Emotet Malware IoCs 2019/03/06

## Emotet Malware Document links/IOCs for 03/06/19 as of 03/06/19 23:45 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 03/06/19 ####
```

http://142.93.249.160/wp-includes/sendinc/support/verif/En_en/03-2019/
http://159.65.121.73/wp-includes/sendincencrypt/support/sec/En/201903/
http://162.243.162.232/MiniDistroid/sendincsecure/support/trust/En/03-2019/
http://165.227.169.67/wp-includes/sendincsec/support/ios/en_EN/032019/
http://165.227.213.164/wp-admin/sendincencrypt/legal/sec/EN_en/03-2019/
http://167.99.186.121/fwcly2f/sendincsecure/support/question/EN/03-2019/
http://167.99.229.165/wp-includes/sendincsec/support/sec/en_EN/2019-03/
http://167.99.61.140/wp-includes/sendinc/legal/verif/EN/201903/
http://168.62.186.228/wp-admin/sendincsec/legal/sec/EN/032019/
http://50.28.74.229/wp/sendincverif/service/question/En/032019/
http://aileenmcewen.co.uk/wp/sendinc/messages/sec/en_EN/2019-03/
http://alegriavzw.be/tmp/sendincencrypt/service/trust/en_EN/032019/
http://alegriavzw.be/tmp/sendincverif/messages/sec/En_en/032019/
http://avis2018.cherrydemoserver10.com/wp-content/sendincverif/legal/question/En/201903/
http://awcq60100.com/sec.accounts.resourses.net/
http://bergdale.co.za/wp-includes/sendincencrypt/legal/ios/En/032019/
http://bil.ranksol.com/Dashboard/sendincverif/service/verif/en_EN/032019/
http://brams.dothome.co.kr/wp-includes/sendincverif/service/verif/EN/2019-03/
http://bungkoos.com/736h36tsud/sendincencrypt/service/secure/En_en/03-2019/
http://camera.risami.net/eizujqmnks/sendincsec/legal/verif/en_EN/03-2019/
http://camionesfaw.cl/assets/sendincverif/legal/sec/En_en/2019-03/
http://ciadaradio.com.br/vox/sendincencrypt/messages/secure/EN/2019-03/
http://codedata.tempsite.ws/wp-admin/sendincverif/messages/sec/EN/032019/
http://constructionclub.pl/wp-content/sendincencrypt/messages/secure/En/201903/
http://demopn.com/lab/components/sendinc/support/ios/En/2019-03/
http://deptomat.unsl.edu.ar/web/wp-content/sendincverif/messages/sec/EN/2019-03/
http://disal-group.kz/cacheec916813e9047d94e78f6564a70a635a/sendincsec/service/verif/EN_en/03-2019/
http://drpradeepupadhayaya.com.np/osticket/sendincverif/legal/verif/En_en/032019/
http://eurusd.news/css/sendincsec/messages/sec/En_en/032019/
http://faded-out.com/wp-admin/sendincsecure/legal/verif/EN/03-2019/
http://fondtomafound.org/wvvw/sendincencrypt/service/secure/EN/032019/
http://fondtomafound.org/wvvw/sendincsecure/service/verif/En/032019/
http://google-ads-expert.co.ua/wp-admin/sendinc/messages/ios/EN/2019-03/
http://grupotaqueando.com/wp-admin/sendincverif/legal/trust/En_en/03-2019/
http://guojibu.hnfms.com.cn/wp-admin/sendincsecure/legal/ios/EN_en/201903/
http://halal-expo.my/wp-admin/sendincsecure/support/ios/en_EN/03-2019/
http://iboutique.vn/wp-content/uploads/sendincsecure/support/trust/en_EN/03-2019/
http://influenced.com/wp-admin/sendincencrypt/legal/trust/EN/201903/
http://ingchuang.com/YMITC/sendincverif/service/ios/en_EN/032019/
http://interiodsign.co.uk/wp-admin/sendinc/messages/question/EN_en/2019-03/
http://jfdibiss.com/wp-admin/sendinc/messages/verif/En/2019-03/
http://joanadarc.chama7.com/wp-includes/sendincsec/support/verif/En_en/032019/
http://kose.online/wp-admin/sendincsec/messages/question/EN_en/032019/
http://lazer-rf.ru/tag/sendincencrypt/support/sec/EN/201903/
http://madhusindia.coolsofttech.com/wp-content/sendincsec/service/question/En_en/03-2019/
http://michaelkors-outletonline.co.uk/cgi-bin/sendincverif/support/ios/En/201903/
http://nanyangbaobao.com/wp-content/sendincsecure/legal/verif/EN/03-2019/
http://new.dongteng.ltd/wp-admin/sendincsec/messages/secure/En/03-2019/
http://nowokay.shop/wp-admin/sendincverif/service/question/En/03-2019/
http://perusahaansecurity.com/wp-includes/sendincsec/support/verif/EN/2019-03/
http://ryanprest.com/cgi-bin/sendincencrypt/messages/ios/EN/201903/
http://shreedadaghagre.com/wzaacky/sendinc/legal/ios/EN_en/03-2019/
http://songbytoad.com/wordpress/sendincsecure/legal/question/EN_en/201903/
http://sukhachova.com/verif.accs.docs.com/
http://syncdatacore.net/back_taslif/assets/sendinc/legal/question/en_EN/2019-03/
http://tdc.manhlinh.net/wp-admin/sendincsec/legal/sec/EN/2019-03/
http://todaysincome.com/wp-content/sendincsec/legal/trust/en_EN/032019/
http://topstock.su/qowtdtvmzc/sendincencrypt/legal/sec/EN_en/2019-03/
http://torginvest.ru.com/wp-includes/sendinc/service/trust/EN/201903/
http://travelloc.dev-amgrade.com/wp-admin/sendincverif/messages/secure/En/2019-03/
http://tufacha.com/wp-admin/sendincencrypt/legal/secure/En/201903/
http://umakara.com.ua/icon/sendincsecure/service/question/EN_en/2019-03/
http://usiquimica.com.br/wp-content/sendinc/support/ios/EN/201903/
http://usiquimica.com.br/wp-content/sendincencrypt/legal/sec/En/201903/
http://whitehorsesteel.com/wp-admin/sendincencrypt/messages/sec/En/032019/
http://wordpress.erisliner.com/wp-content/sendincencrypt/messages/ios/En_en/032019/
http://wsu.ac.za/che_audit/Che_Docs/sendincencrypt/service/trust/en_EN/03-2019/
http://www.ankaratekaservis.com/rww30dc/sendinc/legal/trust/EN/201903/
http://www.avis2018.cherrydemoserver10.com/wp-content/sendincsecure/service/ios/en_EN/03-2019/
http://www.deportetotal.mx/css/sendinc/messages/trust/EN/2019-03/
http://www.donghuongkiengiang.com/wp-admin/sendinc/service/secure/En_en/2019-03/
http://www.eenidee.nu/wp-includes/sendincsec/support/secure/En_en/03-2019/
http://www.famarasurf.com/deutsch/wp-content/uploads/sendincsecure/support/verif/EN/201903/
http://www.hurrican.sk/img/sendincsec/support/sec/En_en/032019/
http://www.judonz.sk/css/sendincencrypt/service/ios/EN_en/2019-03/
http://www.khaf1372.ir/wp-admin/sendincencrypt/legal/verif/EN_en/201903/
http://www.mrshare.info/wp-includes/sendinc/support/sec/EN_en/03-2019/
http://www.ryanprest.com/cgi-bin/sendincencrypt/messages/ios/EN/201903/
http://www.sporiz.com/workspace/sendincsec/service/trust/EN/201903/
http://www.steelbarsshop.com/wp-content/themes/jh/sendincencrypt/support/question/EN/03-2019/
http://www.univers-service.com/wp-includes/sendinc/service/trust/EN_en/032019/
http://www.whatwallet.co.uk/wp-admin/sendincverif/service/question/EN/032019/
http://www.youtube-video-marketing.com/wp-admin/sendincsec/support/question/En/03-2019/
http://www.yszywk.net/wp-includes/sendincsecure/support/verif/en_EN/201903/
http://yourasmus.eu/howe3k5jf/sendinc/messages/question/en_EN/032019/
https://usiquimica.com.br/wp-content/sendinc/support/ios/EN/201903/
https://usiquimica.com.br/wp-content/sendincencrypt/legal/sec/En/201903/
