au/chkl/LLC/1dxbbzv8_eiubn-11195960/
http://avatartw.kayakodev.com/wp-content/uploads/parts_service/joi8ho2nwuc8qnm82tp6_l50hq50yr-401163121/
http://aviciena.id/data/FILE/0cij5yhvf81mp8_rxyd5grrh8-92274744344/
http://awas.ws/JUS/Pages/mOSIehpnpqqFgpRkmTrisdjldXOGI/
http://axwell.kayakodev.com/wp-content/uploads/INC/7ufoulqfu1fqgdnsv1v1trvhsh_emcevi0cp-31910285899/
http://ayashige.sakura.ne.jp/CGI/Scan/fz6cvw5e8ngufnol3p982w_bnti9car8u-67621092197/
http://azisonssports.com/wp-content/uploads/q2qh-gyg3m1-yggbs/
http://bandit.godsshopp.com/wp-admin/INC/q5enq8y67olkqrspdt_4dtexdgw-297260993224/
http://beeonline.cz/dev/3jg4t-meeq4j9-bvpz/
http://bendafamily.com/extras/sites/czpdme69ils_i19t4-679335525148237/
http://benzophen.com/pouchdirect/r6e9-eba9cy-boyp/
http://bestcincinnatihandyman.com/webanalyze/3mmk5z1-oygro-esqh/
http://bestflexiblesolarpanels.com/local/vrcb90l-ot2z0p-opbmn/
http://biocoaching.fr/old/ioe4vi-wn99g-ebilnvg/
http://bitmyjob.gr/css/iui2-vvckm-qqiarun/
http://biztechmgt.com/mailer/g1li0h-1e637ld-ibin/
http://blog.memeal.ai/wp-content/uploads/Document/ZFsLCmoHkqBbcmElpDUfJSE/
http://blueskypharmaservices.com/66znbj8xnfnhon_xogsk-68060929736675/
http://bluespaceit.com/outdoorsiq.com/id7pacr-d6a51fe-empr/
http://bonstock.com/wp-snapshots/fzt0yo-cu0voo7-lxyu/
http://bosomfriends.co.uk/page/img/css/6huui9q-tek9d-asfb/
http://bragarover.com.br/ww4w/fufh-5yqgc5d-dfftyaf/
http://bragheto.com/revista/esm1ids-3d3jj-wvdq/
http://brainbug.at/a3g8-z4bcbkt-zsdzzv/
http://bridger.us/Express_Razorfish/ns53fqj-y0jvtt-myaci/
http://broganfamily.org/eayj7ck-5ef564q-bpjrlw/
http://brownshotelgroup.com/cgi-bin/mx0ho-txuft-cufahvq/
http://bsp-japan.com/_module/4p10yhe-wtfpa9-zfxlmqx/
http://b-styles.net/image/c3n5kg8sgpgqaat6ip_dnaun-64608895701/
http://bunz.li/opendocman/14um7-j6xw9-ajewrom/
http://burrionline.ch/mylionch/bk2t-m1e0l-hpfpope/
http://buttonsarenttoys.co.uk/blog/t4sx1nq-p2bzrx-pxpegx/
http://buybywe.com/roundcube/vendor/pear-pear.php.net/frg6g-j6wr6p-wroq/
http://cali.de/cgi-bin/pkmf0na-9tr1b-ziiapdg/
http://calmtech.net/hiyorinmam/hwez-28m2el-damihxr/
http://campanus.cz/wp-content/qdjtg-8aj9o-tdrk/
http://caninetherapycentre.co.uk/images/wx50hh-1cx7q-zlbifct/
http://capewestcoastaccommodation.com/wp-admin/DOC/3zsu4hmvmj8ntdes51j5sasl_hp4wzldkx-219492044021/
http://captivetouch.com/98w35-ezqov-vpqo/
http://careplusone.co.kr/contents/boxb-gaiws94-cdaws/
http://cb-kaikei.com/mobile/yzmilhy-6sdkx-efbsws/
http://cdaltoebro.com/wp-includes/nzfmtk-608ss-ofvye/
http://cdmedia.pl/wp-admin/vz4p-vwo3k-kuusy/
http://ceffyl.co.uk/u40x5ud-kwqa03-kcthi/
http://cfarchitecture.be/cgi-bin/h07wua1-duhao-obkg/
http://chahooa.com/spamtrawler/1pe06-5593f24-kncqbt/
http://chainedesrotisseursmalta.org/wp-includes/esp/FRmetnfQrViWWLyMsRtrpiRpZkG/
http://chakrasound.net/discs/o0ls8-4hb1i-jkkgh/
http://charleswitt.com/tmp/ptln4-sonz94-jhgkbe/
http://chedea.eu/IQwK-H3ozxvddE7COI2_JSFxHwyu-e6/m8eh0o-tfg7o-trwe/
http://cherdavis.com/brandulove.com/fh5h-wkbg56u-folm/
http://ciervo.ch/muketakela/y5fc-2yd3q-aqtpoxc/
http://cityplanter.co.uk/site/uy6a-99rwdx3-nflrk/
http://classicimagery.com/System/1t9i-w6696-cfdm/
http://closhlab.com/FTP/wm9w9-qu3xqis-hyxg/
http://cocobays.vn/wp-content/paclm/3zwivi7s95_nxgn81-13338007552/
http://colbydix.com/music/rw91-z7kh5v-grmyvf/
http://coneymedia.com/wp-content/ibvkn-q2wqzib-goufhk/
http://conormcbride.com/wp-content/ltbte2-mh2ectg-bisiwgi/
http://consulinfo.net/assets/Document/qug29ymb21kgud_j6epm32es-623592507/
http://coreykeith.com/fancyladcakes/sites/z3wowikborzsnnnq3us_c2y04swk8-3193702188844/
http://cosmicsoft.com/cgi-bin/38tamfo-uu749y-nkeam/
http://covac.co.za/controlite/cd00mvng08n0v10k6enitzu9rn6a7_n5wps24xd-36182008/
http://crawsrus.com/js/LLC/KrKIrtJUbrrXwdCvEXEPyFyQjUNcR/
http://crsystems.it/images/mHPQvYeclmDioTBEsEamUIHsyEI/
http://dagda.es/wp-admin/c6r4mhi9p76m6s_x272tlhmi-000684005/
http://dcc.com.vn/wp-includes/m1wuj-bu0ya-ayud/
http://ddraiggoch.co.uk/family/uwfx-edvl1c7-pkyfb/
http://deftrash.com/admin/parts_service/eTjfWTwnlraAeoyWdAjxqRNlHBl/
http://demellowandco.com/cgi-bin/sites/sqzhz732gvwiqll_xlpob-04136530/
http://depot7.com/aflinks/Scan/DeVpEkEGOhmkf/
http://designworx.co.nz/cli/Document/UCpCKXtNHVJMX/
http://dev.christophepit.com/hbl2mda/cyeuic4iwmijo8yaunjo_jue8p3cx-57029315652/
http://digitalcarecorporation.com/wp-content/b9r1-4rcoa-ujyvo/
http://ding-dong.nu/haze/u1hoc2-fh816-ulhkdy/
http://dishtv.democode.in/awstats-icon/LLC/BkzbKhEvQPwBBdb/
http://doyoucq.com/gtest/FILE/4hkiuibe4ugpao0a90bt93y_unks1d-136351677597/
http://dp5a.surabaya.go.id/wp-content/tyz4-52rml3-tdltzm/
http://dpe.com.tw/jhtml/Scripts/css/LLC/SbvbkOKabpOxrLkC/
http://dragonfang.com/nav/LLC/y0v6gqd7jo3raan9lpop3hs_6xgsxyz-32646600837038/
http://dramitinos.gr/images/sufo9-oi2jbq-dfzosg/
http://drmarins.com/engl/VzPJTRKdIoALUUxCWqlel/
http://drnaseri-pharmacy-24h.com/wp-includes/BYauSIrgnNcnGKNI/
http://d-r-p.biz/data/xatdony-q5h6s-jitxeh/
http://elrayi.kz/mvc/xff3t7-pc6p7-qjokari/
http://emniyetkemerliistulumu.com/wp-includes/parts_service/k7k69lr75sebrjpxdg_j9h9qoidw2-2025788059962/
http://emobility.digitalctzn.com/wp-admin/esp/y34ddsntzc0nkzv39n28dpk_3si376-08738502479969/
http://eurotrustinternational.in/wp-includes/paclm/liVkrbWlEprrmtvPzNSDqDMJvvNim/
http://everythingguinevereapps.com/wp-admin/Document/hvr46wb04wnxe_ygbbs-775162397656/
http://fashion.web4.life/wp-includes/Document/x6xa24l7hsx6h6j_lawkwzysfu-53338331044453/
http://federaciondeclubeser.com.ar/cgi-bin/hutaf-f66wor-yhndizi/
http://fib.conference.unair.ac.id/wp-content/t35mq6-ecffdfy-wfnfrdv/
http://fieldmath.ksphome.com/wp-content/cwc2lu-4hvnm8a-cgtjrif/
http://fittlounge.com/calendar/r2cc87u-eaaui-ofcv/
http://fostercontabilidade.com.br/wp-content/zt9zikp8d31gk_loof3pybk-684255069545556/
http://frutosdelcampotriplea.com/wp-includes/DOC/a8t0z0y1edgw8o_cc1uk1v-917102836801946/
http://giambeosausinh.com.vn/wp-admin/d57k-96x6jyh-xzrdqkh/
http://gn52.cn/css/LLC/yPvjbOhgRRNgSKXFMOOhsLFFZAey/
http://griiptic.ca/wp-content/uploads/uwfonz-g7z2p-mvzmjj/
http://healthandnutritionapps.com/wp-admin/maint/lbARIkDRxrxgvHTceXPAYoLS/
http://hijacketbandungtrendi.com/wp-includes/OYdaCtbTECeQDH/
http://inspirationmedtech.com/freeallaquix.com/parts_service/m2cgq22unygscz95ynetijoj7_7xrkvzs-526446308377/
http://integracion.clubsusazon.com/wp-includes/bg8g7ca-vfsql-hpndiyu/
http://istanbulrentalscooter.com/wp-content/lm/rrkNbfYKWR/
http://jati.gov.bd/wp-admin/yv48v-3ok8nz-lwpg/
http://jumpcity.dev-holbi.co.uk/ealink_import/upload_d/ljd9whw-zvfn83m-qygabjd/
http://laundrysolutionprovider.com/wp-snapshots/lm/3v8fpmpzxxafaah2akec_mnt9fdzxb2-353150303310/
http://lls.usm.md/wp-content/uploads/vaez-tqvjvs-rskmo/
http://look1988.cn/css/xohzqfz-irvpz8n-qawtoj/
http://luanhaxa.vn/sqeh/INC/x6yufaymc4d3gpdnoi2qao3f1trfk1_18aolclev-5636079340/
http://lucky119.com/wzzeb/r1nxjr-1unz4n5-lszfqc/
http://marcofama.it/tmp/FILE/yaw505dvyzqbczreq_egrgi22-2092830933371/
http://masholeh.web.id/wp-admin/paclm/ualq222qts1k41pgprsh_zc5fvy-30015379753/
http://masterchoicepizza.com/wp-content/uploads/z443f5e-q48el-rsof/
http://mazzottadj.com/stats/paclm/vnz09fp2qjl4k7k_ux7tj4699-03652959397/
http://modafinilonlinepharmacy.com/wp-includes/u6hwll3-cshpfe3-bcshq/
http://myminimosini.com/cb9x/zvjbfj-q4ie2x-dpcv/
http://mynetweb.co.uk/wp-admin/lm/r1r1y9q9qpi_ni3t3sov-779608246008/
http://nanang.rtikcirebonkota.id/wp-admin/4w7cf-t683xm-rosmfg/
http://neoangelacplus.incdoor.com/wp-admin/yocurjofbr6ha98c9aaqdio_4wlslx-1086781700454/
