Emotet Malware IoCs 11/08/18

## Emotet Malware Document links/IOCs for 11/08/18 as of 11/08/18 23:59 EST ##
*Notes and Credits now at the bottom* Follow me on twitter @jroosen for more updates.

#### Epoch 1 Document/Downloader links seen for 11/08/18 ####
```

http://149.56.100.86/EN_US/Payments/2018-11/
http://153.126.197.101/En_us/Documents/112018/
http://198.61.187.137/project/oyster/website/En_us/Clients_information/112018/
http://1stniag.com/US/Documents/11_18/
http://209.97.182.51/EN_US/Details/2018-11/
http://209.97.186.248/En_us/Payments/11_18/
http://777ton.ru/US/Clients_information/112018/
http://agrarszakkepzes.hu/En_us/Clients_transactions/112018/
http://alakhbar-usa.com/EN_US/Messages/112018/
http://alkazan.ru/En_us/Documents/11_18/
http://amnisopes.com/En_us/Information/112018/
http://angelhealingspa.com/US/Clients_transactions/2018-11/
http://anyes.com.cn/En_us/Payments/112018/
http://arcoarquitetura.arq.br/EN_US/ACH/2018-11/
http://artpowerlist.com/wp-content/EN_US/Information/2018-11/
http://aspcindia.com/EN_US/Transactions-details/112018/
http://b2streeteats.com/US/Payments/2018-11/
http://balajidyes.com/US/Transactions-details/11_18/
http://bandarbola.net/US/Clients_transactions/2018-11/
http://bengal.pt/En_us/Clients_transactions/11_18/
http://benspear.co.uk/wp-includes/images/US/Clients_transactions/112018/
http://bimonti.com.br/US/Clients/2018-11/
http://binckom-ricoh-liege.be/EN_US/Payments/11_18/
http://blacktiemining.com/EN_US/Clients_Messages/112018/
http://blog.comwriter.com/wp-content/En_us/Details/11_18/
http://bo2.co.id/US/Transaction_details/11_18/
http://bouncequest.com/En_us/Attachments/11_18/
http://bullet-time.su/video/En_us/Information/112018/
http://cabdjw.gov.cn/wp-includes/En_us/Transactions/112018/
http://camlikkamping.com/SpryAssets/En_us/ACH/112018/
http://camlikkamping.com/SpryAssets/En_us/Information/112018/
http://centomilla.hu/US/Transaction_details/112018/
http://cervezadelmonte.com/US/ACH/112018/
http://chedea.eu/EN_US/Clients_transactions/112018/
http://cine80.co.kr/wvw/US/Clients_information/2018-11/
http://cloudsky.com.br/En_us/Information/11_18/
http://cmro.com.mx/EN_US/Clients_Messages/11_18/
http://cohencreates.com/En_us/Details/112018/
http://colexpresscargo.com/US/Messages/112018/
http://conci.pt/EN_US/Clients_transactions/112018/
http://craniofacialhealth.com/En_us/Transaction_details/112018/
http://creatickajans.com/EN_US/Information/2018-11/
http://crowdgusher.com/En_us/Information/11_18/
http://cuberdonbooks.com/US/Clients_information/11_18/
http://cuoichutchoi.net/wp-content/uploads/US/Documents/11_18/
http://deliyiz.net/wp-admin/images/US/Transactions/11_18/
http://demo.gimixz.com.au/EN_US/ACH/2018-11/
http://demo.wearemedia.us/asc/EN_US/Details/2018-11/
http://destinosdelsol.com/EN_US/ACH/11_18/
http://digirising.com/US/Transactions/112018/
http://dingesgang.com/En_us/Clients_information/112018/
http://directkitchen.co.nz/wp-content/uploads/En_us/Documents/112018/
http://dllanka.net/EN_US/Clients_transactions/112018/
http://doimoicongngheviet.com/En_us/Transactions/11_18/
http://dream-energy.ru/EN_US/Clients_transactions/2018-11/
http://duzcetekbiranahtar.com/En_us/Transactions-details/11_18/
http://ecconom.ru/EN_US/Details/112018/
http://ecsconsultancy.com.au/En_us/Transactions/2018-11/
http://ethiccert.com/8004784PXIUFAZ/EN_US/Clients/112018/
http://europeatiredailes.net/EN_US/Attachments/11_18/
http://exictos.ligaempresarial.pt/EN_US/Attachments/112018/
http://ezset.vn/wp-content/uploads/EN_US/Transactions/112018/
http://familybusinessesofamerica.com/En_us/Clients_Messages/112018/
http://familytex.ru/EN_US/Transactions-details/112018/
http://fert.es/EN_US/Clients_information/112018/
http://fglab.com.br/US/Details/112018/
http://fitnice-system.com/US/Messages/11_18/
http://fleetwoodrvpark.com/US/Attachments/11_18/
http://for-rus.ru/En_us/Clients_information/112018/
http://forsazh-service.ru/EN_US/Details/2018-11/
http://forzashowband.com/EN_US/Clients/2018-11/
http://forzavoila.net/En_us/Clients_information/11_18/
http://friv10friv100.com/En_us/Clients_information/112018/
http://fromjoy.fr/EN_US/Clients_transactions/112018/
http://gaardhaverne.dk/EN_US/Clients/2018-11/
http://garamaproperty.com/EN_US/Information/112018/
http://girltalkza.co.za/US/Clients_Messages/112018/
http://glcdevelopersapp-env.kanjpmbfka.us-east-2.elasticbeanstalk.com/US/Documents/112018/
http://gnhe.bt/US/Documents/112018/
http://governmentexamresult.com/US/Details/112018/
http://grandtour.com.ge/EN_US/Clients_information/112018/
http://gsverwelius.nl/En_us/Transactions/11_18/
http://guru-sale-today.desi/US/Attachments/2018-11/
http://guvelioglu.com/En_us/Clients/2018-11/
http://haberplay.site/wp-content/uploads/EN_US/Clients/2018-11/
http://hawaiikaigolf.com/En_us/Attachments/11_18/
http://hawaiikaigolf.com/US/Clients/112018/
http://helpingblogger.com/En_us/Clients_information/11_18/
http://hgfitness.info/En_us/Clients_transactions/11_18/
http://himalayanridersandtrekkers.com/EN_US/Messages/2018-11/
http://homesystems.com.ua/En_us/Information/11_18/
http://hotelmarina.es/wp-content/uploads/En_us/Documents/2018-11/
http://howart.oroit.com/EN_US/Information/11_18/
http://hungariagumiszerviz.hu/US/Information/2018-11/
http://ibws.ca/En_us/Documents/2018-11/
http://ichangevn.org/EN_US/Transactions/112018/
http://icotonin.com/En_us/Transactions-details/112018/
http://iklimlendirmekonferansi.com/EN_US/Attachments/112018/
http://imankeyvani.ir/En_us/Clients_transactions/112018/
http://indoqualitycleaning.com/EN_US/Clients_Messages/2018-11/
http://infratecweb.com.br/US/Messages/2018-11/
http://irparnian.ir/administrator/En_us/Attachments/2018-11/
http://jfogal.com/En_us/Clients_information/11_18/
http://jorgelizaur.com.ar/En_us/Transactions-details/2018-11/
http://jovive.es/US/Documents/112018/
http://kafkeer.net/US/Details/112018/
http://karyailmiah.stks.ac.id/wp-admin/EN_US/Clients_Messages/2018-11/
http://klausnerlaw.com/EN_US/Payments/2018-11/
http://korczak.wielun.pl/US/ACH/112018/
http://lagrandetournee.fr/archive/leblog/wp-content/EN_US/Attachments/2018-11/
http://lasnaro.com/US/Clients/2018-11/
http://learn.jerryxu.cn/En_us/ACH/2018-11/
http://librafans.com/US/Transaction_details/2018-11/
http://lucasurenda.com/US/Payments/112018/
http://luomcambotech.com/En_us/Clients_information/2018-11/
http://madonnadellaneveonline.com/US/Documents/2018-11/
http://mangos.ir/wp-content/En_us/Documents/2018-11/
http://masterdireccionyliderazgo.webs.uvigo.es/EN_US/Documents/112018/
http://mebelsb32.ru/US/Documents/2018-11/
http://mentoryourmind.org/US/ACH/112018/
http://mohanam.org/En_us/ACH/2018-11/
http://muschelsaal-bielefeld.com/US/Transactions/2018-11/
http://mydatawise.com/wp-content/uploads/2016/12/EN_US/Attachments/11_18/
http://nabta.live/EN_US/Transactions-details/112018/
http://natuhemp.net/En_us/Transactions-details/2018-11/
http://nirkz.com/connectors/system/US/Documents/2018-11/
http://notehashtom.ir/wp-admin/US/Information/11_18/
http://numidiatalent.com/EN_US/Payments/112018/
http://nutdelden.nl/EN_US/Attachments/2018-11/
http://pdgijember.org/wp-admin/css/En_us/ACH/2018-11/
http://poc.rscube.com/mstar/wdir/runtime/En_us/Transactions/2018-11/
http://poddbs.com/US/Transaction_details/112018/
http://polka32.ru/En_us/Clients/2018-11/
http://pornbeam.com/En_us/Clients_transactions/2018-11/
http://pragaticontainer.com/US/Transactions/2018-11/
http://pravokld.ru/US/Documents/2018-11/
http://prochembio.com.ar/EN_US/Information/2018-11/
http://quatangbiz.com/EN_US/Transactions/2018-11/
http://raidking.com/EN_US/Payments/112018/
http://repka.digital/En_us/ACH/112018/
http://restaurant-intim-brasov.ro/EN_US/Transaction_details/2018-11/
http://samedayloans.club/EN_US/Transactions/112018/
http://shevruh.com.ua/En_us/Transaction_details/112018/
http://smartshopas.lt/En_us/Details/2018-11/
http://sociallysavvyseo.com/US/Payments/11_18/
http://souqchatbot.com/En_us/Messages/112018/
http://sparklecreations.net/US/Clients/11_18/
http://techdux.xyz/rlbkj2kd/En_us/Transaction_details/11_18/
http://techstarpetro.com/US/ACH/112018/
http://tempodecelebrar.org.br/En_us/Clients_transactions/11_18/
http://tntnation.com/EN_US/Transactions/2018-11/
http://touchandlearn.pt/wp-content/uploads/US/Details/11_18/
http://trailblazersuganda.org/En_us/Details/112018/
http://turmash.ru/En_us/ACH/112018/
http://ultigamer.com/wp-admin/includes/US/Payments/11_18/
http://valerialoromilan.com/En_us/Payments/2018-11/
http://volathailand.com/US/ACH/11_18/
http://walteromargarcia.es/En_us/Messages/2018-11/
http://waraboo.com/EN_US/Payments/11_18/
http://waverunnerball.com/EN_US/Payments/11_18/
http://www.agentlinkapp.com/wp-content/uploads/EN_US/Transactions-details/112018/
http://www.ammey.in/En_us/ACH/11_18/
http://www.angelhealingspa.com/US/Clients_transactions/2018-11/
http://www.anyes.com.cn/En_us/Payments/112018/
http://www.arcoarquitetura.arq.br/EN_US/ACH/2018-11/
http://www.aroundworld.online/En_us/Details/2018-11/
http://www.bedukart.in/En_us/Transaction_details/11_18/
http://www.bouncequest.com/En_us/Attachments/11_18/
http://www.bullet-time.su/video/En_us/Information/112018/
http://www.cabdjw.gov.cn/wp-includes/En_us/Transactions/112018/
http://www.carvaoorquidea.com.br/EN_US/Transactions/11_18/
http://www.centomilla.hu/US/Transaction_details/112018/
http://www.cet-agro.com.br/En_us/Attachments/11_18/
http://www.conci.pt/EN_US/Clients_transactions/112018/
http://www.coolxengineering.com/EN_US/Payments/11_18/
http://www.directkitchen.co.nz/wp-content/uploads/En_us/Documents/112018/
http://www.dllanka.net/EN_US/Clients_transactions/112018/
http://www.espresso-vending.ru/EN_US/Documents/112018/
http://www.familytex.ru/En_us/Messages/11_18/
http://www.helpingblogger.com/En_us/Clients_information/11_18/
http://www.imankeyvani.ir/En_us/Clients_transactions/112018/
http://www.jovive.es/US/Documents/112018/
http://www.klausnerlaw.com/EN_US/Payments/2018-11/
http://www.madonnadellaneveonline.com/US/Documents/2018-11/
http://www.natuhemp.net/En_us/Transactions-details/2018-11/
http://www.nutdelden.nl/EN_US/Attachments/2018-11/
http://www.ourys.com/En_us/ACH/11_18/
http://www.oviajante.pt/US/Attachments/11_18/
http://www.powerandlighting.com.au/En_us/Details/11_18/
http://www.prochembio.com.ar/EN_US/Information/2018-11/
http://www.rcaconstrutora.com.br/EN_US/Details/2018-11/
http://www.shevruh.com.ua/En_us/Transaction_details/112018/
http://www.souqchatbot.com/En_us/Messages/112018/
http://www.tempodecelebrar.org.br/En_us/Clients_transactions/11_18/
http://www.tntnation.com/EN_US/Transactions/2018-11/
http://www.turmash.ru/En_us/ACH/112018/
http://www.ultigamer.com/wp-admin/includes/US/Payments/11_18/
http://www.utcwildon.at/wp-content/uploads/US/Attachments/2018-11/
http://www.waverunnerball.com/EN_US/Payments/11_18/
http://www.youngprosperity.uk/US/Transactions-details/2018-11/
http://xn----0tbgbflc.xn--p1ai/EN_US/Transactions-details/11_18/
http://xn--80ajabbioiffsd5b7e8c.xn--p1ai/US/Transactions/2018-11/
https://linktub.com/blog/wp-content/EN_US/Transaction_details/112018/
https://mx.technolutions.net/mpss/c/BgE/jM0HAA/t.2me/E2sfmJJZTs6mASn8XXBs0w/h0/ExW3HpZOfSKFHF9iDdddDTwLss3aI50r6NDwIIM7gh5ONf5KRnA5zaBG7nDxzJRq-2BG2jji0uf-2F3tBBCTE6AicA-3D-3D/
https://waraboo.com/EN_US/Payments/11_18/
https://www.linktub.com/blog/wp-content/EN_US/Transaction_details/112018/

