Emotet Malware IoCs 2019/03/18

## Emotet Malware Document links/IOCs for 03/18/19 as of 03/18/19 22:45 EDT ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 03/18/19 ####
```

http://247everydaysport.com/oslh4nf/sendinc/messages/secure/en_EN/2019-03/
http://3tavernsstudios.com/wp-admin/sendincverif/service/question/En_en/032019/
http://44200.ir/wordpress/sendincsec/support/sichern/DE_de/201903/
http://aliawisata.com/wp-admin/sendincsecure/legal/trust/en_EN/032019/
http://appsguru.my/fb/sendincsec/legal/verif/EN/03-2019/
http://blog.bellerbyandco.com/wp-admin/sendinc/legal/ios/En_en/201903/
http://bloodybits.com/edwinjefferson.com/sendinc/support/Nachprufung/De/032019/
http://crabnet.com/admin/sendinc/nachrichten/Nachprufung/DE/03-2019/
http://dnew242.com/dnew242.com/sendinc/support/ios/En/2019-03/
http://duncaninstallation.com/js/sendincsec/service/sich/De/03-2019/
http://easternmobility.com/js/sendinc/nachrichten/Nachprufung/DE_de/03-2019/
http://edtech.iae.edu.vn/wp-includes/sendincsecure/nachrichten/nachpr/De_de/03-2019/
http://emseenerji.com/wp-content/sendincsecure/support/secure/EN_en/201903/
http://firemaplegames.com/screenshots/sendinc/service/trust/En_en/201903/
http://fisika.mipa.uns.ac.id/dashboard/sendinc/nachrichten/vertrauen/DE/03-2019/
http://gamarepro.com/plugins/sendincencrypt/support/secure/en_EN/03-2019/
http://generalwebmayhem.com/2k11/sendincencrypt/support/secure/En_en/201903/
http://grupoweb.cl/wp-admin/sendinc/service/ios/en_EN/032019/
http://haru1ban.net/files/sendincverif/support/sec/En_en/2019-03/
http://horseshows.io/c2nkrlt/sendincencrypt/nachrichten/nachpr/DE_de/03-2019/
http://impro.in/components/sendincverif/messages/sec/EN_en/03-2019/
http://indirimpazarim.com/cgi-bin/sendincsec/support/trust/En_en/201903/
http://instituthypnos.com/1sxuh6w/sendincsec/nachrichten/Frage/De_de/032019/
http://jobmall.co.ke/wp-admin/sendincsec/service/trust/En/201903/
http://junkmover.ca/wp-includes/sendincsecure/legal/secure/EN/032019/
http://kakoon.co.il/cgi-bin/sendincsec/service/secure/EN_en/03-2019/
http://kannada.awgp.org/wp-content/uploads/sendinc/service/ios/en_EN/032019/
http://klasisgk.or.id/fonts/sendincencrypt/support/nachpr/De/03-2019/
http://lamdepvungkinphunu.vn/bk_/sendincverif/support/secure/En_en/03-2019/
http://makrohayat.com/wp-admin/sendincencrypt/nachrichten/vertrauen/De/03-2019/
http://mauriandrade.com/COPYRIGHT/sendincsecure/support/trust/EN/2019-03/
http://muacangua.com/wp-admin/sendinc/support/Nachprufung/De/03-2019/
http://pro-forma.com.pl/stuff/sendincverif/support/verif/en_EN/201903/
http://qualityoil.co/templates/sendincverif/legal/sec/EN/032019/
http://shapeshifters.net.nz/slade/sendincverif/support/verif/EN/032019/
http://smart-tech.pt/wordpress/sendincverif/messages/ios/EN/032019/
http://sus-scrofa.nl/NewDash2/sendincsec/legal/secure/En/2019-03/
http://taxiinspector.com.au/poker-platform.com/sendincsecure/legal/secure/EN_en/03-2019/
http://tcbrs.com/sendincencrypt/service/ios/en_EN/032019/
http://tewon.de/wp-includes/sendincsec/messages/secure/EN/03-2019/
http://th.cr/administrator/sendincsecure/service/ios/En/032019/
http://tsk-winery.com/wp-includes/sendinc/service/question/en_EN/03-2019/
http://wajeehshafiq.com/cgi-bin/sendincencrypt/legal/verif/EN_en/2019-03/
http://wallstreetancona.wazabit.it/wp-content/uploads/sendincsecure/support/question/En/032019/
http://wellplayed.asia/wp-content/sendincsec/service/sec/EN/2019-03/
http://wlkttc.top/ErrorPages/sendincsec/service/verif/En_en/2019-03/
http://www.68h7.com/wp-admin/sendincverif/support/secure/En_en/2019-03/
http://www.majoristanbul.com/cgi-bin/sendincverif/support/sichern/DE_de/03-2019/
http://www.ridgewaywebsites.co.uk/cgi-bin/sendinc/messages/sec/EN/03-2019/
http://xn--12co8a6cdw9dmf.xyz/wp-includes/sendinc/legal/trust/EN/03-2019/
http://xn--wertschtzende-worte-mwb.de/wp-admin/sendincencrypt/service/secure/EN_en/2019-03/
http://xn----zhcbeat6aupuu3f.org.il/wp-content/sendincverif/service/sec/En/2019-03/
http://zambud.eu/wp-includes/sendinc/legal/trust/EN/032019/
http://zemdirbyste.lt/wp-content/sendinc/messages/secure/EN_en/2019-03/
https://abi.com.vn/BaoMat/sendincsecure/nachrichten/vertrauen/de_DE/03-2019/
https://etprimewomenawards.com/apply2/uploads/sendincencrypt/nachrichten/Nachprufung/de_DE/2019-03/
https://horseshows.io/c2nkrlt/sendincencrypt/nachrichten/nachpr/DE_de/03-2019/
https://liblockchain.org/wp-content/sendincsec/legale/Frage/DE/03-2019/
https://myphamthienthao.com/wp-admin/sendincsecure/service/vertrauen/De_de/2019-03/
https://qualityansweringservice.com/icon/sendincsec/support/verif/En/201903/
https://senteca.com/wp-content/plugins/js_composer/sendinc/support/nachpr/De/03-2019/

```
#### Epoch 2 Document/Downloader links seen for 03/18/19 ####
```

http://0dzs.comicfishing.com/wp-content/v41s-2a0k63-neor/
http://108studija.lt/wp-includes/xng9p-eb7oy-yoynb/
http://10x.circlesphere.co/wp-includes/o0ki-dho05-gwdmqhehy/
http://12-greatest-today.world/wp-content/dm97-kmkt8-ghysguze/
http://16morningdoveestate.com/wp-includes/xz4xj-jjpsj3-rkgji/
http://2000miles.com.ph/wp-admin/aaxl-6yhg8y-ynrgtk/
http://2013.kaunasphoto.com/wp-content/txz0-68ta7-nfxp/
http://35.171.174.52/wp-admin/pjfzg-wocqk-vpasso/
http://3dcentral.hu/wp-includes/vmbq-nbu1i-vrkey/
http://46.29.96.96/wp-includes/3l567-6zno6-loez/
http://accessreal.i-sprint.com/wp-admin/ovyc9-lih7o-dvxhbtb/
http://adafitz.de/wp-admin/wjy5-f64u0-eoupgiee/
http://adaletbagdu.com/wp-admin/41p86-txjlc-pplfunumx/
http://admiaf.com.br/stats/al78w-ut7n9-pywkpjy/
http://aestheticsmedicaltraininguk.co.uk/wp-admin/7818-xdotj-zhfovexx/
http://aggrbandhusewa.com/profiletoday28march/nh6g9-03scp2-uzhkbp/
http://agilitygenesis.com/wp-content/8ct91-v8734-sfjarg/
http://albayrakyalcin.com/wp-admin/9qirj-6th42s-sfkuilfo/
http://aldurragroup.com/tkeylei/gxa9-vuql9z-ervhlo/
http://almasoodi.com.pk/almasoodi/0vc5-6lu5l0-janr/
http://bobby.hkisl.net/cgi-bin/ykdsh-37hql-ykcygw/
http://christyscottage.com/mailscanner/images/s5c0m-wgyma-mlichefld/
http://dda.co.ir/wp-snapshots/igc7i-h00yrw-dlsmuewj/
http://dda.co.ir/wp-snapshots/upeyg-4co203-hwxzeoin/
http://drpradeepupadhayaya.com.np/osticket/xhz37-fff7sy-iaecwp/
http://firstmnd.com/wp/wp-content/zpo19-jpgti-pvbudmm/
http://jasakonveksisemarang.com/wp-includes/lf2ao-3ymc2-qshahpdcz/
http://jmduarte.com/wp-admin/4gqt-og9dd-iyklzq/
http://jofox.nl/stream/esj7-qaaewz-rshzxvb/
http://jslink.com.vn/wp-admin/xlwr-2y19b-dhmhpy/
http://kamir.es/controllers/1smy-eb5gia-avwpwuyo/
http://kelp4less.com/wp-includes/fp3ak-0zi3gf-okpeyydff/
http://kianse.ir/svsvbk/6urfs-9oa387-egez/
http://kianse.ir/svsvbk/ctmb-hy04ov-wimlpinsf/
http://lalaparadise.com/ponytale/sdt3-bwf8p9-kowjwnd/
http://lasercow.co.uk/6202HR/cvs2q-oiybe-vdczqei/
http://layoutd.net/css/5sl1-2abwa7-rvkhlyd/
http://libtech.com.au/wp-content/uploads/2016/07/6ou1u-9d9160-lqaawrpyn/
http://makson.co.in/Admin/7j1u6-543u6o-nrpuvqd/
http://mangaml.com/jdownloader/scripts/pyload_stop/88gq-fsfqb-akuqf/
http://manorviews.co.nz/cgi-bin/sgr69-wxcbiy-nehevywc/
http://martinamasaze.cz/modules/jrxu-g557l-tduecplkh/
http://matefactor.com/go/v7a3-m4u28-pxopjhgq/
http://mcbeth.com.au/nick.mcbeth.com.au/gl6m-82eyl-cqeapcqk/
http://mejpy.com/wp/mgpmm-f9ngh-rchddekjg/
http://menisija.si/wp-content/uploads/9l1a-lj29s8-rbklnri/
http://mireiatorrent.com/wp-includes/hev4-xkfct-yymf/
http://mktfan.com/admin/ch2e0-qu0u1c-hdfuvv/
http://multiesfera.com/wp-content/7ivqe-3s0ht-ucui/
http://multimix.hu/angol/vqww-bh73tg-eyeq/
http://naturathome.be/sws4tl7/axt66-6ro1v5-nlteaf/
http://odkdesigns.com/vsawja3/qkd2-k8nnl-qsuqwv/
http://onlinelab.dk/7mobw-hnwi83-heuixzh/
http://ooshdesign.com/cgi-bin/l78b-hvitys-deml/