http://observatorysystems.com/wp-content/x8wtyif-2f5seni-xtvacep/
http://orangeink-tattoo.de/wp-content/uploads/ab8v8y8-35227v-pkpcib/
http://orientalmanagement.org/wp-includes/dersf-j87qut-omlkvn/
http://paparatzi.co.il/wp-includes/whu4zj37sa3wps0izc7c63bsfmt_nd5p50gnxz-675364576943/
http://pawn-stars-shop-uk.com/njvs/Document/rk38yd54zm9jj72bw_ks75d-68780852428/
http://peopleslab.mslgroup.com/peoplesinsights/ci34pto-grm12wt-aanx/
http://petigroup.com/wordpress/gkhoz-jjwn5-dhyapf/
http://phikunprogramming.com/bs/page/css/Document/hfoy037g5_o9sl3q9-17910792696532/
http://philamag.tirusait.com/calendar/wl9q-5gyi1-zzkkd/
http://phukienlucky.com.vn/wp-admin/hpx4jq-mxoq7-oyvxxce/
http://piidpel.kemendesa.go.id/ngcr/sites/bblhemuhe2tsn1q_z712zf-279336711/
http://pmpress.es/img/sites/rjcQFqfxJiFG/
http://primenumberdesigns.com/mark/85x1-2ayszk-cjyy/
http://pulse.net.pk/fixmycar.co.ke/57pevo-84bt58-hmjm/
http://reviewhash.com/wp-snapshots/FILE/XwkUhipSpLUypdrUMnFIEoF/
http://sercommunity.com/demo1/Document/OBIUaZrZTUYEdyaEs/
http://serhatmuh.com.tr/wp-includes/DOC/zzDiepakiwLSdJLkDgBuoqGkOon/
http://skincodeindia.com/wp-content/x7ix-vyv442b-jkitd/
http://sliceoflimedesigns.com/journal/qbnd5l-o0qjn8a-dgpwjk/
http://sneezy.be/files/Scan/sdkXdyCdFaVIjwC/
http://spartagourmet.com/wp-includes/b6y17p-piyv0-drila/
http://staceywallphotography.com/wp-content/coffiqr-qeqq3-siec/
http://stellaricci.in/wp-includes/9notuv-4ntbf-hvuan/
http://stmarysbarwaha.in/css/dpf2-olbcm-mqdnwdc/
http://synj.net/dpmlv-f17p8y3-vhguvk/
http://tabuncov.ru/wp-content/uploads/uviobj-f6thcgn-rplemje/
http://test.comforex.ro/wp-includes/ci14c-icrci-dxemgvf/
http://tkdealdesign.com/wp-content/lm/FtWUEEVHswwdM/
http://tklglaw.com/wp-admin/70dnwt-9tkb7-detclt/
http://truyenkyvolam.mobi/vtwdoxb/l4c32q0bmhldm6v1zw_aivrrem3-451347890574/
http://try-kumagaya.net/4_19/INC/fen0iluzo715x4e59yr_mhlgj-16907241903/
http://tudodanca.com.br/wp-includes/Document/mwviKSpOyPXjgdQZJkSjsCh/
http://tuyendung.life/wp-content/ugmn7l-7pwc0gc-tigyupt/
http://umbrellajo.com/cgi-bin/INC/prtrvdayqrhup9ibg3g2l7_hfrfsaax2b-36041821672634/
http://urzedniczatv.pl/wp-admin/0zdx-e8rvi-nxedggc/
http://vantaihoanggia.com/wp-content/sites/dwKGnmplV/
http://vfixmeters.com/wp-admin/sites/stihedbbpp_58mog40-815605807/
http://viettel3g4g.online/wp-includes/eIXuHYKMXtrCfrFgonGKUcUBO/
http://viettelelecom.com/wp-admin/parts_service/x7zkgnj1nizm_r8edrf7u7-12855772637716/
http://vitamia.com.vn/wp-includes/FILE/zho9mbnu5kmipqnksbnzln4h_ywrtshl-1345285209218/
http://vlelectronics.in/cgi-bin/parts_service/qoXEVYnYZPVk/
http://voguedraper.com/wp-admin/Pages/w2aeu6gn8fq8hg1s5v9l6evo_h0c8ra24-89631947787687/
http://wa-ka-ku-sa.net/blogs/cdmqs-0n274c-yqpmda/
http://wallpaaper.xyz/wp-content/wjyfRKWlfRJWpGZVwbV/
http://watchmoviesonlinehub.com/gamenews/j9ki9a-w9pdn-kocltg/
http://webdesign2010.hu/FILE/h6bm-n1nz5-jlusw/
http://weineundgenuss.de/wp-admin/MpkzYeAJRznnPoW/
http://whiteraven.org.ua/wp-content/uploads/9tt1s-estcx-fvuxg/
http://whwzyy.cn/wp-includes/lm/qw2q0cxo8n7kmgtep03igi43d7k_lhhd0l-48826149/
http://willins.com.br/wp-admin/INC/syCnxpRjKdOEfvGbcLsadsr/
http://wmtrees.services/cgi-bin/vo4l-3lvwc-rigzsgq/
http://wodmetaldom.pl/wp-content/als6wg-yrge3mv-isitugw/
http://worldlifefree.info/wp-content/sites/raolmbvfskk0hy877jowbnjh_bbdpr80fmp-0490083640/
http://wp.o-enpro.com/ceo/6830o89idwubs605gca96hg_l57jjh-754828550/
http://www.blueskypharmaservices.com/66znbj8xnfnhon_xogsk-68060929736675/
http://www.doyoucq.com/gtest/FILE/4hkiuibe4ugpao0a90bt93y_unks1d-136351677597/
http://www.pomohouse.com/wp-content/h1hbm6-dsc5vhc-ikbb/
http://www.steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/sites/nANIISuFCOTmhNmZ/
http://www.tailorexpress.co/wp-admin/Pages/ku7ypk91_knr1168gu9-87549152415478/
http://www.whwzyy.cn/wp-includes/lm/qw2q0cxo8n7kmgtep03igi43d7k_lhhd0l-48826149/
http://xn--12c4dvbwc.com/rgcdn8e/INC/fOsWPPYl/
http://xn----8sbabmdgae0av6czacej5c.xn--90ais/test/t2zze23q22wagy93k0i669_htioaxphlj-24205647253/
http://xn--altnoran-vkb.com.tr/cgi-bin/esp/i3wu2115gs3o5aadt287f7khls95tg_z5zdr-92660439933/
http://yaxiang1976.com.tw/wp-admin/mg8nij6cut02t_qfic4yl2d-58460417285441/
http://yocomomejillon.cl/wp-content/LLC/dm643kofyk13fhlh4gsbjh7b_b0ynyg-139183996/
http://yogabeamz.co.uk/wp-content/ifbz-1nnroz-qyiokfc/
http://yolotravelz.com/wp-includes/Pages/jcgHvEcekNLQejAgNNsnVTUCN/
http://ypom.com.br/static/m9wq-aorffc-kebc/
http://zefat.nl/3n6saw13x4bwz7pgvxw47dyk7wf_6ffrqyaipn-0578905968/
http://zerone.jp/about/LLC/pnl9sbwu4qy_ozzj1wj1w-7564791705247/
http://zonefound.com.cn/gallery/moub3w-ed5ixza-jppjx/
http://zuev.biz/css/o5px-55h9aam-epzq/
http://zuix.com/leads/INC/zdwj03ios9nbmiy7ryx6b2apnrod_79t70h-88368783614/
https://acronimofenix.com.br/webmail/paclm/lsucr4y8qwbv88f68ajxpd94n_jo5uh8z3zi-1620827239936/
https://alohagift.com/101MSDCF/LLC/2pnqbo52isqd255ervvy8iwby0qagh_xgs8mz-61772365737/
https://bitmyjob.gr/css/iui2-vvckm-qqiarun/
https://blog.memeal.ai/wp-content/uploads/Document/ZFsLCmoHkqBbcmElpDUfJSE/
https://bonstock.com/wp-snapshots/fzt0yo-cu0voo7-lxyu/
https://brownshotelgroup.com/cgi-bin/mx0ho-txuft-cufahvq/
https://busesworldwide.org/images/a7k9q-1nbwx-ndsyp/
https://busesworldwide.org/images/olm9k-r3d8pxk-juro/
https://buttonsarenttoys.co.uk/blog/t4sx1nq-p2bzrx-pxpegx/
https://cali.de/cgi-bin/pkmf0na-9tr1b-ziiapdg/
https://canopyofgloryministries.org/wp-content/uwl120-e48vz-msskpl/
https://chahooa.com/spamtrawler/1pe06-5593f24-kncqbt/
https://comitware.de/analytics/8p2yr4-r91ew6w-fnay/
https://cosmicsoft.com/cgi-bin/38tamfo-uu749y-nkeam/
https://covac.co.za/controlite/cd00mvng08n0v10k6enitzu9rn6a7_n5wps24xd-36182008/
https://dkstudy.com/JxuuXPhVg/esp/GlVKuoYNGAXZZmSaxClQG/
https://happyroad.vn/wp-admin/xmqec93pt0_7eo5j86xzk-043862086895/
https://hikmah-puasa.harnodsnet.com/wp-admin/LLC/FLENlXWHxaoqgBpjlZqLmoqtThxO/
https://itspueh.nl/cgi-bin/paclm/AEcdpTIsOXIlWmLfWzQpnGCdOkL/
https://lucky119.com/wzzeb/r1nxjr-1unz4n5-lszfqc/
https://masholeh.web.id/wp-admin/paclm/ualq222qts1k41pgprsh_zc5fvy-30015379753/
https://microglobalsolutionsinc.com/wp-content/esp/ikxu7w8mpsjp_bybwa-820231260352/
https://paparatzi.co.il/wp-includes/whu4zj37sa3wps0izc7c63bsfmt_nd5p50gnxz-675364576943/
https://smitamakeup.com/iu25sjh/esp/suMrZdhUUUAZ/
https://staceywallphotography.com/wp-content/coffiqr-qeqq3-siec/
https://test.desidcrea.com/wp-content/2278pn-8azhk-duejui/
https://totaltechi.com/wp-admin/lm/114l7if5rkm3ejsmzs5f_a7aqx-044980568477070/
https://tuyendung.life/wp-content/ugmn7l-7pwc0gc-tigyupt/
https://vishwabharati.com/wp-includes/qz4pxh1-jcv50-mdlv/
https://wittayuonline.com/wp-includes/us9ecyvazhytyq1j63tz_pfyi2-5640611481873/
https://worldlifefree.info/wp-content/sites/raolmbvfskk0hy877jowbnjh_bbdpr80fmp-0490083640/
https://worshiphubug.com/wp-includes/3w2crqx-7cuw9k3-vvbaf/
https://www.steuerberaterin-vellmann.de/blog/wp-content/zYNaHPdFRXPFScDLeolQGyEmflqIjn/sites/nANIISuFCOTmhNmZ/
https://www.tailorexpress.co/wp-admin/Pages/ku7ypk91_knr1168gu9-87549152415478/
https://www.tailorexpress.co/wp-admin/parts_service/HtnLquxXvMLHRpvijsYSf/
https://www.touchoftuscany.com/wp-content/rmsd-anh7e-lhza/
https://yduckshop.com/wp-content/f2v4-lo035x-koxm/
https://ypom.com.br/static/m9wq-aorffc-kebc/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-05-08 18:15	(From ZIP - JS Based - Fake Error)
SHA256:
783cf5eff1762ca544ba31f17f2100c4ab413aae319384039a2290a231d2cb12