```
#### Epoch 2 Document/Downloader links seen for 11/08/18 ####
```
http://128.199.223.4/996383R/SWIFT/Personal/
http://162.243.23.45/7972311SJUSZZ/com/US/
http://18.188.218.228/upload/319PnZk7GutdSz5xxT/de_DE/Firmenkunden/
http://18.188.218.228/upload/candidateattachments/036VBQEL/com/Personal/
http://18.219.13.62/G4yDVqR4TTLI/biz/200-Jahre/
http://35.167.6.44/71578FPC/com/Commercial/
http://37.187.216.196/wp-content/72SYTHSSH/PAY/Smallbusiness/
http://40.114.217.184/988338DUAZJ/oamo/Smallbusiness/
http://40.114.217.184/doc/En_us/Sales-Invoice/
http://4soobook.com/wp-content/40HZEDIVL/identity/US/
http://67.205.132.211/875rP336N/SEP/Privatkunden/
http://afan.xin/2610121O/HvqD0Tg0pfDIx6EjC/SEP/200-Jahre/
http://aktis.archi/2M/WIRE/US/
http://alakhbar-usa.com/xerox/En_us/Inv-27037-PO-3Q297161/
http://albertacareers.com/7089LFHVIFB/SWIFT/Smallbusiness/
http://alindco.com/19708ZIT/biz/Business/
http://allengsp.com/BqXEm76sVtOZULTy/de/PrivateBanking/
http://allibera.cl/6PQX/WIRE/Commercial/
http://altaredlife.com/6564E/BIZ/Commercial/
http://altaredlife.com/logssite/INFO/US_us/Question/
http://amalblysk.eu/FILE/US/Invoices-attached/
http://amnisopes.com/LLC/US_us/Important-Please-Read/
http://andradevdp.com/9267VHDJQUB/PAYMENT/Smallbusiness/
http://angelusgroup.net/6762155JXX/PAYROLL/Smallbusiness/
http://aonespot.com/scan/US/Invoice-receipt/
http://apcngassociation.com/6405231GFTMX/identity/Personal/
http://appointmentbookingsoftware.net/3981PGF/ACH/Smallbusiness/
http://apqpower.com/assets/files/834SMOALYHQ/PAY/US/
http://apqpower.com/assets/files/S04Ac7CDyo5LVDmPQzjJ/DE/Privatkunden/
http://aquastor.ru/18FLK/BIZ/US/
http://aquastor.ru/53WDCT/oamo/Business/
http://ardakankala.com/738598DIIIFO/ACH/Business/
http://armator.info/tjweather/doc/US/Invoices-attached/
http://art-n-couture.com/3232154XWKFY/WIRE/Personal/
http://artvisionkorbee.nl/6eMlYpo6FiN7w/BIZ/Service-Center/
http://asianint.info/258647W/identity/Business/
http://astro-icsa.ru/FILE/US_us/Invoice/
http://baglung.net/DOC/US/Invoice/
http://balajidyes.com/9T/ACH/Personal/
http://ballparkbroadcasting.com/261R/BIZ/Smallbusiness/
http://bapelitbang.bengkulukota.go.id/161821Y/WIRE/Commercial/
http://batallon.ru/4973395JA/PAYROLL/Commercial/
http://bawalisharif.com/doc/En/Invoices-Overdue/
http://bawalisharif.com/sites/US/Paid-Invoice/
http://bebechas.com/INFO/US/Paid-Invoice-Credit-Card-Receipt/
http://bemnyc.com/4WQIXACT/com/Business/
http://benchmarkiso.com/9VCOENSJD/identity/Business/
http://berger.aero/assets/components/gallery/cache/658047FALMJ/biz/Personal/
http://bezrukfamily.ru/upload/VriQHkgdl/07TAEN/PAY/Business/
http://bgtest.vedel-oesterby.dk/6013103YMGZD/SEP/Personal/
http://bizimbag.com/8F/SEP/Business/
http://bloominggood.co.za/LLC/US_us/Summit-Companies-Invoice-11071689/
http://bobfeick.com/8090961CZUSVO/PAYMENT/Commercial/
http://borggini.com/506FOBG/BIZ/Smallbusiness/
http://brenterprise.info/67253BMFFGJN/biz/Commercial/
http://camdentownunlimited.demo.uxloft.com/DOC/En_us/Overdue-payment/
http://canetafixa.com.br/newsletter/EN_en/Invoice-for-you/
http://canguakho.net/Download/En_us/Invoice-for-l/k-11/07/2018/
http://casavells.com/vfZoXhgnBkkwBS9/de_DE/200-Jahre/
http://casellamoving.com/doc/EN_en/Invoice-Number-88837/
http://centomilla.hu/doc/US_us/Inv-07586-PO-1H255138/
http://centr-maximum.ru/NpGfALqWiYbeQZNvdS1/DE/200-Jahre/
http://cevahirogludoner.com/4IU/SWIFT/Smallbusiness/
http://chandrima.webhibe.com/517671JU/ACH/Personal/
http://chang.be/Corporation/En_us/756-95-132253-654-756-95-132253-139/
http://chang.be/scan/US/617-32-449028-622-617-32-449028-476/
http://cheapnikeairmaxshoes-online.com/0866X/SEP/Business/
http://cidadeempreendedora.org.br/wp-content/upgrade/11MGJM/SWIFT/US/
http://cleaningprof.ru/i2BsOjR/de/Privatkunden/
http://clinic.onua.edu.ua/1664WCRXVUC/WIRE/Business/
http://club-gallery.ru/936JUIKN/SWIFT/Commercial/
http://corporaciondelsur.com.pe/3194DKQPCUL/identity/Personal/
http://csckoilpulwama.tk/9765497CTH/BIZ/Smallbusiness/
http://cuidatmas.com/972DKDLYCA/ACH/Smallbusiness/
http://cunninghams.agentsbydesign.com.au/9R/BIZ/Business/
http://d2.gotoproject.net/2468OFX/oamo/Smallbusiness/
http://datos.com.tw/logssite/7962JEUO/biz/Commercial/
http://ddyatirim.com/assets/2GPUOX/biz/Business/
http://debellefroid.com/7759PI/com/Business/
http://dev.kevinscott.com.au/85SRSH/PAY/Personal/
http://diamondlanka.info/files/En_us/Open-invoices/
http://djeffries.com/58727GSSW/PAY/Commercial/
http://djwesz.nl/wp-admin/3NG/PAYROLL/US/
http://doimoicongngheviet.com/05HCEFCRV/biz/Personal/
http://dorsetcateringservices.co.uk/618LYIXH/identity/Smallbusiness/
http://dr-daroo.com/101YXGLLU/ACH/Commercial/
http://dreamachievrz.com/94DQQIM/PAY/Business/
http://drivinginsurancereview.com/9479735XK/identity/Commercial/
http://dshshare.ca/24784AH/biz/Commercial/
http://duanquangngai.com/3674OMTGQ/PAYROLL/Smallbusiness/
http://dumnapulcesty.cz/75649VP/biz/US/
http://edengardenrewari.com/xerox/US_us/Past-Due-Invoices/
http://eduardoraupp.com/5932524XRKENYI/WIRE/Smallbusiness/
http://egomall.net/249ZMFZVA/BIZ/Smallbusiness/
http://eis.ictu.edu.vn/9854TVPI/PAY/Smallbusiness/
http://elfgrtrading.com/sites/En_us/Summit-Companies-Invoice-0759166/
http://elieng.com/3494990NHWRR/com/Personal/
http://emark4sudan.com/DOC/EN_en/Paid-Invoice/
http://emilyxu.com/5AFBW/BIZ/Smallbusiness/
http://esinseyrek.com/Corporation/US_us/Outstanding-Invoices/
http://estelleappiah.com/oldsite-06-08-2015/files/Nov2018/US/Invoice/
http://estumpbusters.com/xerox/EN_en/Outstanding-Invoices/
http://excelengineeringbd.com/qihwd/77352DUG/com/US/
http://exeterpremedia.com/1PIKISST/SWIFT/Business/
http://ezpullonline.com/Download/En/Paid-Invoice/
http://fancygoods17.org/INFO/En/Paid-Invoice/
http://fantastika.in.ua/3616974KVTNZUT/PAYMENT/Commercial/
http://fantastika.in.ua/BR14GfgUp/SEPA/Service-Center/
http://farmasi.uin-malang.ac.id/wp-content/Corporation/63HSOTD/SEP/Business/
http://fastoffset.ru/p9gxj4I9d7LYdcFZRU/de/Service-Center/
http://felipeuchoa.com.br/wp-content/uploads/doc/US_us/Service-Report-30005/
http://figawi.com/89505JQJPX/BIZ/Commercial/
http://fixdermateen.com/Download/EN_en/ACH-form/
http://fmlatina.net/INFO/EN_en/Invoices-attached/
http://folk.investments/25WWNSFDHU/SWIFT/Business/
http://folk.investments/default/EN_en/Scan/
http://forum-rybakov.ru/tmp1/default/En/Open-Past-Due-Orders/
http://fpw.com.my/9510855GQDPQ/oamo/Business/
http://fullstacks.cn/667YVYXTG/WIRE/US/
http://gippokrat-ri.ru/309B/PAYROLL/US/
http://glcdevelopersapp-env.kanjpmbfka.us-east-2.elasticbeanstalk.com/8204295AQNX/WIRE/Smallbusiness/
http://glyanec-adler.ru/822M/SEP/US/
http://goldland.com.vn/wp-content/uploads/669872ILEOSYBB/PAY/Smallbusiness/
http://governmentexamresult.com/Document/US/Sales-Invoice/
http://grandtour.com.ge/sites/EN_en/Paid-Invoice/
http://greatvacationgiveaways.com/6VRRMAFHD/WIRE/Smallbusiness/
http://greenbuildingacademy.org/727EDSVSB/SEP/Smallbusiness/
http://greenheaven.in/8332803LUAQJSKZ/PAYMENT/Smallbusiness/
http://grille-tech.com/irTZxa/DE/Privatkunden/
http://gueben.es/FILE/En_us/Invoice/
http://gularte.com.br/879QGYHL/oamo/Business/
http://gundemhaber.org/3499016Z/oamo/US/
http://haberplay.site/wp-content/uploads/FILE/En/Past-Due-Invoices/
http://hacapuri.com.tr/8432VVMRIXLB/oamo/Commercial/
http://haraldweinbrecht.com/newsletter/EN_en/Invoices-Overdue/
http://hciot.net/3KZSNNTXT/Corporation/US_us/Invoice-receipt/
http://hectorcordova.com/8440UNN/ACH/Smallbusiness/
http://hellodocumentary.com/doc/EN_en/Invoices-Overdue/
http://helpdeskfixer.com/INFO/En_us/Past-Due-Invoices/
http://hockeystickz.com/45DPOD/WIRE/Personal/
http://hydro-united.pl/8761572G/com/Personal/
http://ibws.ca/347GS/ACH/Commercial/
http://ichangevn.org/default/EN_en/Outstanding-Invoices/
http://iclikoftesiparisalinir.com/99284VBA/PAYROLL/Smallbusiness/
http://idayvuelta.nu/wp-includes/LLC/En_us/Invoice-for-d/i-11/08/2018/
http://iepedacitodecielo.edu.co/2ZWQWL/PAY/Personal/
http://ij-consultants.com/6FATKLH/SWIFT/US/
http://imefer.com.br/372OZLXI/oamo/Business/
http://imish.ru/973815XWDCVEXE/PAYROLL/Smallbusiness/
http://inspiraat.nu/MwcvvWPg8pVbOYZZ4/SEPA/PrivateBanking/
http://investicon.in/wp-content/plugins/workfence/89614BAPN/PAY/Smallbusiness/
http://ism.bao.ac.cn/astro/HI/849MC/oamo/Smallbusiness/
http://ivcontent.info/LLC/En/Important-Please-Read/
http://juegosaleo.com/sites/EN_en/Open-Past-Due-Orders/
http://kamadecor.ru/qe0mKLJTQYHYFUSSs/BIZ/PrivateBanking/
http://kebun.net/wp-content/default/US_us/Open-invoices/
http://komedhold.com/wp-content/289DCD/PAY/Smallbusiness/
http://kulikovonn.ru/Download/US_us/Invoices-Overdue/
http://lambpainting.com/281690VGW/PAY/Smallbusiness/
http://laparomag.ru/45936MZOL/PAYROLL/Smallbusiness/
http://laurascarr.com/INFO/US_us/Overdue-payment/
http://lead.vision/mobile/54218CNYKG/PAY/Commercial/
http://lesbouchesrient.com/logsite/Nov2018/En/Open-Past-Due-Orders/
http://lespieuxprotech.com/Download/EN_en/Open-invoices/
http://listyourhomes.ca/22AG/PAYMENT/Smallbusiness/
http://loei.drr.go.th/wp-content/FILE/US/Document-needed/
http://loei.drr.go.th/wp-content/scan/En_us/Invoice-receipt/
http://lovalledor.cl/DOC/US/Past-Due-Invoices/
http://lrksafari.com/126082IR/SWIFT/Business/
http://meleyrodri.com/5YKRKE/com/Commercial/
http://mils-group.com/944SNB/biz/Personal/
http://mint05.ph/5VCIFIJ/WIRE/Personal/
http://mironovka-school.ru/doc/US/Outstanding-Invoices)/
http://mironovka-school.ru/doc/US/Outstanding-Invoices/