http://opequenoprincipe.com/pdf_pages_lepetitprince/f0h5s-au2k1-lzcwh/
http://orawskiewyrko.pl/wp-includes/arl0-rs6hl-gjzgkupd/
http://papaya.ne.jp/tools/1zja-r5ta4x-dbaq/
http://paramos.info/8wqx-lgeew0-otyu/
http://parbio.es/wp-content/yzij-wjq12p-lyezo/
http://pasb.my/blog/mj0b8-xxcv4u-bktoxy/
http://pequenosgrandesnegocios.pt/wp/8qeuk-09lhm-tleosofa/
http://plugnstage.com/logo/39gsw-15n5s5-ftrk/
http://ppryt-architect.com/wp-content/249c-mfvl2l-zifzbkwup/
http://profilegeomatics.ca/rvsincludefile/c5oa-cz0j9y-akatvoo/
http://property-in-vietnam.com/cgi-bin/326h-qj999-jgifaa/
http://qlstandard.com.mx/docs/mckr-pmznym-dxziqsf/
http://radiosul.net/wp/wp-content/gttp-1tyx24-rqum/
http://riccocard.com/test/ktsgi-yhl00-rhzoxcp/
http://roxhospedagem.com.br/chatonline2/gmim-r1isxu-pwpn/
http://sag.ceo/wp-content/caqq-woagy-jbod/
http://sdiamonds.co.il/wp-content/6s0z-2bhxz-wmop/
http://songlinhtran.vn/OosCQKy7/e3gkz-ie1n8u-mtiac/
http://successexpert.pt/282vjnt/10ze-curkbn-vehhyd/
http://svenahrens.nl/InBus/nk3d-v2iuk-mmmsa/
http://symbiflo.com/PJ2015/9653-7dnwzg-jlapv/
http://tabb.ro/images/shnql-f157br-faijegdsh/
http://tacticsco.com/Dev3/f8oxo-iy8w9a-rbflybxma/
http://takapi.info/ww4w/rknf-goaokx-avdo/
http://tammytpa.nl/js/mc2w-2eeen-icunckzu/
http://taulen.org/diverse/3zk8v-9zy9us-xdusyazb/
http://tecniset.cat/docs/h81j-d58gia-rtkctolpt/
http://teknotown.com/wp-admin/pomev-r93mc-uaietnc/
http://ten.fte.rmuti.ac.th/wp-content/puip-9m9axq-fjqn/
http://terbeest.nl/Maildir/9q2ud-3kqgus-mzyh/
http://thecoldfront.com/smf/ehym-3o09f-cwldbmzu/
http://thehangout.com.au/wp-content/98zz-zp9hf-bfcbqc/
http://themar.com.br/wp-includes/p60c-7fiys-lyyzrj/
http://thepickledcarrot.ca/wp/bttob-5u1h48-syli/
http://theshowzone.com/dzXTs-oS3jd_aAKpXSCGI-Mo/1o0g-rdqm6-rzanv/
http://thinkresearchinc.com/rvn/gtvd4-cl0yod-nzdpolzn/
http://timdudley.net/roadtrip/qzs3h-i2y8ao-nrlhtrv/
http://tongdaigroup.com/bill/k8dsw-jzz6q2-himzbkr/
http://topgas.co.th/lthJk-9l1PUQnCptcE7D_OXJdrcYg-yCU/nwod-kfas5-hzec/
http://tosekara.com/wp-admin/te4u-hlmy8-hyrfplkzr/
http://tours.ba/wp-content/7k9je-2y6mv-nucmika/
http://tr.capers.co/xjoma8v/8ui0h-alyt4-mlwlgecsm/
http://traffikmedia.co.uk/images/mir7-xu61j0-rlcdtvpak/
http://traviscons.com/_borders/crhm-mwyim-fvzcfv/
http://trusticar.lt/cgi-bin/1nzj-rq5ji2-ehimjd/
http://tubbzmix.com/p69a6-z9i21-fdiwfb/
http://twicebakedauburn.com/mv1e7kj/6447-6nmuv-xxqnzzfk/
http://upgradeyourbrowser.org/fs2mvmj/wzdl6-2zmd9-uyxueb/
http://uscsigorta.com/wordpress/k6kil-4rpky-ztxlgftek/
http://walkbrain.com/sqikpdt/hlcwt-h7nbj-sdbvisv/
http://waqf.sa/wordpress/p25i-63jdd-monhkzwsp/
http://wdt.co.il/wp-includes/3pik-wwsfea-zkflfo/
http://webforchurch.com/wp-content/zfxt-bym1z-royj/
http://webzine.jejuhub.org/wp-content/uploads/ria30-x31stl-starwqoig/
http://wedliny-zmtrzebownisko.big07.pl/wp-admin/ct13-9rg9i0-cwfq/
http://wingfo.com/wp-content/ywnc0-x4l5eo-wyoi/
http://wintergames.lt/wp-admin/e7wyx-b7h6g-dydnnj/
http://wismartrading.com/dup-installer/9lf4-n5zch3-ljjksniuk/
http://workforcesolutions.org.uk/calendar/pg5ap-0p934-hwxgdwxl/
http://www.01e2.com/wp-admin/3jjc-we879a-lrffikd/
http://www.hurrican.sk/img/z6ca-2oxby-dplnxwuef/
http://www.xseel.com/kbzo0dq/65uxw-gfc2bh-dgpixty/
http://www.zoha.farosur.com.ar/wp-admin/3d63q-mp8k9i-jiuqcdkzj/
http://xsoft.tomsk.ru/kdlkxl/tmnla-cx7p5k-frukf/
http://yaelduval.com/1dyipxc/i1fuc-v4942e-rvzjdqj/
http://yesgt.ir/mnpas/bf78-2atkv-elqchp/
http://zakatandsadaqat.org.ng/wp-includes/e727u-m1ntd0-kfvvu/
https://buckinghamandlloyds.com/wp-admin/70fyp-wm3a0-tvsailnle/
https://euforikoi.xyz/application/2s2ar-n42xb-dblv/
https://fbufz.xyz/f7rm-92c6yv-hzcm/
https://gilsanbus.com/wp-includes/bddmt-ut3oid-gqcs/
https://inclusao.enap.gov.br/wp-content/uploads/8u6mc-92ntf-neywptrl/
https://kebulak.com/puppies/58azf-a49vh9-smtzg/
https://smartjusticeaz.org/wp-content/jq94-3ouyb-xoug/
https://tapchicaythuoc.com/cgi-bin/8ju1n-dwcs2-ptsbe/
https://taynguyen.dulichvietnam.com.vn/wp-includes/Requests/Cookie/sudden.conf/3wegk-ev844s-gnqom/
https://ten.fte.rmuti.ac.th/wp-content/puip-9m9axq-fjqn/
https://travelpoint.de/wp-admin/5qz1b-1s450-nqdfgxqoa/
https://twicebakedauburn.com/mv1e7kj/6447-6nmuv-xxqnzzfk/
https://utit.vn/wp-includes/jtir-wz19br-imgha/
https://vrfantasy.gallery/wp-admin/3b7s-o0eus-aiui/
https://wiratamaenergi.com/ytpu2jy/isme-z16or0-wvgzxickz/
https://www.clarityit.com/wp/hnfb-9y5o2g-nhaucg/
https://www.esteticabiobel.es/njcdqgd/1iyh-pe0n0-atmryswws/
https://www.imageia.co.il/wp-admin/gqedx-tync4-sasjdosuw/
https://www.udhaiyamdhall.com/images/9lb6-471z9p-mdevdyz/
https://wzydw.com/wp-content/uploads/3u3s-6ktvp-iikfc/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-18 18:01:00 (DOC Based - ENG - 365 Blue Box)
SHA256:
dab034059a83468bfc31ad7ca57ec3a59f8084e2885efe7ea8e7a9ca53fe2c6e
7c7ddd7bd3762fb34953fe5b8ba0a6de4a373549abb6b1eab3f7fb7890c7f279
b3d903a3abf09e58721272639397be9d9eb94059dd71570deca272d54f34b83c
43ed94269915c937be28ef593103436bd2efa2b2c16beed1d225e3ca9ac15a5c
04bc07b69f3958f3459e5f6e243255c41d09e641e4a55817620edbf49f3b05ff
a6f948d2005cf699785d65d684c6bee1964b356e19bb4420ece4e853f4673b8d
8619a01621efb74f95cba674c037d15cdd144aa3c008e16cd993e90f7e977af9
c0a59b36bc868bf5b23e2d0b55655b97825bfa8c5dc82605245743d2347da538
e0410e3337a2ba7d27f6753a11fda15d784ef8ba220747d5419dba72b9efebbf
e31e15dbe65601f18a7a67489073f15c8ca70354733834440f05e39f7ff62917
7d1e0078cd3d171100cfd73644f1082fb7244d21f88121b0e973815021d74d56
263de8755df1727b4e5777ae9fbafad6fb063ddd9484398f596db4c45d447695
4c17af7259701cb558b156c6d4f076cb8fcbbff63316a8c62f61adb985afb4cf
6ace4ee9311aa4a72313b6d50e95368fac68865d1c5d076aa8b091d9327b2bad
eacc33169dedf58f1b792a3638f42d1909d2b2e6418c80f54ffb41f8fc982744
2101068e2d2fee9f0c699a0590563cf71fb3b4d75cd3734e41c4c2c1392dd19c
640ef5e5299efc9a279f96620a7013c0dd41cfa1e8196f2beb146c94cfa070b6
3478951f5f6a4f0ff13aacb3548d26adf1fd0cad29ae42befb5f4532c1182640
b1f8a0c4da431fb4315ede601875ca026ed95aa6123d7cfb33991615c372307a
d31c266bbb5ca7fdf75a87bb226657f5b6a5b06d5e819c9c55594d723809e709
1ebbfc92cffd783e8a5ecec272f6018808a0221c76f662d1e90740b61f2cfc19

https://www.hk026.com/2zsjmbk/wffC/
https://www.handbuiltapps.com/rcfbi/HM4l/
http://www.cbmagency.com/wp-content/GpXbVu/
http://larissapharma.com/fobn/LAwc/
http://georgekiser.com/test/QtX/

Creation Time	2019-03-18 11:29:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
94da822b78da4156a1fee69f4549e5e7e9ba18198909225192c9216990f50240
c4d01417ffc72b42371ec7770f69167aba63564388af3e987814ff2aefd80f89
faf68d93bbb1d0c351ced73c551b2ab3f997c21831873908c2d96fc70d7e0606
1c0dab7b7fb1e9e249f5a5646522c02ce268c7db4d309ab585bf615bd72d04c2
8b6291698866b05f7f9106a887b462f4c51c6364efa2ca97fd5a312028b2aeb1
1aa549cfa375e69f5bc4ace30019978683d1450ff7c248e32259c7735693d3ef
77d3c28f0f2a5186cdfaf7e287959a46fd140f278cfff116eaf3a2a1d5ae71c9
0dd9cf4c246cfb4de5d12d45fca7b336eb0cb8e4d3a58b74649df0c41aca0c43
ca5ce0b3d48fe7c9291b1a4b48167ef3ba6f7ddb881bff53ed642fe703d1da9b
e21104042d79b8f84efda3e1d697661879af43f1c592f92997a249d46faa91f2
e64ad24509916e8c78e968f00e1c0de3543bb89854954bd9e6d9b50ee998c45d
75bf0e2e8074015b017f2eeb0a71adc5b9d1dded3526a131e4b06c6a34af4092
9833e01807af6a2f74e6a094616b1d3837ef9d8e036d2fe67fc890ff187f2a64
389c151d986f0886a4ab8f2ed40b7a4ccf87d70acebf908c1addb0281976f495
d1af8a8cf0c0cb042df4676741967b3b360aa4e8d8a6169b5ebe03281b41682a
c7722c91bfdabfed8ff9c2b1ca28d420737e9fae85586416203fef37b85e3576
663a9aff53ecc08c402fffdd4a2850819cc9fdf504a10740a149c242c5825aa6
8a6a17b3c69dfb1c1ef3b6412aeb31febe39336f5e35da41b075d807bc52f563
5059c55ff213ac0f55b4ed2aa4118d6c73456ca969bd315cb13b0ab6a3eefce7
6b3841da5ca9b5d65ddcf16340f9e0e2966ccb982c46d9447657c25bf1add269