http://top5khampha.com/wp-admin/285909/
http://sgtechgulf.com/demo/pl87/
http://garagesilencieuxselect.com/engl/s61/
http://akuseruseisyun.net/2018Photo/zz2s31f1293/
http://agnicreative.com/428QGSAYD/cj2636/


Creation Time	2019-05-08 17:36:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
fb7c51f338a1cf784dc47aaa43858e72f48b6dd62a5c2d90e3c559add4499786
e54e3244fd282e2498df9cd1a6e23981bd858cd178665263b6eeff3edb6cba82
40b558d421d181b3591f1bd4508b269349c8a4a3f167ca75908a443aa98330d7

http://saarthieduhub.com/wp-includes/tmr3o5284/
http://zoracle.com/mw71/
http://mukunth.com/shop/jhr5097/
http://eyupp.com/bapmxkl/7ack8/
http://kulalusramag.net/calendar/lznsbh5579/


Creation Time	2019-05-08 13:05:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
190b11df7732d70d534d5f9efc969298fdc931c8beaff3a3b9592494a919fb05
927c96c70b804871a95bfe923a5b229e548e3f03aad83495171e1a5cc1ae0b02
664a576806b5be93bb64cf4e77256607a885f468b2bdda82b5eb68e851a11d3e
98c46f0bb26e4e59538488565084fce2edce3ed4bdaf1548e64cdc5e61ff95da
69efef71fd431b1b601de70b6696c0aa176fc81f7d1570a15e209d12a921f99d
af79f48979f5eb2068aa8c1e24daf9ac3a042cb2748b2f265eb4dcd0aa4523b2
8fa0addc0c1417dd05c67e654d3530a9fad4c40825cf2537d1b425b66f6e7deb
58b0c3490de0d0f8ba240f9f695e80b652d48e1ebf6107ac46905553ea37c04b
5399e6a99150ac8a9561d649401909114e1898c12e234c48123cabcde633bad0
f5959bc6b3e669fbf9daa1826db0246dc4c05af7428b78675316623a41a288b7
6964b98e57e916fabb11b9325e9610748e9154a71cd4a51c3f1eb9f26a3026c3
2c7ec2396653e7c68f52aeda5fb4ac5e1c6c7936797d3c6038c2468dda2e785d
6cce6b2e652d8c8dc1f805d5ecde46eb88681d2d3ebde6efcf242558e20149ff
d448eb94b5e8751acbf1985ee01d4e74cf5e8c057788b925d7317b7b425d8d73
40eeeb4ee5415b3aa859074dd71679bcd1ba4b5f5258f608544bf67ab13cd962
208d162c579bc62898a2fd2721c1778e20d8729f7db4f7cf806087e8a3abebcd
5691e8df84dece6ce7b50e4c289acdb5a7c17d2d0c773635bd56faee9dfcd8e3
54053c82daecdb5be2414ca91605f1af3d1320eb7052ea5a8c5aea8a8c24d81f
b88c1ee1597faba5cde36e0003f07c23433d7514e955426e133d3cf3b6bf80eb
ee3387f37f72239aa8ea1c47c80627005fd966905566f74e6eae9f46e7ebd70d
baf9b54f6efd1a6b5d9619c9a8adb66c56304883959e13506727841aef26e28a
705bf8dd974ca594c5ec213d5913d057d8c684ebe956dcb6bea4d13079199737
2f4a8482178f88a6a82aab7aa00505ccd1692da3234d17957f6e95ec7ae12f4a
647b8186f54829fa40016643bdfb427948be40c2942f72b978604f65269bf00a
9b9f0d27b290aed4d358ff85d53de4fafe310198baf09c56d659fcc68ee67dfb
d8a0acaa9bb1b597dc420ca546a8b90a9453bb658654244a6a08cb31c247db1c
5da184f6d3b18a2323e7bd3f14dcca6c2cec98eb2fd7aa11a4d5a6dd14bd9ab0

https://babalublog.com/image/h5jo1ao23800/
http://harazoil.com/wp-content/r7v83/
http://bigbrushmedia.com/wvvw/aljrz25/
http://blipin.com/vna984247/
http://bmserve.com/mobile/m1z5378/