http://mosti-tonneli.ru/sites/En/Open-Past-Due-Orders/
http://multiaccueil-quesnoysurdeule.fr/10KHEYT/WIRE/Business/
http://napm-india.org/1LQU/SEP/US/
http://netsupmali.com/34DJZJAKV/WIRE/Smallbusiness/
http://nga.no/91985U/biz/Personal/
http://nga.no/hqFjqeyKW/SWIFT/200-Jahre/
http://nikbox.ru/Reke5kkZjha/de_DE/Privatkunden/
http://nuomed.com/Nov2018/En_us/Service-Report-3672/
http://nutrican.com.ar/30WY/identity/Commercial/
http://nutrilatina.com.br/6V/com/Business/
http://oliversbarbershop.com/Download/En/Paid-Invoice-Credit-Card-Receipt/
http://omnigroupcapital.com/02403UR/com/Commercial/
http://onlinecoconutoil.com/newsletter/En/528-26-700203-776-528-26-700203-219/
http://ourys.com/2JKL/BIZ/Business/
http://paternoster.ro/Document/US_us/Past-Due-Invoices/
http://peacesprit.ir/526WSDPLW/PAYMENT/Business/
http://perflow.com/990521WYBZFUKO/SWIFT/Smallbusiness/
http://pers-int.ru/02PE/PAY/Business/
http://peruwalkingtravel.com/xerox/EN_en/Invoice/
http://phaimanhdanong.com/multimedia/99EGMMQ/PAYROLL/Business/
http://pirilax.su/4757B/SWIFT/US/
http://pirilax.su/6ZW/PAYROLL/Commercial/
http://plastiflex.com.py/554GQOIASO/PAYMENT/Business/
http://prekesbiurui.lt/DOC/En_us/Invoice-for-y/u-11/08/2018/
http://property.saiberwebsitefactory.com/0155897A/biz/Personal/
http://prva-gradanska-posmrtna-pripomoc.hr/54LURWM/oamo/Personal/
http://pstore.info/986896Y/PAYROLL/Business/
http://qinyongjin.net/yqkjgqgj/4532692NJ/biz/Business/
http://qinyongjin.net/yqkjgqgj/979KVTDSKKY/PAYMENT/Personal/
http://raeesp.com/4827GWQCGH/com/Commercial/
http://raeesp.com/hUc77ZvQQxq/de/Privatkunden/
http://rcaconstrutora.com.br/67665REOL/PAYROLL/US/
http://restaurant-intim-brasov.ro/21681UE/WIRE/Smallbusiness/
http://retro-jordans-for-sale.com/629YYHGMI/PAYMENT/US/
http://robotop.cn/826919MUE/SWIFT/Commercial/
http://robshop.lt/5QGOXCWXK/biz/US/
http://sagestls.com/wp-content/95OPU/identity/Commercial/
http://sahinhurdageridonusum.net/96399M/SWIFT/Business/
http://salon-semeynaya.ru/6JCUBEA/identity/US/
http://santoshdiesel.com/8632793WWHZBF/SWIFT/Commercial/
http://seegeesolutions.com/Document/EN_en/Invoice-for-you/
http://seo1mexico.com/Corporation/US/Scan/
http://sesisitmer.com/DOC/EN_en/Outstanding-Invoices/
http://sevremont-plus.com/xerox/US_us/Service-Invoice/
http://sharpdeanne.com/newsletter/En/Past-Due-Invoices/
http://shaunsmyth.ch/2424068FKYQQBG/PAYMENT/US/
http://shingari.ru/Lo0o7ZcsHzfmpH/DE/200-Jahre/
http://shop.irpointcenter.com/23289HBKXSWO/com/Commercial/
http://shop.irpointcenter.com/INFO/EN_en/Invoice-4512460-November/
http://sightspansecurity.com/2116087xsaiumsi/ach/personal/
http://skyhouse.ir/8515XOEI/oamo/US/
http://smartcare.com.tr/smartcarecoaching/1ZAAIZGLH/SWIFT/Personal/
http://sophis.biz/8YCOXH/PAYMENT/Commercial/
http://souferramentasipiranga.com.br/9308806HLTOGGD/oamo/US/
http://spiritexecutive.com/0X/oamo/Smallbusiness/
http://sprolf.ru/Rd9lsSoGZ3rwA7SLdj/SEPA/200-Jahre/
http://sproutsschools.org/781HCFWVWR/PAYMENT/Smallbusiness/
http://srtms.in/37SIC/PAYMENT/Business/
http://steelbarsshop.com/198598LC/ACH/US/
http://stefanobaldini.net/components/DOC/EN_en/Past-Due-Invoices/
http://swiftsgroup.com/LLC/En/Outstanding-Invoices/
http://taman-anapa.ru/default/US_us/Open-Past-Due-Orders/
http://tanjiaxing.cn/67279V/identity/Commercial/
http://tbnsa.org/609KK/WIRE/Business/
http://techtrainer360.com/newsletter/US_us/Invoices-attached/
http://test.vic-pro.com/xerox/US_us/Sales-Invoice/
http://thaiascobrake.com/files/En/Invoice-receipt/
http://theitalianaccountant.com/2q3vHmMo20dW/biz/Privatkunden/
http://timlinger.com/DOC/EN_en/ACH-form/
http://toramanlar.com.tr/838021IQVGEOTZ/4TLTAAM/PAY/Smallbusiness/
http://toronto.rogersupfront.com/kyJzuMtkAWLT9/biz/PrivateBanking/
http://track.bestwesternlex.com/track/click/30971017/raeesp.com?p=eyJzIjoiUC0zZ3F4QVVNbGtoci1hUmFob0ZqZEJUdzVVIiwidiI6MSwicCI6IntcInVcIjozMDk3MTAxNyxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvcmFlZXNwLmNvbVxcXC9oVWM3N1p2UVF4cVxcXC9kZVxcXC9Qcml2YXRrdW5kZW5cIixcImlkXCI6XCIzMDEwNzI1MGFiODY0NTc2OTBhNzA3Yjc3MWEwZTYxNlwiLFwidXJsX2lkc1wiOltcIjk2YTliMzdhZTU4Njk5M2FlNzc3Y2ZiNGQ3MzU1YWFlNzQ2ZjE3NzVcIl19In0/
http://transimperial.ru/671VJSAK/oamo/Business/
http://ts-prod-assets.tripleseat.com.s3.amazonaws.com/assets/008/801/364/INV-7YTG57078.doc?1541678799/
http://tulparmotors.com/6837822BWNNX/PAYROLL/Smallbusiness/
http://vcorset.com/wp-content/uploads/387755Z/com/Personal/
http://vengemutfak.com/1949399FJZQBMTP/ACH/Commercial/
http://visiontomotion.com/LMS/question/engine/upgrade/HEu6VwUOv/biz/Firmenkunden/
http://volminpetshop.com/16BEVDPAK/PAYMENT/Personal/
http://willbcn.com/Corporation/En/Invoice/
http://witfil.com/xerox/US_us/Service-Report-25140/
http://www.200hoursyogattc.com/3ZVEW/identity/Personal/
http://www.247computersale.com/872RLSFNQ/oamo/US/
http://www.24complex.ru/UyQEaUv35HnH2/de/IhreSparkasse/
http://www.2itchyfeets.com/doc/US_us/Summit-Companies-Invoice-6051598/
http://www.aforttablecleaning.com/403ASBTKWS/WIRE/Smallbusiness/
http://www.alsahagroup.com/504408RKJTL/BIZ/US/
http://www.andradevdp.com/9267VHDJQUB/PAYMENT/Smallbusiness/
http://www.antalyahabercisi.com/files/US_us/Important-Please-Read/
http://www.aonespot.com/scan/US/Invoice-receipt/
http://www.aquastor.ru/18FLK/BIZ/US/
http://www.aquastor.ru/53WDCT/oamo/Business/
http://www.asianint.info/258647W/identity/Business/
http://www.bangaloreadisaibhavan.com/587682GWZFNSZB/SWIFT/Commercial/
http://www.best-web-page-design-company.com/6259DBAIGJ/SEP/Business/
http://www.blubrezzahotel.com/xflri3kf/6STFQLADP/SWIFT/US/
http://www.bnmgroup.ru/993739WUEJDY/WIRE/Smallbusiness/
http://www.busparty.com.br/91XMGVTTTC/PAYROLL/Personal/
http://www.bzdvip.com/yRewI1wbu/DE/Service-Center/
http://www.camlikkamping.com/SpryAssets/74GPOXEQPD/PAYMENT/US/
http://www.canguakho.net/Download/En_us/Invoice-for-l/k-11/07/2018/
http://www.carnavalinbest.nl/11C/PAYROLL/Smallbusiness/
http://www.centomilla.hu/doc/US_us/Inv-07586-PO-1H255138/
http://www.christolar.cz/FILE/US_us/047-92-716972-835-047-92-716972-285/
http://www.cityoffuture.org/638784MC/WIRE/Smallbusiness/
http://www.cursosmedicos.com.br/7385PJNZUAKB/PAYROLL/Personal/
http://www.dacle.eu/72SO/com/Business/
http://www.ddyatirim.com/assets/2GPUOX/biz/Business/
http://www.diamondlanka.info/files/En_us/Open-invoices/
http://www.dumnapulcesty.cz/75649VP/biz/US/
http://www.emark4sudan.com/DOC/EN_en/Paid-Invoice/
http://www.esinseyrek.com/Corporation/US_us/Outstanding-Invoices/
http://www.espaceurbain.com/2700838EOGU/PAY/Business/
http://www.estelleappiah.com/oldsite-06-08-2015/files/Nov2018/US/Invoice/
http://www.excelengineeringbd.com/qihwd/77352DUG/com/US/
http://www.fixdermateen.com/Download/EN_en/ACH-form/
http://www.forum-rybakov.ru/tmp1/default/En/Open-Past-Due-Orders/
http://www.fundeppr.com.br/996MPGHLQN/identity/Smallbusiness/
http://www.gemmad.co.uk/9021422QWDGABQ/PAYROLL/Business/
http://www.haraldweinbrecht.com/newsletter/EN_en/Invoices-Overdue/
http://www.hotelpleasantstay.com/4061GXJ/oamo/Commercial/
http://www.iclikoftesiparisalinir.com/99284VBA/PAYROLL/Smallbusiness/
http://www.knofoto.ru/4IESE/biz/Smallbusiness/
http://www.modernizar.com.br/062OFLNJWG/PAY/Commercial/
http://www.nga.no/91985U/biz/Personal/
http://www.nga.no/hqFjqeyKW/SWIFT/200-Jahre/
http://www.oliversbarbershop.com/Download/En/Paid-Invoice-Credit-Card-Receipt/
http://www.property.saiberwebsitefactory.com/0155897A/biz/Personal/
http://www.remnanttabernacle7thday.com/6485UEZ/biz/Commercial/
http://www.retro-jordans-for-sale.com/629YYHGMI/PAYMENT/US/
http://www.sahinhurdageridonusum.net/96399M/SWIFT/Business/
http://www.seo1mexico.com/Corporation/US/Scan/
http://www.soldeyanahuara.com/441281SSVQ/PAY/Smallbusiness/
http://www.spiritexecutive.com/0X/oamo/Smallbusiness/
http://www.steelbarsshop.com/198598LC/ACH/US/
http://www.suzanamira.com/Fr6G35vY/SEP/Service-Center/
http://www.swiftsgroup.com/LLC/En/Outstanding-Invoices/
http://www.test.vic-pro.com/xerox/US_us/Sales-Invoice/
http://www.transimperial.ru/671VJSAK/oamo/Business/
http://www.traveltoursmachupicchuperu.com/5460OCJNPKD/PAYROLL/Smallbusiness/
http://www.willbcn.com/Corporation/En/Invoice/
http://www.zerenprofessional.com/66675PLYNTB/PAY/US/
http://xianjiaopi.com/4324873PVXXR/ACH/Business/
http://xiegangdian.com/wordpress/Document/US/Paid-Invoice-Credit-Card-Receipt/
http://xn----7sbbae3bn0bphij.xn--80adxhks/Nov2018/US_us/Service-Invoice/
http://xn----gtbreobjp7byc.xn--p1ai/32NNLUEIY/com/Commercial/
http://xn----gtbreobjp7byc.xn--p1ai/892N/biz/Smallbusiness/
http://yaneekpage.com/zYaJhQTJNr/de_DE/Firmenkunden/
http://yogahuongthaogovap.com/DOC/En_us/Open-Past-Due-Orders/
http://youtabart.com/038FLZCCUO/ACH/Smallbusiness/
http://yukmapan.com/189JM/com/Commercial/
http://zalco.nl/Aj5JNjMzzRJ/de_DE/Privatkunden/
http://zerenprofessional.com/66675PLYNTB/PAY/US/
https://belapari.org/6388TTVJAJME/PAYMENT/Personal/
https://cuidatmas.com/972DKDLYCA/ACH/Smallbusiness/
https://sightspansecurity.com/2116087xsaiumsi/ach/personal/
https://u3688615.ct.sendgrid.net/wf/click?upn=RcVRSRs2k0IgZ-2B-2F13yqJPaeJZdEq3k9X3hVqlmPSvDt0tt2IZlEw9-2Fbz5aUDQ4I-2B88G-2FCEhNBbrFEQ4-2Fso15oA-3D-3D_N-2F5ETLTa35PSDDmVI7LoNsBB49MMUSRPWJ2JHussl9-2B-2F0AsqBHWs4UqBcH5WCX8-2FInfozcJmgiDhyzD-2BLbZVQuLx1vkMCGqowaJFqbeZ7NKBMbAsGDEd9qQ7eVh-2BSc3JtsOgqTJB8gGgHuA3f6FltZo1mu1m3xGo68epTXws9JX9S8dWs82PYnMh86vbX3Ed-2Fffg3M-2BLVSMYn3G-2BnglzcQ-3D-3D/
https://www.cuidatmas.com/972DKDLYCA/ACH/Smallbusiness/
https://yukmapan.com/189JM/com/Commercial/