377e5f9f68b5adc05be6930fdadaee6618121b6eb791c6bf553a876672e98816
fcb96925bff14801fb70ac9d1ff9ad13c7deaa8eb60576016331bba48d04ea25
3874d50d6a006663aeaa6ecc1951549fe68ca2a22689fd1d5946490a8c186f70
20518f8bccb15c5f7842ab3dbcdbfab106863dd3ac167072e7a9333305932088
1149f0045253447ae20c5050ae4f604b3484cf720cd5366977369a69b668b33a
d73428cc2c2fc72cd03c415892912931854d545cca04306790cbe28526510aca
32733e35c742a2729b0200feb35198b350a3f09b7d7ffd56a88109241bf0a7cb
e96430759c7dcdc277bfa26acd5920d65c782a887cda7f9140724e8c4ac39341
f55627f9962eacd4cb16055012e0f4c8811672035b7554ec0364237ae1cb2f09
0aa4b8a2de3377cb218eae1b49f25b031a1e7aec63e014da4f4c3accd535ecbb
14cdc1e22333ba3425a6e2b28f59bde66890bb92091c9e00eeb8936e4c0144f2
df724ae365ad0ef23616a0cad3ca9c11b4976e1b0fdd83b203e441ea94d31e0f
5517176c7e3ee8c9604d69ada05c11e59028145e80027e0c54fa6f0be616b359
594147bf1f0325556bf2ba0edb212b5cde3677de48f8030f1e19adc8c7ef3c74
d792c4624b847286ea73ef5ab21d1a7df19f8af3ba105ca3a4077d59d05b9e93
8c2f674451b0a869403914a439f8c88a7db7c877fcbd6f46bcc3b0bfc07c59ab
ed93d02d7fd469be86563680732d860933ba99db636553b814b9d6ff7f617b47
a12b367ed107480d79cea4ebf70f9d18d0bff72223a13ff86c5bccf3fcfc7b6d

https://ksoncrossfit.com/rylawpc/AI/
http://weisbergweb.com/lxPU-3j60nDONL_Sy-66/X0RSz/
http://akashicinsights.com/absolute_abundance_files/6zqv/
http://ayodhyatrade.com/ww4w/f523d/
http://tom11.com/blog/0E/

Creation Time	2019-03-18 07:06:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
e1d3bedac0445e8a53e7285332c9aebe9f2ea85b85bfd50b2b2cd2bcc4e405e0
cf3014384a63f552321a3061bdfee63ac067ae53724019c73dd8cd4719c7fc90
51f42f597ab1706bb031e913b0e2a8020b59bd83f5d5649f7e4941bddee2cd97
75f534530ecef0638bc57fe3f208eabacbbd8ccceb0b17a19f24924781209461
4f1c7753bb5ec83636b53539a58fb53162adf927cb86c932dd8d0791a75a41da
a3d7df77b65b3789dade49ba2a8ce1bdcc175a1a2f2ea5167c112773741e11f8
9a5777173c93bbf4a4ded4650392b7b187c1f82d8067097165132ffff1b55aa4
4b31f26642b52c9e1bd9b552136dcd7c52f332c728aae13eb643765ea72e6fdb
84bc7d0c106becacf79a44cf7afab03c2207934e80ab54a6a27f44abfb107543
23af8e178e773c8839fb8da68fc2459cd9a3fd782ebbc89d1875fa88e6048ede
e27759870cfc6efd494ddc70fc196b46568b3be8b66974ef9099453e9f517b5a
4b31f26642b52c9e1bd9b552136dcd7c52f332c728aae13eb643765ea72e6fdb
60c54abfb5e24857cf6dd52eb40820aaaaf569a928420103298b0a6b696dfc83
579a07499718f461e31f580afaf933ebbde3551c7cd8b7829d70f75b696df770
2919076c871c7d2820861e7ca5c63e7cd10468094c93f65e66bd1484d12a62e7
2e410c7d2323a5ef0b41ecb249be3558e294762ac334035fda5beb67594122da
fc7ca1dd61f23711e79796f5ccdd83f1bbf393321a949e97b766727ca7a6d0e8
2f9b4e42bbf4457c86dee511119d375dbb5f82c388cfa97cf79da40009aef754
dc9980dd106c39d1dce95d141595030fec2ff88ebf80cf13bdadbfc68ceba6ab
fc7ca1dd61f23711e79796f5ccdd83f1bbf393321a949e97b766727ca7a6d0e8
6d8f3464696f0f91eaba99760b2812a7172ec1f6c4e2664c7ebf7a26ee585cb4
ac267adf29174f56d684186310c9fb9b23559a9ecb8cb9493e49ba4de7b86a59
90541beccc687957d805a3f64f83b05fa14c1e4bfa53d52e22a3ebe6edbbd3b9

http://www.donghuongkiengiang.com/wp-admin/lMV/
http://parii.com/wp-content/iSkGD/
http://pdsconsulting.com/blogs/55pQu/
https://bashheal.com/eymakax/HrsO2/
http://basr.sunrisetheme.com/database/I6/


Creation Time	2019-03-15 21:12:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
176fc8d7c9b766558643e303d26923c6fa2986729865aacc86f3221f2c97f05e
321803fc2fe67c1970f91ef6d946c027bce814014127b61ab283ecf3af660fdd
94783c6c7bbe2bb28eecacd6995495f57d8a115804d88ec8659f779239cedf5c
379e9857bb740f4443cf3ec144d39eb6108d6d30bd939b6cbc68461d45aec375
0dfad534e04f382f2667cf75ce6f6a3e6e87c0445906925cc9f4a57549f8a1b2
9408cc0de182ed99662b1f336072eede213cae1fd2173169dc4d264a2ab0909f
599090f793d1f4752439e670affdba99777d930827e733c05bff4529d0dc1676
3826137a54e6d54a11fd3abc91ccf1f6a8ebe5fb97249b9acc1b78743e7fd2b6
50b6a072ba9d674f974bf4b63a71c7d4a5edf2aa45c1274e565f1661e647a7ad
c2fafdea65121542a5eaabc866c357056578622b9ad35c5eec9d6b1f0a0e32cc
7a0c1e98b6cd1ab15de3a02fcbf9109fc0ef60f5782542ce0a4fcde9e97e0510
12b3278ea6bd4f0d1871972ef70f8fa85ff57eaee913cd0623839839ac3a637c
06b4ce2f7e662c39b5bdbe3e0259274068eec935a4c94f7f14894253665b1db3
20a89df1a440432d35bac1fcd2a355dcef0e3a586180710669076e58b4c3c5aa
f02e6224c6abab128890cb86360afa3503ae97f368223ee0a55f0fa90e412152
4b44321c887786e399d73cfdeb6a1f44dfc3b6820f412324933af3e1a4470a24
d92dcadbddefbfb244f1f8b98b642fc25769f48a7ddca9cf2717ab7535ef3179
2d01980c4cec30b55dc47ff3b9b720cce20cf2dc3f49bfaac6aa141ca6e6a815
342001d88dd249354eaac47693ee4704bd736b6ab253e430e01d9b16968757bb
379f56b94f4d9a3fcfff535e6352579e2a097487512f5e708ca637abb3b9a3fb
f973bf6429cd7f943327f693d3b924b7d8f205a063e82afb324704c3656c7f0a
bb12c614eace8d4d7b8189aac27d2abb3bebd376443720f019a4e0c2b889d9ce
b8171f79b97106f4d8cb7e4973f925dc682390842ab386b8182ab58591fad50f
3dbd2c570a9fefab5ae5423b4a1e4ee2e5880690db9d44a85e76352e07b2421e
5aca51ef3565dd63e6996f2e650a9d4474f75f3a3bd63839ad1039d7df86fdd8
d5045f79618588abf0f79ca1aecd5e75e586453da66a54efc266df943852d44f
caa997dccfc927ee5acb725c817c195fada447bcc8ff13c55322bcc0fb752597
c3ea24f00b1c7d19ab9a5950fca634cc48472ef956529aa76fd97e5bb3acedc0
b542e1dcee9bd6b5f6e568ab45e96067c823d00510b6e557f2ac138d3ef0ba70
c6717315ad9667ac4b93634a72cbff6e9e743d617abbce289c3e2e5845bdbea5
72f4edd6d9a0d0f97af9d60ae15fe29fa3fb47a36b8a431004868e875192699f
8835c4045c9d6fbd9e4ea35529a3ab434369458feab327a7d08ed878cc6f5925
db1f563cabfd7405cff597ebeee4662d500ba0efc17e682de0938ac6db6cf9a0
45ba1e45fb0948ba35f375a0260815114972d5d9cbcd93ce3c9df8e00b039c49
a203b6af59485d57d4530f2ba99f787233466005eef20da05b17976311370e2f
661530f5346e05fee9521e2c3925a1b75ff9512f9fbe4f3818a256b0dbfea830
5c77f3a493cabe60afa8403288fd2cf521c373dbf286aa4299d5195a602161ba
60683e4d53f06d4fa4501753e6fc6068adce1da7e23903635406e85bbd299607
c4fbe1560255335c1841233e59cb2311a29a0c8e9fa048e5b9c17d63229a9af2
bcd76cfbb19148316273e9474206fc37f92a3359838a63c6898368ced0ba3fcc
fca65dab5ad7ecf95f0fd270155481011075e57d39fd72c0c651565dfd570483
a5509b36a9b9f001b6ec7abf32474ea8f71e3d79df8567e19b2bb3b30009deee

http://mrpiratz.com/wp-admin/u7/
http://wonderfulbrandss.com/wp-content/ZuEO0/
http://opequenoprincipe.com/pdf_pages_lepetitprince/fA/
http://outpoststudios.com/doteasy-under-construction/EbH5/
http://tranhcanvas.top/wp-includes/Vm7Vb/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 03/16-18/19 ####
```

28d770293b31f7dace1fd48c528f98add1db625d623a405105efa48b7e004855
aafcd24d4b0056a8553d0007028d5125c7c371cca63eb70812616823c5f288f2
e64c507cd2bc0ee7e5c113a84df35e0f55d9a39a13ba96b46c0f08a97fb35da8
a1782d882bb92c45836dd2899ca0d15fbe041c6f128159fb2312cfc35e098378
1b7174aabd726dd3c25c06c12b56bf53026ce534e059c9cd131c844a3d06b2f0
cf07ae364b2bd546cd59ad050797662256019d29ce9a121c2df9fd9450ef9c22
4dbf100c2c81c92cbcb601fad11009794adb59a3c4be18bf304b8f1e820e6c99
5204d3db69ce6800ee64f9ba3b616302a5ff913329bbdd119414872eab58a00a
afb81a8982194c2404818b3871e8bf4a21f49e437ac1caad9d8925cd492717af
86ce01908cc043e70bf020658faf19ab6985dbe1f001f77e94cd5fdb8f7e7c18
bc6d180652c721e052a2341a65e20af74cc960fff0177d94018a315095ef913c
e0397084e97daec48855191866058fe4656db97f600af3bc382bc99467a2963d
73c5e8d0db51b719d7347f33f7c3c6bc6e0bf5db5c8d723400da9540af371761
75a36819f8e6df08eafc78cc6cd8279e13d8502531ef15d27b15eb0e78e8b9c7
ccb47a52721669c6f3a13c83024f80eca56f4ce82df65a7d5db36db9ad1f4645
5f2c6c33e049d7027a277c5b3e637e15953b8a0715b17a064c30a0aa3c233d11
3ea94eeddf982f011b0e6971df85df7e21a698256b9d18a8cb2725f99d483d9d
16b7fa76cb7193f55d2e8eb09ffdc583d64ba198b2ef09d1f036284474c29939
d3a0878ca16277e2b2e071da74f0ca5230f2e44c1290fc5f2cab23a0b6dd8c82
ddabd7a338f45bf438e7e92a793276affde2e5d772b4436f7251739697d718c2
a0c7ead22cef0061bcb485fb57225d40e69bdcc1c3f759cc69cd070340012e7d