https://www.itotemic.com/mckkwjtog/sendincsecure/support/verif/EN/201903/

```
#### Epoch 2 Document/Downloader links seen for 03/06/19 ####
```

http://118.24.109.236/wp-includes/jnn8-ymfke-clsv.view/
http://13.59.135.197/wp-includes/fqhw5-6k88r-dgufy.view/
http://142.93.28.49/wp-snapshots/sarz-p4gzk-ktvbi.view/
http://165.227.75.138/wp-includes/nvgl-it1tv-jpgef.view/
http://167.99.172.18/wp-content/uploads/7se8-o13wbw-mqqzn.view/
http://336ddf.info/cgi-bin/50fhi-i18tmb-cgmp.view/
http://54.172.85.221/wp-includes/loj9-oe8wzk-jcwc.view/
http://abdullahshfeek.info/wp-content/ttpy-gp3ue-ieor.view/
http://apd2.hospedagemdesites.ws/wp-admin/rpdf2-9o0k7z-dmhfv.view/
http://arendus.edreamhotels.com/wp-admin/tksim-vcx58-izhgn.view/
http://armadilloeventos.com/wp-includes/azg8b-9qhy00-empwv.view/
http://azatfazlyev.ru/wp-includes/vtyhl-b812te-vodi.view/
http://bcp-industry.be/_notes/he1yp-syhls-qykt.view/
http://blog.paras.ir/wp-includes/gkd52-olvzq5-bjdsh.view/
http://bounceg.com/wp-includes/jxo3c-0as6kw-zfetp.view/
http://cattleyadessert.online/30sh5im/sbmbf-5n3bk-cxep.view/
http://cursos.lincect.com.br/wp-admin_old/v1og-a6s37-frfy.view/
http://deconmit.com/sanpham/p1f2-0u85e-hqir.view/
http://designer.ge/wp-admin/4bqeq-odcmt-xixs.view/
http://diyiqw.info/ydtsdnqzqu/ozwiz-5vhn9-rolh.view/
http://dmf.karsu.uz/wp-admin/q23x-65cgl-ftutd.view/
http://doveroma.com/wp-includes/9yfp-mee157-mfhf.view/
http://droneandroid.cz/test/uhpv-zkyod-rjcdb.view/
http://drroller.us/cgi-bin/k6bo-hgnzs-bcvx.view/
http://ebjedpabrikankaos.com/wp-includes/hr2v-qwtlg-oddfm.view/
http://edvanta.com/wp-content/uploads/3rjm-ts6b3-lxsd.view/
http://embraercssguide.com/wp-admin/5zglz-kgww7q-xvsi.view/
http://fondtomafound.org/wvvw/56cvz-9d017-brfzr.view/
http://gadgetzone.bh/store/w4qe-vnam6-mdjl.view/
http://geecon.co.uk/brizzy/facr-hapmg5-kmvo.view/
http://getacom.org/wp-includes/tnvwr-m1iof4-bojhs.view/
http://goldfera.com/wp-admin/0gtsi-cgszxl-zjgw.view/
http://hlttourism.com/wp-includes/6y2nl-nlj7qt-rffgz.view/
http://honeygico.com/wp-includes/tj5c-zagzee-dbfah.view/
http://hopex.com.co/cgi-bin/6dkpt-3itqgw-aekx.view/
http://iszuddinismail.com/wp-includes/nw4qn-u94jy-ojey.view/
http://jsbspod.com/wp-includes/0et51-s6mqn2-pwmz.view/
http://kalo-vau.hu/error/blaz-fmsj3-nznut.view/
http://khaivankinhdoanh.com/wp-includes/5f4jw-crl3s-wrle.view/
http://legendsoftbd.com/css/c61ub-hnawf-halt.view/
http://machdeinbeinfett.info/cgi-bin/1ol2-skpgw-xetqx.view/
http://machebella.com.br/woomcl/zkpgn-q89jju-vkft.view/
http://malkow-pl.revres.pl/wp-content/1wlg7-eypdtn-mmff.view/
http://marisol.092.es/img/rr39-y7qu5m-twbrd.view/
http://mikekirin.com/css/c7xwy-vjhtd-zqqh.view/
http://milakeinternationnal.com/wp-admin/3km50-hayq8x-jfpt.view/
http://mrzaheer.com/nxb/38kr-j1kqhr-qpna.view/
http://nanyangbaobao.com/wp-content/10g5-gvuhq-llpm.view/
http://nrgeotecnia.com/wp-admin/6na8-i2wb3d-mrwc.view/
http://parvathidigitalsystems.com/wp-includes/gl71h-lweqb-xhlag.view/
http://promotoyotaindo.com/wp-content/ke1y-3jginq-rkrh.view/
http://sahafstandi.com/wc-logs/954w3-nkswpf-wqbj.view/
http://scenography.om/dhl/hhsdn-bew00-mjmx.view/
http://study.ir/uhm1ins/sdlv-j1ov5-lppt.view/
http://tecnologiacervecera.com/wp/f0na-9tr1b-ziiap.view/
http://test.proapparel.my/howe3k5jf/ufc34-hoo135-mwqb.view/
http://thientds1809a.dizito.me/wordpress/vzeqm-vdmnw-aaim.view/
http://thienuy.com/wp-snapshots/c2h8-kgbl4i-xtas.view/
http://tijenkaras.com/wp-includes/wave-haepe-nrgnu.view/
http://tinhdauhanoi.org/tdtsapb/pi7w-gy49w-gpzyv.view/
http://tongphanphoison.com/kgzz3bl/8zk7r-0g155w-mtna.view/
http://top5e.com/cgi-bin/z4qm-o2k5c-ntdr.view/
http://totaltek.cc/wp-admin/t1dvl-nl53p4-utpe.view/
http://trendendustriyel.com/wp-content/1b8n7-4aqe6-ejca.view/
http://tutoriseguranca.com.br/wp-includes/dmmd-j19e6j-mqjp.view/
http://underconstruction.webrammer.com/buY4KD/0kpxb-z4avw3-qifva.view/
http://useit.cc/imades/40nv2-6dhdp-sejg.view/
http://usiquimica.com.br/wp-content/y81zm-iksm8-jeynm.view/
http://uzeyirpeygamber.com/wp-admin/6n14u-oh9t7w-wklbt.view/
http://vinfofix.com/wp-admin/ffsd-17grv9-wawxn.view/
http://waitbuzz.net/insta.waitbuzz.net/zmyap-uleb1-nwqdf.view/
http://website.fauzulhasan.com/wp-content/64xlz-71ng2f-srxet.view/
http://webtop.lv/wp-admin/rssk3-gxdhud-hstdt.view/
http://willson.dothome.co.kr/wp-admin/hyoyd-ksd6gu-etji.view/
http://wordpress2.fauzulhasan.com/wp-content/ykt9-e6h3k-eioqe.view/
http://www.80smp4.xyz/o0jvby2/b0727-0ht99y-jlbu.view/
http://www.allstate.com.ng/tmp/upload/qu6h5-08hpr-ettju.view/
http://www.basse-vision.info/afkogprean/kdyjx-lcdoc-fftk.view/
http://www.breathenetwork.co.uk/tmp/4d4cu-6gxnm-mlvc.view/
http://www.consultor100.es/wp-content/htm7g-788at9-sxvy.view/
http://www.diaf.com.sa/cgi-bin/3rbc8-phwuo-dkzn.view/
http://www.dron-draper.com/wp-content/wcqd-l1cp9-fmkt.view/
http://www.eurobaujm.com/wp-admin/apwrn-zp472n-zzlq.view/
http://www.famarasurf.com/deutsch/wp-content/uploads/5zv31-g7mz9m-ebuqb.view/
http://www.farmacialucini.it/wp-content/tzeyh-4iua8c-zdzdx.view/
http://www.firmadergisi.com/wp-includes/gdu89-d8v9w1-ajru.view/
http://www.flux.com.uy/wp-admin/nqdb-vzj04f-olvg.view/
http://www.gruposolution.com/xflri3kf/ftax-2oluf4-rnvdc.view/
http://www.imenbazr.com/wp-admin/49s51-rxyjda-lkdyk.view/
http://www.jazlan.ideaemas.com.my/wp-includes/r9z68-iw8mka-sbhc.view/
http://www.lymphaticyogaexpert.com/wp-content/dlr0-wdsp1f-rkszp.view/
http://www.media-union.net/css/er129-s9lt5g-ruikd.view/
http://www.m-gs.at/howe3k5jf/yk77-3jpnn-boek.view/
http://www.milakeinternationnal.com/wp-admin/qg2q5-2t7wle-ebzcz.view/
http://www.modernfruits.com/wp-admin/gf1d-ogk1e-cpes.view/
http://www.mxzhiyuan.com/wp-includes/lks6b-axy86-vajnd.view/
http://www.mypierogis.com/cgi-bin/kc7k-kabt1-fmmzo.view/
http://www.pueblastars.mx/admin/nk78-s3iqhe-uajv.view/
http://www.rusticfurniture.online/howe3k5jf/vmmfa-76hbsz-hxggs.view/
http://www.sahafstandi.com/wc-logs/954w3-nkswpf-wqbj.view/
http://www.sefp-boispro.fr/__MACOSX/l3gt-v3ljn-pghod.view/
http://www.shinespins.com/wp-content/t0v7-rsgze8-axlp.view/
http://www.stormcrm.com/wp-admin/e9hjg-o1zcan-ipueq.view/
http://www.study.ir/uhm1ins/dzb8c-dkv65h-bddbp.view/
http://www.sunnylea.co.za/wp-includes/06xj-qt9nx2-nvrtu.view/
http://www.take-zou.com/sp/8rzlr-5uqe2-swxco.view/
http://www.tarakiriclusterfoundation.org/lbjjqctggh/m9cz-skhkd-stwow.view/
http://www.tophrmyanmar.com/wp-content/uploads/9132-las4l-jnvs.view/
http://www.veyettegroup.com/wp-includes/7k4b-y4p4l-wspg.view/