```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-08 23:11:00
SHA256:
44bcdc56cd842e5375efc46de3024992c8b06cfb0cfaa661d898f2ee869b821b
003591243133d77d308b2aeabaa396dbb8287c60fecf6a7645771e10317d9e5f
59da97b68f8450c3e6bd14d0bdeaecfa32d61f4bcab48ad90565f94014d49527
77e3a5bc43e8f7337819165120eaaf4c01a63184f206e61a897e5a5330f6a035
10c1f5f9baabc6450aec3bcf979ac18a8cc16f9bb1b3eaa56bb7138714497130
2c1a1c2c47668064bafc2a37db3a60527068813f5865dffce44d80858d32a3e4
647421be22e4d004dedb97dddc6408ebd475d102963c7f40992fab3b5e56dd9d
6eb5a3263f2a962c9fc10e8fe64b5cea55f625e0fc72fcbe3077315e95cd2ac3
c9f588732f8250f3640df3a5b1dd41aba6847c56718f425856a289b0680bd10c
cad49daaa3ca3d7bd46b472723c5cb9b19006dd13303e2aaad0231295ec5a650
eee7617113d4a7d6efd12c71027618c908f47aa4e4e96b19f4c1805c166fe876
68e5cf10c297a7862c047d35228f9121d32a9d7012c9df0aa015e496e3fa434c
c994b1ee2952fcf4c11a83a3031b16ef939ef2b6ff8d002ab9dd8174e43d7b6f
8481620269d137b8bd05d6808d7f84072fff396f4acb2f445b2685d4ea1c20cd
12e9a9a645d810f2e198087ce972da09caa2cb228e0f7032593aac587127cac2
9f6882af874f9b46d28a1b37955a42ac69e5b74bb5f4e3a7af85db7397a0a504
ae4df3f30e27acd583ddd6a02daccb1d807212f369007de06dfecbadb35dd064