db21070f168225ef84ba01a34ad82850bcfef573205520fccee46e44b443c7f1
02f66dc132a80ce953ebe46fd7a2552b0f0f69916d2cc46e534f53f60948d1d0
ed38f33b6bd881a5ba0813e7226d18c2828e6fd1f0b54a6f77f12a903f3557d9
f64fdaae249985d99408516ed250c08169aa95bca9b0368ad4d2ff018acc1eb5
5f4f0d3b0127938843f6f19bc8c2ecba53bae328e1380b678a1a17d02b759cbb
3456b7e3b90c73cc1967a185da1d179c4b41b45829d156d1a6634f585f2c52a7
870eccba891517c9f26b93f13306bc5b405a4989f74676e96db92b72e3e554c9
66af0e6fdbf370d7e2b93cbd564367653b1223e3141591338518f29244111c46
86ce4113be3dc8931a862a50e72f4d0011fe501c0a7a85da66f60ee2c3ad2493
b59e9f6f144a6e6d763f5b87adc02c876d425438d72fd116cf89ebab66178ca2
08a6aebde6dcd72315862865c725ece1351749e8725cdbe335bc67ac390841c8
fd56f7262e163f84815f709de8e95604da53fc50cc838ada7132427948f93506
4d619c288e02a0427a0437d67f6c3b1abb06458ed2c3f6a37f3454a1c9b8cff1
dfaeb74049ecb876852a3681c0990b3beaf8b1198fa920cd52f9e9a6feb7a434
2c45e5a30bdb789125dd9331e056148266a1df14ecbf463fdb4a9bf42980ffc5
b172761dd5d6e9b8a42e14b86e630b00417923570290371687f724d02a87d07d
e956894e8a1a414b8eef875b7ae1c7e3b0a72ea82ebd93c8b0750422cd34ee8b
8b2d4dbe8e7c37c61f987472eac51ec3e8eb12f9fdf322c0ff50c649d8b1ea50
e6a7a25ca2f3ab862d87b4d60af700b06d9f8f81b95c860120e656efc9fd99da
ee04da1f2fc02ccfccdc534f1a43fdca8a985849923fdc59c36bd473081821bf
232a6f842d78973b126ae7102e3ed5ac56604081e39adc5c6452570b8c7f84eb
d3ee270a9f3ed4ecbf680465d4c77bac834a74b926906ba3e42c66202ce9a345
73642616a2741789dd2e8a4073b2f49fe489c4a5d944f337adcb9a50b405c382
1d7b2aa578a7595bf6f808868b5c137e2cedce1ef9de3094c316ac9fbabd294d
c67836c8df110310db9d146d9520cf85a14a40008c3ee3a5afcb0df892ebb96c
8d0d4ee4c8ea7300a00a5f1a1041e8867cae17976edb360eb4537db7c3568e8a
85b63887368946d4db76d073c6cc8d668a370b20086c2b85d446b62483debf68
02ef5de392a0da7efd00fcd97527bb7eb253b8790dd0d60779165c1d102f207d
ab602401c64c8041ab60904d30c493876ee2d59f991e556e0f3abe0430ae68ef
fa66e5cd4e9df411fead74cd0e261d60d6fd1908f119815feb0d51c3b0aa2f4d
6d31a66c9ceee20db666f3f9306441ccf134dbe23c5d4e2ff6d2109e70622b97
5c33b37a7625f73e5fed6a04152687cc94d3895e237b5c0c1623fb0a853715d3
f341288b495f2e2b71d9fdce2b79c7387a9286792d96c783912900bae570e01f
b7a41d66fc8ffb95e7b9fbdc0e78103dde607e99d2d403a4043c067a63742ae3
7f0479ec2659a98bfb4275f691be2e9f5164fc54a3789a92f501b0514c7bc061
4f604b83abea7c2f496e59c3adbb2ce1024c25ccccd56e7c5591042458a0fe9f
6e01ace6771402c016a9f98da700a9608ffac190fcc70b5b37df6b5037b34d69
1ff2e6efdf034dcd20feccb6fc2651825b7084e3487e8251392d778d1359f011
fdef491567df73edc34690dbd4f94529e1a57d327d0598d51f9e432ffd358b82
dd863de1fce119de5930b711e3ddfbbbe7fc370a2e8ee4fd73f75bf8669cbc7d
2dd672c532ef7d33cc88a422cebc66ea4a5b27dddf557acf9680cdc569f7aa39
64752b10d1ddb29cb0c58815b60cc60434fcb07681f17212375feb2ea2ac3225
879ff294c18db04a8f393598e55474309785c06e05f32b05c4dfe3768d5e2f03
75c860a1d9ee67bbf04b1e402830bc29e7bcd0a9b8f9a1b22cf09196740dedb7
6fb037c2677eeb30688faf8a8b496705353cec4eff9c38f35c30d71fd4de4407
f322921eeaa8f8c7545d00c4c16c8b732ae9427d8a22069f94428f6d50f7a595
66530fb1001b4900fff069048c34c643cc523e6402899cf995c24bf03094cc09
64a7ec77dab4ca625768ce6b354648150a11ce6f4ac1bae6f7fc404e6c054128
7eee9e4395690107b342c8130152b96510962467a98a6a7a5b158425dda50e2c
93c92744646a6a9ab72091d4fc3c11d76488a43b2dc0633a76f49e4cd2a864d8
45d8ddabacb9976d985b2f35fff66feea61178700162733a3e45b653c48d7fe3
5c25b333db34f1176628a9095ad218c3f3af02ff2799e4e7705ea631e1a2e8f4
a70735ac0a75e543bead5f03c8954a97f0970d315fa24ff0d81260c24f1a9e03
76e85fa5edf4aaa16ecddc890d3ca5b936c6330de0ef86bf7cb082273ebc6058
1cd869b103e376248775c02e605bffea0c6c2f9f3d877409e81f11bc526b522d
ed5b73a353e50eddfbb4562ecd902466ef45c5dfc8bdb448de0681a10838f636
0109598b7c36933163f2ba250f78e441ac257a6f408411c9b4c9683a840b0ae4
e51622154ecdfd87b2fded4bf861a847e2cb22b616c507edc93549c6e9ac8fad
17e01b06c2e591fca92406c6e5f8c407070ebee532c2be905e5d9b16cee1bbfd
18cd3eeafe63064084f68d8fa8e34210dba5ddec8bdbc2db8e2c38315f1c2c0d
9cb244603fb6b88ba3528500ee26a88428e8f93e7f761fe264b6bc1284a08d74
dd3618fa8534ce6ab48e86d78216e0b3ab0e3049bad2d006faad5f79eaf351ff
5f153b85869222c68c23f02150f4463a285b75a83c60b6fa667ed5ea2760f235
13b73255e4fc3094839b7168b1d8c821f595d8efb3fcbfd8ae200a1330f188aa
aaa3fa5a07723ef62452fb2adba23bf8338e0bf3e225745f6ca55ee3f14e82ef
67d99da01575a87849ecd4bfa4c80ba0610ca0a7c88ceb907a701a309fd6fc04
f0b4c7d7a9c98f9505e99921afa28f51f564c993ba994262093e6894e414b576
64af53b65fb758a44d2d5ccf92af8be3283877a897b9b5c3410aec4137c22c67
1a5115c1dadbc358b5985532e3cb1429bf72901175335a79eb5f0277f6496fdd
79910e46d1f3c44e259f047ff43f2e8f65b577fea6ccf242d47e949591f28a87
7965183dfccc0fb071e54ca62abb313353c38fab46faf1510dc441e9b97b44ce
316b1f19f0d294ff1f1453cab1a5c898e9e349e24c919bd81782b5d6f73100c5
fc11aa817f699400da5cab637c38f26171ed43459b26112c74e396084aa71706
207ab81f13765e8d4b8e35946e65b4604548e628d439ef47c88ab731dba4fef2
198965f5ed2adfe7adadb96c7fa36ff1cea5820967b1173fd349f9e30f727069
4585f4f6a0bf82914c70d0cc3948b4ed8a476ee6e7c20af8916a23728782a707
18f1b773ffce5ce9d74ae75a817cad1bb8ccac5e085e2eaea5469dd90c2cde29
3810580406e4a035ccfb2d3f0b3b6187933b4963a434df0b9671ff54a0864854
070fce5d66a20efd031e792b991472eba39a9cd4eb030b25d54e29b870163c19
36567f2770bea34e4d9cc1206bb667ab48d3f376201efbd3668a407b947125cd
5e323db92742f4c1ec61f80071cc05b5941000b803edc762fc34604a8b6773a9
f5428404ed471a0d886124e66b52ae78f30eef56aa801037b316b8c7fc341294
39c1b1337aee80acbb538544b8cebc54a4f1492682bbcb7715717c74e17d7c96
1c8085910daaefa474ca6fe232bcc9c12ff62a729c8efa87a7f55c9805a40c77
2e3d7283e50de4455cce93008bddd99614e384ca266120e0e2341dab2d6561cf
cc03e759ac607b18e6e73cca3b9cb4d42d52a772818ef7dbe2ceed59d0384a6f
50b71d26f9aec9e3f5b4e54a27013249e4d7a0c17b1e3c633eb0462a995944cd
aef873e766b3f3d416c90036d598d6e48b8bd9764f4644216743d63c58667e96
2e54eecd6d3d9658247033918a2d334fcc4d89f53b95e51833ee7089613986ce
9ac20367dfda634d74b410bd1f567018da79058e63f3cd395d6bc651ecbd4901
1a65dbc8e144c390677a71162cc81f9b8f4d07b4a2054ab53627f483c7aa262e
a2a1e8e535fe9da93f06d93a4d26c055e8f8a886a5c354fc72b62c5e95a5ce7e
f6ded7135a34394842e5f095f4d317d77313cb08fbbc4f410bcd53bd36579b95
53c7aef0a7304b587c628c83fa792a28a0979daaf23a2ec52482a76874b9b8a7
6edf09058b1810a63642e8a0228768e3f619af463802cce244d5e5c6d05dc87d
00f95dfe22a1d6c35bbb757fe19b7e7f51bed6c992d9621f93c76c5e8692c9d8
8fa439cea44c016c75ab73046eef15e0c0c3837686daff23cf506433d3d99f0f
d8f7e0943d54b70d1a81e1ba3e435070f291376c7241c4b46eaec7762254ce02
403d4d295b482517007b5c0da1cb52cf76935e74f79fdeab0b67250eb45f9e0d
f66e6ac110f72bc5b9543778239b27cbb05a95c3bfa02197696f6b6f844ccf68
b663aefb4e717b90f0b76f161157b401b8932e285d182a62cee9a41b1abb3ba4
69cde87b87a2e8d3e601a6aeccede30b943c4ae670fc049279eb5272c80a7662
46597ce9b12027e3865151f9ed22d38b7edf4df9bb48539ef88df04e44b509a1
1e51e73ff91d6b92ce8e16489f6d355015cfa5bbc69a691cf758ae53a3049e59
444cd014266ea7828a99c0aae2aa36984a14de02b13a13c5ff35d3dc5362c9ff
df3bd9ef4441b4a46deb282f822e7961c1188b92463a8ab703de95bdd2f2d0c3
4375388003ce13bd286d60a4a21e3e3155f1e592d6d1eacbf275aab51ac2c438
bd54f7db79c9afe282f2aebf588d7a8b1474042c69ad27cdb5acafd0d7240df3
d7f749e6da04b796570eabe51424091f72a096a0945093a5e953793112fface9
118d5fbec6245899f39093fd01e699bae8097a7aae163c118ae8453fd4703006
f53a0f48195a80b74d3c20990c332ab38720247bad6f01ffe55fcdd04491e2aa
aae728ffb953cfcc573c82b63eef7603c9b29c95f42bb032b790d6d51813f7c3
11642de3c30b59a6fae31fd1397853f83ba09c51f0ba5538ff154e5e67121332
12559e6e218d03e4c0f230f17fb10258dfb980442006c2442068aeb9f6688cd7
248f21a6cdab08346c03e3801d03e057b863c8af5d2461bc629e0d3a8f8bd575
67f8d8d2d5c1436610384851392c37b1edb7d93bb83ae9628a4dcc060a6daf31
b12923939bb72c7cf4c63cbf5f0d1ab2f22d366738fbe9c47a4a3a33f571d490
6d7abac6e93f75730772205702e46db48b2545529d80fc922d51797fe4204ad4
888b76107f41224436fd7d87236a6080c9bb48ccf49bb2d95762bcb63a545ae0