http://www.you-s-gazai.com/jutorje32/j5v7-ml8ooe-hxsgx.view/
http://www.zmhws.com/cgi-bin/caon-n6y0v-lfvdo.view/
http://x4r7.ru/pixel2/6k4w9-7s39b-vovb.view/
http://xn--19-6kcatahwd3a3au6a.xn--p1ai/dir/3r41y-gokcam-ybgiy.view/
http://xn--80ahduel7b5d.xn--p1ai/proramm1/ojm4-tvodm-dxew.view/
http://xn--90avpa.xn--p1ai/yxpeidy/aujy-ury06n-dssec.view/
http://yogaindelhincr.com/l09f2gy/3ia5-45rgxx-ufkjm.view/
http://zakodujbiznes.ml/ola/gdxmw-mg9wmj-txoin.view/
http://zastavaso.com/final/03m9t-kpyawp-vekfj.view/
https://usiquimica.com.br/wp-content/y81zm-iksm8-jeynm.view/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-06	21:25:00	(XML Based - ENG - 365 Blue Box)
SHA256:
068fd5faecd0443857a31230f3de8b1d4a5b5d6d156e23fd52c3fc8461e727a4
e18e88fe755ab62a8e847a05f1f04573aa3c4608ff231fc8cf6dc3ff85344480
7cd3b353d16cc7d5bb78c0a82d3ae96bb31042399348607d0b3faa3b8929cdd9
32dc7b0d81391b605335fb4fcf96c044d81028c83e29b8dd3249e279140dac18
c21b0dac5cbc1d673d0e5b74700f868338a099a5e8ae613a085a239d01af0154
12ca6b2b51a9a19e3d51d638ff518b28ffb7e709d7ef4d24fc93c273baafc855
2c9cee90673f5c46c52dda89fd60a9120eff8106e38ed147d39b99e564b6339d
3953ef8245df7fdeb28a323b1cdc8124ea0073a4ac80333c10d3b4b60c4a366b
8a696eb3a19fe177a02585ff22192e843e52afe8a3606390a2b4693b6be97c37
0c925701d1ca8acb7d3bc5dc58d11a02a52fb479320cd8e147a188b19f4a69aa
71ee6c1e90e6b367a0242b1e35b7322e681046bf6c650f5bc54865ff7620c949
7fe5588e14e3e6c6994f7f970f95a57c8df3cf9702353c3ab38a4a857e03ca43
3b19a4e138f4ed4f7c012ec57feb10829bbe168a20571f182f38724025f8dc45
26a4058835160c6df2397ff70b0a23998e5c17a0b920bd307cadf67935311ebc
508698721286ed9cec798459793fd3d323a15db13b86c2965a83b163c638ebfe
610209b09b2834e378644f0cb27025d7f1d31edcd43746699e99ad240aeeb381
d12dac042b113bac83221edb28aff912ad9b0f02242ebb9bfc2572006d10666b
fa6104f7061212dddab6251d502eb12656e47d4f4a31e3bef9a6aa9e2984e403
608f581cda58b65066e934f6e8bf09e026c929415030b59b1e38b7812b65080f
e349f0e40a77878b1deeba1615ca9792e8c06dc46515aab792258280284e73d8
a822627a75d5fe19fb73e5e52ff7d226bd362593b72d0d50030a47de520a442f
2e47b8f057329b5f69bd5ecbad1197ef4fd86226b733940184ee6300aebad4cb
c0d497ed93cdf3f86d01f5ce8836f975a5f74d44132f468d112c10324cec0aec
e972a00bdde4291f08c6a94896368f9cb02d38a32e0ebf9a5c4ce3421c889bc5
73dc042ef51013fa98b0db07a164291f0b675db0c455afe7d660d416f5d6b1d0
70ece93a1769f7def79e34832f7c1435bdc9ccccec17bd8e677a2e7eec3b29c9
88d9a8b9a9acb3015c90671e09e42ad30698778edbb841ae96427bd35de3fa09
b13616a6f01b030d450c556dc7824590de5cad4f61e6c11005006a01fe82c0d9
5d81ba15a62d1cbeee494da19157adb41295e5e1146d3576c1a5c7c06c9a55cf
d814a67405968e3c745e60c2638261143d30cee5e0ebe5be3aa146bd02a55726
bc62b5c9178d6d49ab60627d0bf6f336e1d5cf3ebff7b66ac28c26de5a6d28c3
1db3f122b7c8540d48bed16cbaec4f9fcec8538f37375a32a5e5c7fc46de4579
6ff44ede7f80f7b25f191ea64a7966cdb74ef08f0ba0c342c03ac42a33a4e1ac
3ed46616dd521eb299ee59fd38f6e36960ea16f2d2a09bd817300fcb56f10b09
9ff92628798eeb45a5fa8b8ceccaf412004fa83af7e4cf10d67b91def29c0c8b
926c7b7d896af5f7d2f1632febf7b1996968ae04e626a42212d14c8794b603e8

http://thietbirang.com/wp-content/EKfmd/
http://travelingua.dev.trestristestigres.com/wp-content/twIP/
http://daythietke.com.vn/vhoadon/3zzqn/
http://www.avantiataudes.com.mx/cgi-bin/dkhOZ5/
http://165.227.119.146/wp-content/EsQk/

Creation Time	2019-03-06	19:20:00	(XML Based - ENG - 365 Blue Box)
SHA256:
f2c17a12482281ed5e825f1a5cf3c0a384f952df88d5fa7c67d35c2dfd1ecfe2
b31e2b2e3d47acee280e9b0de20f276386152a27d56740e7f6b7ca0837054740
1537fba4621ea1a2fae50949ccabda20c021bc0cbe1b495007aa5b00d18a4562
6985f52b0980cebc204967fd03e837df124957d267c4eb3b88ce671205a27f86
9537249fc3e4b4a3638cde184dc9a579fc6f292fd7b86dcfaf83f5ba529daa19
28d9ce8186621bae76e14ed146321cd2034eabf440b00aaa00fe78d02780144f
f47a98fd16b345442090dfac320b0c4aaadcfa7a5a60d8b526d748ee7ef5abe4
48bb756a229de338eea1e7fa9a11a3e8de9a7d33e55a054cb4cca9ac740d2bd8
7007aabc93298b5f0fb93756a00bf6e396f72905d2c4a78139afad23bc67b3a3
6bd3bc7eedbed417c8756ae315958d61a030947531202feacbf148062f79a50e
535daf91cbc6bcd6bb87c01738cd4ad23829bb194c998a9087c133db80ee382e
7fe7ece316603d704c4056d3ba8ad275b2fafecd46030806fc9c741b639934dd
d39ba167ba9e3383d0d49cb220ccb2869395d6b9711f2d83f392794ad9d1a386
35fda15cd156d297c8481aa203137f37a0c7a3ba10148003029bb01afb18db41

http://wp.sieucongcu.com/wp-admin/deBtBa/
http://165.227.44.216/wp-includes/xm/
http://159.203.169.147/wp-includes/9aZ/
http://159.203.1.140/wp-includes/ICTp/
http://165.227.140.241/wp-snapshots/v0LB/

Creation Time	2019-03-06	14:30:00	(XML Based - ENG - 365 Blue Box)
SHA256:
a2141bbf523a46743bcedf75534086f1f6e7edc5126ebc7bac3bf3e711b0048a
30072d0725dfac272062252fc67d3cbe37655e687d79109b8c4524ef9219c0c2
80f5f3912db25ad1f9de1d09a86a2d67a40dea78b2bb37e4b7bfc318ef010c54
23f8ff3096f6b78f3a5f69b9751d019389b4de8ecace49aa704af5370e8b5164
37ef1a3cedf9d29b63e40f4f29e43c3361a27d2e74c89d522c7aba880172817a
43464fb43c3b3b14c50d8452af99cd8d25ccbbc5b9437e4a2c1d336fda6d9ab5
441d237af7b2d15b464a5e1af3b98419e7a07de5605dae263c512e80d5b5d913
c42d5bf5d2db1b481a17d3c89b6d90dc704826e57bec97a6cd1272b74cb826af
bed30fabb27f9e638fd87a762468bc3c470418122b7310fdbd806ecfdaa5283d
2c891c59d7a2895959db99989b55a7fb3a0c11bac4a5e0300ea843352c8faaa9
b99b706772f6be1aa68c9c746ac3c9a5111d339ac51f638fe96c5e29062b552c
2f3db9a92684e7e64c2d51826433c4f58eb1c5cc04ad9e19b8667fac73659a78
98f8105117d14ee9f60177ae644e9e84d6a0c615d4304178641197372c8e911e
ad1bf4d97243e5c7e4901f61a0bf0cb4e9df946e84d46900f7f91d4e7a302154
6d9bcc654e1a21ebbf7941d86656a53b13096523e496075b65ea1eb9e6032fa3
8244eb56ac5a66a6794efa846005a2b88a9f3885b3cb62d169b423903cc264b6
c9d448ea3a4112dd01639c17ae72159511a32a83c8dac45dac7650bdbad004ac
a2b2f39efa5af3662f42a593e67dc5e83e105e4b4bfc07b290be39d6882f36a3
149666f2d8a859c5a038fda4ba35c6c39e38461a3ccb404955aa1d3eab38e3f8
ab975ab9f972d7c3a962632bf3e6334bb40ab244b6bcba0b3fb38ac1ea8c8533
ea1b6699939b1fb0b14faf46233ea7ff1d81698405872f73d73d1d03bcbce2f4
2645602503a49190143088e7681fc609af58619e73a682a32a7b20a74da74e9e
517b0e3eae72664232a0ce4f0271c455cf482ed28005fae73d65c38763c3fb00
f3c0eb3d8e00be6fb6dc5be1cfa601b7ea122b99f7a8c30183089f5468f1c427
31d7a5ea1d73997a57546a687a82c78f81cf8cf56991151dfbc3844771e2a788
c40992b21c1f19cbdf3217bdb8b619672f6eb50906b7ddc098e22d8e4e961cc7
af6cf363c6b0f65088339a2423cec637fbd2da0aba07176df794949796014d07
a64a359ed7a42b37e9794bcc712c14965f6b7a9cf9bc4e1c9268be9d5b2cf293
370f612923e21e80d2d87ddb58d6db5b4fd7620073c7bcad3e50d723b47e0606
052d0e60f8b226934c3c3c009563d6583834a3fa9f986d76e5d10d5a8c37e936
75e00a688895ac329b3ae7a2702a0ff58bffa4a81f82e7bdc53febd05b54438a
