Lista actualizada Canales junio

#Emotet Malware Document links/IOCs 06/07/18 17:30 EDT *Notes and Credits now at the bottom*

Document/Downloader links seen for Epoch 1 06/07/18:

http://zenenet.com/FILE/ACCOUNT889247/
http://chris-dark.com/FILE/408063/
http://kadatagroup.com/ACCOUNT/553737/
http://www.sarinsaat.com.tr/FILE/tracking-number-and-invoice-of-your-order/
http://plgmea.com/Invoices-DOCS/
http://baute.org/STATUS/Account-25013/
http://vagrantcafe.com/css/ups.com/WebTracking/GHY-062476711/
http://ieasydeal.com/DOC/Invoice-0832814/
http://www.dronetech.eu/STATUS/Invoice-03742462555-06-07-2018/
http://aharoncagle.com/Client/Please-pull-invoice-81866/
http://miracletours.jp/FILE/Invoice-22581/
http://royeagle.com/_dsn/ACCOUNT/Direct-Deposit-Notice/
http://www.markos-art.dk/ACCOUNT/Invoice-06-08-18/
http://etchbusters.com/ups.com/WebTracking/GO-084528073696903/
http://skydomeacademy.com/Data/DOC/Direct-Deposit-Notice/
http://autoteile-cologne.de/DOC/New-Invoice-VV0691-JX-60669/
http://trevorchristensen.com/STATUS/Account-08994/
http://wiliangomes.com/ups.com/WebTracking/ITT-536356715267909/
http://amazingmike.net/Client/Invoice-2274976/
http://moomi-daeri.com/STATUS/Invoice-195444603-Invoice-date-060718-Order-no-49493163275/
http://www.luminanza.com.br/FILE/INV382318060786/
http://triround.com/ACCOUNT/New-Invoice-CR2418-UA-44569/
http://glasneck.de/DOC/Customer-Invoice-IG-1757272/
http://cpmccc.com/FILE/invoice/
http://hade-noh.de/ACCOUNT/Invoices/
http://solvensplus.co.rs/DOC/HRI-Monthly-Invoice/
http://velo2max.com/wp-content/themes/Client/INV042284215829084515/
http://kevinjonasonline.com/Client/Direct-Deposit-Notice/
http://www.istanbulsuaritma.net/DOC/INV9098788/
https://silke-steinle.de/ACCOUNT/Account-24258/
http://super-filtr.ru/ups.com/WebTracking/MY-815412922/
http://sarahmpetersonfoundation.org/STATUS/Payment/
http://backdeckstudio.com/DOC/ACCOUNT01811367/
http://gagat.am/ACCOUNT/invoice/
http://robertrowe.com/DOC/Past-Due-invoice/
http://nepapiano.com/ACCOUNT/Auditor-of-State-Notification-of-EFT-Deposit/
http://muybn.com/aspnet_client/Client/Emailing-P94754VT-447035/
http://bbdsports.com/ups.com/WebTracking/DB-9570901/
http://soundshock.com/DOC/Invoice-90715/
http://ravefoto.de/wpp-app/ups.com/WebTracking/HE-23359205661508/
http://www.prkanchang.com/ups.com/WebTracking/QHY-07891091555/
http://feltbobs.com/ups.com/WebTracking/WRU-812159019/
http://meta-designs.com/STATUS/Invoice-50418617-Invoice-date-060718-Order-no-3169541221/
http://wildpete.com/ACCOUNT/Auditor-of-State-Notification-of-EFT-Deposit/
http://own-transport.com/pub/ACCOUNT/Invoice-702750935-Invoice-date-060718-Order-no-4720107772/
http://villematti.info/STATUS/Past-Due-invoice/
http://miyahashi.jp/Client/tracking-number-and-invoice-of-your-order/
http://parisel.pl/ACCOUNT/Invoice-16229538-Invoice-date-060718-Order-no-1184763202/
http://wojones.com/Client/Invoice-06-07-18/
http://geely.emgrand-shop.com/Client/HRI-Monthly-Invoice/
http://golfcorporativo.cl/DOC/Invoice-06-07-18/
http://sleepsolve.co.uk/account/services-06-07-18-new-customer-tb/
http://appraisalsofwmsbg.com/Client/Invoices/
http://airmaxx.rs/ups.com/WebTracking/OTZ-23561915786/
http://detss.com/ups.com/WebTracking/FSD-48222800/
http://bunt.com/phpmyfaq/xml/ups.com/WebTracking/OA-7033272/
http://sandwichpicker.com/ups.com/WebTracking/EL-9320270/
http://lasagneria.eu/OVERDUE-ACCOUNT/ups.com/WebTracking/LC-832298544533553/
http://uk-et.co.uk/ups.com/WebTracking/PHS-45772614/
http://ontracksolutions.com/FILE/Past-Due-invoice/
http://eurofood.net.ua/ups.com/WebTracking/UT-667634924614246/
http://ptgut.co.id/DOC/ACCOUNT73637535/
http://aspaud.com/Client/Invoice-268772/
http://healthdataknowledge.com/datadownloads/STATUS/Invoice-861937/
http://solarreinigung-volpers.de/ups.com/WebTracking/OG-415450703176/
http://thecentralbaptist.com/ups.com/WebTracking/SMJ-697192525515168/
http://maxlaconca.com/ups.com/WebTracking/VH-48952942813/