0b5faa77fb25137a6f74c6ad4c41fef7d956fb2330a1de6b1e06fc3e2cb49c7e
fe014d8f5a25606f6e281abeb66f2223579c9ae2841e72ceb2aef4e705cf5140
4ee0c65a0526ed18bd752e2f6d10565a71135ed4bb5f66860f18896801a80bd9
721229c04e88982dd7c96839c483123b98ef1b4302e7fc9dcd05706e3d54758f
5dff058d393ed2a78248ff626869d5bfa9f67d65ebfad2ba19769ac4512a23da
d1513bcb2b1ae910a64419e383448a8bfa22212bbb67fdb5b76f3775cc5c6a9d
b7c5bcf2fa26aa7035cf41eb3fa4cf41156c46ba80a6d1b48ec9055ddcdb223e
635dc0d948b74cb45b995de04807eb23c8fee3d6e12e7203c001406cda9deb59
5ac99b49a63a4670e1fed32bc9b89b7f1d9b5b948b89092b8e7b8f9c06b533c7
4d31d4b146d4f24d8211a269f104160a14e45415c03ced0e52648957e958e2ad
f4ab100041b10bd4b93aa5811fba57d26645350eea371b2d4345a0c3f7d866f7
fe9d527e04c0425781151bf9433ef291c448e6fe7ca211bbacd6187c4ab6c57d
481b0c4e448b2403839a320f94777edc28aac4a9b44c72b41ce750559c4bac5c
9da0c1f4915a60fc796e4e3e595fb11ac87833668a3fd1126a578071ee99677b
6c8a5fef40023a54f6cdf132bfb97e403424ef653cd7814ddd0608c73c971166
892bf20c9f542ced69adc4f50b1ce4f91b8bf6680d2773c627859d63c478732e
1b9e1f5e7d838ba68c27b91e359640a7844b3081a8989440f1c1905a6522f4a2
512a3ac6d7e8d0e7c481f5ffc5ae331be3ea398ffed54445857a436d99c78631
4eb113dd1a2fe4e9785b120b82ebf6c035815b98456300fafe4cc6f797cfa52b
814820d744f0f8687b0ce4ecc6f3c498eb5c1f300ed63382f320ef22f8f271d9
d309c1fd25adce42ae749685fd86e377aa0a0959d86a79e565ec3de17b445c79
aaad919df339bd3e0f00ee229b406712cdc3fdb937ad56a861476ed1b25df334
f99109ea33284c9617408b5bd3e27bd47edb0d2467657828459d96d7cefcfedb
4dd2989a0ad22e23989e6e5cbc67d50ba7b26542db3eaa55721f3a2c8cbb70a9
3ca6b02f22e2a522ad5d1901dd7c740b549a147c8f1c713a4731fef8f67b7995
4f3a6dfc85dfc2660738e61f60ab02fa1e751f6d4479a20bead6553c9950ce9b
7f00b920408f38e19ef043b2788cdce4a18674b32855eeb916c85fc0b2716198
cf3c77387a64b02ae8fe346b557fa185e431c53469cb74e82bf68a4ec64f7ddb
c24e7fdecd83cb92f5bfea8ca7305e1a3a03b2e9dcf2a50f93da53c7198a1600
3dc296e3ff010d0c706f8ca41826a32f5e2330fbca46a4379b0adde0088ec15d
d1599cf5de0be7071c7ef28816cfe0503722cdce239038ae17fddcd8066df418
637a841c68375673266382186ddd1371b2f231f3a2f9989508f1814d9945d4b4
0ffc22cc2e5fb0c925a54b3904c9732b44d78f605ab1a230008fde1060ea8c17
7ce3f0c538110cb5994e2c65a186d0bb3e5f6231161894c37ee7a4fe22398af9
e235629e925a308109039031ffb22af2438c923639c77d8a2f907337a9b81543
242324370da0f01c27ce8234450c156b9022c5d35ba00b9a59f24faa2d32e3a5
92a318f59ecab7c961773205fa090ff18367a6cd6362512e436af43ab2325380
d90dd17d677581674c4bb1529417f4b60dbcaffefbbb2b18bdff79eb6aeaf3cd
537ee9d0d3e8f1f362df136dbd193bc651db6cfd254c18ba0db294a98f1daacb
5005d1237ba33181c272e42c259d0e7482abf09bc882081a19ec5eea43f469df
26a4341d8784e19693e05910e48b00e9c17516e9a698885f439a2507d6b0459d
0856ba1ee6caadc8b6bd9e52eee48e9e13fbcff442aed7f014d4979c21a2d8a9
3252277cfd98700ae555b20891ed44adb7adc099515f3ea0688664bf9c9d3554
8ad665c53a1b2c529f01af7cda57f37bfe983961e04089ffe310ab5fc6ccd2a6
78f71b854e7d99dc4272b8fbf68f1a8788af3bb542c8ea20437a0a3eaa07ee08
acbaf65c9b24bd39b6fcffed3a1a016dd5bde0a4eea2718ef07cf91aa2a642aa
4a72255ca70a79aef878b979e7c4d2edaf4c453ed05f373334a2e6c7f7dbd67c
9fdd997067235ad4edc70870badfd6451782622b2830ecc581ea18600636ac20
5398045cd6b4236eb3620ffd33a69c1113ffbb12770105905dd213efda667c90
41baf81afdb409a596eabdb70dfa5e49c8657238e709df4c1a015a32c957b54a
27b49f5fff1484eeb076c327caa4168365c9ad46ec29ba2567068745e899341d
1d089bbd2fe199c5b3c010883af1e3dc9bb4031eba9263ce7e428ddfeae54bdc
8ce493a5e6727e1a636fc86690b81e67b0e0ab092799cdacaf3aa7edd2c7cf8c
6128483050fcfa309a0e70af400ad9037c18906d5fbaf7580f84e340a15afed5
0e2af0480479326d6f341603eed292c26765e6ad7ad1ec5dd8dab60307c19f9e
3b1c532efff947b5b469b662344c35896d810692b7bce765aa976f5212ff3ada
faccb5ee0077cc79a1fa431aa7c79c88821ce9f6b086abf7670f97d6f7a8b5bf
cf97aec2d30490169676d6dae2dd60801938cfca3dba255dc0e8b988498b71ea
9256ce3ec2d7db130d91db775b03ec411e76e9d6d02d404638bcae21298b2501
8ea78439188e28b478fb985bdc03fcc39dc34385de785c5b66ee19433bbae4dd
b017d88907e0995a794480d5e7970dfe64ed09da71c98c4cf421f6f71558eca2
a5884def50008ff2d33243f2e5c9965e32f7dccf319417f3c1fb824f8df286d8
78fe95b2f93f846945697c36b46df96e03ec27db5414d95d2d417cbfda276daa
2f740734281bd605438972e4cab9a6765bf17e66d10145862e68d7855b3c8efa
8de651936329f72653d1aaa8f1153363adb4e3aa6f98c99381145b4c91404fdc
4c263e51074a306e95364191b1bb7fb1870188e2278c0dd68e1010067935c5f3
2a56dc813e0102e51290a1d226170ac2570659fafb53cbc605d919db9f815666
1f262b60b2a75ae13646416ac9d4b3cc794e15efd0fb7f89c5e00cec17ca2b96
07a21447795abd8e5763b2276f5cdb7b13bdd4956e15e61aa378617495f224a4
fdee3b1436d5075df7b5114822781873d2358ea75589b743c03dcb501f4234ad
a9aeaec1fa9d63d9c239495b07ba7aba6527488fd452741f8300ce3ea7220b15
921b272747abe3027813b0d8d91d8f0d11ee06940f6079dfd5d207fdaa754b0c
512ae0ad75cfa9b72ac945b0f91124b3dc7a148f5acde73d975efa44e868f8c0
c0e1b1da3167b0732c183f50750a2fc1b55966b485b07b337853d9ba1d6554b6
266c6cf8204de6f696ae944a428a580fcb18a269f3607d3650cfe340d55ab851
5202091ac3e9478d978169b4aff458e6dbae58e8a04d9cf6df0f6e0f5b3e7d9a
e1401dc1dbaf38ecfaf1a5f30da7f5eb2e5dcd2afa552b06d02c89516388c69c
2f8df5471493c07febd9ba8f03d209fe64492b18f7742e40a7dcff2b54e1f27a
5967d7ada4a4af4acc5df58f182e104edb381320809863c314a067af3604b2a3
3f0b7ac4b85418593d57d1e4d15d918987903fe26cd157ac732b975f8edc15e1
46186ba405fce9d28d8d0ef7292b204542f2b81f79c27a95c4a38d8056f85e5f
1ffed4374908bcae378cd007aadb48b727e62764fac3471bc78b110de8be4e96
2310631452df6004e3dee36c20aabbef7e4abde3f18794526bbc32ce92b5e0b2
e49bf73874da23fe4abb8e84c091447824afc2174bb73465fba98639c29c7811
74e7ef48f33f8cabbd4083424c04a5cfd16883da2b04deff811ba1a5efca5861
84756851c02da750ed26fc5e037c151bcad0e5c72c815d2aa891e88841a0ba70
9bf99c1148ee452bac198a6be5fcbe5776a2420dda181dae6cc50cf3540b1952
9f5927a3244abe57b1e69201118565d2a2ff5b5f50507e76b82a7fa98b45b941
29b5906d2f4157958fb3ebbcc79cb7332ba731c70cb1f3d7862c21b3531af935
8b84d9b15de5d7a636da74bbdda04e3fa0ba04deb32bf207f00dda706d106f31
8b61f00d77cedd603db39135161b0ef84fdf53a00aed9012bab84b6b224bbf4e
7dc05299430a278a3d7f6f3f5cb3912329be70b2cc3646676e52b051604dc732
de5a60bf292b87d85347cc9a882295a2aede1712c284439a387e29a415f57d52
c21bd7ae12a3a4bcf1994f4759ed12ea78b6d8c80d553a195e342cbdf92bf0fa
17996f5c966d27b19990c021eb411058af82e4ad31099914eb19573bf3174828
b7331479079cfac5d48480533051ad11fe369ee1a5d0e449d4c0e70a2e9a9dcc
e9b87604d1a052884544154053de819d6b6c04dd8b3ac931506028bde17327b7
f6463eb5f040d027a1524fae32e1a38b9675ee399fbafcbefdece1b12032548a
3bf78e7214dc929422179a8e82777921858a9bb44099e19fa93977605e212108
49c521a98401cdce4bae619f26313a0631178ade20532d18930031dab3520402
ad51c450df1e4dacca881ab6bae2b5d52e18485ea62ce92b48f160cab6c5b98b
37dfb42a59b50e9ded45609e076b205d3e00490ab20748d854e0ee9e444110fb
dde5c80db06a4c8646fa7c22d051be22dc48c692b7ed17184f523f7540255e73
50af699fbcacbaf55a722609b1ca8793bca4d850d67f17744d5a21ca1004c34a
f24376b7baea28659eece84c2c8a5eb960900fe7db80ff9c80b81172365102a3
bda19e20cb021e1f9312b579ae4a152f7eb988090eb15592a9764520125b7649


```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-18 20:43:00 (DOCX Based - ENG - 365 Blue Box)
SHA256:

c7effcaaa891bdf9abd87ded7e9148a8d5c883c95472120d4be76d8d391468e8

http://ireviewproduct.com/font/QVhA/
http://gapmendoza.com/cgi-bin/Lq/
http://thetourland.com/wp-admin/h2L/
http://aliadesign.com.my/cgi-bin/VJCj/
http://famille-sak.com/chouchane/bVs/

Creation Time	2019-03-18 20:24:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
4156ebd32fa90c109feb90c1dd753cd5bb4c706266c8ef56c1fca2e37273af3d
fad4dcecfba04c9fbbf177ee158e890681c6f628cf6defa98469acf723d76bd8
0810762bcc6b70bbd93865840cd56b6d8502a16a6821dc5b4fad98d3b72404c6

http://ireviewproduct.com/font/QVhA/
http://gapmendoza.com/cgi-bin/Lq/
http://thetourland.com/wp-admin/h2L/