a3ecd6cbf485462acf783437ba4df3f235204f9200fc358233a7a2704696ec96

http://winmacprinters.com/wp-includes/viq8I/
http://usaistefl.com/wp-content/DqxlD/
http://lymphaticyogaexpert.com/wp-content/llEmW3/
http://travellow.world/networko/YjLuu/
http://blog.concretedecor.net/cgi-bin/xjox/

Creation Time	2019-03-05	22:29:00	(XML Based - ENG - 365 Blue Box)
SHA256:
2a941920f3141a6c6ddb1323715ffed25a53eec27ffa855291abd696c1992108
2bd4fae72d3ab987b9304454fb8f23e8f8e84fff0dbcdd898ddf3f561d184f42
93b87fd97dc1f524a337da95daa190502cf93ced35624809bc57ea7c60426b97
ff87ffe29a1101bb418ff247eee1f92bba3069c973d461895682b71ec9a14c23
5df678afc8e67909d8f14c0ab430800f78ada119941787a12dd2a524c2ddfc5f
ed167edd35014427009ce66f1cd3de7cf48460b9b64eb44dbeacd789481d8b68
a2e04e00b1dad83d59a31ea0490d796eea1368e8b18858d4b3da470510e22423
2a5cdc81579e952831d63d0cedb38c32ba3508d7f67589374db9ca798691783c
3277461ae2957c556d00eee879ff9e1046c3154441c11241b8c92a41e425c592
4c99c56a7f2070edb3436f7d502f465d4670e3b5960d67e124e5acb2838113a4
fc237196ce5cc7ffd5e4f7e948eab74dd5b2c55715537d404377cb219be5b557
1ed979dd6f2a973c269bc18268a3ba787d83217159b90d0f09c011532eb3da60
8c5a4a398d1752740912d7331ecdde2a58ac078cda456afbd44c66fb2ccd26fc
09a3878757ed1498317469051f8720b8b2a1dac1057b8495f70d581cc121e5c4
5b15b2f8ff2090def26c29db9ea04ae33acf97d689162a5ee08adb65341c2ec8
d8160686e205ec2a48a9c20802839473f61d5e9ade929fff0266cf664bf2074a
823973bc199dc16b01c9daa63a8f376ed0f6bc5978beff7ee39e244858eb516d
84f68f7a16f091cfb89e9c6c938d5a5cee9ac159deaa86c91a13f581eaaa02c8
da1e9461b88c53163e82f2f8b7ae6cbf232cb1f863a597661c9141479e33109a
b974213ce7e33c2574a323197b57f79cec5b1992ac127356fde3b2d7dfd32706
19a4b301cec70545b88f8381e4eb13704a563519c80027dd63e135075632cd7e
27d61ea3a3c3ecdb8b900b4f5d08bf0aa70890c006348e7def1441126c94535b
1c833fc82050ef8299050a69aedf206793f8643a835cfd76b85eeee3681f657c
bf50846da5fc65f41cd13158d498dd2a5a7f107347e49648c91739951075e67e
06a844a779d676fda6336c5906b4649b32d85815821fc00ad91ade39ed039d48
7e06307d2307e4d355f60b1667d42f6abb64b3d5ca13c4eeb85bb19b3fbc676b
eb0b09b8783c1c1a703d8221cf8375d6d89d7468011122bb1941ad95ccc8e6f1
3707670361f6d9370f4e37b60e30314013242dc3009338556d4008bb89849dc4
4028136afc0bd4f5addda390fd1a90e4509336d753f7836f9313bc38dda460de
174e0aef21b128cae8d0f481f7e711613c1fd59ad58f11a2b54480b88a26e324
ef8b13f956b05117ec9c9d334da3abe4110ea70a6ec3433f4dab8a9658b1572b
776bbc72d7a1ee931fdb088d4d5c8c0b1d2b7184f3937f285fc885f036787f21
a4ed2c043354b7a3221bacc8fcc72126901e94c22e721266a65baf085663e69a
c5cc86004a67d4cbd2ea7a86c23b50418b3d19d7fb54563dcabad4264463029b
cd62c54034e3c62cdceb28ff26289551368a99c9edeaef6e2d9b51314a8d641d
4f76cf4e36ca9219901c98b94ba2823a5b2f0e18f64f90dd735d7683003c7f0a

http://kasebbazar.com/wp-includes/KGbQIc/
http://118.24.81.160/wp-includes/a3w/
http://118.25.25.201:8081/wp-content/jzU/
http://211.159.168.108/wp-content/uuZ6/
http://demo.dichvutop.net/noithat12/JMQ3/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 03/06/19 ####
```

b02603187c2d39f55a9bb16b24e4a084f39037d15ea68b05bd998ee3756be1c3
41372a3db6365c03252e4d322ebfccc7d17c4168054bff533b30a71dcbba22a9
f52bb5d73baefd48c269c65c17dcd81b2ca559d5afa3d66ffe81ced53f7a49ad
755aa49238874929593f8835f7d07c3563406d1fa38777fdcb5cf1fab29ace8b
bcc09826babed53ba7edd3ac969988a7a328d223a8a93110a9e008a202cc12c8
3ef852510e3646926fd6abc0441f8b234ee84aa9dd2c0f0b1f6e170ec62b4cfe
4985b161b0495fa39cf8d0a403561906d00da9cbad6c4db5baa19e242ee9533e
7f887d313b3472c913a7a800a83409a440422654aacfd679319b6676c7d34817
cb3b376be046d2479dfef7f557f5c8228dcedbc57dff669a27940138d0120f7e
cd247eb3bf0bc7ba12de061ca020c775dd1f0a31d84b40f823774ec8f7ebd0f3
155a4c8081931195683977edc2c29feb77e1769205ad694baadece0a5eba03ef
370799564028eba7361973faaeac806b11eece9f8dfd519697c7d13ba2054a0f
0fdd46a05e88a608ddec0603abbb3d31efe696c94bda07b33d99251fd63759c9
83d4c23a1defe99f6de15f8c8a72712d55ece22f63b00c9236a3e182d3527b62
b3127fb14b191937fd92ff98e731e33b060205b17fa326a46c4892c882866ec8
8bb3d5a1a4d532bbe0a6ba122b362e97a61dcdd445c6a1b07439e1007faf7623
91304d57dccac35e0f18ef069a8de4d88c8fcb5849e9b7c1b78a18786bf06137
e153e6494d107297eefa49d3813513e382201e2986c6d99c98f00705555cd524
612f4e9c1fc5caf9802fb3f7a838b55d36514895acde9f08242f378d50e29969
eaabd2432039771453b235bad63f9a0a252110865e3e8fb2c5eb26f94073035d
e83da4e60f441c3882c0669d47b4251c040a9d2836a4d6f9d1bddc551476a5a8
8040c28fa6193c2f72b954d1245eb13b9bfd3aa88d6862f38277cc6c48eb9eb2
cb660e9290e59105883164cf4aa25c22df4f959fd3de0420fb79a670536bd91b
248cc5e1afddd8f7cd0b946b75c89c2561571472e88105a6ea41dcb15ee77a2a
c945aabd20fc85d4c32a7746b37166faaac0ac36e652ad836928095939644f81
a5e3674e73270ff298922063bbbcb6a5874dce9892d038422c9bdb5268a01d1b
bf7708b3305b642c5d1a96a6e5a5673383b199f2ccabc2b4ead51a9496e43972
790d8f8318cbbb5e56bc9593b1c69bc9c0be7fabc1ec4abf71c254925671332d
d77afe296083951647a936ac86c2b237054a332252c145d1bcc4bc4c72b72691
552b27466e9d8e2d4147016700e32bbdc5f1dd237a4de365bc58c27b917b82ec
dc030e8825a2c8bc54355e04855a958610fe06783761338950d85887de9cd97b
e677737983cda1cdf096b9a93df6904c91dc11bba0bc343e67d50bc43875c43d
7ccdd168013d78d1c79ba959bb871b9bed41445ab2e86c25c30ae84e2842fca7
2786cc5e556803c2506682ca58030194fae1b3ca00fa02849c8c9ad83fdd93b3
6d3be4c9e3944c112bc0c3e8390d21d21af0f0af4aebe30b0ebb36f083d06c97
5e669050d36b2b8894a510a15e7b96fceb871e8f172dc4b05f673e27cd13ff7a
a1028169f7c3aa8146bfcb5eec53334c516017345145a5b9b190a3cd39d021ae
c17e5405f7a743c5e5789d632974248b3a120b7dcf4036597f6dbe7b94182f08
c9d4f3f1f0cdf392b974c9088630655bce04cb9d320217f35b04656195620c7b
2a53cc9132372d2ec17b7ef74772b03e1ce88655c88b2b2406fc944c15706c82
24ba1c3ddfb05c5d4f24fb199731d35f03faf359728a7694fa02034ecd0ba592
e391721774cc73e09f34fbe03631e750afcf3f94d3fa97cc43f22b7736b590aa
d35563990c6899ff29692ba1d18ee9796d6209cc1e005d5ed57d9cfc66285c4e
2c032926ec7e06c6ae92fc527975feb8cc23ce030b87427d53b0e2dbb2a24b0d
30275274cec43f21c1b27855d089a02c32c17bb15cb5201ddfc30c76acd01496
0e71edc3bce9e2adbe59e80d9586d8e37781cce6a40915b480994e5b114ac5e6
2540a07a27835bdd531a1f4c6884928ed9542623ff5c4c78c411d2ef3f4db8e9
e526fc8bdd720ef9efe08455399107204b4c7f2a821ac7cda2532bdbd0474438
3e28b2605e9fc742004234f5bed59f60eeb226e9c6429091c126c5d57ea345dd
87938b9f59753f87cab09b456cb4b8cd8f4b912f114fc1a8fc57ce8abf35300a
44a37af2f2c12662eeeff30468fb74963fe6bf39a4cb24073cb8b9062a75c62d
0cab6ce69f229f8631bae77e5e4480997b87aabbe3c01f7106fb036d52c0d0da
b133e0cf5e64285bb6f0c441ae9abae06a22bb680f8836521160a03011d6dd50
d3b01dd00b383aa0eb202239bde84a07fad4b78a0f5becdf7fe6ff9bee8b0ca3
a6331f45b658f4383c73e76e95eb49d317833c19dc748bf82eb42adab7c4e81b