http://generalgauffin.se/ACCOUNT/INV258052823058271/
http://hoxen.net/ups.com/WebTracking/ZN-17214160971575/
http://skyviewprojects.com/DOC/Pay-Invoice/
https://unsignedonly.com/ups.com/WebTracking/HC-11303672500/
http://profiles.co.nz/ups.com/WebTracking/BIW-52734101302269/
http://djceejay.de/20180524/ups.com/WebTracking/WO-36518774273295/
http://gladwynecapital.com/STATUS/invoice/
http://fatafati.net/ACCOUNT/Auditor-of-State-Notification-of-EFT-Deposit/
http://radioplay.ro/ups.com/WebTracking/RDB-010718759810/
http://electriquestew.com/ups.com/WebTracking/PT-41866471/
http://eliaswessel.com/STATUS/Customer-Invoice-AL-01962289/
http://ukstock.co.uk/ACCOUNT/Invoice-06-07-18/
http://smind.com/ups.com/WebTracking/RU-5174264233597/
http://stroysvit.com/ups.com/WebTracking/GXY-01219011/
http://sweatshop.org/Zahlung/Rechnungs-Details-045-1653/
http://techidra.com.br/FILE/Customer-Invoice-IG-0599125/
http://top4pics.com/FILE/Emailing-S65496BD-03328/
http://ternakikan.com/DOC/Account-33957/
http://totalsigorta.com/Rechnungsanschrift/Hilfestellung-zu-Ihrer-Rechnung-002927/
http://verlagsakademie.de/ups.com/WebTracking/EB-82153990/
http://wilmesmeier.de/ups.com/WebTracking/KK-21670391802/
http://yenibanyo.com/DOC/Rechnung-scan/
http://shop.goldcarp.sk/DOC/Pay-Invoice/
http://rolandkurmann.de/ups.com/WebTracking/RRE-9394255877275/
http://reidsprite.com/ups.com/WebTracking/PG-85714871584/
http://photographybyamandak.com/ups.com/WebTracking/JDO-9716256221246/
http://onenightlife.com/gallery/ups.com/WebTracking/CKF-934329952/
http://mgtc.dk/ACCOUNT/Past-Due-invoice/
http://nemocadeiras.com.br/ups.com/WebTracking/ZC-3912932659455/
http://ncp.su/ACCOUNT/Payment/
http://mischief.com.my/ups.com/WebTracking/KEC-7464938676981/
http://mactayiz.net/DOC/Hilfestellung-zu-Ihrer-Rechnung/
http://jctvlive.in/FILE/99250/
http://scd.com.gt/ups.com/WebTracking/EM-8912820698/
http://oilmotor.com.ua/ups.com/WebTracking/HDX-0486799569428/
http://yenibanyo.com/DOC/Rechnung-scan/
http://www.scottwellington.co/Rechnungsanschrift/Rechnung-0784-354/
https://frankfurter-blumenbote.de/m/pdf/ups.com/WebTracking/YC-309053861/
http://hajdamowicz.com/Rechnungszahlung/Rechnungszahlung-020-2435/
http://vodaweb.jp/ups.com/WebTracking/KXB-240051680025342/
http://jana-spreen.de/ups.com/WebTracking/WTL-360524599/
http://i-call.it/RECHNUNG/Zahlungserinnerung-vom-Juni-003-8780/
http://hajdamowicz.com/Rechnungszahlung/Rechnungszahlung-020-2435/
http://wbauer.com.br/STATUS/Invoice-269844/
http://romancech.com/ACCOUNT/Emailing-Y781182NC-465289/
http://floriculturarosadesaron.com.br/ACCOUNT/Emailing-V520100YO-739783/
http://familiekoning.net/ups.com/WebTracking/SFV-301427341868751/
http://coimbragarcia.adv.br/RECHNUNG/Fakturierung-Nr022859/
http://arnedspb.ru/ups.com/WebTracking/WD-497413213212/
http://124.com.ua/ups.com/WebTracking/GTZ-620807656/
http://sagunpapers.com/DOC/Services-06-07-18-New-Customer-ZH/
http://fourtion.com/Client/Pay-Invoice/
http://anzo.jp/DOC/Invoice/
http://vinastone.com/FILE/Invoice-663900/
http://vvegroep.com/STATUS/Invoice-06-07-18/
http://webpathfinder.com/DOC/Direct-Deposit-Notice/
http://giftofdivinity.com/Zahlungserinnerung/Hilfestellung-zu-Ihrer-Rechnung-Nr01042/
http://arditaff.com/Client/Invoice-6147810/
http://vermaelen.be/ups.com/WebTracking/YJ-8322172060/
http://reborntechnology.co.uk/ups.com/WebTracking/QE-9427310841/
http://hotshot.com.tr/Client/Emailing-C21622FS-818612/
http://charihome.com/DOC/264053/
http://tovara.cz/ups.com/WebTracking/YX-041648071/
http://nerdtshirtsuk.com/ACCOUNT/Invoice-9174944751-06-07-2018/
http://www.ravirandal.com/ACCOUNT/Invoices/
http://broscam.cl/ups.com/WebTracking/WM-680441900/
http://s-kotobuki.co.jp/ACCOUNT/Past-Due-invoice/
http://geonatural.ge/DOC/Invoice/
http://swapbanka.com/FILE/Invoice-56996/
http://zitoon.net/ups.com/WebTracking/YUP-017500832043/
http://orzessek.de/STATUS/INV02880911/