http://aliadesign.com.my/cgi-bin/VJCj/
http://famille-sak.com/chouchane/bVs/

Creation Time	2019-03-18 15:49:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
2b8dfd458a888355911b206ae04a86e3452f4a6b2315a0a835025d00da683c03
03288dc8b4769c92a293f790f8836753fd20f7a2c1e2c923329b9baafb7baa94
845658cab600728fc289a4c693d092394479b40fd41a1225c0913770b207cb64
07e3aa12908a145092396fb0dc90a540b0a8061bb46d2283251f98ac863ff036
dfb2465fadc1229c80b60a2cac8c0c3f23ff0fe5f7ce64b7bd4a23a04036f4d6
5d151c196a639f207331c5a43ad3af7a78b895867fe3b190022aa52899eedc03
bf9ae78f2b83ed44519c699c45042316dd4faaed827fc16e126f97e14fee71ef
c5d397fa0b3dd8b8ee3189b9b7c4e0348b2be3dfced80176e6eb12fafb627327
8ddbd8db2eefcd9b526d34a1d837526574697be5a71f6c0c41e3280f2ffce2c8
113c6c5311006bdbd29777ccb22bc21c6c3c3b29e782d35e5462ec14e5f8ddab
1138627d7270c39fe483082f971b12b049a2ab9e6ab51cacdb5f6403f419a4f9
6ac24edcd8aca70411e1c9f49aa32aae9e200c00ab083fd4243fe3594579a842
b41d42f5949df954b0e27cf0a9888d006d265c7f6d6eb5f6eadf11bf77d8b4a7
4b7728053be05a86cb662065a3a1ed42aa930fa653769babb5c523cb58665f85
bc94b91fedb3dd71da2a6215421c5eeaf77b04e8816785dcacd9bec094c1d2dc
e17dbaaa4dcfecaa7c61f033dd7479cffb73bf5b02e18bc1bf4b40120bc80319
f2d1410a2b89abb2c47af657b9fa58b55fc4f16514543419de2f6d01fdccbfcd
043e64edfa83d8ae41198153ec00a6b0d4afd8ce958aa3c5776d78092595144b
cbe485e4ffe2be5e0fa88505f7856c3624d4c51f4fe077a0b8b8b2df9a9b3e4c
f5f2c2595b9334e90e58cb725c603a8e8c181a4ae5099a5602e73f23cb812bef
556db28a3ec6f4b95278fd1bbd6476a62120b90862867ca286e2b767e412a1c7
c877de051591a6967859013bc6ea2f99fb06538d6659b85ce97ab81944685278
62d6fbe2a3ee080a5e43a6e50b1154819ee4a00c6e14ce39b74bf59ab263fe1a
ab6986d5e58aa962ece58574f0a10ea14675e852ef3ab2a5785a53eb3aed56bd

https://inovatips.com/9yorcan/fvp/
http://alpinaemlak.com/wp-contents/Mb5/
http://hillhousewriters.com/images/OgP/
http://geoclimachillers.com/wp-includes/vJ/
http://jargongeneration.com/Gambia/lSF/

Creation Time	2019-03-15 14:12:00	(DOC Based - ENG - 365 Blue Box)
SHA256:
f350612cd869a24a2eda1831234957a0d039007e64060b0532960a9daaf76d03
e26f27fc9f96fd81d4ea35e8a646abc2dffc19025b758a19b80511d9f4c77c07
37d1202eb265a09f8a50520c4d3709d0db0020c1f6700ab5fba2acd5bf8612da
553330a94c186826929df11dc1e7bac6afb2078a9dd4272b41f10b48ead75a12
c523c1feaf944ceda2f7cd3f7153826adde1c17bc1cfd23315e1b1d853adf4ce
17bd003cc3b5d5179b7f9ae72c5c9030a1bb860f50f9826b6a737c25cc597cb9
af8e2888bd64490a70b1309b3860118339130a019d32a57de1d95d8d73123d69
cac22557ceaec572f0783ebe2e01fbfa9356d447a8efd457a46a8c3c0284a9c7
72347ba8b7e6f89637b64f773655d9769c7f753188960d54f11978ad07b1f484
28a4b33b6539f006b20d02f1bab38c3f25fe2ebb515e0c6b00a07c6e99dcc959
bbf554b9fb07d7fb4b3bf21b4c53b1769b678d6bd5a3023c62e344b7ecbe07cb
36ca2cb9b898a45501d282239dbd50a31d4bc3dc7bb35f12181edb3563bc1b25
0fcba547b52ec4523cae954a6ba30c2862206e24fe521b2987b85c8991e29ec2
ddf8088e8d20e6320e6b8381ffc11303bae71c0ced56739ccc4a00cdd5ebd249
7d9e94517584a288d05bc6da8a38a2e55aec5f05481e752eb56343857f02ba4e
362b8a185f5462bc87c79f3774eb02399bde94bbb3890f2cc5042e12ada68c2f
39752866b4e0aab0bccc1d8a153619ab2e6b01d18802d2e0db2590576e85d263
744a61510c073117c7bdeb66cacb336f7783c0d8de37517729dfd5813546e4d2
2fbd64621b79df5e283e3a678f8e19f5d6915606c3c3b76aa51b8ec43be5115f
e2c2fded2d4d0d44484f496ef3b47fd4bde46aad6c768af715842d612ab4ab63
425ff319be68ed1402f40b6e6abbf188a0857d9e0d59d5b6e57a2ea8a7ebe039
ede18ac09dd9ab563bc95d5a3a3d91e0319bfc5b0bbae509fb03ba8c11228e22
d43575d88a7ccd73a4d265a6b1937d6df10dd504ad4b647e57818cd8f4c8cb81
509067b017fc594b417b93d6fb8b122ac7fd467fc384ed3e06b34d4fea8e36cf
914afb21dad659e1289991c0cf11194b04d7b83b3e6397857d3310e41a75552c
dfdd975cd860626d4edcbc854d8b867fc2d05a953524884d4cbb75cc72ff9b4f
f236525e9c45c8f47c90b25f282b107183b7d0926d4e9f821bf2c50a8b6e959d
457ae565a800e5627bb08489fcdcb2b0d010a766ac5bd6784836c387644fd0b3
1e897b6aa1607f22a9016bd31302ba7666a9d89b3ef509a70d580d4faf0fa0d6
2c26a0a8a62cccc87a258f73ac8d0a3ed16b75ae85923251140d14b174fa200c
1550c23045c33ac74a7246df56d2c1021e58e216f0d95c7a18e29035cf4c33bb
e54ce33083b377ac80463785d9300214958673ff30797750da30d0661f82f35f
f123c3f1bb4c1bb17297cf1b7d6f247a20e84d06a4888e50461d846621e6fcbe
ab64cafb80f50f8178f035adfa03d893da9db01cfaa47ff2fbe15be89014b86b
db407e674507467231a1a24ebd21199212ab21a70a35bf4e735419d22f32c89a
fc269ab7069e6fbf795f2e0c89cd4b5863961bc3bae6d5fe6c422714db1a04e9
43addf8c1d6a54c0d082c7bbaace5789c44f5d94a5b18b65c621dd55cb9d68e6
56443b5dcae8501d615a7b2982bdb51c47bb7fe239224ea898da35bcad6511aa
2d2fa29185ad0f48f665f9c93cc8282d3eeca9c848543453cd223333ea2485b4

https://uninortediverso.com/awstatsicons/QThc/
http://lesserassociates.com/wp-content/E8h/
http://forexproservice.com/wp-content/tW/
http://nieuwhoftegelwerken.nl/g9A/Wj/
https://vigor-dragon.com/wp-content/bIO/


```
#### SHA256s for Epoch 2 Payload EXEs seen on 03/16-18/19 ####
```

8f8482d0260eb07bcf15b0218eafac1e12529747c16d9d4807e1ecc9c7688a2f
b083533a636bf58ed5b234d5a6dac3d0d6bbdf18edd024362866505acf3ff873
133b43d7b3dc3626c0d58e6b56c74c57308821a1255214a81558ec62f0d45ae9
d12fcea5746dbabfe2102570c967d73d0fe3eef2117977382557e3562a1c414c
7c487c9979e8d7c8896440fec35b1a81f6be73a30689f973339044c279ed1f56
85041387a5e123ba4edeed08dabefe879885d4d8878946670433c725eb25428f
c85fb2b843b15706648c06df2d6dd79668f382d03fab4ab73b4be9eda969b8c8
b88be5820657df081001afdb3da407da6f185680f5d2e829f737c698eb722d3d
4801b894aef72ff560663f5d7f37fc383d8973428126452d7fa35d9eac759f7e
2b532bdccf4ddfd2d3094bcee746292fdc8be3505f4966342130317aeaf9f4bf
c236cef71400339620f54550d4ee107bb627d052356e1b07ea73a545f410210d
9fa287079a2d136ea45684aeb073c8e66f7affe406535fadcb07c8af0c394d48
9b3bab0ce135820799710d08be5a811c2e5cd60c4caa3a864e2baca20ddcd6e4
c74137267e9fb931e6279c5a6e6cd25debd0f9885d52bf23648c94a34149d075
50efb20ecd27bfc6c77c23dcbdb224fa374d10f71dc92b3ebcb361d42b824dcf
f341c3d58d116603b49f47191359e38442dfcc34c5735bafa0b3104a6ca9747b
e745df3648d828705f2a1e76cd9c41b4878b644f40abda0a59608f53d2eed292
db63c5ada3b3684634db59bf76ee3e5f81c69f93a4091c2f069d59198240da73
1c3b034cdb9613245dde020bf33008185fb30bd9548f973a8cfe45894a68f6f3
eedde8c44170dbeb244cbb4bce5a0d8ff0fa160923c005f06cfa68859db9f5df
7b48d60b4ab98fb8ba1c480aef96ce09b7bc92263498f8410a88c5f2a247c533
f593ccb7b2cb45b956bcdb245128b65fc9a8e35852bd63856c4aafa804dec16a
a3a043290bd3280f9d46efed86b5b2e92836a916da07171e6a06f35900340a98
7d0493a41f0152ccbd7bc2cb0c4fe5545faf498533ce4ed02942bc14db7a6ae0
a18cf166dd7d44a0aefebfefd8c0d2ae6c1eecd3ea39a608f9fb5d1015d2ab6f
a4618c94bd2d4ab8b19a2e78e515a4be1beb0ef3258a67feb6bfa3104e88ee92
9e976784e26930dc2682c3e47b5e9de91bbb346c9e16d84b829064f643f4e1bb
8d2f6bb06347a431b3cd5f470cde425d5e11c138120d1ce8c0889db8d3f9e52f
fc1c31ff4b050fc9621c1c91bfba6a4b1e11a00d1830cb61aeca3513a91f5e53
a9fde71785d0849ca7eccca84f2f7d54a58ca57ccbb8c0719cd55a6f95e0ff66
480e388ee856871866c781fcf0f14ee2563f81eb1353441f3361d8ea30b6d4f0
dbaafd56cb07bd4120acf265dbcd29e9cf6604af174165d00097fc887679ce8e
d4d000a647b30fc802155153b7b2a04f31d38308dc3ee95ba1e36d43b2a6e3e7
e7625dbf0ac5e36fe6df01064573949d99da48d29cbd52273063665359c72b87
f54de3d948d658e286351270a46287ba2ffa1b2987f226c50aa83bfc3a2f1a68
7ba86c1c9607f3b2d2c1936e234c0ac9104cda41440cf4ce6c887ebb777a6252
43af25a22304180193b0052d005084e501c42b104ea2976e330103dba95df8b5
24886a1a83a3a0a01e8d12000fd135d55108e09494f0a4bf40f3e787392d4ec2
acd3f94cfb086dee9159d0cc22af36724fffea1be1cfebede590bdbe0503a860
c41479feaf032aa8be86eee7969eb8addce390eb4da64de2ddf53234aaa10615
2f6162ced7b98f2c43dfefaf55febc9112bda1343b8493e2267ec315787d518e
381a2dcc7dbf2c08f5592f3bd001a2be3c71a7597a4133561e08436a2b1a145d
4304c0e11f32989d3af41d2203c694963a1813bcbe68fb37073211d85b200f3e
ca07c0082ea4e957c7fa43ca86af68faa60f6ddff6550f16ed4063d25d43653c