4c48f9fe4b55c93056ddd27ddf754423e09cae0cb47e04e71c17e56edf93e53c
3e965b1bd83ac341b9901c26f6d25e5ef6a86de44762caa5ea3ded8550731dcb
fd0e0ba6c9ba95eb63fd715ad445af200908ce90e5b69d25e7a7d57e90f843a9
06573962d72b9c39863d9f432080fb6bb2174ece1525e505383788154f1d5ef9
f54864306708b3564ac831238a78df40da50d06d3fb791ca3a6c75421d69ef80
a2986ffe2181b9b72682f38eb43aa60dadce2256ba589a602e6c8d9015a0419c
3ce01822f1f7d6a3a06a07ae755652bbb1a6dcf7bcca441af1219d9427114e10
f45b665258b6db7291d42ca437e89e772475b9e4e21255afdda6c4e357164876
2327ed4555dc40f5f366b35f27c6233f550b1de7fde8c8cc98ffc996845f3b1d
65a791d56d2f97a5ab99d3fc6f86ac52158161f6659791a1d5b1d01aa03cc4f3
39ebb382c97fe841cd5d57413f84f787876c23005c271b9da837fe1dbad5b75a
c8c62112f95c17dedff9cef640700d5b146f04b745e12fe54bdcdd8644aab635
d89a467fde157aefa8270763f969fe6d40448ed0f2e18852e6785f88ab5f4b6a
d4486049b95815858dc0793a8096e9ecc11fffaa4f6299ba77383d19e42395a2
d65e2b3c555b2e7433ca71bd792acdb74cc764bb188aadb7b66f729eb165cac4
974e92f688d75e9827ffc10f35abf57be508a31668d9588f02f9671e84f6419a
41ef43f441dbe7236c47c17e19c7df202f97c5c18b6a5fc87d7a5de7135fd24e
2c1d92aa17f8a93cb63fa6ecbea1416b6e2a52b9bdb92e47fdc7822a604104a1
f7a2e759f50c78d415bd870dc53b2c662b20441a5e0ba73471dac73b58ee1a24
0c66288ce1786643b2004b972b862e4286dc7109cbef5405ec71e43ef0ceaf93
fecc82f5275b2e7cc3d726dd279549f74b434eae1145742830289934ae4c326c
98633dc7fdfd63f9432c0d473c77cebbd240c1c323d4ca262a7faa3a9e228dc6
aae49871729ee527349285a25a6480eee2118d7cddf71322d44484e944c28042
7137fec3ee0ae2fe09010d557fb4aa94e4185be4e7962c9debc1313e0c102a9b
8378e19a956aa6808131efb6c56f46353970a65e5c87798ae1351d9b99925823
30fa0b9748be397e817faa41b034bd972dfb463b351b11281969a7d426411982
d7e460385ca326914835cc3d4d2ab2973fafb8e31bdfc281f95d670567142e31
a64eb3db2e085303c398d68f04a309d86a59af671740c5afb401310f8769b657
cbf4da3ce0e4cd96f5e7b044e872e2d25ef15fc9bcfd55149ed911b7273f0076
7fde9f852d0bcc4aa3c5fcbe0f5567b95136a43bcf30d10bd0e5659dda302b2e
d7a60bddf08fb2a984bf4890414f515107a779a78d768472704c4fd55cc98d60
aec418b9682e3ea0b464e8b1d91e2405f504aadcd8dc647500bdeec4d70e5157
eea472bff927cb7828a1f0588a73844a0162763d8a9f3d7ee137a67d695bcf78
85fae47d5a33894feae3725756433eabb347276eb74addf7fcce3377ed9b73b1
8a2d668a5a125f933462c9cb275c2d3fb6e967a3d8dc9253019b20c617546435
187eda0a49166df757fe9f31f8d7bd2827fe963f4c1f68c9578a3ad8150d4198
d7d102a580ed67a463e4b537a2139f24c0198a8867fdb75d6beb23f3205ea738
29b509bc928c27fcc2b627d78a2408bd887b884d47776220139aedf315d78204
ee1bb32dfbd64485f43990e0b44a823d8034283db78116487b0562c7c99b8395
3d35262cc8ab1dcd959cdd951a0c8aca15a77a72e1ef6277e516c800c7f0486f
b95d85ce147127dd60abb398d8fab0db67f3c2ed88a421f44bdc765c27930636
f7d13961e9599afa4b9bcedf0a4757b46d78ff2a0360ff909bcb2f904a29606b
d54ba9741de7870b47b509d420e5758bd456358d0a9858d39ab55260301c2932
7d715b9c222bd48a69d4ba0cde5e4cfe326422a7122efcc77441ee7db7e659fd
cd6dd63fa0ebff3285aa051686b6e4777c57c4fb61aa8fffc8702ce0436314c7
808e54f4783fb5986b3f105a19d8da8b46e3f4054eda609951defc6a1e80cefb
7305973b2299cdf668310f5dcf96c5dc41e9b387d6be33bd704ab8b2a8f889e2
f4668813c2397c5b76d67fb107377e9bd1056670e2b7c486b6e7f98440a61496
8da1f72f946c7c8f7e4d3e20caa49ca70019f506c41033890a9993c712feb4cf
dba431e3d42ee643c92d5bde9ec0ebcfdc96f042a7034cab6234f65c02667f67
63b719f4f2766eb2b6f307af08babc8963bf14ba81b328ef3efe21565a569dbe
908106d70a5c2495cfeaf7cdb63fe0738c3a10e7974447a3b1fa83928f6fedee
f8a3862682e74024b4e580f45f3b9799e3f2440a758d44e0b33f17e972286ebc
4c22b4d723bd820104e6dc7d6c2b16fed1848243b2da8c16539e3e36c096421f
dc98820562e473760c697a70fef905a7a55b13dcd14d8c1b63ca8c1530a59798
91aa2ee4faf2d822961eae1f4cf99927e474e9924669483fbc6e36301d0dff19
f8168f70cfc9427e113e898798e8ec0f383367ce190daccd1971d73e7a0c4175
d8ce52436592bf90ca052b12e54727add0ea8122a2ba3c1cbb824bedc45411c8
847121522c652454067d162656400c2dbb9903b07e7f473cd8b4e82d8ec7cb12
90e7c8499b551d875b212e9006904961772a4d5799f0fd6fd519a7985cfdb0e7
2123515c7d6ef72755ed69473529e004257ce0de15c006520b2a2854aa70058b
0740f112c36df8a1f4693bf02a2884aa6bd49d0872f358ea6e415ea85a5da5c9
ba192a185e7f377f2b54cebc1abd2b80728cd6f31d4f31d36b6de58628177019
b44b28ef3c4e753874726102ff5aae0ecc25dfd134fd23ad36a4149dd0bc6e41
136daec3a6e8452d9d1647c6d557291c72d0e86326d480985125ff4257fdfaee
906246794e4a83e4c2a649c8ebaee360633dd049c950212e1968328e80faa27d
e0c7568205f861fe17fe025597699291f831308382c360a0fcca346e62262e25
8bdb0cdf957e2c0127c6e97fcaa42b47385eff718271f48a2fb27bffa9aafff8
31d0254fa7f8e5c2cbd3a13777b81a6a7ef46d5fe74f261815e7dd2e06ca5505
d66038a62e3afa46c099048ac59dc5fd9246cfcefa616eb7b7624ba6b3c1dfd6
efed59c2b1473891a2032927baebe69c87dcace3d87e0b359fe583bbe9181b9b
119eba4996e37fea2ea42714eaa6569336182e5cb927086cd342e084947b38bc
f865ffcc04f388b20a66d927c0914b774bf6aced946e39b393b771aa2341d8ce
f98e72782ff292db1c13a974b8934140f373ed71b067b667beb65c223cf0e1aa
1d8183654c7222e48cd9e18c8b039237725ade77a22489310372dbf7d4ec1704
45e2e6e617c1ec13d80ed1f6b691151e366496a5b0b9147cc7445cb09ae4aa79
1c6484f85482bc1e5c4e84c96c7f0d7fdbd2e2ca53191712cdfecf1ba85063df
a77e97d6ecbc4ca7d5e78bd840e53162f63b23204bc0a42d171643925c33719b
fdea1c1a8c574c1274498e25436eee3f30ba0972601bf149d4dfd3a0fd3d808b
6991953a3335cad01efcd6c6927135c7087c13f6d9f934e954162ae19d4aac19
ffe1fc4635db3f9072d1327ef9b435297e3c477588f74bf60e42812ff4d104e4
7dd34e258e34c323819dc461f9e7c7ca75daa116d3fff7831a465c7817f4dadb
98c732ff586036fb295f5ae67f11044ecdcc9d9d51f8651fe25c09714bce4d8c
e3f51357cff4ec4071727933d9869ec349af3ee6f52e7b16bb9916a20ae00277
868717da15ca4e5f367e6cfab0f069807d110b8ef6286c77eb43fbb2258834b5
9c7b9037d8ea065e9673ba5595631d0be1dedcddd2f42ae7b9aacea731199be5
2d1f2455c35020e365bc2e91bcdff8c59c44cb39c2b37ed013383c1c0b029cd6
e5e1d90746ace858da7c11da92d493c5395287165fdc65b3ba7deb432d42a462
847dc5a7ef8f238e1f419c6ebf0f82e24b4dfcf022ef6fbc8d9383ea1ae70b01
ee812af82dcb842f75d645e006f0a5ec0ddd698d711b23f07b617b009e35af40
65eb96e8325a4c66f656faf7762770c7f719cf7fc26ddf3e1720dff65b1b5248
eb63218ce4b7921df0958b4fcc828337312174a11c001e2f5f22002d4982668d
725e8425ec5077a2aee67037843f93fa260a23cb723ea34fb39fe13835de8382
67171e9cdeaff544f47f32d6f0d9802b2188332aa118cfe4ca07cd2f3f342208
6148b5fc9f9a886ec2aa8939015f6c07310f1367cb5f2d487117a573de4960fb
7a104531e95476075526b140fb4bff67a06529d1ee6601e43545e25c0dcb5613
360c0346d8266a0d78a27b29844959460a3619ff728eedb8cc76fda3799bcb9b
bee6305b6ccc8a8829d9d475c0ab2b6fad2e9006456a0c8646bc520378908329
d116fc48de01f3a90c24bd4ac39579a5ad07838fede48903a52215b3157b0650
7fb64cf180b143ef87e91c31656d7fc107fc5869f95a9645aa3c8544357f0464