Document/Downloader links seen for Epoch 2 06/07/18:

http://westyellowstone.nl/Service-Report/
http://hermesfortune.com/Past-Due-Invoices-June/06/2018/
http://familiekoning.net/UPS-Available-invoices-June-02I/17/
http://macrospazio.it/Service-Inv/
http://sjbnet.net/Invoices-DOCS/
http://c-daiko.com/topics/Sales-Invoice-June/07/2018/
http://emmagine.com.br/Service-Inv/
http://uscoinsnut.com/Paid-Invoice-Receipt-June/07/2018/
http://stezhka.com/Rechnungs-Details-06-Juni/
http://srediscezdravja.si/Rechnungszahlung-06-Juni/
http://tutorial9.net/Paid-Invoice-Receipt/
http://pssquared.com/Available-invoices-June/
http://vedapeople.com.ua/INV/
http://yequjun.com/Rechnungs-06/06/2018/
http://srediscezdravja.si/Rechnungszahlung-06-Juni
http://sitymag.ru/Rechnungs-scan-06-Juni/
http://frcs.com.br/Inv-Documents/
http://nincom.nl/Rechnungs-Details-05/06/2018/
http://mbtechnosolutions.com/UPS-Service-Report-7003/
http://le-meur.net/Rechnungs-scan-06-Juni/
http://istanbulsuaritma.net/Past-Due-Invoices-June/05/2018/
http://ilpets.com/Zahlungserinnerung/
https://viewto.de/Invoice-for-downloads/
http://columbiainstitute.org/Rechnungszahlung/Rechnungs/
http://citylog.net/siad/wp-content/Rechnungs-scan-06-Juni/
http://pulseman.ru/Rechnungsanschrift-korrigiert/

Payloads epoch #1 by SHA256:

SHA256: 340a996d634c9cd1d83432d3fefaf1adc7faa4a2868e1fefdec102b4020787f3
295c1c62c655ace3adb3a63ef4f808c493feda5542b50f0c64e790c155827088
63b07f7cd5b9e6f5ccbf193ac9a0f55aff39dc40ffbdc29f530e0996a093796a

http://launchcurve.com/KyawzUU/ - 74.220.215.83
http://429days.com/fwR0r/ - 50.62.26.129
http://seege.de/jt4itV/ - 81.169.145.156
http://jc3web.com/gj5o4ke/ - 216.15.245.208
http://zonguldakescortbu.xyz/kvc8/ - 5.196.34.252