Creation Time	2019-05-08 06:44:00
SHA256:
470fd20eb9b45a3e4f09b473d7896bf245afae246a38b71ff554b20a3ffaab35
e8ae2cde2f6d615a57c4f8de185979bf9e882a0519e49283dd7c4789a64b7db0
c89b34de371735abb9d17a3df676a2f6650421e85e35931f21f57551870ac410
977e1d50c07620cb76180b1e11429e0b92419257d983b17bc67df8cfbdfe9a42
5aa042c4337f710cdfbee3517a8f65cbe1d173bab103828cd3cff4deb3408eca
c96aff88540493676e47a11d3dc2e966a1dbf536ff7bfe9f566a62b19ab0851b
426ee0e7ea683201cf4ee8c547697a03714c836edc1db2a7bd0809211d2cd8d8
a736ef05913edc5208776d9af41b8004186a5158708f73789b9e4b8843fdf016
64449fb77436bb96215b647f24e1f572c7da6f73238cbc390b011039f94e434f
5e416e9f9829f36b7e0f9b18b38b7e0fb83e72c1959e2080a76baee18d83768a
cfa504b0e71133bb708e1ae2b9aa315afd1365767926c69425a4e96f03f3e1df
a1b26a054c9eef15d1ff05980d44a632a020abfe2a7f72b5df29c8120cc55ab6
e7b9e02133ef7b8745cacd5a71838137222feb5b25b632a60678b0a4ef96999a
66d31faaa38c9bf8a46114974ba396590b0022c29007fa95b271e431f4a7b5a6
0d5e232be1657fd93b44de00c866c14712e3165796b5ce62adce796609827ae1
9937a81a55b1205d1c436992bde547496754ce77a29177eaed7d1673032f37d3
faa93a52464667dc92e4bbcdb1ff53705153cac70e629c31c8d536ec604bfaf9
c72e1d90f3fc7835b93de5127d69050895ec26c19ba56d88147cc06fb6ee83c2
9b1ee33ad69ae1b8c13bef2d7df35bd903703fa8c30744e2cfd9f7130c728ff6
7359527ef1385dc935b577b830ed6710bca0910e919744c0654285fec14279a6
f21b6e39d6ee1ca0a3d52503815fbb5e9f9655e89ba29ef14759c16822fa70d0
73e0ae6da49d2e7c6e4dcc33601be8f7dfc20cd5639b3587fb793ebd5cd26a4c
34598c1d258661e7d512b46602d5f1260a52a1a0a039c1687af0dd11e404a449
ef8716972370b8719474fe7c6d896d751cf27f0fa0a80bab6524f840ea05344e
00a7a24e8c3913b663b5afe730f39d0ffa55f58f9dcb3fc4f853612c73e4208c
edd09f6afb1e0449e2eecfc1c85466ed16e9a7930416ba4d35ff82b330e9afd7
dd1224246a2a776b8f890f606f4c435ab8a3405c805167d35016bd08fe835edb
a11b7de80e066d3c06ecd25f055575ea500d8df54e97c707e6ed354cc7fe844c
57693c145ffdf48026c1948d309293da4e0007b524dc060b8de17034a41448cb
735d79ebe44a283b4c97f2678b0879451f8f44c210b212aa749d9d47196041e0
9a8749e487bd3936a7f3d05adf3fdcf604ef8745057765f33c247baf3068c40a
d53c78c899c46b336ad6b7fecfbce2aa98bedbd4ee225d370d5d48b59c760c6f
99abc56ebba7819a27bfef97998622a7082c44eb00aa6f4e225a77af0e257ba9
fc46f39706794ddcda5e6bb10f617953bcd1e0265857e1393c53171303e92b9f
de89c62e977b0e9f18e020226bcd81db51f73aab08e47b46c443fb21cd299b2a
00b30926c8bbd1e09856dcc22b6386c05ac89f7e415c1ef1d0b1417681961ef5
21a83c71b47586377e1b1e6785f61cf9a2bc4dfb8a65bdbbbe0e448ecd0030d9

http://herpesvirusfacts.com/wp-admin/arhh42365/
http://optimumenergytech.com/wp-admin/k83t4/
http://porchestergs.com/AGM/ns8ayu934/
http://pnbtasarim.com/cgi-bin/21uo828/
http://ozkayalar.com/admin836cnxhpb/8td3bl5/


Creation Time	2019-05-07 15:54:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
1445c07e94df1aab9b8d29c8bdc0d2dacaf61c5af509c9fd4e77b252a4259f71
a71b8728cbc139ec32ddbafbde1c2b3bcd08e239523ef892111ff48e4ad93997
5c9301442366cd17b9f4d1a329f18ae3129b9308b1489fd817ed636ee683c2ba
722cbefec1022164be968df23a8f7081ab768291911979480f9e717ffd936b52
2be7874eddd637b0d3706c4e29fa6829f66b339499349caeed0d5a36febdad8b
3ecee8f48addb263299de0849e73514748a3ea6f8adde3e4963b95acbeea4cd9
f13b12b90d3f13577fb85c79d91b639adcfb07d1ac2216c74158f64a6e4659ca
b3f81b567f6c6036683f1e2f3ee789b3d881fde3490b4fb9e56346c469b83f9a
e85ae3a7e658c979dd728a2f016d2412e8d1ef84d49f9c224975a1d38f56eb1f
1e742c21b21154da98e7fe08b6fca6a321b1631ac6dea39e3b90b9183a5c5177
6aa2d08a78cb0badf5975d3fdddfc6de5d55b2437a4ce7cf288d1046395c5325
c8f26dac5a3509f3cce31f1aa286c9a6e27d64e4416d50fde21ff351a00d3aba
9e86125a17e0fcbd78f720791e852e872df6b7bd85f7e7511b08bd894381e088
1aadb58fde0d5930efe45b67877b68884437f3c8311cabd9d62fe08d563c16b1
ea5d4c535f425371ab118f223fa14e9f54201700f1302e4b30fbe68f9c445b3f
ce782d77e724997a02e7e03c49b96bc419eea745c44d47076e7c0bba8317bfa7
acdb1b2be789ffabe11b8d2cfc407bc03260be277ace12b50d9e69952c0525a3
df5fce2cf5a41b6cae0de341173a1c3f072734ab2686a54bcf0d9811a199f924
a4c4dcf79d6b070599d3a813d8b542c8688a393b69f816012924b9f4d7f04059
1628fa954d509993c6a6a2932592f04429d055998d42440c702fb5d9299b6dfa
a1e91c9fbc40861d132c909f1bfac528ce335bbd36f5905f3b6444a403953f27
41289082e20c3e62e9f052b546c976a55040189acbb92e08c27bf88ad815807b
7316dac03434401997d957718c916f71132bf33fd5223ccaf8a90dfd6074db31
7e04cea50f00b2126fe6a5c652db5af26695897eb80b13cbe264542a365cf319
945d2d135ae3508e486be34ea2bea9305c48a699ae6447462ee1f251e4fd3b15
e327b0795f320710f7e5aea2d8791e62d8170215b6ecc533cdb3e20a3f3e3fa2
54694d41210054d6fffe9271fd650a69c55eeaf92ae903d4ef07ce795984dad2
00650af5c835d6845b6ae8bbf2ffd870781d87e19d4fa1a4f53ffac93cabef23
bef91b7b69c2e4ef09f2b8b703a6bdb42a2d55e2a31fcc201f02c8f755ab7ab8
6c74e8cd204af8dbbb5ceaf66e4a09d1b5d0ab931f0d10f8fa3e5d392505c355
c03d22b252f0d74bd310b9674d7a852963c7f51dc5bd50f3623f29dfb137cc38
cf54d777d317f6560902e5a7cc40cd0a6be8d5b96c154ac063cd8bf4b1a56c44
535af08c5e5a827b5daba5ff5df228e00ce08aae8b972997362e06675c0d8a56
c14d58c877a8a41518bd68122ff5d6de09132057e9d26550a491df6581532798
ebb1ef08bf0dacbff6724a7d5852c5c3553d30ea64399c5f8e5b9bc40b3e5207
88f30754e15ba9b17cc55ff40459c8f567459a5790efa40370eb8a1bd4c7981c
790342f9d67266fc51352ad24fbd2615d0b7ca059feda6ffc6b8274e270a8909
6359cfca4c3a4f6c657c285c6840af0bc66e00fcede8f7e2d3aa8e5bb96a24c4
8670c8f5745bc3c7b663d04b2a806f217cfe4f76c2c149ee9b42e2b15ac9d9aa
6c7023a5fc913fb54f373b39e479577cca9549f8e88e027fcdbf168d20796738
07a44560da37fb475f59d60fcb3da3094ef2754f807a5cf136cc3fa2cc8ebc00
156e844588da646b631952680d1e656c8c78c6034d4afb43242289114d542ba3
4991d4c01967ef17683391a9912466b0bdd986de3dfc05fed0079ffdd359d480
cd0f24f23e5e1bbfec611a79e1a01601f5e02d7edbf73af8c671a9abae4fae19
457cf8b857df178f9bd6ae41fdef7d1975f767e5b2b46c37def79018a6e4eced
fdabc899b0c2bc25cb3b6ec69d5fa312aa2522202c2db571919fd227df45b278
e42ef9b8fccdbaa6d3cfd699daa8b1ba95b7b1108a653a648d6ce0d59913a805
2a220f10836a32e58bdd6096fd417f0f03d17916e9979769752e0b8b9b2a6805
53456f80f5d1a9f6471012a45a4139cb4c49820e06c519dcbb91cd48c598a632
7abd6dfea23905d558c92b1278fe6689b1c916bd37855afcd1a3544b30d1c072
39f2d3b8787f0e7f2b8b1f44c78083a794963f0577355cc7d4e498ba86d74390
2d7ced6f4a830f8bcde131572dc8b9169e4e575846ec7f6e9c9de6a3dbb2f185
43aad8b76dc5a1ffed686d4aafd266c31af8da8992b55526e4cdf393c19ba3ad
b37d86de392439e00b45f822f9699317c320fd4f2e825f370a1fa86184b69403
25aa3c5f6d9418509dfffdf4af45b44a86e0ffd1b744401f2d1cd605362956b1
9fa5ad3598085a481902c06a22980cc06fd9e0fd5d43faf7d5bacb01108e1269
209f2ee22799264f2cbb508ff8900a5d57ea781337ac201e0bfb369fa9c2a3ed
0c22106e5100d3eb7cbd0f42bcee73d9d39030462217726b4fb1ad9c509de78d
cbad48b53a2f8d11b767dd4b866c9f243afa70ef413db8aede0912abd4349fba
e92bfa4b3acf4c91be1bd1771a6befc7a39e64922f489936c9381add86ee7556
97010e51e25867647281291e4cd1ab068f492d197aafd55713aed4f4e7566c3b
d0b5b27f1f684fc3797cd946020b3a900f68596b334479ae0577c00ff5df6bd9