http://gbsbrows.com/JZLqJd4
http://www.sastudio.co/GgGV3mOVlN
http://xn----etbgbwdhbuf3am6n.xn--p1ai/OYRECjhJU
http://evelin.ru/fgARtN6g
http://priscawrites.com/tS6M2ffhC


Creation Time	2018-11-08 16:04:00
SHA256:
8b4bf9c2ed1b934e01d5d64fc8eda3d442c5f6ef7a5151ebadcbcebe9a7acd47
1197a623fa85aef3b64389fc4c413fb74208791e21034b205bb4ef1063d319a6
1c942e4d87c93a6fa59065ac7eb5c76f6f6acfab25e5f8843beaaaf8229f328e
5180c6e94e4132bd1d7c9f7697e00dc17abc7f480bf60ff75c704b714cc3fd7b
e57f9b7ce52edba1ec74c19714e2a9baaeef40bca090b304ed2bb3704ca285c7
ea7d53b1b0c0425871b2cad02ea8242e849f07fcda6f989752476283c595e57e
ddea806eed156285de41d86b04ae49905f6b34adb09251bda9396615eb39bb28
8690798df86f32a0f2cea2b1b621d933f8ae8e1a856ae67abff43f65f9455af6
1e317356d411a9fb88dc5cc453f6039fb5e828b0be727bcd3590ee788f9b188e
c3116425326f96a0540ea890b1000ee3024992c213345c479ff7e4035e155596
180accd872e1335ebcaecc3726bc8715fef5783cfe8e694bd8e4d8a46a279248
eb00ae7ff3e88a951435d2bd4d7cad1409780c224f744b72d67ad101e740f35b
7ce6dcf9a399877d416926ac2605fbe901c555d803d5f13253753ef43cfb0817
e2572648abd3d970d1c2fb7c534913887f1d912f880c20281ca02e853fee129f
c1b4468828553106702bbbfb0ccb8c78a293c701408bee39cccc464d311794a7
d810657ab2ac06293ce444064c39b28c29bb4d4b14cc866fa65c5c40aabdabf0
1593f36d1cbedbc3d73c19f55d12fa6ebb2a8697a9340433f5420c2cbbb9f23a
385535824144ed45d2618bbd5a2d604bbac94afb0242c0dbf3d201087fc0371f
ea769652fc08b10d18b53a7d920b35b94d23da8d3d6ce03841d5c519342f9359
dc01b127247b752421996cf1553de8eadb8a8636b3fdd1378aa78b53c9b33459
385a7461909257b9a1b154ee0a0f4db583283f741de418d622adbf7d32a4cb8a
944ef7d0fdbc73f54dba6b4bd1df8e3ff0f7d1d50cb759cb00b7312faf36a5f3
07ba042f7c75e835b35ac32e370e496cbf8854bd9f1f20119cbc541214a6a6a5
57a7aa7b7a7c7092296f38d964ba38b1405a2022240344a139cf7333bc87af29
6913925ee5d3ee3c397099fa1eedcfe374a12c9c62572e92c764fe1a8414d6fe
3d7b26de55ca1a8e0e6c25fa757c918d2626f0f33bb50664335e07a3a770da2f
63f9a90115978f57afc2afd56992e1a413d3a6b0b79fd1b0ae5036812cebf12e

http://helpdeskfixer.com/kmvkWIp
http://fyzika.unipo.sk/data/geo/agent/wav2/virus/LWG4sdt
http://lesbouchesrient.com/logsite/1ytczfElCN
http://www.efbirbilgisayar.com/rAwlqp7
http://borges-print.ru/Da4pr05By8