SHA256: f2d0be0cb95bbf73b7818048b1f082966d95ec2f9429453306384b51d4794646

http://castlewinds.com/9T8dz/ - 216.117.135.198
http://vircom.cz/vsPjbD/ - 85.118.128.38
http://shabab.ps/vb2/attachments/RLkR/ - 195.201.117.248
http://jasoncevera.com/KCWt3P/ - 45.40.183.1
http://rumsto.ru/image/6sYG7/ - 213.133.111.12


SHA256: 28a4bf4772910c48b256e42192c648b251b5d923e0f3ade34b1f448be3b6132e
a60d662aaccdfb5ad852975bbdc7513fc28b1b2d68b3ebab079d28637819a29d
2b3638961858e5b86d503b393b541b589b439a392b40227a8bb78dcd16faa841

http://hynek.eu/iByAcPe/ - 95.168.198.164
http://classicink.biz/lXyzJa/ - 173.254.64.82
http://rashev.org/qnp7xg/ - 79.124.76.20
http://indepmo.com/qKE3/ - 192.243.109.168
http://walley.org/YXtlJ/ - 80.79.21.60

SHA256: 84186dd72b75a7e8eb6d0835d42591ea34abe9ea8ff8d3bd5843c74424c9db4c
9d689446eb0c3d55da0b92ed552d963d3adbb14396722d2abe6d520d2b250d10
08c29031ae7ca3c57078963e8339039d25b90b3fc7fc5053dd4c49797063d62d

http://jameslumgair.com/WlOOE/ - 208.113.175.60
http://motoracer.fr/XnZdh/ - 213.186.33.18
http://madding.net/VNAknZ/ - 72.34.47.254
http://poswieciekuchni.pl/qVsDJGT/ - 88.198.46.26
http://lewistonsports.com/wqvx7ge/ - 173.237.136.21

Payloads epoch #2 by SHA256:

SHA256: f2bf755223c742a1fcf22b0b04dce33f08365d94bab97e1707f6bb2e240ebd9d
9f3076ee74ddde143821de914418d9b481bb804c306e378e6c1b7f961ad334c5
e4e2ae9ea40907daafbf1fc151922862dc1a4f00a43d6e77c0db89821b2e762e
8ed0f2ebab985e79047971e2f6365e947805ed2ce96213e87acb7d9710c64836
6de0fac1020a02d0810136b4a8391f6f3ecf0bd64fb615f114f79ea037e58dde
3e1ea2abbd9c410e9ffdbee02453c59eeb213868dd7767d33143b571046a2341
261ad571891ef9e20698955e012fc828b63dc9ebd24b3693a930de0131ceddda
be8a12b8dc41a705fbf85de252a27aacd995a65050f105d4faa7afa3b84df483

http://l7.si/6gfpfd/ - 146.247.24.82
http://solarne-svietidla.com/X8Ak0fz5/ - 46.229.230.35
http://raffaelli.com.br/lu3UF5Uff/ - 158.69.162.72
http://sileria.de/4eo0Ri2DLD/ - 81.169.145.150
http://lglab.co.uk/CdNcx0A5/ - 69.163.185.97

SHA256: b035f568772a4adda8514de9640117687b0c8fe2449032584d04b58bd6ff650e
e67c4c17f3a2afd4b948731c7b62903f7190c0476aa843ef311bdcb1fa1316a1
585fb966ebf3b4dbbda0bde553774c351d6ea58ceb5846636081beca3dbe6fd2
2094db722ec4fc390788b50f1f913ceab5402a57b0c974f243054f8ec5440e3e
851dcf5eccb972b282832ebdd06a2306dc13c0749914f037337ebeca9ea7fd01
1712c2a61bba4e05a1b2bbbfec3c5eef8f0fd66289d3f83fb8bcc7aac0f57a2d
530e6e71129c87ad12251065a8d1adbeff9e85ba0a06cef1951e3ac1464bbb5a

http://vana-events.nl/a3BcMo2/ - 46.17.2.32
http://mirusstaffing.com/DfEyHWL/ - 132.148.51.145
http://rostudios.ca/ZaxcX41VAh/ - 69.28.199.230
http://divergentsight.net/BPPdCo20K/ - 208.113.186.94
http://willemjan.info/x9L1bBbn/ - 84.244.139.15