http://psufoundation.capsuledna.com/wp-content/8q5opa6/
http://nosites-top10.com/wp-includes/k826yx3/
http://oilportraitfromphotos.com/0eax/jvvar9/
http://radiocharlene.com/cgi-bin/gg2hw52/
http://realestate.estatedeeds.com/files/g0/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 05/08/19 ####
```

af50c77e63620eccb3be78fce0ed3de6bf9aa6812fbd7e503e6488abddf31a4b
edd618c5755dea812662db45c19b693d3583797260e268744abaed84aaa9c15b
d1e0715a789b02c3e4f5718e56e4389b2000afc9ebc6d30266859d3fa08b637e
3f3794adab1574448252a64e7383b7fac1e97f4127667a1eae63f2ae993c30e5
1e722699d523d755b7c51342db5daf947f64638d3cdc2be41c8e0e85fc227771
31122707059551ca6e0ec57b54ed2f6f25804300fd48b3b4f625248a6de46662
9d772e41a6170658984cd3dc08880a3697e04c3847847c2a7fd7798d4a650ec9
5d12c17afc1f063befa9c8ab90506541fc16669e089cae72ddf81bcfac442419
150b5ee89d07ba59cb43ebd1bddab22244667009b7bc78d5e4ae6b37aecb373c
33083b984dd10f3d7f938e7468fa6f9a083db32643f0526bef01fd3c04204fce
07ce4a0ed15c447c45977c355001f83ab849186d834294550ee6e208e27ee567
e67aaedd63543172b9953b9159b8fb8f9cf9afff37823593ae1bda9497ac9fcb
ca4743687a23510980442574a2236c573be364c2a75082fb13d4ab30f3569641
16ac9a68fee924638174657ad7ab005030b026cc7bc9e0ee2270e378640b08ea
1d6458fe846c15db8207de992b6d921735c94ca7f690935df33dac708c86098a
172591f8375a492a1f99412e8b103300efed99734db0781f6abe69105be97636
48188de3d188dff027547f6e99c30efbe3c0ccd1f72f680416aac62d9b07be93
bbc8c3c31884afca6d606d0641864d69459d9f609d92bcaddaa039ac17dc150e
112397204a7a02d203165df3e229695e6ff76fa0dfeab7bb839cbb26f64837e3
28e3736f37222e7fbc4cde3e0cc31f88e3bfc16cc5c889b326a2f74f46e415ac
4d2cdf092f3cac112ca493ab8f3e327b5d168068a4a70c8ac8a4f5ca91965bc5
44f84630dee351deee8db77603cd2f9b317086e00d84a7b7d708b2bf883ed904
d597d72f7b987a9198c97f5227189ad218423e35e4253676fb7cfcdd5903f6ef
78e0f20db01b27e9a4bc5bc62a018bfbd970a3ccc739edf8fd3e3542b5eaa7e3
018995f0893b0284f20fadb3bb62e522ec42ae7bd6b8a89b53a0af8ccbc0d896
8cf26504fbcd56d97155dbab115ec79ce8ba71b77b9ecc56b6336b5e0ca24a30
88f6a13d839840843f82e0bf65a036ab107d134c6c63a06a80c0724780ff5f0c
b5efebf3c79ea9170698f0de358e1394f8ac2f7a06dffb1376ab7f96e99e755f
b3575c7a95a2d0811e785ec4e4321e9c8f8b344c5195b7f82328815b3959c39f
abfc70fe383fd81c9282e950c5e4ad11ce10385d4568f9e6b51d963eae8500e3
b96413e0f609e53c36c70bbc61295f8a09d0ff7f46124a7ef7237aab2844f360
9e1b5c16cfad4919489e562d2d2c4d29634fe08dc58db81f90c47082c5d85091
a6e03a6270afe8d2bec9130ddfeb5aa960d4061dba8b333701e87f46ca5b0556
286a32016dbe0cb7eef1c0a0bc4439e013da1ae84237dee5315280052db36786
034d857dc9e4d89cf48cd94ec99b3629c409387aac10501eee25507c91dedfcc
c3e0530a6b190927531c5e1d35bb983d82914d4035dd3d9e7a1671e051710300
5493f7935a9ccade975afd856c5e1b39b23ef892931bd7176a585fae5212efbf
a827731f3da0eff519b4e96e2d5e633e4fa0f2e8e82cb5b7e5a64d20c407496b
02ed50e54fdda447860c10950d23149dea0710587ef174b3b49be3a36c1baa0b

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-05-08 23:25	(From ZIP - JS Based - Fake Error)
SHA256:
7af96357f43ad572524ce419cf7cd6c720543ee930a83b9b7d8e7d02a9484b76

http://misenar.com/hiddencreekhoney/xMOtBGSC/
http://mvid.com/index_htm_files/bw5fb_s9rd37p9w-117/
http://warwickvalleyliving.com/includes/HrQZWAsb/
http://zahrahenna.com.sg/wp-includes/7uf4_hgpra-18/
http://samegrelorm.ge/wp-content/qZxIbhPt/


Creation Time	2019-05-08 19:05	(From ZIP - JS Based - Fake Error)
SHA256:
bee2e5dcd6dcc52fa9a20552b0da985e82eb0f85a3b3a7291d3190fda9b27acc

http://zolfagharico.com/wp-includes/o331_l12tk22-594/
https://stickersaigon.com/wp-includes/jjynadm_9nryjijf-33275133/
http://macbookprorepairmumbai.com/cgi-bin/7fqjqeq_llxkv-633/
http://intertexbrasov.ro/wp-admin/m5sigejrxl_dtjzp-2161/
http://2019.roncallischoolgids.nl/wp-includes/o0n3_haz0gxiu-859/

Creation Time	2019-05-08 13:49:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
ac2d5b5137c50f63870e74a5c2f3363163d644788ee695599362e11d40867e22
a63b1db43f155ee73981732360e46955ca373000608019113f6504ec08811bde
37390a65227c1c3d33a74d43898940cfd4690953cea047db95f39e191a20dfb2
4ba386fc55054b552861920518ad12c69e8d9879a3e8b2e7ec433f06f7c28d1d
8ea46d2e7b76e5d7298c7f8bfd87d9ae27ccc62f881caad23ff2bef3d898ed4d
a1cfae30890020cb617673300b06c8c56cabc6d7a9e2cd1468d0af3e673f0f4a
90177c7d1132ae75fe36f64b01e5e520180967157e656502a0aa75d92faa428d
c039cd2a725e21a30c662162ab53dd3e6073d61f295e1463187b1060ba1ef78f
71185c9cc943c6cc503e108507f5cab7834203a833eb3597487f24a5cb3822c9
9fca8a5a5331231d7c2e24f98c132be370fc4c1d314f6f0b674161bf086e32e2
2f4d7eb0480b6c47bbeaaf362fd64fae9aedc5fcdeb35f7defe26ca9bba23f28
4987eff30322e183f2564965c47cb409b92b466095d4c7ff3583b57419cc4cb3
abb657219fa4293bdb3ea83eef9701a8a1b8db399122ac9b78988d2d7670f05b
7b85bc06a4a5512e48375bc579949a5cdf7e83be9a39cb4f5f4397be9a328415
74f72b0d108ec97611ee692717d66facf8ae5ca0394a4f9739c04cbdb1906ff7
adfb40518e76da88b465cac35e6c32bb025e1f0188d96470a06ef516aef5d5ea
141bfa7e5d4c145c77ee707866c3c14780bcf22b84220012170bdf50b6152dbb
50cdfcb1f7724fdab8da553f24f51686cb4835efef1d43f535ea00f220297ea7
ccf713f98bfa24d4b3aaa4ac68b4b990b777b99c20b6bb61aa6ad25538f50bb7
05a1b779f06811f6f3278380db221fc143ef10a8b3b0868b046ba6661009d3c5
f28a138902f60bdeac2acde65169d1460c6edefacd534edb04269f62e3b280db
55b414fdc1fd75ce344a26606b4f1a0260a4867c0a35a202a08de8f3d6c2bd1b
1e38f977023236a6846336944e69af0ec5c89016191720fb97d1aa7b8ca65768
3ddb12e26d6b727c1a1bc194a72b7db0ea67f962855b0925cddc44ddf919dbf0
9fff48d7c0f4494bddbba99f1e95a2de9bcef7435ebc10c66d6b62aa57f62e95
e68497a4f031505d16b9c6c97077eafe011ca0b7a64f01baef10886dc8dbeabd
644420b3e764f5becc1266ffda8af58fbc5290b8dc111da82d1cc03c894a10b5
76078c12f217788bc8a017d80c6a7e207a86a0141792fe1e43009847c44dd365
7569c44f5d04fef27c5b9be4b22eee2f5f81edb46857e077255f4d593cf09d33
68c4e68c357c5ec0e3d94a13bd5ef452621f55480c6a2ad6d385da52ac160260
a6654bf3a1dc1407b542532d1a9d11c30b84cdd9cc736abccfec742eb677b117

http://creaception.com/wp-content/xiGNlqqqTY/
http://credigas.com.br/banner/gy7r_septedp8a2-535832/
http://downinthecountry.com/logsite/uBkMGLPsSs/
https://ingelse.net/awstats/yBDJPpkqn/
http://kelp4less.com/wp-includes/r3txlpz_ncoq6p-28/

Creation Time	2019-05-08 08:22:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
b70c13bc142ec6454363d4907cc0501c70d6fa2c8a693b49746c3cbaf6dad5db
9adc9066332115a8bb06624f01c63cf46cac833799ab8c34d9443a30d0eda268
af3d8682792e3fda67746101dc2c7b4de96b6ea742436384e38a5f9cd0fe2bf1
5137a1d660ecd9d33fc30a34c97a4b5293dd9b6e202548999ed1a9adb6606d5d
910b21b089dd8f21d37f4a08fb65efe7d20807abedda2a694bb1bc42dbbf4b90
033473cc78cd2c60e3bb42a6e5d9fb35fb15c5dfd748b7f0b35eaa606fdf8652
120666b2a90b52983e5e261eeccdcaa831ea1649c7b09ae4ca94c54de20a4e92
36ef5f0cd967eef41fbf234f27bdd1d24ff531212d34431ab10fc42a56ca2c2a
ce167af75e50476a8b2d4e8b9634594333f949ba78d64001efd6b16c9f4220e8
56a81f054ec9d600f1085245e2cb9e6e88794c3c91069b4f088a764fa03e9021
21dba7464d1347ae8dc50f9cf753d3b568b85a47c47ecb1d054192c732994656
e300839acf67537a25e4c8e80ff602320bfb2775d67ca20c99ee484905b808ae
3c0ad83a45a3cdc5d74704e4ca026a5af448f0fd2d70e43de077ac2defbfbe2e
5610fb4f2521abbb5a78ce55ce5efaf6ea7d9c3125baeeb653e9248053417e8c
f0f86903255f88f4d0a80355d0dcc331e0f33f32b30505115fcd4727e91bbf33
d4a3e3dc460302326adcae4baf09fb4bdf846b1b8bd5f6c76908b0a1b62fd663
24267568d3fa011adb7ef53f107f6aa01162750e40eef869781ceb0ce6651f54
0f13e41640e9281bb775ba53333af8c80f0ac73b5436fb497910b3cdd397aca0
64455bb11732d7b5a9935f85241a69e6b0549e480bb8d5ee55a0cb6f5bff0c6c
93404bc2b21ae4c2eea881e5bfaf89e24e0f038467b271ab9ae1c96ff461b910
9f1c7192efe5fd241d1df09e7705fafd9356fb2e03e08e0d82ee4a26535b4ab4
154e8aaaf4a5e299f3f5db330ad353ba64c111c7ef8e1c52b75b9d356aede4ef
713b34f0494e837eb6b50e34b67c944ca9b271f30fc81ae59ce8cecefb835f37
9fdc9305eec872f1ca504b377314371c1ced1b0772987356ea9fe9ab7662633b
fc22a0864c6bd060ed4cc63069bd5c4bc021cd09871bdd910cd56ef61edd8296
a14108d923c95372e82d7caca6fc38dc4d3e02b63586c15bbd024fa305d3de2d
3e7d6e2f8a0965f759788182fd17786fa9ba5ecafdca5b71b86c737d09ace85a
70f4d11f59ab292faf7be98442a8075b1847f6201ae29f07525107fcf44637eb
69dd47a9e865304064c05f1d65b550b015d516f9dcef8474054e51b05484cee5
60df75698c85bbf2a51c0ed1186a82f85472d41f37e0b6ec5901b100bc1e7b00
54285762a074ad6e7081fd15decba3f09debabc6d9c364f8894c65910cbaf0df
9cb9e15e944c542fc3308e7b5c9108994bc6522efa562d3c89d5b20d232a260d
ba914a678ad010cc2bbe98ad8eedf42154633867e2a9222186c7ea69f420826b

http://brelecs.com/wpp-app/ZInfJkrMDM/
http://mysterylover.com/corenascreations/zencartcatalog/cache/4sqgznci_giubib758k-0265085318/
http://mythosproductions.com/riseup/t4yn_a6eopru5-1724458/
http://shazaamwebsites.com/perfzone/aTLMJWPzkj/
http://stegwee.eu/aanbieding/x9tx_4jb6ut6vl-02705/

Creation Time	2019-05-07 18:10:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
d7fc74cd2d6f34bcc7e02522812778a91bbc6591f4805164208847add84ecf2e
ca3df80f2b645b8d3eca905f0640d605b9d70f79ae9424e883fa73c50ec1fe88
f431544f9099b4f86cf43b676b6be9752436fc4773cf672f23f743b17c41eb9d
65b609123b8aafb5df555501ae3c892b5d207b3f5fd7bb27b896ecefebe4d8e5
36ef0c5f8ba0efa2505776be985aacab717ec52d28257e8609d1588771752832
d97f2899ee64066ec4a0e641b598c9203a52800de6f3bebe11edad394043add7
afc7e59c3f7eb40403410c8ea91e4483a08c01fe3dbb9e5ec2d792db05d71615
7092578eb42ea5e3e0b820f6f301371644c515f38089081ffac439f75a7df138
4199ac96a54a1125914dd6d442d3827273228153c600083f1ad4290c9dd2030b
942c15d908cca46bf861a0f12afaa5564f358631ac5438f46dd8aec5320ec8ca
4a6de75161f4f0e0c1ad38e60650d1858a366dd17851c33e9c5ea1d6948f74ef
69d7ce691dcb1bcef6362246015fbf110c2f8261f030712604580f321ee800da
4f55f58bff347fb85cc57d6ca1b3558cd0854ab94889455f7c9c297e0a53f296
28cd75af6569612c8dc642936de3a2680f75d49e1d38be1a3a782fcf11dedb31
747bb54841560a6b05816044c854a2de0f5598c1c041aa770ec5452fe5e46def
1667101838ea1804515221c8a6b6b55f2629605f5900e10f5ad9681d62659ab7
71b6be26315c131c1fe9fea2b209427cc31e69b472690d38b8f32e8c8a3132a9
97751f7f85a31dab44e329097291f769be1f4f616b727338faf73cfe603ada69
e32bd1dff874e887b1687bd375630d75aec57fda6ba90436543a25fbf31e2da4
4bcc23a49582fcb2c84b80463a8735ed1c152533b8145b656c1e9011747c8bd5
f47066b0cc76015cc75de6b864de2d94048b07e5907d3aa8de1716050d655b22
ca79cb63740912029a80925b94cdfeb13c9ffa62743e6371de9f7ff5c49afbfe
fa49a4384a297a41b1b926457c55e15b422f83ec648b527db8ee133d8348ed08
0a8b639c5a7cea57c3b32100976afef1f1582399fe60ad44fa09edd0401a5cc1
cc5d88ce8bdcae9b0807e00ac25b8810061ef74875ce4c1e6de004b6bb42c594
0d259d80a2460b40a664d20e76eebbe3bea398cc0a391c3bb201e6fbf18979e7
36b7c488433df34c87e4908670f6e9672e213accaca3edd81fbf66221628ea15
e9d8031de13727606b06d94c6d63be04a9b692d5eeeb83c251dd8678e87cd4e7
e7b78b900c3b24784538e7a4c770d7287cf87e3fa2d6b3de7a8d0406f07b4ab7
e0cca29fbe79912a60ba57c8776d7f84e85495fa54a0e5244c0917df09b6b359
c1fc82efd89f0d1cb1c529195ce3c7197811bc6e6a16f84d96c3cb10246c31bd
a8312b81169d94088d58157b4de7a098b55b97e0f7a059185c7bbcb339643d9e
ba9cfe63d81cf564cb9dec71bce28548d8187549e79d308ef2fc0ae273660afb
497fe0c5adffb28afd5d1add4b8fff359cd9a43fcb88aaa1f0e3ff9c30e268b8
eba293fdf7e66106538b72167c72639bf586a3fb1f104a7b8ecb720a858bd264
f4c60396875624b651f71704a2ad83cebfb42f18d8417e552f2053398b461810
e5926330a88c1b093a99a57cf8a0a427b494a60a012f4f0f9814843c221301b2
3ca3b11abd89194bed84645f9427a71ca200fb70aef0af93eb6e20511228f36f
bf55a3a3036d1f003f56596666d4ee9d217fd276a3a24bf38d1eb2f4d581f149
ec758a682d45e64a356016892c8e6c724989500dba194e3ef870134d5b7fe8c9
b1483f528d6f343065873260bd457abe6436aff1c7cb08d3df1f4a293028fc90
e7f32681de1db48818bf4d4fa2fea775f9064eff9602123dc2d014d931f82d22
39acc515c1171c8b4599f6bff37aaa446ebb192a920fe07e3b8b58624d67b6a3
67828c67eec09559b895632f669dd636dc7cf926dc962a68d13b757eaf1f11bf
9a4b3d0898fddc61f0f32ec6625a50040817f46c87e715b56ac1ba48cc17199c
e6c5cf2d7f36d84ab09e9785e24783ee44b08a299a445f514a8d8aeec7f70a31
c01333aae874f5d8bfff02bed8513a1d40c316d71e503764ac6d03279971572d
0aaeaa93626bdc87153bcbd213712de5c3fa7f98f2455f1e6e5cd2f46c03b0d3
f0e05fcf22d473ad5eb79a73fc82818bdf3555325d04a54b965953de5bdc8c4b
f72d7824f747268dc008eb1ed7f7c4c22003a22c098458e155456b074dad2bc1
df831ed46beb9a144ec45bb0a6dba56443f92f4b28c7055d325f1e12296b99f1

http://splussystems.com/wp-admin/eUJLagjD/
http://www.portduo.com/wp-content/KdWRhFjK/
http://telenvivo.com/hq1g/vp33l1h56_o4b8mev9qw-7034/
http://luxuryindiancatering.co.uk/wp-includes/ukoe_7v10mk-02/
http://prizma.ch/wp-content/fFVmwFqTq/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 05/08/19 ####
```