7c57536c7a419f95cd428f999cf3cd461729dacd02a91754bd9c27de1b2dc906
ece19545865f835fed0db8d8b4e62a07cb6856c74614ca2ad436604315b4ab36
3508ae3c70fab683dfc16b2e06f901f2d96bdfdc042b6390c7bce70c78c1b812
eb512eb7200340d07bc209b0fa1edcefc3d3a7dd7c98bcbcf35b0eb39cdf1c48
49c8520663e3eb3e50763a0db27565d41d0122ffbe8a70d2a0f458f09a6d6fde
0fe3f288f1119de3078538a3e811c0dd0226915db4e6993df8ca229466d3fe5c
6b74237f27acf67ce819cf56dedf251ed835575aa94d71f15b8810aec1f12904
3e2c3302f8e86ed3c8cd06e7b6c75e015ca0c743f2f5f1cafe31361cd130f16c
0c29266763f9f890268a872b70316d5c99f8d9395e907d758c91b16a3823c304
9023ccc41352e5dbda02c2d17c95c6ab99f7178ffed3b9aa2c4fdd60fd795f21
1a9492294e69f7d211062002fa010d1c20e6b79bfcf7855a80e1b690e4006e30
0353f2248e563b7ff5baea386b36c431ada211a64daed740c35c5b3df0b6c114
6fa0cf7627a4b729c312c0ccccdb8a880457f91f69d7c3f3fb96720f25fad859
886cd0b06f5c2c64b9c1b945a3cbed309df0719b6e7a982e9460e2b6078270e8
e36fddaf5b8ad502a84965ea4a9f84d3b96f3cc896114e4b22246a26e6e5372c
d95577b21bd2755238d0703bcc94154e8a5926438518ad61c505152848ea54fb
877350d75d7de0b77c966e5eff9bcefb355652b27a9a50856ebc25df04204f84
e6c6a07d0a040528bbbd2b1e44092fef685dfa33c66f99ad4826cc6bc3b051f7
fb307b1d84a77e0f9321b40fdb59a41b696c6183cd86c0accb651bb76b67c8de
ef4789fc32e723000fad590088e2ffdbec72532994c9c6f4e0dd38945fda0a78
f30e67ff165c0593fdac312a14179ca08cf768dc6991e76ad7e5195e176ba425
ba14c54341e852e51eba8c5a7289a834e5d8b70066330407e8c78841393d4431
f02f6d0faa45d441d7e73e613e9b43a04ccc92054dd1b5a8dd87c081decdd124
b1a786e1d8b2bbd685474f504ed6ff8ef8d417a59f14d342275e322a3fb80ac4
ac90d4262e1d5e7fd2dc7df0d29a5dc4c8eb44aa9ca117b46be6afc47629cc64
29db1155410d5eaf9201efbdcf8d8f8eebb30890d552c0bbf3ef201f216c8da5
a52d5ea17e9a199bcbb8962873881c80437b753f6ed4f4252f85fdc5f05439b4
fdd772e24f4eb15897297ad3210d1c3493582a6099d44ffded79bf19a1f0bd89
2f573168a5467d50580e2fdfd7e7537e18b7b509fb0afd6004826cb223bdd494
1c3180469b0af5e2c15dbaa3a0f1849dbc1170be7c0d5f27aa4703f594215a1d
2bce9a9b89677e39a16e01d0c2f07b0a337d939188d0fa22ecfe845394c6a338
77038373ef72a63753f19f8f2cb23feed99cb7a310bb3d4350a144bcf2880a8b
f2ceb3e54551c206058c7cf7822ff3f83ea62d2f2bdead3454b035668fa519b4
79602739198240d8f95fea394b00102f5d51d9c1d9faff3142274a9ccb67f073
b3059976cab538aa3f6aa68f8272dc7ae84e2425a27e263cd350f753095f9699
6cdcb8f48028508f14a30ed0077a6f4b90c1f70b61ba574718dfc0475286d6cc
a0d6c72828b40bd73e9fc5b20bd4b6c0c67e5a2be6ca456ab89de8c96b875b08
5db861eb9e0428413be793b0e931212fa56c903a4b96dfe7767265fa880c256f

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-03-06	22:15:00	(XML Based - ENG - 365 Blue Box)
SHA256:
4812ea687d6ba28777dd6d95308ca9de212b7c0c6e56b3e5f91a36bf98bc27e9
48fb81b9556ca4385207c98031065c21d4b9c123495a074ca33815da1dd4c074
21357b23d71cdc54ec4f6d0ce61cd882a77764af3c19cb72e0c3316e06c3341c
1a47b4d31c6b3c54952c64fb0769a6111e4980cc46c6030caa3c322977917531
745df604bb5dc64602399b203ed4486babe0121ccb9263c8b6a7663fa36f9843
6be41a55cd47b50228603f5c51dba44cb959b88f9b55ff13dc1f32f32ad0a6a0
36e808d2385767ab8f0b38d5a2b53fc9cfa04409eaf023e53a5757dfcf820bed
ac701dd42602b201cdd7138b4aaf0df422e216bddfbab66a9aedc73942af2994
7c3a3659eba87b1a51f8fd8e043fa4dfbc226eabaddf7faa32184944241604d0
af8d0c59a076cd9c16925f688f6dbb5b1ae3fb8db6dae2b2491c83fd757fd963
f72ae1e3d4f73185739a4dd41d7e5210fead61b8138963dff3c93db760c6b474
2e0e57abb024c3006f59e742f289ac341c755333fc57d3b5c3d0c4ed2aec0000
f344d2ced99c84d3ef8fa050b1f110776379a1e0443d6fb17eb87d1d1f4ab42c
7ec37a37f320efcfdc05a6d7d1be9bc06266f3f2161df135bc5d331d45678a6e
2120e8877e276142b0c758529bd5fa2a5dcbd43877530a028f5d730e1e3545cf
6e95e693716ea9821320160929bc15a8b295b14448e1fd168d8f86556dd56019
48ba6d0a485ebd9b9f83f12a49a384e0036b84942be32e2c237b601efd98e631
69e73228d0d6b4b2198563729d32300e5101cbfafac0ecf658fb957b7966f158
68e641619681499dcd489eac8a5686590090f2e03b2ccf5725e31a8fd4bc1e15
1b6269d55d4a1c71a0c501971cff44473032dd361e8bdea0b6aed37365ec631e
867cf5475399cacb3faa3989527d4502f06691b78ecb254c3c81a02349321b58
88cc67ba0ce7d718b64f8ac0444013bc85260d8eabc92d11a053a2b2b06b144e
3b6301eab7a7049eda176c4a2633edcc81f182d6d44cb52cbb26b6409ff11de8
661f7d5aee7585cb680af63760332a10385eb8950927f9fecac1c18a5b9dd05e
d00c72e635b39b23893f80c7fc0ff47f6d3416d2649e2fc5996986211448bc82
48c509e7c02b2075046141f60ab81e9fc569c3c50f8f5ed0183a5e8549dc4fb9
1ab25db04f61509a97d64d5b76bf3d13e6f43fdf1581ac30725a722477ad2d1a
bfbd18f30613de53f8d2c12126b2d4252a7d310a5d4f86c220b76d5e5b989f51
588bc2d6d0e6d40ea223ba9def83229ecc860854c1e410cbcf908e0f7666f9d0
8e4ebea6169c64ac1a4bf7ee97fe59b3b4dd04f392bbb518793619bf71e587df
cfcaf3bfc1ef4063ba654e6914e638fa752ba276772506e8642f2b745359f4b4

http://designerforhad.com/cgi-bin/EM7E/
http://costayres.com/wordpress/wp-content/uploads/fWe/
http://itmo.ifrn.edu.br/wp-content/yH/
http://icon-stikepppni.org/wp-includes/yt/
http://efotur.com/surecc/tW/

Creation Time	2019-03-06	16:30:00	(XML Based - ENG - 365 Blue Box)
SHA256:
b28a383f39b68b4dba8a150bf191a3ea26f386a07a8d6ba65d78d5e86793c37b
5550735f899cce64c19e6ea6f8381dc3066c1206494b3200788c1dd553e3d99c
c1c1a87107853f2818de6aac5f5afe13db384400cc53618e1b6317c31f83a34e
7ee6904cab6811a6f614652c1875a1db9e787ac7054939f5f1186c60fc8dd3ce
c3a12345dbe221cca256f1f1ff362616252bdbdd8b62aadc1c06be0929c21d34
e04bab20786814636051c327be3fbcde67cbb51ad3df789dc87954178737b24d
23ace2a3f890fd7d33f585be50b04b88e584b61cdb7fec606334d9a46e718cf7
5005088103260d1d2149858149442272583db34919c2f6f11eea20664d167265
67cec032d9fb7b85f0a217fdc6723db874b152607879b8b90490423e9ffbf7ca
359ab6aaafa05c98c0da6b23e0a8b057922c97c5e364e736c6945e2fc393053f
c89b510105c6767bf4a4048087b2c5cbe7c4f2239f19523d44e42305b815f2ea
d1e56e12d18131ff42b688809e519f08ceb272f9a9d262aa12264cd8cda3bf21
fa68465139cb3da5cb093f19ddcf39047bd324ea08cb2ad36af99ec4e8d6127e
bd0d5223077efec80f5b592e17cf1361fa628394f030577c9a05dbce5694d92a
e28c6c82386a772c270ec3f411510c5c4485d4c078a8e80fa88e3f48e4724db1
6c84cb91935c52dcb2949f7a3e0e4753620f7b7dc17113e0c61ac87f743acb7d
a9154dd6891e0227892030a3cd9897d0868b73a1e72681541b9b575f35f7d9a9
6dcb0e2c5b6c9a157ca131176c99391a072c3cc221a83fbfbfa6597375a614e7
2e32ab622e0bb34719b101d8ac76a3ec3265e91563708abf0b47f8403480df4a
d11fc7c82966fe054d354cbd412f687e6cf98933a3efeae2e7bb6f703ac38b9c
916f4911f9c09eae3127a2dcb7ce85515499201a6f3027869bc0e356ee6753a0
bdb0d30d746c1701f321a238be12b74b9cf9ee099bad01d7913347b2d0bd95d4
a6247e8e856ae22c4ae371398431d8bcc3fae22a7d7138e08917c27a8ac96eb7
5ee60a0bbc892c50bcee25a9a2a9e82869877677c5c3b90a672e1909fcb8e63a
983d287bd30c3768f81a0f9fab8504d2549836c8c9f7fc23202c0dbefe09be8e
d72cc7591e2638a1a890e4229b115f8623f835d759397e2e7d476a712275bfbd