72fba1a06fe93b9e00c2816f96ce5fbfc9202fccf30149b6922b40d3ffc46ec3
d1e21a353d50fe79a12ccbb414cb311a0e30af9f18cf5ba4884324534c18b2a1
19181e0cc313e952ad1fd7e0a5337e5f3c38d1e174a1b8c376876fde79977e89
cac8031042770b65f86cd08b97d22f1d058f1f8db5277bc6d413609fa5d8ed0a
a895db33c5e3661e7e5aeba084a1d30c719bd378526bc88f6d6611f6e893dba1
60dc28f17721d1b32c58f918fe99fdd5c25717d3bcfb00ebfd99796cc3cb5b56
7287c7bdbda6b35d5d8c748de0cc1ce2160a189cf7f02366564f4f9ad8a8f3df
08f1b56bec9017337186f8b1c13870fe35995cbfb476bb2efac853bba541d58c
467fc5850f8c00ec7a1d9e842b7a89588584667d05a736d8c6744f14b406a0c0
934097aa7169d9332e1f92cc38ee3394aa9063cbb2f874e076525de3affa5998
08844cd3631cfa162163319b9b09fc0006e952928bac67858df1f349de16a951
660a32676826757eff9983339d5681c2bc36674818efa473c92b2c043fe96f20
0ed940932db87653a7445877539d6126f4941223c4329112d18b8335a9d20f16
d0c92b667f27f0bf31a960aa1acdcc9b1ad7d7e92606fe430868c812981d1157
767dfe11d3ea44701e77cc64b527ecb3a2452de27c707c3101b4d4cda1e98f4c
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5
cfb969b782579d646207ad446858d7b3257f8724b0d6e27af16e3b5a5cc0eea9
aefe92e5cbc3b9a774baeceb1ab0304666695daf0c7e76337de4609f3f469a85
1f4caf69007c9cc107803dc8e7f1ec0241f263bfe8f549531096dadefce09147
7ef78394d113be3be6f208efc067c556611b07a3f7081db29fa75148304bac9d
f42f1d59793cbef1ae0452eb87b3385a4133f7b1e3520f35e6c4406c5a3d7376
8a56ee7933f5a67052e564d85c1aaa292743d5d54a08002632722332d4849082
3d4e41f6961dceb66ea1b507e064cb3b0c4a49a149ba20c2697e9d899ceb0258
fb8329be94e354102b9c2e090f881a107d4bf6a32bc284e7d3ba17245baa1def
8a6a918ad19b2b5231d1f40e6444cb793e41dc4842ce4cda7f0c4228dee62a63
918520312ab796fa04c514fbfc8593cafaeb07df33056e2b057cb9c49f84a690
e3e40de385a7bca22bc702afe9830f1e9758aaa11da881d687611eb8fc4c851c
6bc040eceec8ca3ad584a8b92c805557af7cc5beb9d67d63f8ac9bde3614a368
9c57ef5a1f77afe26c87b44c6c011fc278b97b311a28752d8ffbe582609a77ac
c0434a109e770f037282ac9a728c033b8a5f65f8a19e2750eb46a9834951a9ff
3d11bb346312c4c01868b0aab7fa3d1b227ef5f677cc2206f9fa112b02a8e2fc
266dac867b00a91eac4b2774610d880cf3994a02c3601c5cc900d17ea9c00254
21a20fe8864e3b6475d6b431db48696544568dbd58d85c9560b96dab57ca7212
474d5777e6a704d06fed73188f8b633bc0fb2625f213407e5ffc237b3a9731a6
56229df816c3172dcea8e7257b506c1e4928713f972e311ca0b15f6cca9e6310
a8a9deaa5760178984617801ec3579c8b39ac80c88e6c157bc53b5f6cdc2fd67
10cfe16700c3d7071e4147dc1a5a376c663c7b9b5794658742e77061164cd4f7
0ff7f6a101c341f0077b126413e3d095f284d1a65c0f1f3db7c82998376b9dda
188b85efd97990f5eea55ff32863e9bc5a33089272f3173f73aa24263435ed0a
5108da575d119d511f12b5fe123406eff9fc7f157b00d277189db42061f6ff99
fb1910324aa6f33857602b250835a04ff03cc35ba851900351e0b15ce9c52e2f
8bf7dab9998bf204353aaa1c65b14f3bf580f1f7b03ec7a44310e9729a69aeb5
71c7a9aedf99686df6909c2ff38c0581a843f265ccf0b0fa10e4581ef94219d9
f528b8f8b46729bdae8761b1a8861d245cdeb69013275ff33dff97ef717b67e9
afe704ce10893675fee8eb7d9cd6c1c97f4339c4a7cb53233c40f75313cf6641
cdf876a0026db7838056aad8722126e011363b71e0e33b9e323d4f5f283887df
c09f105c2444baa75b31fec2b24a236f9430eb2d5428ccbdb39d6a58b87898ac
d3330ca87c9e519fe60a2e38c0426c90d2d4f4848eae3f1a9268f286ef7fcf47
8eacbbebf8cb20eaed55ab8118bf69354f78c9fe04397078a2b6293bdc031023
4c30d7e53a23a84b0d3e41a2e05d95b1c4f119dfd12c357caf2647ea0506ace1
3868ef4a35c0ef69f70c64e545926e8869ab402339227784ecf65e18d55bbb4d
50b6a09403d5dca83822ab1c65c1aa32cbd1dc72e4c811ca1a1e99260117e04d
a30ab8746efe8e6080dd740ac0d490dd6e040f11c60562db4d4c2100e8a314fd
39d7241453c031dcb53a65541a2d92311ee6e6230dce0983be99e6d2fa4c6f30
728b736900020c86891ad6a8eb642c4d96b0e87f9bdb87331aa85805efc7a384
8da3d4ee5daea18a6e60eb17127b7f2f0b6567beec108bc5284baae0807477d9
1a614c4e1d5213c8e065a0c767e682f82bc82011b1566ac2ae0a5ffbb87c7fac
6398152b0f2fe31fe3de97b7f2b24049c01821680906527ce7091825f5380578
9029cc1c65b2eb3f99dc90735fa8ab418406efc24b32d6b53734a093ce6050b2
969c4ee2211867bad04f196cc724364ef9551196eb1e7d4285fb8404e9dc25f2
6f519218d2d95e2b0c364e0b7b16035468495e1e71e0a515c0db4388ae425f8a
ade57dd5f911c704c6d661d10e71c352b4c2e5f6a8a1cbacdafbe32c7d7e4a97
70bd913b729820f32d40c6a24080ed6d6835e35aa23147aeae1e99a364eec4ad
f8dd3b4afdcab601df0f0316b07c201031e5e240dcd66d0d4478d6800cf5d375
f9d15007301d40c02230bd52d1e69806283f9a90adb6ddb5beaffcca93a6eaaa
e3a6477dbab6527bc5d9ff2586ba417a1dc103e4506f667ffbb14ffea86cba66
375c694e15ba12af6eaa1d0b4b0251ed155bc7e47626436278172fcb455fcee5
5a9bcca814db4d7d53019c560b448dd1a8d2ffaa51d1e968522be142b14f7234
97a18e3ea90030b00fe5596551c262c9e0ed6d3c579ca528c1c6b452d8566cdc
a98ffd690b635ac8ce592bb2a0c0652b9ebf56c552c8a0576ab9d5e032c2979d
2cfae14e297066934ebf379662b54928e6e57510fcf5ba7eafe01256a5590652
58c50e975533848ad5f2512bfb740481cdc8e82af7a8de2a775e12f13aeaae1d
08a7a234e555c3ee16f7293f4cb3db3f8e980ba1f8540a7a4b23fbbf416e023a
ba4af5dcea58b9eddbe49bd3090c40a3ccd45c03375f608d0f4c943dfe568aa8
4257d28b1c1b92dcf5f90a2f184f3505665e168f887bdc0779327726a7e4d473
1779081b8068a1d545082dece2726d2fa885c8825af37834dfcabd52fe8c99b9
1779081b8068a1d545082dece2726d2fa885c8825af37834dfcabd52fe8c99b9
d7fa6fe9b6d6926619ad388f5825653ca47441ab885478a365c1987b5e5d27e6
0a8888945757f7cb372c24c469a835ffda12e2e71cbab52fb8c734ed4361c069
4c6dd57583a13ab6ca9e6d0faef216af651e848c259e290bfdfaff60c32d6cc5
705bca5f0a73450c0e264387aa64e941e4fbe9c4d18ed6f82164b4f3dde0b00d
afc75b6382f973e734cf59696949520f40cecb5584f65abb847171f638df3604
ed095a8b482542a0274a8f26c2475cc797f7fc56859d2412e9384efdeb0531a7
f080790fb853baeced1d7c8389ffc8c31c2e22315c0f37fcbe233a180bd53b7d
326b12f60fdf061d3a34b0f0bb53980dba77c118cfb763e1bd41ac5dc3cc35e0
54e37cfaa64999cbe0a5d4baea3990d72e34fec0f05421ae0558e833ba191610
d9923f6fa312de28c5ef3583ae3f5376c6cffd24a69664a04bdadee1a8feb635
677edec6c3442ab344aa887f660e2bf7dde63b73c7c729c1de3e3fd08b89ec2b
a70b068d8cdd156eb7eb7cb70e5f96ca13535cf2534ae5fee7aa16809264eea8
1ad09e3d038b2d41cefa80e0f27ce6158ba4c515f44f9b95e476b1b0966b6f8f
45492e45d3eaaa819247ebc8a32c105e3d4ea20e2e1c8b8ee41bc89f2754dc69
f747adce0bcb9d53ff5b17269014a3e47a4c68219a87d4b52d10818a87001744
2555a65a48cf7677481cbca5cdf8f9b72d8c10b5a41b55a4f3441bc8417ff8fd
f8e46a19ecaf614e023dd2951d0fd66982a303407951b558689fe892aa7ac14c
9b2515cd799819bc186b8feac694ff32fe6d1f6685dc58966971dc7217315394
2e06554049dddc5e0f18eecb3a313c38bfad3a62c12e1754f201acca50304d9f
4fb593f049c6d0b98c024c90d551cb35c6b57076a46c44d52de089f4d0d3a244
d5360c2790cfb5fab25d001141d9c8985b58368e10d023bb81e5968acf8b630a
7f076d36307be5cfbe2c10d63f1fc533e287632547eccd9d6e47d031c41f5456
b46bc9d558c8d4fd167b76140f5c693ecbadb2e64a5dfdf0293687fb76132f43
54cde1e4f8df2055a23ad0f11fdc0871c6289cd7d36da9ec9d2947ceba52bf2e
71e126a8976b0d8b5f23bd2515e08d3296f776e1b8183057401c98cd54fb5e18
122faecd384ae771984d7c39f632e0625a0510554084e217c58c53ee10f4e753
3f44f5da578e4941708c179d1636cd57e36358f8a35b8609f791b4026b865ac6
5854bbacbaaa3d283a65f41f994419d17de1ec771787d532d4dc1171ef66a127
8c81d6011ac596c16b115a30926015fd75cae4ad587b56f3102cf5ab9c6b28b9
9522f70d1419860742213ecca5113a0919774a9ef32511cc8c6f03f99b3b61ff
dc7994728835cc4f2c69e7a5a2274329fa5da7e8b366291a2b58e7e50b31183f
8eabdeeb94baad11dc67a520677abd7469f7b02656152c50e89f456362c5964c
6a8700d39552227b6538234a5c874f059db7fafa8bd41f41f19e4041ceca91a3
3ba38bfd39796b08917c74d020cac35b7ec03e0b040db85346fc828737cabec6
02eef07eb0311d84ee063c1199ce3169b9a5d89659ace1e4aedeca2e434d7545
0b10d5c8bdbca26a3d6f0d94d092bfd62260ef38657d25d9b8783819f8c579c3
f8514b465842b9251e0ccd0a0e6f15f088862a3d78ff8d4d660119e7b266ef99
b912b5d03a1568e2cb025ea53db71f9d5ddacae7920924803fb9310425c6bb88
76d11553d74511c0f3ca0bd8325f36a08e32af9b652cbc2b880a065cc562bad1
791399ec5d7f04f742948a4f25e040e3561e8979436743f105f2b0fc736e0697
d422dc169a6cb3975cc603ad5d1b215ca802e6e21a75fa9c64858ae1eab040f6
ca13c2bd710600f84cd80d7dae41ab11dc12cb2c1f20ecb3f097c5460d8410b7