0edd0fd6fcc05383bf72832512f1bc7b362917b99c99d3657889d4f9e9f3ace0
bc7d1b5270c9f01237f87b6b98996b247ba961ef9842b4643ec8e581af83bfee
0f3b1096ea868942b19b85e896939862854532ff5d09ca5dbd6ce71b79a0fdec
9008cd37caa7a7a0e098f425a07c124c87a9289ac0a81aaec3c3d23a9f42e8cb
abb4922f1bd581b45babfb427bd1c5f313af3d00a7b16d2b889c952884aa3cac
602228f1368f78974944f2c7f6b92bcfd526329613b297488f64d6dc60e18915
24313dbfae6020adfd4393007a06d21b1ee89b4b3daa6cd142c506189eb10364
28de59caf441b91038395d025450124041e3c71d681f4909597f087951d35f44
efb76770ee5c4ad3a44e7cbcf02201672eb1661dfa025db33ebec12af28d2c74
7624029e1b3a375e42f57e0f211283a3508d7432a42be3afca8e64ac72279341
b05d205091fee0c2cb401a5799e6a386cdcedfa9a9640385e268b6a4332f71b8
379e281c460dd29ae85d66b8738f4c66c22340e74316c22df73c5535e4a58550
003b8776d92b911a858a18865276dda11d73ec9c30b8f9e585de48de673203e7
3714434eb036572ca016c56c19f0aa0fe2ee0cfbafbea4b63874dae7d0781922
faba5c2062b68a464880cfc71b2e632562ef5a13ef5a7d20c86d4db83cd9a4e5
42d487b16944be3000e4db79450a20f930f1ca8ed33b7873144c9e9a4d1b56cd
3176331d11d83253a7da826f65cceb206c14c71a92b7cfd89a01af212ae94ad7
5f0745d03f16d994afa640c4b7c34e04ec1f2f2b424410f5c064c812c32d6305
3009380e337074845c161e52ae7704fa418037bf3b116309397a6f94e5a7c523
ed6644060bd08f2d323a7e9256882fcff0f86cbcf6896252eb276a8efb15c9e0
caf2aafb8df58fd0b203c4aacfa38eeac6e72583d9a1295756dd7356c7220500
451a842fb2e9d67a01c01327779f2eb784d662ed27a3131ef3a179ef93e329c8
868b917687f102cd577fb8686ce896fd1cf2dbe665c381473f2157c74eef5bf4
cc4bf772f7b0275b14cd4e5d0151506a5bef0c245285814bdd441569a553d33d
ff59a5c5bf4e54299814361844e650c8ad6f3308746645bd0542ba90c875d012
640ab8bfd32a3bdfbaca93a42ea558dfabe1783a746c3f15d2f2ac7b41d50ef5
bbfc0f90b81d25917d58a8fa1031374ac2e597a6ef9dae74dc07cb92af0e4168
ff799fe3ed17f34af34105eba5e96b74951bebfd43d9dbfef1ba99c474b50e47
35367a9b62d6ba85deffc5728f8471318184fb77ccc22f47b6434db65919c777
b40476704673499bb38e61b1a32daa136e7fef6f88bb07a4e0670f5013522352
d52022a604678b97f24bb4b16dc1691bb99b4fd47c3fc69f578991080b1afa01
05304c4c5fb0cfab7eb8486156bff5177b39476b382965ecec5dc2b1a2fb6913
01cbd7d02c3639cad6b4d7859607c1b788c521c5b243f20b749a8a57ca375b24
ef891923c6d2f19304241cbf7fa95b675ecfb8f9a831aed1493578953eb1efe0
7b55dd4a87fc6bf2ea960e769f570c599818a667f65c89289e681b0965e8af3c
2bd7c192e194e8c9c7f17ab0d69a5a28f468b346bdc5908d54b133da4431766c
bf8a1fc51c5a4131037812e0a5e340f46a174e77d21f63c81712342ffba1df32


```
#### Epoch 1 C2s ####
```