9061d2afe2327733c5cd003d12e78a866b6598ce71df72f8631cbd0034d528e9
f966e0b2a81cc2d4c4bb9632095d1646ac56fd38bf70235b5c84344c664d02d3
2076f5955c1c2d0db23f20bbe0690602bd624e4c4a44ef36b93526211f4d709d

http://www.mekanggroup.com/wp-includes/uCQ/
http://vahokad.sk/access/65rf/
http://vitiliderm.dspharma.ca/kJ6lpC/8Oe/
http://ucipk.com/howe3k5jf/aT9/
http://tvbildirim.com/sendincverif/dw/


Creation Time	2019-03-06	12:40:00	(XML Based - ENG - 365 Blue Box)
SHA256:
72c04f8234bf0bc12a04cf87fbb8211f7d4ae09893237a9f2e8350ffb4d59646
59547d6832a253fe4924046454129f76fd4652deebea172997b32b61a84fec51
0916369822d970f2bf3eaa8452328afd5fd147fbed3df60be3f2e4eeb6c86d75
13934c8f37a72977b544987914e107bc167b7940d61b0a6405ebc3636b3c5a50
4351f6639bf53025774e0c1165874add71ed503f587589d35b2b99904b4852af
e6a8fa6fd2d7f6e8617dc912c1b1fda01b63c17b8daaea514c41c5c296e5da71
6d657155c6839f42c7bd6edc1b3f2d5ad52235561a623fbc0331d0a068c4c5dc
1d5475d45501d757e3dc5f13e7a729cf7552b8001b5a5658b58ed4e18289c10d
69ff777882f36b2b5b5dcc202da002af220734619c14aa63362223119d299749
2c59004b86ea03ce674d1d043405ce778ae19e05a58cd7f72dbb0df5c299447f
04666d076b0cc083a7521124276d4fcf65a24b394c0f050787b7cbc32d01fe77
e37d0a6d96c7b89fc1df34845a943122577f147d995728c3bb56912f891716d5
e1075d72bdb7a44b4780001492dd4cd2fd1ce53dc0e9c7b7d6d815c988e26c47
5d069c1f3b84df81117abe63752b741eef65c6c20a5d4534f0a45c295d296291
56405f40b6e2feb7000409b3c7e1ecef050282885d884107c5a1d32cf595a6c7
c53be477fd795f5f4e983a7d603643d1385b696a39e190bea98bd19e0ab51d46
fc6e3c5fba8af420a3d4a4d12d4275df31be496628e0a6c455564f2e4bb8b5e0
4e7a007032659bd6c9ea650f0425733cca86f4c33675a082e9c571ad9ce9829f
8641cfd1aa2c05014642d4f17894d826f6c30396a9c021baa38cc9c32a65b9c7
99205b1659843af1df2ae5e6f2811ec95212ace5f6450ffceaa5c0b67c7bfbe5
87abf75443eb85de2808da03b26d4403fc7a550f2107eb651ccbcd701c481082
6ac2c2c110243763400c935374936446a07cde808861667931411bf2247e2a35
fa01290115cf9f5e0bd221a447374a33207aa4d8b9e33aa58b75bb7d71e0f5c6

http://djakman.web.id/wp-includes/Xy/
http://fitnesstrener-jozef.eu/0vta8ll/lQb/
http://fillysrealestate.com/wp/kGE/
http://www.app.koobeba.com/wp-admin/RBZ/
http://blog.snailwhite.vn/wp-content/9Ll4/

Creation Time	2019-03-05	19:00:00	(XML Based - ENG - 365 Blue Box)
SHA256:
7a0a851eb7e69b84e7975d143cb6613f4240136859eef155ebb4e8b2a3c061e4
12e59e6768f4ac72cb7d94024c2c422e8ec798bd969241eb740be198578f16c6
851a78255b4192c43dc367f82cd1f4d3b602f49dd33baf1b21f7ff971f5bcaf8
d55a5ea062f93f9db628b54a369f8011ad5bbef761a38fc690812eaad4c9d608
5b77c4ceb71cf67906f66d8ec4944db7f7dd31dc61d4f91443de723f681a15fd
9605208f7bf2119402e500a4cf52c94af124b2d7a9b500bede6620630ec7a3b5
97dccbea577db803c99d5d473b6feb37afb9695c1a00b1cf0f27e1888dad76a4
87c776148fb8e889ffd00a415c68d8e5c0ca0a01dd82a78d373acd9537eb43ee
8cf4e9457f7628daa011b76378846889b081133efa103e2a01541be537e921b2
cb56cbb37fca44842395fe8cc467bb3d70e2c5cfd22d0c06a42326a6f75b2b01
4bbb8dacbf0190b6e9394faa7e75808699bdbab86c7b0cbfebe855427a78469b
a4dabc324426e2794b1862afb9b3a40f81938951d8fa7dcb6ad0234520bdd6af
383f9697dae7c7f668cea4afd6e691b5033076225c94007d46c433a70c1b8782
b4eaee273cbfc0bf4f8b15bb98f7c078a661d717bd8cd02f5a899c9282225e1e
234df25dd373a6991a4da5e145114f64999b75ba3484da70ca7b052d39073720
bc38f5c36d5e7d6058e1ae48d9fa4e5050e9885c36fe45f6927d2f535b69aae8
5b40e5409d1ce4230e73dcaa67ca489dd61b8de730b714663c5ba366633b3256
f26bfed1b83be1432492432147ed3b6cb4335b625db4e2c2d808deb9bf8b8685
9029fee585bda620e7e6ab2e07b8046cf06e3c1cfbca7a41cdb1676f3618ba58
018d828e17c564e968fe602c930acc04c34fac03f2b289aa7b1362584cdfe180
275e7e60d0654abab9166fac71553edd726528608f044713d32a53ad69235cd5
5a652d0c04994886a1b7827ab8cdc621724a1381c0c568be49680d92bc5465f7
7b1a981d08207c533d4a4b2f5c2c09624a81d65215687581af47d507abf05c0c
50182d9c358670f53fd1c86a14d81e913e32445e8aed727e216727d33b574238
569f94e9e36d7ae553f469ed523c30725e6ed6e3178d350fc56d49096aa6e628
c5841f92ca99cccd82b839080547786c54c07bed382bc0e25b87171e2ec7d11b
b0437ca86994a45f08736d3e612491e0e0ccb8f6f89057b56e4ade9075c74ffa
09bb76e2b4507b37c0442281d86acddad20be8ef7f179a36de7ae6c63172d02c
6ea5d22807ed611c964355d44aceaa7276d50e27fbd48c661cbe64724e821803
43bbf0afde29b21f98adae2e6a6c5d93701e5e723c19f91bfb3f4531e5e4bb95
0bc1c015c9d2199a089e2aaa89a67dc9a7fa0b51cfd9f7f32b7d9210964ed934
6c5766050c69e210773d3fb9d7115836854decab47bd4952dfad51b7236e87bb
4fcee3fb915fbc5ebf6b9455d5033d4ae406ff7100e3d5511351082cc5d7a48d
433d222899298ae9186785becb3fee9efc501bb9f52469707c05211a27d20399
65c10177b790c7196f78ddc6fa2528cfaa80ef6b3039e6f7fba147d3b6633da1
bd8b04e5817f685b7b1acb62531975319e3b4412b1791bdf4e6bd1c5f51b8810
d8d04334e16e126ecff0f83450d4e141f9ca987e50aff09554e4f76a9ec13293
d5db46b19b771202e09a07f5efd332f875991c359ea5912446f4ea846d9f3f92
83a89cadd6bb2f37235f38e1df37e8bd7f67392e2da50fa4056f99f9322361a5
126b76ff49fa0e4a770b85b4aeca1a90321f135a1f1f272771fc3700e58926c1
ed6f8053949221ed10cd06006f9abb14ec7a5e68ce3e4410a3ae3a7a65c8189e
b5c4f069de45cf6fb4cb93efca890daff8f11116cca078a17a25393462f2a5e4
84af37348d1461733a4d77140d8861ed17e4195b8969ad09ff0cadf54f8e397f
4cbacae502913235ba9844b8077a904a92a79bd87807d2ced4b87a1429dcf10c
7c5df858b49cdd6e5a2a642fabdcf00cd575beec4c62fba6749930fa71654eeb
a1df82894fe0ec2f05370eb3e528c0690a10d9d5f666d2e461225c8cfa2ab955
d13b5ea2761899fe92b4f097f488303f9cbc2f0488d3abd753ad6267ee3c8d8c
b658f6d2637e167db691c2e328a6ac5a0a77fa110ab18dc4aca4fb80b0c413b8
42dc0fed7e73a75497b8a0a7564b46141f6c128de6a1bc64f061766ba2dbc8a3
e7f16d43aa6076188c1426f3d6e28521bdd95893130816a3f92a863c2cfdb540
f9c668acfd272f7559a02786f87a776e0207d2c2237bde1a60fdfe96876d9f9d
3fb1e14af9a89d88a19906e6eca416a6291cdeb86a6fc9049fabea36d54f3509
ca059caef95957d6648e83486e6e53777b0ddb69f6cd7431666c87e0fdf7bf18
b71d4615e0ec6c0fd4ac78377e127e085245287185e25865e5fa9766b910dcf1
6e0ac7c3f3f2e067cee0b1ec0158e20f74ed5037b44af4c1e46f2c40bf4850ad

http://basr.sunrisetheme.com/database/e8mI/
http://bipcode.com.br/news/wR/
http://bud-etc.com.ua/wp-admin/Ycc/
http://bafa.com.ar/wp-content/qs/
http://adeladesign.ro/wp-content/u0B/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 03/06/19 ####
```

2eb63fd7cafed84f8ffd51d24e15faaaabb16ab28f8ff2b45e9ac80e3040b30c
a150fc0f9bd5edbd2ab834657aeb98f6aa64f34d84f5426fbf18858660e0b4b5
6d350b65a9fbd5b77a86069862aaa464a3afe6f257d89da41c3f47d5ec7faeec
47e3cff274d6f22d173b04636e2a994cd66b1f6e8e853dca2f26fb1d85ef2c25
8e1e2721446006c71495d61f639d5467a66dab30f2dad77f58855e61fba32a47
9ef7174e407b3af31bafa31d4a12dada53486e1d663e3ff3c907e077ef339e0d
8e1d0dcdca8554639dc060e4c825e5ec90f3c3e2d5a079620a092d82c7856261