Creation Time	2018-11-08 11:05:00
SHA256:
70c4582ab429a6ed1c580a0e917c7801139b2f7b96ac2fc45f0017ced78ea29a
8f7336bb78e697ba80eed310c63bdbdc721f6430cb002772a4bf2179c1697e6c
3481a7dc18c6924966720b040585e3ce4203e7dcfe81bba78dba2feac6b1c8d7
75b87903540c9362854bfb71f79dc3408a370b1c7aa829af6d12d04fa62fc026
7fc466fbb0512cd1a7213abedb71a6ddba84d0dff4e012d13be1b3f27b95f598
1bc46fa242c7ff83db21f8169567c21026438fc5f6985bb95602ce590139bd68
6d4aafc9c71dbe7337085be20211583724930279a48b0a98e62ee8a3d5a7a530
96e3e5ae8b36724f9e1c95409c73d1130d93afa7e0659d52997a67846be12e9b
8961ce481d754141af7af5f15e09e829a0ae53821aa466e41f1fd788f83cd92b
df293e00369843ec93a81cf8f96d41a86438bb7a1920b3e347de90a904e8a377
45ac4e9600cd8a3a143cba0f4b655b82dff52867774f236194a35e6b21a8fe70
5192081422d54f42774310a4b9521725b42d58708d3fade304ceb2b48025f6d5
bb8473cab0b5d82cce325a1cfcd434e0641a52d0c100376fdbf6290c1a5af688
3570d1982858cbc7c209f611e5d5eb7eb9e626907aad27243e34daf4919d2892
4aaac5950c0405bd5afd633c56330709075d0f7b4afe49eb2842985db5ff6faa
00ad96a25485e893980b4d37bc4c8146c8b14644e4d6f9b6f6c4af9c2cd8a86c
1b70d7e452d68eee61465edc3c8adcd7cf4a1ec155e8ddfe846db68c6807f9a0
ab4e5d7bc57b1ef35f09d0f12a20f770d17ab10e22e6d2c66397072da9257ce8
95ccdde554a10ec8a9e4946296d92033aa7f712e44747d0859bc52476eadf02c

http://madisonda.com/PncwJNSS
http://atlas-lab.ru/iooP39igv
http://migrac.com/CbVFJsO257
http://speakwrite.edu.pe/language/GbnErpSb
http://www.bundleddeal.com/dveNyRR42

Creation Time	2018-11-08 03:58:00
SHA256:
60fc5fe7e6b3de599bf01ff3cfa750f95faa0ded389e8858de24561507274531
97ba9903760db96cb1659c9ac914335e164db4df8eba631d14c0806427a5f3aa
9017dadedf804a4e13915dad839ed9df00621061d4bddc8fb5520daa5edc2766
e4f65a411246fcf3d9e2b41c41faea35cdd796229b17b3e7f3794e007e1b13b5
2e2c3a44d48c36e154fcce81faeb6a2fc95d5264eb601c8c6c8b846f7eece9c6
b08ab34d675266fd012014a09ca1af376392c3b4a00c5c6981ec124c872b540a
a7e80c448efb6e22d4bbeed42add330ac4d581b42f07d5ccce9073b7298faa27
66e9bb6fb141fca015463ef430a5d955d0477b644155ccbf428ce7af6d1828d9
0333bb3655416bb70ce170b6639c345d08c9fd37a47e981cc913b68204ab2cfc
c81562bf33c1e35bead2b9db4f0825e866f0343735182b96ae4a7a3dd51cf291
51c02006263ab729c695ad5594e8df9f22cd9be5e419f0e5796426514b94dc2d
26fbb6f51c8396e3d64b603f78b9440b06d81e1c4b1897901287abe1d48df0b2
ed012c8bb21721f2a68304abda7e68452a1419a6617b53724642797d8e5ae6fa
f5157bb10f4869655706640c47f5dedd2a97a8ffd49284fff261427521f66beb
577a152093f7481d8d437e5826673a12692db008e1de00bd87d57d730e5ccf40
e5dfed83fb965cde0dbbfd21577f59dd71eea99185e5d1836c0ea2dc20b9d4d2
be645b0d9b086cd962bb27333a1bcb3379d3739dc9e5e9f3f8e8f1a97ba792fb
9b716abff6984130172f7efe3ae3a603d8fd9f5f75b388c7b2c3921e132ad7b2
ab4a021ae7e085a71a80ce7ec8ebb3ca2f2fcc183705071f6e483f6e7f98dfa1
110eadfb5f462cfd22bfbcb0d8cc0b218cdb720a357997e4afeb636491f8ffaa
ec3b2b6febb35f8a51d08a718412c93d8978c24e9c791817370dac7f0884e27e
8e1c2489094ec22269b8fd8fc733b4ad4c360850a643f1cfefe497049be2bc62
524960d840a94228f410dfa281b24e1438d4d80fb3f8b6ae143284141af84607
29dbe0d274dd02917b97a77de3989e2907f5e55251ea42b32f0624a6b260374b
3fc7c70af48172664df06453be12dea9e53b2d37c06eb65bda9524852d03bcbc
9ac279646788fec6dc1621e622e507ecd58432ae09428eb48728763ec9d18b5b

http://boxofgiggles.com/Ts7kBW9Yg
http://carbonbyte.com/gNvePvCus
http://carisga.com/gwtryWL
http://www.gtworldacademy.webhibe.com/JCUxhB2E
http://www.ayoobeducationaltrust.in/r4KfYtf1JX

```
#### SHA256s for Epoch 1 Payload EXEs seen on 11/06/18 ####
```

487434c91a40357b2b9e8b8888f6523e77e6dcdd108a4eed89cadce8de0b123a
f8000aaf823f1327f38052e8914b863794a44b8b2991667bd2066bc5e7a03f22
616084af06e1d2af84097716846a1cebac58fbd3a2f078ebecc0843e5e039bb6
e93faa873c651c2b89b6eb9d3b3d2c226e13c9113d91f5d11f023198300e269e
63b0ecc943fce32c509e12af374918b7d0c9c65663f5b2e100facc2faee1dc81
64bb87460f4f11717891f4598f20bf4913f70a0ae2e71d71c69f37193a65ad6d
c22b1dd5348d6fe4afd2c96f07846b5f02a2b3baca520fd4c8da641f2774217f
da1534bb3a4562783d4b5d531ce4e1b0c1361f9c5d6b33a040ff72d89c145efe

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-08 20:38:00
SHA256:
2603874b99d565b0fd36e308ee2c1d8de9ada18b33885f4f432d5fff4e79a5a9
9e6b715349a99e708f06bd5b5d0a765742e28f489717fda7290a1c6672d9895d
ce2cbaf245772ffd96d1f26f1100a47191ec6465c31649189888f55be406b3ca
974bb04266ebb7d31802ff9ac60d5428899a7baddaab4bcca4c29e55f1791b07
a5ebce2fa96c3fe9c6a34697dbbe25ed83a21550478d77660994d759e2c77c98
e478be33954e73025e22a39ddfafabcd38f20d95b52e601d0d2156d2328e3e59
0fe82daf5749199f74f3f6085a6749fa2e91d0ba1323d33c59fa4ab0bc82c23a
3329277ebc13bc45cd40c28b51e83c382eb36598a931f9861d7b1ecf402a8a2d
a02b1b73c586228031f394dee8e4fe338f2c1a08ed57e16168d095903d3b8e64
638490afb37f15f79dc33a1ff2f5b81026ccc021d61cbc585aeef5df54175d75
ace08d522b61d893ee9bbfbb1a8477b66042de77c8ec82061993972054670004
4d6da5e8af73d60e45a0bdb8484eb0d241dad34207104c868d5e7b153d591661
826061b8c0ceac3eeb5124e019fedf53f55ecef351736b82a6930137b4b74bab
ae81a753323c0f9879a3f01a81fd3d1a5cf034241327430b999d99b55373f678
788f2664d8d90cc23b7b0f987112fdd80c54de4ba9566a5714392b7fe0208fe9
55424d3137121477ae8e4b62fc854986e55e79c1560691cf27a2f9a42163d6b3
b4da28a1621ea5876ecc11ece53f9ff98547b8869a6c9ee7d067d5f9e40050ef
ed4e49dfa9693a493270dc8c7e43e74764a4b8d73e5784ac84644d983d97dcf1
644a3adea5693680ca5d217ceac61a9362cb1dc851c3c1a121c886bf777bf97b
ff75dbd9b1ca0614fa39637d69651e9397605569bc30d243e8a417df8fbe4573
4abdb5fd9bed9c55ed62f4364d3f98217fddbed8ff5a5f0a5952068c8dec0392
65dd0a961c79c34ce6bbd6a9433a44f3a44550de1d3f53af91c06b45918e090a
6977d4ede9f6b977fc508bbe6ba2c8c016041e85df7b6344394685cfa99fec87
f450368e25cb33035db9b9f53b6616876a3cbba23b2ffed79db86a53e9d0f7d9
703f619bb48b60b91ac18d8ba1c1f3f420c12da675a24c012913573ed4825235
501eed07ad571ab363ec2f2a8db1cfde8ce5e76eef5e0ea9691c139fc73d4073
16d47699c91fc66ad6350f03502f7c9b15dba5874ce8b441b1a5322f82a4033d
2f555628139a56bb01e32db231776cc6b9491d4c06b71b8e8f9ab1fbe7c673f1
30231749d01e4d16fb6f17e1c183cc84e935d3333240ce72d77745b38d5df307
bb907b5c67f138a7ead1754218d4b61eccf3101d9b7a609b83bbb945303047ac
8779752ac01fa0d3b348b00da3bf361911b99a2838f960226e84f260acefb599
97b006e48fc5f35ec402eccd38df13fff9f9ed20818f94659534066ed793a272
c731aead9936d12073ef929d67a653e5c59fdcc8f309d8b0db4e5b93ebf9f7a6
c34f4ec745ba8d3db5f00f7b08df0406c50e69d7aaf3fa61f197e54207ba4ea9
9ab9f92ab6ba6aad05e39eed466cda84b56c209df92805f4b3ad823228390739
644a3adea5693680ca5d217ceac61a9362cb1dc851c3c1a121c886bf777bf97b
d9425a1610eb04f4ba2d32411720a55ed8320512ecf5fe22a018c070c036b21c
afb0c782a106e9f6f765ba8e9ac9de942fe5a02a2eebb686764552024c8c8e66
de297da302bc78c159b7b3567718274dff764e3754a9be3722832548868a942b
29e6629b29e8bb933b7bea30c8a822514d6ecf0e319011f7f994de1e7213ff9a