103.201.150.209:80
103.213.212.42:443
105.224.171.102:80
107.159.94.183:8080
109.104.79.48:8080
109.73.52.242:8080
111.67.12.221:8080
115.132.227.247:443
139.59.19.157:80
144.76.117.247:8080
159.69.211.211:8080
175.107.200.27:443
176.58.93.123:8080
181.15.243.22:80
181.199.151.19:80
181.29.101.13:80
181.30.126.66:80
185.86.148.222:8080
185.94.252.27:443
186.139.160.193:8080
187.188.166.192:80
189.196.140.187:80
190.117.206.153:443
190.171.230.41:80
190.180.52.146:20
190.85.206.228:80
192.155.90.90:7080
192.163.199.254:8080
196.6.112.70:443
200.107.105.16:465
200.127.0.8:80
200.28.131.215:443
200.58.171.51:80
201.251.229.37:80
203.25.159.3:8080
213.172.88.13:80
216.98.148.136:4143
217.199.175.216:8080
218.161.88.253:8080
219.94.254.93:8080
222.104.222.145:443
23.254.203.51:8080
24.150.44.53:80
37.59.1.74:8080
43.229.62.186:8080
51.255.50.164:8080
62.75.143.100:7080
66.209.69.165:443
66.228.45.129:8080
69.163.33.82:8080
72.47.248.48:8080
81.3.6.78:7080
82.226.163.9:80
83.110.195.120:443
85.132.96.242:80
91.205.215.57:7080
91.83.93.124:7080

```
#### Epoch 1 - Spam/Stealer C2s ####
```