SHA256: 71457b9bfa1730cc0f82037be3b50ce5b635fae2be071c298e870984ee6913e0
3a256eeeeaf3dcb506fb8b361561f5ab5df23731c5691efa8b5de6ab1d801115

https://eqwolf.com/VM6vU2i/ - 174.71.200.210
http://laurelhillinn.com/NRooitjL/ - 70.39.151.44
http://mbignell.com/t6FDuI/ - 143.95.41.176
http://meister-spec.com/nz5fMF/ - 157.7.188.240
http://silentjoe.ca/iwaX88CvEu/ - 72.47.212.119

C2s by port:

20:
151.237.93.131
62.159.33.122

80:
108.51.20.17
119.18.8.51
121.135.19.214
125.99.157.3
142.169.147.106
166.130.140.213
179.42.195.195
179.52.236.96
184.186.78.177
187.162.64.157
189.152.34.255
189.199.94.178
190.99.34.60
190.213.120.246
199.189.228.60
206.248.60.218
206.255.140.203
217.8.51.144
222.112.169.133
24.217.117.217
24.248.225.107
50.84.214.74
50.84.95.206
59.100.1.89
65.34.131.135
65.41.38.155
66.61.15.55
67.176.238.209
67.187.20.176
71.246.52.87
77.72.254.210
78.246.224.252
80.227.184.182
*81.28.204.179
87.191.131.208
87.248.77.159
88.249.182.27
89.217.155.84
91.205.122.42
92.129.84.121
95.154.148.38
96.242.234.105
98.172.71.14

443:
12.162.84.2
154.0.171.246
175.107.201.101
177.99.167.185
191.242.178.46
194.88.246.242
217.160.20.223
49.212.135.76
60.243.114.122
62.113.223.234
74.139.102.161
81.28.204.179

4143:
119.59.124.163
162.251.81.235
216.105.170.139
71.244.60.231
82.211.30.202
91.134.186.49

7080:
132.204.161.158
*217.91.43.150

8080:
106.187.91.235
115.160.247.148
125.129.212.89
139.162.216.32
149.62.173.247
158.181.186.171
173.78.254.86
181.41.88.6
187.162.170.206
202.142.47.78
203.198.129.4
205.178.137.221
207.68.223.75
208.84.149.100
216.230.231.74
23.239.2.11
37.210.210.225
37.59.51.53
46.38.238.8
46.4.100.178
50.31.146.101
50.84.214.74
5.9.252.80
70.183.98.85
72.52.216.110
77.154.197.178
89.186.26.179
98.191.195.92

*50000:
*66.220.110.56

Credits and Notes Section:
Note - The doc DL URLS are in non alphabetical order because it is the order I find them. I leave the most recent finds at the top.

Community Lists:

https://pastebin.com/hc0qSRPH - @pollo290987
https://pastebin.com/STwnUgyc - @DecayPotato
https://pastebin.com/aCjWbCWS - @James_inthe_box/@fewatoms

Credits: (OC or combination unless otherwise noted below)
Doc DL URLs - @infernalTwin_ @James_inthe_box, @fewatoms, @JAMESWT_MHT, @c_APT_ure, @DecayPotato, @_ddoxer, @Techhelplistcom, @executemalware, @JAMESWT_MHT
C2 info - @pollo290987
Payloads - @RealRalf9000, @pollo290987, @AmirRedh
Daily Log:

06:45 - new payloads for both epochs
07:15 - mostly old emotet malspam that was sent 6/6/18 was coming in over night but as of a few minutes ago getting some freshly sent malspam with links.
07:22 - already a new hash on Epoch 1 but same payloads
07:30 - already a new hash on Epoch 2 but same payloads
09:30 - new payloads for epoch 1
09:45 - new payloads for epoch 2
10:15 - new hash for epoch2
10:45 - new hash for epoch1
11:15 - new hash for epoch2
11:30 - new hash for epoch2 again
12:15 - new hash for epoch2 again!
12:20 - I think some of the sites that were hosting one epoch are now hosting the other epoch and vice versa. Interesting. There is some consistency but it is interesting that a couple are moving around. I wonder why.
12:30 - Looking over @pollo290987 IoCs and noticed that we have a new port being used again for C2, 50000 which I  have not seen before. Very interesting. Added all new content to C2 section with * denoting it.
12:45 - seeing new hash for epoch1
13:00 - yet another new hash for epoch2 with the same payload.
13:20 - new payloads for epoch2
13:40 - new payloads for epoch1
14:30 - new hash for epoch2
15:15 - new hash for epoch2
15:30 - new payloads for epoch1
15:50 - new hash for epoch1 already but same payloads
16:05 - new hash for epoch2
16:30 - new hash for epoch2
16:45 - new hash for epoch2
16:55 - new hash for epoch1
17:00 - since about midday, I am only seeing attached file versions of the malspam from emotet and most of them are referencing Payroll or Tax documents or a combination thereof.
17:10 - new hash once again for epoch2 but same payloads
17:30 - new hash once again for epoch2 but same payloads