http://ipuclascolinas.com/8x6SFxw7
http://spurpromo.com/b9eYIWM
http://www.secretariaextension.unt.edu.ar/wp-content/bK
http://tellytadka.net/waOaTDz
http://elom.su/v

Creation Time	2018-11-08 15:35:00
SHA256:
7d3c77ba285ebf6d6ce69e88f23b49d756d2081dbef6296ac387df0ba2fd3d3c
10cc3fef240e2e3f48d6155af7ad0f0667c2b3890662137ab14f4eb519d5db92
7fdb1c03f7a7284dddc0457e793eca012d187fb1c1679950aca570821a6b352f
2bedd8bf8e6ac93fd67260c5d82cad95352238ea8ba2dd351162c39457200e3e
82035d9b995f9232d980f27df349217cb9189b900bdcec85150fc835bf359aed
7077e1c519ff5c35d604ebf6dd52b921e566db20ab57a669518527c36cc5bc9f
0bae6e399d1beb4adf3a5e3709458edfbf1a5bdd705c6df67ecbc541a1d38dad
e6c07f5ae0292e5aa7daaadd3d1ef1bf98fe63f66fd1400d3fa0b62311eac255
ba44d95859def9e7ce638342eb03462c0826ca46b9c8ea0476db64878addaeb3
75d2a9b1b2b15e91a8cf126b90cbb8126702042073fe5d3341ff61ff82675a9e
8fb8f702aeae6cb3096cca3e2e38a56fd75d9ced76b984c522747f0517c3c03d
9ed8c2451ae27127382daf87dc98074b130a46e9ed54792cc15f3209fc82f796
7008678eae1bf9a6c810fcbbcd9f2b0f35bb71d7c19bacdf8a55e28b46d4327a
96bb510e3d581f5661b137e929ddabbd7177b2c68fc990565460c6dc36ea8770
cea0ddc3f6cb707bf9018ae2814cf05d3a79985dfaadbce87218dca9d39b0a31
96b0094233a1487a1ae8b1bb53eb809690a9e7d9d7874f81c985f5b1a9553c37
9854f194448e26b3f04e2c414f4416e0529f38b35e43d0a64701715722a82c3f
0b020582bc52b3ba14735bb2ebcd403fd4427cc3d8730020b3870e8ee1d5d3e2
3afbb7fe5b55ba5c58e0e3c9a9fe0ca8e66ce68b69ee4b5ff2382976c2949b3f
aa8dca5caa97ceef58c783b02f7ad4aa5169cc28eddeecb12f1bf7799b121cb5
d49d6574b21f49734a0e2b6241431661df84f7d36bf7614be0e8149d2de6eea3
d7f2c3437344c74e9dc49a41428660d9e7fa6fd8f76c4566e56ce318706a0028
69629b529662dab9ff0b9d0bbaa83b5c14773f3959c804f348ac556a23a9cb57
92b41f53e1495a6ecf2c37f892262551999ea97ccf72cc30b4ca332540c96b9d
ae22c46a9820503b56eb7548a78668013b7ca456dc5015bfca4226e9eac557ad
469f50c1c6cfbb2dce6c587285ba51f263584eac90ef0350722df06e72706a3d
5435241b4b4ede03ce9313238b8a89800f10f37e3beaf27055280f979ce758a1

http://phaimanhdanong.com/cHelM
http://batallon.ru/siNdFC
http://www.e-zoom.mobi/ZuJeEY
http://destinasidunia.com/wQYk
http://www.diskominfo.asahankab.go.id/kkYOegA

Creation Time	2018-11-08 10:52:00
SHA256:
43d3ec20e669293eb8628f0cc6a38b0d143a7cf55c93d6433935f864c176f52a
9fcf53383a2dee796725b8ad5ee01e602ef9b93c0ebfef6200d55448df623bda
25ac62c5d29f28cff74f95a664fa5856841b130a70fdf0f4c70210e361f6bed3
302ccc4e7fa6cf496d59d778d8ed0f1d2934799653460aa4aa98509069f7dba3
547143925c0c8f466db862a36f623438c1019d49907c4a11297c472ee2e51546
1441a0561991d100e813e23c700ac5352626491de833d9af720628d921b86fd7
753b2b1a087fdd8be3d7d67781fe86a045495f94372df22ca186e6a6ca21a663
488a6807480eae8b91320fd43a3df9516068be7ea871b8dd478ec7d3662997bc
ea36164e20f73599c5c83a2f5e2b55628a5b2a465cd74a8527b292ec79c1c31d
6d77567eec3f017bf6436655a155c11e618971e9806ca21ca49918c90069b10f
eaa60691053dc58f05d2ad7a5e9ffaeee8f53c5a9ebc505915fed05c06809164
6ea3961b94020b5a942bc013c9d5b9c8444c9a36f442e4a49588db8824f30909
277c537847577d3209200d486479c81ac3184d328f0951ca9fc91767f7943596
55913055fbb3ddca12de7529bb0b3df4abcbd1489b3813037e3a1a1f03b13f23
c55e17d88c8f92a84ea19824470fcd8605effeef73c89904a750c0e74482030e
ed508ec5f2d47bc6deb3d706ba32aa62bb16c3477c5bcaeecd2af91c0e0a1943
ef841fed634bbf073804cf953facf526d457fa40a35a0d932a7f776d2b235995
c21179de61c9ea6a1a4bd88838ca6293296e39737d6491a012e55c41df421200
3d03fdbc8ba4b4266c88145f8771d44b9c136171e2c76e86c3e86a080b982724
e75b2858a88962cfb7818a6908ad01a9682b0074e5f996cede0f59c8a83a3908
5af782017f3258f635fe323944cdd13aa8c6deaea5c6a18e0b14f7df8464846f
961d3a096a7427cb171b7a63b27d2ab8a95c0866c2440874e274e7b76c17c026
17854478138d2dbdbbf8f7e78d2f9d63bd58009d341fe0029982b662baccee9d
fbf501ffe44fe9b12cafc703025ce601f3bc1bdbb291e55d441df5d0cc650f63
6381a604665a84b89e9ba574b0d54a13e5b961be1c3b9f9dce95962a6945735a
9eaddcbef361d598b312e7529cf56cc0f8fe4b2e8bdb396c2b85c6154a46a597
aebb81a6d05b646ad0c345c4ef4b4f8a1ec08d703cd48f1d4f149095f47e7a1a

http://www.fieradellamusica.it/4V
http://effluxmedia.com/sc
http://www.machupicchureps.com/7l5Vpp4V
http://www.adtsmartsecurity.com/RDFiiXyc
http://brasileirinhabeauty.com.br/QRu4EMAe