61.92.159.208:8080
104.236.185.25:8080
50.116.63.9:7080

```
#### Current Epoch 1 RSA Public Key ####
```


MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

103.255.150.84:80
103.53.44.20:80
119.155.153.14:21
124.123.42.93:80
133.242.156.30:7080
136.243.177.26:8080
138.201.140.110:8080
144.202.9.18:8080
147.135.210.39:8080
148.244.114.49:7080
149.167.86.174:990
149.255.56.242:8080
162.243.125.212:8080
167.114.210.191:8080
169.239.182.217:8080
173.255.196.209:8080
174.93.130.148:8443
175.100.138.82:22
177.230.108.144:22
177.242.202.30:8080
177.242.214.30:80
178.152.78.149:20
178.62.37.188:443
178.79.161.166:443
179.14.2.75:21
180.150.87.75:22
181.63.2.226:8080
182.176.132.213:8090
182.176.94.236:80
182.188.47.206:990
183.82.100.135:80
183.82.110.170:53
186.113.19.171:80
186.4.167.166:80
186.4.234.27:443
186.56.192.241:21
187.189.195.208:8443
187.192.147.246:21
188.138.91.26:7080
189.209.217.49:80
190.112.228.47:443
190.145.67.134:8090
190.25.255.98:443
190.25.255.98:80
190.72.136.214:465
2.50.4.159:443
2.50.52.255:20
200.21.90.6:80
201.199.89.223:8443
201.220.152.101:80
201.231.44.78:80
206.212.248.178:8080
208.78.100.202:8080
211.252.7.11:993
211.63.71.72:8080
212.22.215.140:80
213.14.166.152:990
216.98.148.156:8080
217.13.106.160:7080
217.199.175.217:8080
24.139.205.186:8080
41.169.20.147:143
41.220.119.246:80
45.123.3.54:443
45.33.49.124:443
50.31.0.160:8080
50.99.132.7:465
59.103.164.174:80
62.75.146.221:7080
62.75.187.192:8080
64.13.225.150:8080
67.205.149.117:8080
69.45.19.145:8080
69.45.19.252:8080
73.49.109.200:443
77.56.253.112:80
78.100.187.118:80
78.186.5.109:443
78.189.173.217:143
84.241.10.111:53
85.104.59.244:20
86.122.149.86:8080
87.106.139.101:8080
87.106.23.241:8080
91.205.215.66:8080
92.154.101.154:50000
94.130.35.140:443
94.14.58.32:80
94.76.200.114:8080
95.128.43.213:8080
98.144.73.193:80

```
#### Epoch 2 - Spam/Stealer C2s ####
```

198.58.114.91:4143
213.136.86.219:7080
91.205.215.10:7080

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/07/2019)

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
time period.
Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any one time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
via C2 to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```
https://pastebin.com/LqHuzEpV - @lazyactivist192
https://pastebin.com/vf5qnAZW - @ps66uk

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey,
@Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial, @lazyactivist192

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman, @lazyactivist192, @TrendMicro

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch,
@urlscanio, @TrendMicro and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log 05-08-19 ####
```

General News:

Both @ps66uk and I received only a handful of malspam today. I only received 1 link based malspam this morning and @ps66uk received
7 DOCs as attachments. I am not sure what is going on but E1 seemed less active today based on what we saw out there. E2 was still
plenty active though. Both botnets were doing ZIP/JS by the end of the day.

In other news:

If you didnt already see it, there is a very simple way to defang these ZIP/JS attachments or links. Just change the Explorer association
to open .JS files via Notepad.exe. You can follow my instruction here in this Any.Run:
https://app.any.run/tasks/81503633-0f95-48d4-bd80-c83ec5c2b763
or you can do this via GPO. Here is a nice writeup on this process: https://montour.co/2016/09/group-policy-force-js-files/
I recommend you do this because .JS malware is very 2016 or even earlier and most users never need to run .JS or .JSE for that matter.
You can likely throw other extensions into the same configuration and @JayTHL had a nice thread discussing this here:
https://twitter.com/JayTHL/status/1126204098670411779

@JayTHL had a nice review of our data last night:

https://twitter.com/JayTHL/status/1125999273110380544

Email Template Report:

The template I got today was basically the same as they have been the last few weeks.
@ps66uk reported on what he received here:
https://twitter.com/ps66uk/status/1126226187007791106

Review:
What we know about the threaded templates/reply chain:(changes are marked with *)

- Emails are sourced from once (or still) compromised users all over the world.
- Emotet injects a reply into a real email conversation thread between the compromised party and another party that replied
to the compromised party on or before Nov 2018 until at least January 2019. (may be up to present) Also have seen emails going
back as far as June 2018.
- Now on E1 and E2.
- Now seeing German based templates that are essentially the same thing but in German.
*- The injected reply is usually prefaced with the following:
"Attached is your confidential docs."
"Attached please find the wire transfer form."
"Thank you for your help. Please see the attached."
*"Load instructions attached"
*"A printer friendly attachment is now included with each email."
*"Click on the attachment to open or save the printer friendly version of your report."
- Both attached and link based delivery of the maldocs/ZIP/JS have been observed.
- Attachments seem to be in the filename format of *_Month_DD_YYYY.doc/js so far.
- The link is customized for the display text of the link to show the real domain of the spoofed organization.
- These templates are pretty limited in run and not very numerous.

Link Regex Report:

Regex directory patterns - Nothing new since yesterday. These 6 were active today:
* indicates updated or very active. Yes you want to take out the * in front because it doesnt belong in the actual Regex. :)

E1
*https?:\/\/.+?\/([A-Za-z0-9]{4,5})-([A-Za-z0-9]{14,16})_([A-Za-z0-9]{8,9})-([A-Za-z0-9]{2,3})\/
*https?:\/\/.+?\/(trust(ed)?|sec|verif|public|secure|open|verif_seg)\.([DdEeGgNn]{2,3})?\.?(logged|signed|accounts|myacc|sign|anyone|myaccount|accs)\.(resourses|docs?|open_res|send|office|rep|public|sent)\.?(net|com|sec|biz)?\/
*\/(Frage|Nachprufung|nachpr|sich|sichern|vertrauen|([DdeEnN_]{2,5}))\/([0-59\-]){6,7}\/

E2
*https?:\/\/.+?\/([A-Za-z0-9]{4,30})_([a-z0-9]{5,10})-([0-9]{8,15})\/
https?:\/\/.+?\/(assets|blogs|cgi-bin|demo|direc|Document|DOC|esp|FILE|INC|LLC|lm|paclm|Pages|parts_service|phpmyadmin|Scan|sites|test|themes|uploads|WP2|wp-admin|wp-content|wp-includes)\/([A-Za-z0-9]{7,30})\/(\"|\n)
*https?:\/\/.+?\/([a-z0-9]{4,7})-([a-z0-9]{5,7})-([a-z0-9]{4,7})\/

NOTE: If you get a lot of false positives, try adding (\"|\n) at the end of some of these after the last \/

These Regex patterns are to be used experimentally and at your own risk but they caught 95%+ of what I saw in link malspam.

Payloads Report:

A new loader appeared on both botnets today that is a combination of the old loader and the new loader. It was first dropped
on E1 at 21:30UTC and then E2 at 21:45UTC. To avoid confusion, all loaders before this point as the old loader, I am going to
call Loader v1 and the new loader is v2. This one released today is v3.

In distro and C2 the v3 loader is being deployed and there is no hash busting or updates. It looks like a 10-12 hour lifecycle
like we have seen with the v2 loader lately. Perhaps they finally joined what they liked out of both and we will see hash busting
and updates every 5 minutes soon.

Both botnets were doing Docs via attachments and links until about 18:15 UTC. E1 started doing ZIP/JS at this point
and then E2 followed suit shortly thereafter at 19:00. So I guess Operation Zipper Stuck is still going on... seems painful
for Ivan. :D

C2 Report: C2 Combos continue to climb higher and higher on E2 now at a record 91!

C2s did NOT change for E1 remained at 57 combos in total. - recorded above
C2s DID change for E2 and increased from 85 to 91 combos in total. - recorded above

Closing:

Nothing too interesting going on today. Malspam levels seem to be going down in general and I bet the infection counts are dropping
based on all of the slow to update loader issues and loader crashes that were happening today. This is all good news and all I can
say is good riddance!

TT

```
#### Sandbox 05/08/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-05-09 at 03:00 UTC - https://app.any.run/tasks/c7a8b9d6-9f71-4ff7-a94f-31706e91bfe4

```

```

Epoch 2 C2 run on 2019-05-09 at 01:00 UTC - From @lazyactivist192 data here: https://pastebin.com/LqHuzEpV

```