Sandbox 06/07/18: (all with fakenet and MITM)
Epoch 1 as of 06:45EDT - https://app.any.run/tasks/a6ae832f-870f-4d8b-ad81-62d98deebf76
Epoch 2 as of 06:45EDT - https://app.any.run/tasks/fb4cbe2a-916a-4533-b85f-864ad513fd64
Epoch 1 as of 07:22EDT - https://app.any.run/tasks/4614394e-d45e-4435-9005-dad01b631ae0
Epoch 2 as of 07:30EDT - https://app.any.run/tasks/cc7318b8-b22c-4d9c-8582-b7c5b2dd4315
Epoch 1 as of 09:30EDT - https://app.any.run/tasks/e740f8fe-59c7-4469-a3e3-d142202750d3
Epoch 2 as of 09:45EDT - https://app.any.run/tasks/38d388e4-a1e1-433a-b0a2-a1733cb39cbc
Epoch 2 as of 10:15EDT - https://app.any.run/tasks/111e81b7-05cd-422c-b772-6f1a30f37b60
Epoch 1 as of 10:45EDT - https://app.any.run/tasks/bbd82847-8064-4ee1-a876-8dee42d43bb6
Epoch 2 as of 11:15EDT - https://app.any.run/tasks/45484d5f-e980-4e10-9f6c-e34537a86b69
Epoch 2 as of 11:30EDT - https://app.any.run/tasks/3f1fec31-a8bd-4be8-a51b-66e795677d5d
Epoch 2 as of 12:15EDT - https://app.any.run/tasks/0b9f9558-0a56-43b5-ba3f-813dbb1a06e1
Epoch 1 as of 12:45EDT - https://app.any.run/tasks/bcdb06e5-8ff1-4aed-8fa0-8261be217c0e
Epoch 2 as of 13:00EDT - https://app.any.run/tasks/63760f10-d0a5-40c8-a8ae-4f946427da72
Epoch 2 as of 13:20EDT - https://app.any.run/tasks/08baded2-404c-4ec0-a086-4ea153f20d1d
Epoch 1 as of 13:40EDT - https://app.any.run/tasks/728e43a8-431e-4fa1-b585-8583f3db5208
Epoch 2 as of 14:30EDT - https://app.any.run/tasks/6547bfb2-a440-4f9f-9697-45a7e1fe9472
Epoch 2 as of 15:15EDT - https://app.any.run/tasks/59658385-d0b0-4b86-9f2d-48995bb95561
Epoch 1 as of 15:30EDT - https://app.any.run/tasks/f68e8d29-75f1-4dc2-b6b9-e147e0c280ab
Epoch 1 as of 15:50EDT - https://app.any.run/tasks/6df1323d-6a60-4607-b025-58bda484b7cb
Epoch 2 as of 16:05EDT - https://app.any.run/tasks/cc9ad40d-8349-42bb-8472-1936a3976012
Epoch 2 as of 16:30EDT - https://app.any.run/tasks/2ea294f7-bf96-40a4-b1b8-dd2bb167c2a8
Epoch 2 as of 16:45EDT - https://app.any.run/tasks/903e9e51-3142-4c40-976d-20404f156494
Epoch 1 as of 16:55EDT - https://app.any.run/tasks/06a39eeb-758d-4b73-b0e2-8bc1f2498ef2
Epoch 2 as of 17:15EDT - https://app.any.run/tasks/1b5268c4-77f6-4872-a9ec-2e1a6751dea5
Epoch 2 as of 17:30EDT - https://app.any.run/tasks/90418780-8ae2-483c-8a19-b89085c20183