Creation Time	2018-11-08 07:55:00
SHA256:
c9fd66e60cf78fb0e19aa4dcbc4cfa3402ceddba29cfb90f8ed0e241bb4e53a5
1e6cead91340f41192e57b48292cfbbfb8bec3c7815768cb3ca1b284b22d81c0
bce51db10983cf29038a23bd49dc6721bab5547a95967b287a481a93e5159b92
750977f7a6f6642f593ff5a1bdcfca3efad389a2e9c9eab2aa84cb710ff3fb08
4b5feec70b7b2a9048a60b19b7fff66264776404524a3dcf2e4c8eeec36c0218
168ea0a83a949c26875014c54b9e94907734c1a8162eafc7695ac94fb0bae106
1bd399295025d6d9f305c469c5409b4e4aa775a9235ad33710554f51b27dfbfd
f65e2b9255836cd59cd169a0fdf072d43b10f141879a489d79785798c4ea0e89
3d9e7c95ee32476608b70b410bfb6d602aed5fd192e83e1c28c0f48e0b64e69d
d81cb8f2567e1a01301756f57efd27cb4f791d3488e25b5b0f9ff4ec529de0f4
8d573d296b7a5cfee0e83f6a9e8c9161e3e1126b608eebc092310ce3375fdf35
9243685da3defde3ad5297959c49e9d862d86b435eb659cf5de203108eb875a6
665a35854295a9d1479d4d3764958acfdb66961aef1435e750a2843c259de49a
b861572ca2503b3fc8948def7650eb58fc3df24c08c8272cbf4e856f19187488
00a5af4c372bab182ef8aa8deecab6b9dfca034b856253b57a7869ddc9cd7e19

http://tvaradze.com/8
http://artzkaypharmacy.com.au/Sq
http://duwon.net/wpp-app/K
http://mimbarumum.com/ZQrQRYQ7
http://www.bdt.org.br/BtoVJ


Creation Time	2018-11-07 16:31:00
SHA256:

c4478a4db02a64fd5d38d8d62654684067a04a77bcd0c898efbefefe91fa143e
065ad3cb92a773152f7c827d993c1ee092de9aa050dd0f06a1997ff02dc8a9d0
4fc352403394ff98aed2cdd3e548c700cb0225251c1adf222de471378e563a08
efea6d372ebe4d7b60d7199a8366acf0baa26024559febe0cb0466bc19a32305
b0dc1f34bc3cf68e1a98219c61e657aee98d05025447304a26d045b7c847b9b1
c8f69576e5fc713779688615b85faf919fad47cdbe883a4c14bfdf4bbd776041
d0f6f0e8787c53b777da2fad4581055323da6d6aee07a9abd3d3ef9b648e7e98
681cc363fc041671aa207a170fe7700c2e93fc92dcedc9c5fd82bb4ac33c3569
400d20a33d33ea5e6886d9c04dca8b6f579665676211cb4bf35412e75ee13d85
96963e0d210f565c26fab3fbe8cfbbf2ef824a6b7ffff4b3e205bbbff2348f73
2d134f1e2f7f4854d6ba68266ce65e33d6b60b8d6f76b2a55f345b86ff5c362b
2bfe239def043a1d53ad539cd2e37754d429ea2f629ec31537d4581279b20513
f808a4eab23dcf9492e6afbe997ada2fc07d431b625e1277d69301e7ae8d55f7
ef0a3eea675d6b22acc934f0af94b7504e7a27f73602385ddc76fab4aaadd7bf
fabb1baf2a45169b2905dcd2e42fc63f77922f0a1eabf9b8cfd54993841f2699
b194a6a7899a44a600313b78cb0afac8693e16c27e54b740d7decbefb1c327e7
1b371b41d00d4908689d6fe5b56d9eba93e69cb963540045d948d67b5741c4d5
38a95f498021688e8d2be0a27936be3067c96b17236b62ebfb8e00a4b8bfd0d2
16f73488995f88354beb1c589bf66bae9be6da3373b824438847c81014401580
37b2cb1bd480c248cb0485580619a3a46d6033e01edd6a34921918a23f80194e
53b85c79b1013869f61d0ae8cc2b5d5c4b597206438ca1b5d2798ca56ec2a4fa
451b3c70afd30018f5e3203eedca530fcae41eab34641ee844cfad023fe4226e
ca41f559af6ba727b62cd85fd17c54e1856431acb3c485b2ccbba1d402353bfe
f898411e938a4016c3af84a9a75466b2eb4eb7d0bd0f37bf0c84c242f39c9739
a9548108725507e9d7473a4a93658a18a47544f651e0e8ac50f0cedc7667d7d7
62cb96a1dc38ea7cd8c1738f267ca4ccb0de5253abe722a9b51a247aff9762f8
4a2c9082c452d68532bc11d6bb1d684483dc56453f24f7c18b0378bae9a82790
91f9a71093960259914101608b6d8bb64ef9cb4d3dee2c8d87d8057a929d8c46
009a3621ef37a31db9b03aa16fb6434dbef9c98e82f72250451b8a90dfae1bc6

http://steelstraightening.com/sDCqr
http://www.codestic.net/Bm93
http://www.fraserfrance.fr/T
http://rusjur.ru/3dgheWz
http://cisnecosmetics.com.br/T

```
#### SHA256s for Epoch 2 Payload EXEs seen on 11/08/18 ####
```

a67915345f7a32e7c40c51469a983ae18b731a658c04e370f2674ce8246c32dd
30f7e202f871f54121c5d791fddfc6b4ffdc86abcbac32d1b416c3ffb786d277
2ef8e296f75257a0583fc608adf3d0c0aab142b28bd44b698c62459ffb8d936a
832f9efb77513710c7f32442bd87b4a521bfc9c9e8c080908c81bec7d3811a22
1175be83c70c2f140571429d35b3fc2f4a8c755f5a101ec63dd30094e2b5c46e
fb315278068025168e33a322a5e313436bfb3f59dc418f726e184f36c6e25eb0
c59063f09295a90dfa5fbd90cf7b8423aa68ec71c425da8c2143142b109a4f6f
9bb439c20499ad22c4f75ce8f1cd69d147da5dc0c55c2dc4dcdbdfff704b295e
6803739cac3a53cc9855fa7da897a1ae5f7ef127303b9a8561aa1dfe92ab2ec3
ef8914ae40818d3fdc578f08d4ca5927e2ed7c0518a03cda5692521b7796f302
fadfcef4ce33a364fc7d7472a8ea619066625e8df3e5fc6c137057c325783da6

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

104.5.49.54:8443
107.10.139.119:443
118.69.186.155:8080
133.242.208.183:8080
139.59.242.76:8080
148.69.94.166:50000
159.65.76.245:443
165.227.213.173:8080
181.229.155.11
181.27.126.228:990
186.15.60.167:443
187.163.174.149:8080
187.163.49.123:8090
187.207.72.201:443
189.130.50.85
192.155.90.90:7080
198.199.185.25:443
207.255.59.231:443
210.2.86.72:8080
210.2.86.94:8080
216.176.21.143
216.251.1.1
23.254.203.51:8080
37.120.175.15
49.212.135.76:443
5.32.65.50:8080
5.9.128.163:8080
50.21.147.8:8090
67.237.41.34:8443
69.198.17.20:8080
70.60.50.60:8080
77.44.98.67:8080
96.246.206.16

```
#### Spam/Stealer C2s ####
```

47.157.181.81:443
50.121.220.115:80
24.216.53.12:80
72.47.209.128:8080
208.87.225.248:443
216.196.180.70:8090
190.17.44.48:443

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

104.15.149.209:8080
105.247.100.215:7080
115.71.233.127:443
12.139.46.57
120.150.206.156
139.162.151.141:8080
153.122.38.158:443
172.248.199.224:990
173.34.90.245:443
174.70.176.45:8080
200.194.26.234:443
206.174.187.58
208.180.149.228
211.115.111.19:443
217.13.106.160:7080
217.174.206.181:443
222.214.218.192:4143
24.176.58.106
24.206.17.102:8080
45.123.3.54:443
45.42.31.50
46.163.76.187:8080
5.230.147.179:8080
50.96.217.247
64.183.104.2
66.66.196.79
67.205.149.117:443
67.43.253.189:8080
69.198.17.7:8080
69.8.25.109:443
70.77.68.255
72.26.54.182:8080
72.84.82.20
73.57.148.230:443
76.90.224.32:443
78.47.182.42:8080
81.7.10.106:7080
83.222.124.62:8080
84.200.106.120:8080
86.98.71.86:7080
95.141.175.240:443
98.142.208.27:443


```
#### Epoch 2 - Spam/Stealer C2s ####
```

201.171.29.119:80
24.14.3.175:80
186.64.140.213:80
46.249.204.99:8080
138.68.67.4:8080
47.138.19.152:443
68.103.245.205:990

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture: https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list. I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now. Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change payloads every 3-6 hours now and hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100% sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/kSJpX1St - @James_inthe_box
https://pastebin.com/KVNyw9Uq - @ps66uk
https://pastebin.com/y5rXPpk6 - @pollo290987

https://pastebin.com/SkSLDFMe - @SaurabhSha15  Spam templates
https://pastebin.com/DQRAvnVv - @SaurabhSha15  Spam templates
https://pastebin.com/EmQa19CP - @SaurabhSha15  Spam templates
https://pastebin.com/hmXQwQA4 - @SaurabhSha15  Spam templates

```
#### Credits ####
```
(OC and combination work)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie, @Bitterman59
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @Techhelplistcom, @pollo290987, @malware_traffic, @0xtadavie
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @Bitterman59
Spam Templates - @0xtadavie, @SaurabhSha15

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!

```
#### Daily Log ####
```

It seems like the spamming is slowing down today. Nothing really else to report other than a lot of the same websites with new directories and whatnot. Same templates for the most part with minor variations.

```
#### Sandbox 11/08/18 ####
(all with fakenet and MITM unless spam/secondary infection)
```

```
Epoch 1 C2 Run at 22:30 EST https://app.any.run/tasks/11d3e6f3-1cc4-422f-936e-4bb8b7b24c29

Epoch 2 C2 Run at 22:57 EST https://app.any.run/tasks/121d2204-3653-47d1-b552-b0640d1a76a6


``