c484ab894f43e2b5f2fc6394d7b7c4da7fcfd7c01ab5cbda07b2b141d4128936
c20719a0e9a3f903149c694aa33591d12c1be771a5fe022f00ff611348271b26
d425882d4a92c44f4fa8eb814ed2f3723743f20a91ed2ff3ca0c0c7210c4261f
ff3b32b1768c2340e15d4a4589f34bbb99b364b8e1e6e95b19a2c5815c59c65f
d86af60157059a9397990d7f78b6b121ba3a970f66bbbd55be97d58ae9dc28ca
ce2832eb063befb64ffecc0425ee60e676536cdbe8504071ec35a77114db24f2
0afc3aaa1ba3c9fb94fa6b2178a1fe781554827d0f4e6ea0fdb837fca48f8a63
aa2ea334ce73f0a3c01b2e317c1f159d9b97b36c5ed805bf948bd1b3fb2f84d6
0739b26d42c1687b6963289a4df4fc920d01975b13b12f24b324a1b04ebbec9a
34289e86748a8685f54e8a99a30d9f70aa59e9ee8406be3057429babdbe8ff1d
636b47268a8db08adc53b11b22a4befa07a045f38396625a340c8f6c6512d06d
30caff02685f18650c76826e2ba9ab28cacff51cadb0d244050ebce84650c2c1
c0c69982786158efd37fec2693e8652dc8700dff504d5f626a538a1259de8c3a
fc786259a256de76ac7a627b914ad5fef27ee1a8ebd7296ed4d1517602a0623e
f26c142e8b8adb3b309937668ceecbf401eeb151a5a81c30966cc904de18c85c
dbf653513d6d669da7ec9035a98c1082b93a3f14c1f9f9442862f8b76b3d3375
62dbe5f71cf88ded61fdc41d6ca2f20201b73ae78d414adde9995c4a982a8499
592cd9d70a901e4c1e8b4f7a6ea993cb2f97b8cd934a1c69f1befd85619a37ae
53f45a6ab1162c4c88c112d53aa2c721c363680ca7f94a145b63fd3260ecffad
279f334a11d90c8f8905980e8ecaaba6a44dcc7ad31b816f29a4a57f1e8fc0b1
3126ca08eaa0b24a453a74c17567fba1b500ff617fbb6d5ad6e3e55d70a7d041
99bd269b32032cd30e21f6f36618ad66a374b54502a8f0bb9de81bc50cc6ba15
0b696dfc24ed6b347df510f6a2933d02a00153442359b761884847fbcbaf6f47
c5c4d867611301b639078e53fbe28f69df173e620fdc01fa761018a92435f36d
ec626106a40fe5e4633ee2649f83b715bbcc9d00a3fa184fc74ea63eccbf6e4a
b863e385ebc98c52372abc01c9367f6ae88fd6b9f566f74392ce0c08746359eb
fd32601a79a23919b16818d89934b9d0ffedf5596f702d94f23d2b3cc8064754
51da70505e3344d95a5da9741a4eae7fca04f5a656899de2252bd03d70c7a20f
09677c0ebb786d734b540d42ffb4eeffb756332f05f055a0489b2f1cfac36fe6
7daa90df55cab96ab95a2bf4712a172becabe4050bee47bce9c4b2a8af644025
520688507b249d9c1929226a354faf7b121fcead8f895b04495f6f3c9d2501e1
161423a3d89191bcb67f81250296a7499d78c0696696ac8e0ff0945444bd344f
d2da7a50aa42fc11477eafa932b3828aa837cac6e8d026669a6b3402f4c77203
b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9
fc11176d420a0f3fe83328f4c24b01911666b50032261e67a97a74ee2e4bc5f0
2aa739b7898beee2b1c4ae8ee936554f7a411867cac19c2af886af1e977cb910
c0df1fb63191af8f14f75878e157c5cf1dd59470745bef9ee82a6e7b27a1a808


```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
109.73.52.242:8080
138.68.139.199:443
139.59.19.157:80
144.76.117.247:8080
152.171.65.137:8090
159.65.76.245:443
165.227.213.173:8080
173.248.147.186:80
173.94.53.3:8080
178.78.64.80:8443
181.16.4.180:80
181.228.211.100:443
181.29.214.233:8080
181.40.122.122:8080
181.56.165.97:53
181.61.221.146:80
185.86.148.222:8080
186.137.133.132:8080
186.138.205.189:80
186.3.188.74:80
187.207.188.248:443
189.208.239.98:443
190.117.206.153:443
190.146.214.85:80
190.146.86.180:443
190.15.198.47:80
190.210.3.93:443
192.155.90.90:7080
192.163.199.254:8080
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
213.107.110.253:143
219.94.254.93:8080
23.254.203.51:8080
5.9.128.163:8080
50.246.45.249:7080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.184.97.144:8443
70.28.22.105:8090
70.28.3.120:7080
71.11.157.249:80
72.47.248.48:8080
82.78.228.57:443
89.211.193.18:80
91.205.215.57:7080
92.48.118.27:8080

```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
181.168.129.146:80
189.159.195.202:995
190.147.23.76:80
47.180.177.96:80
50.116.63.9:7080
70.44.163.160:443
73.14.76.77:20
81.168.92.58:443

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

105.185.141.205:80
108.188.116.179:80
109.194.50.231:80
133.242.156.30:7080
138.201.140.110:8080
147.135.210.39:8080
167.114.210.191:8080
173.255.196.209:8080
173.255.250.241:443
178.62.37.188:443
185.94.252.3:443
186.113.255.229:22
186.183.141.17:80
186.4.234.27:443
187.189.195.208:8443
190.211.207.11:443
190.97.219.241:80
200.113.185.229:8080
200.123.135.17:80
200.125.222.34:80
200.50.185.54:80
201.220.152.101:80
201.236.95.82:80
201.239.154.191:443
203.143.86.111:8080
207.255.210.196:80
208.78.100.202:8080
212.122.71.196:995
213.191.168.93:80
217.13.106.160:7080
24.243.101.134:80
41.220.119.246:80
45.123.3.54:443
45.33.49.124:443
5.230.147.179:8080
50.31.0.160:8080
50.80.248.108:443
58.171.215.214:8080
59.103.164.174:80
62.75.187.192:8080
64.13.225.150:8080
64.46.91.165:80
67.205.149.117:443
67.248.56.82:22
69.198.17.7:8080
70.57.82.196:80
73.183.131.231:990
78.188.105.159:21
83.222.124.62:8080
85.104.59.244:20
86.239.117.57:8090
87.106.139.101:8080
87.106.210.123:80
94.76.200.114:8080

```
#### Epoch 2 - Spam/Stealer C2s ####
```

198.58.114.91:4143
213.136.86.219:7080
91.205.215.10:7080

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/07/2019)

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
time period.
Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any one time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
via C2 to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```
https://pastebin.com/xp9QTYF5 - @ps66uk
https://pastebin.com/gaW7ZDab - @pollo290987
https://pastebin.com/uHBDNQ4X - @pollo290987

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch, @urlscanio
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Pretty light today for me but some people like @ps66uk were pounded this morning with attachment based doc spam from E1. I only received
5 and it was primarily attachments. 1 PDF 2 DOCs and 2 links. Not a large selection so do not put much stock in that. @ps66uk received
almost if not entirely attachments as far as I know.

The templates today were UPS Invoice Notification, Outstanding Payment, Payment Summary and SendInc Encryption Messages. Nothing new
really and the same old stuff. Seems like a pretty weak start to a week and maybe it is time for Emotet to take a break.

The C2 observations is now the same for E1 and E2. We still seem some GET requests with the old large cookie but most of them are
now based on the new 1-3 random directory structure posts on each botnet. I am sure this was done to stop YARA rules from finding
the Emotet C2 traffic and calling it out that way on the internal network. Here is a recap of that change in case you missed it on
Friday:

Brad and Cofense noticed today that the C2s were communicating with posts to webforms vs using the cookie method for talking back with C2s.
Here are those posts:
https://twitter.com/malware_traffic/status/1106788893318217728
https://twitter.com/malware_traffic/status/1106576866205302784
https://twitter.com/Cofense/status/1106613373586866176

E1 also had only 3 payload sets today and E2 had really 2 but there was a weird 2007+ XML docx with a single hash with the same payloads
as the previous payload set at 20:24:00. I am not sure why they do this but it helps find all the URLs for the day because it is a single
hash. So DocX may be the theme for this week if they make the switch for tomorrow.

EXE Rehash is still going nuts and we are seeing new hashes every 5 minutes.

C2s DID NOT CHANGE for E1 and stayed at 50 combos in total. - recorded above
C2s changed for E2 and decreased from 56 combos to 54 total. - recorded above

It remains to be seen if Emotet can get the spam volumes up this week or if we are due for a shrinking performance from the botnet.
Time will tell and we will see how round 2 is for Tuesday.

Till tomorrow.

```
#### Sandbox 03/18/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-03-19 at 02:15 UTC - https://cape.contextis.com/analysis/50358/

```

```

Epoch 2 C2 run on 2019-03-19 at 02:15 UTC - https://cape.contextis.com/analysis/50359/


```