9ef7174e407b3af31bafa31d4a12dada53486e1d663e3ff3c907e077ef339e0d
8e1d0dcdca8554639dc060e4c825e5ec90f3c3e2d5a079620a092d82c7856261
701bdd4d31169497080f71938ecb96e2e9a358970ec7b426fe72a75a59d53664
186a10f3f0d3fb1ecf21a4035eba80b6518189453509bd49be45a224dd6ed370
87e2db43a9c7dc3685e49cb7b0cf22f44241fbf47c90e353eeb1d30e45084c13
3251a2a4e7ea845aac93ef99cb887f7e62eec35a2b0f18d148607a20e1f843bb
0b90c1a779c1ee591d5aafc5410bb9d65aaf6665e1d1eeab8db6d1fe87c12b26
10d73031b61f59c3a0c805bca7ee1fd3606b10f5c975585cab6f5a3b39d8c744
0751da9c723b6137a600a145ff506a3082bd3c2f92fd2be56e1684358a0f8276
97a38ab18c7de1d4ae57eabb0beee69bff9cb07f4a593d0f784b201ceb9c21c5
273a8420e6cc49370974a17ec01feb591ba59387a2aedabe7ed11f96266b2c23
37229e58d1b0539fa6b9fa76d1a4b22d8fb911b25b29444ce993c89ebf04ba1b
90c7c1b98735d3a398c788ed9be2b83b4eee3f0dd6c4dd3f21a706c043a1dddd
8c00db9d10efc215d977f9955e9bd9b2f10c910ebf7359ed8e97ad8dbe3e26b2
b37436d00c614e49a5ccdf5d3e36b1db1b9d88f6db87925e24f6c1d6a6969bfe
946d290c99eb5f580ec1b44b0af464c33226d66145f0f59590f0280f5d6aa7a6
835609483b26d0acaad4bd6164c8bed8fb732be181d94ca2f34b9e0ac0884482
636d0b02e95b71e3b09c9d88ac3f4f034ac78ec095c377fb81eb68b222696eb5
c02b7f8e275d5060a7c75613bc74cae0d1588f6607cf93d8a85c2c1cd1d1d205
86bfbe6573a4c959f0a4b27074f1b1b9917876c1a3c945a3583da5ace9847c5a
7b1895762ccfd507ec0e792b6186fe936b7835fc565520a31e54afea77ef0436
8a01a331e47c80733d1c8cb1478fa4668316f95020b00dcb3ac3ff86cdf0075b
5f4d0a769cd5f0de13717938a62000edd22c2d95f882e5d72decf29a1c2d20df
4bd2bc58e4ae7adf862dd4ea80e7f32eab850adfaed6333f096809650f1aaca9
cf3cc598adac5249eb39b0e9f123c7c467882eedb463fb7b80ff4e5c74e87afb
a84467d38acf34f850a1a77852325bb758d69d1ee175b2c98f9ba1a95f914536
c4882096f219515091a82898e8a643c3f30306104d742f8e3968768f53031357
b64dfbb5a2ffc0763dbe29341aa498499aa1d73fff60c487246f47be94b3b335
31a7247a9cfcecbc9692583dfd93bb6970beb1a02d132a0d05b6187b553acb39
84609bec21f195404e576e953918791e4d5f0439a212f4e439115ce0000db59c
74be5fc6eeb3ec62441ec54e743268a9889b7fefdd853368b92fcc97a3f3a87b
d4061888c3a1faa6da9dc59afb20d4c8d92bd4317c631c5ca9a114a55af3e0e2
493d4db4bdac9ca7b09dbda28d93d242ac109a8c80b8921d9bc557d8b9505ad5
1f06bbfcbb3aa334189490a975a26d8c01b3463fd19ee6cd109c0021d03a82db
a291e7586147f8901201bc23130a60b413d4375f20d4e1e4abab872bd74b3e92
c526e64c58f92d0b02103007612b63fb459ce04c67697ef8b71470bb90826ad1
72521724ebfb60d34d20a4a2931442edbba26200c9a7595e9644c4d6d2afa51e
43319cda99c66fd6b42389847d45ac5568a0b00410365445fe3d6727488323d2
a58d559ed603b1ec680c79e75e9b7d60b3c64c80b3473e14236a37bd3e37537a
1780c41b9014a5f1b29b3a71bc0bd329242ba11b61e81e4096a7a5306e611308
f3d8efd5726941e00660254f76f35529ee4f2b8c4efe17f9cf844ba0c2c37ef5
267f4ac61870975ed3d7d31083d4b3f5d6ed5dc35ff9db3139f104fd3d2669fc
48711edb507981bf8b33020237972b9da079a28f2a70af74137175f227e6d9ba
2d6905e707a05fcd5bfdf86c1b5bb73dcaab985fac9da6259141bc3e8abfba4f
092d160f845ee1091298bb5daf8bc450b43e2d9522cf65a702ef50708d23a9be
626e1846be7e19c19b8aa0487859d22295d421e61017df3f98cbac7ef504f70e
cea83062fb250927612c287492072e3a259568969550c951230d760d85f7cd90
28af3e269e3d27af4f58738982d089f047ae796b5fbe24e69002928eae4fbdb2
9e0d33cfa4e61200fdb0636df6e56d48cdff726e3a5c145154134dd5137949ff
a1b1861aa2f40694d0b2bf6ae292aeca58abf699319c7043babed31f62ef4e3c
dc8a2a748ee8afcf7999bcf861ed0bc9651af01d994aa48ac591f7b33edb11cb
7c626e678aa8dd288b8ffd25ad0c12ab571dc516071df49137e4a09dbbd2abc2
0448a3a16b7b977ca1aa463e2478204383f388ab8d5df0a6f45a5259dab1da31
2e973956102295c839a74722c9aa323d5d9ac47bfedf50a3bc959afdb93e51d6
8005132b2a4f76ae57ce97e97f2e08cd1cbe7ae6fc14971ba21d0a7f2a17a220
768c9cd41b223b71acb6c4764c6b40a264650e37098664793fbc3df7d275600f
100085cc56691be2b4dc35c2cc48a60b6f805796326768985db5b48689d659f5
7d3aa4ae97a50d107195f8b57770142c45a895eefb086f0d9ffbc067550a70de
9e78a0fee440f8046a44ea5480dce3dfa8f479c6b64d592baba9e6c78c92e408
2dc564162089abfc3788c22f315365ba1b1678dc098f991e99daf51e4ac99e6c
d4431e5b45fd0adc26d3e5210f091ed3ef9a3b6b5753264948f8b6fa695e8e66
9b5934f47d6e9691c3036fd57e9c273bc7fcd628d163cef1163df4f037e384af
133e03f5f37236dc17753e3de3cf6564bfd33007260fd29458e2624f42e7f954
423d834065e7ef5a201a5721f6164e96d3ea76dc2388bba3fc29a529ba197722
eeac869acc34750e43a05bd1d30829c0c68e6fbe2fd92bb0840e00e9924910f8
e948d320e129dacea4d022555c03e90d37977b32c45bd58100acdf26d896f639
25a6ff8266c19ce418fe4e2e810ea25fc654ae2dad118b608007f0cb58bdcd32
e542fb0627edf500a7431b7eea7d004d2fa4c15090b38396922b9833333f2a1d
aa638d871db059dc17c34d8aa8f310d93e32de26048634e35d883895cf15ed19
c72f78f712ae9cba963d1445ad65b6c89de734b1874b1c205faf7ef6468bc2e9
cf625a2664c34a249bbb86b0cf4c88e29a5c0a9bc4c588aea7ac4e0e3bcaad0b
2592219628e22981968702c97e97698269367695f0c73de8585f205483c77cce
5a8e5634c154df0359b26c5c3025cb52a45f180e3d78e76c0f226f284a0397aa
59e885e0d58e8f86b0ff3bc87acb820461054145c924702e4a207d5a53747b83
8b061d276a13bb2985c201b242bb3df5bbaab19ee5646489ba28603f7c5db8e7
14395ae9536220949730db28c9bdc85d714749af6081c888d203cd5028b63c5e
f203153dd8e4d6fe96ce37b7cc8b6dc4a13817d2cd3b0da968cfbf48d415f266
e99b309ad568b104e20953872b4ae703821d2c99275cf4e2d45c03daa8b9d6c3
ad171473ba1a4db8dcb99fcb028424ecb7cc94629e5758522355cf0276c14609
c5a9608f1d33fd01a8295d0af5aaf06f9bdae72de8bdf447bc7c62f2cd2c62db
611990eb4ac3fbd04263d50b45705441a053996ed0a62f1170a2e30117122b6c
0051712e0ea6a95d5156c7c787aa026e6ac69137c5404845fa400c21648bb8ac
3c817f7f45a7cc1119a3bc2d9719bd2b5c5dc0f741234a16336dd34fe95053c4
7de7618b277ebb7e5ebfec02e2f99bae59353b349a11aec3e07bfa97ffc132fd
10591feecfe851510fcabb8a43eefa1595d2a567f1bf113a0d44b2b52c80ed7d
da994076d1280afb455429318ff3eb5387e1aac69fbe465d0df88207cac55d32
7787666617a4a7a4828488dbb0e2ad17d0d4efc62f074736a1adb24348854eaa
20f98d8d58c59d9de1619828852047c5b24673a3bbb1874e76ce7c2485bec5c6
cd73804466dd6280457176a359f415c4d1f1a1833928472badf27f446b4b6f9a
3cec728815c7cfeeafdbff6c488c1adaa956afe3e4759d88c53181aa59a35528
4c4f43b9777ba75837b0320312544429eb69a7d2b8eefffb875205756117674d
ce04a56d63472eab3eca61bafdc9f8694bb356df1ee99a9196a172f323756132
f428287c22db34b5f253a286d7c01a98e2e46343806b6544b21bbbf423d495bc
da7111ef3f62a4d296a667ff3348f051ea451b980c4689c7b35378e4142ab3d1
bb4ee98b770ed13b981558fcc1719a494c634505d8cd186b7952a27c27f1e4dd
70b75c9401cdc9356c55547f2fb5167506f67e5f0bcf123ab30efcddf437e154
3933e6053920fb3b48bc860c8c3ff599c94f97292d1edb4ff351160f2c069f8a
cc7f60560dfb6854cd211b217573d4aea19bde8a7729bdbee731a1424385a5f5
cc7f60560dfb6854cd211b217573d4aea19bde8a7729bdbee731a1424385a5f5
c9ac157e03c7525eefe551e63fccb5cf41670cadb7470b0b72ea370240d907b5
607c4e1c98617676e729ae7d7df70b30bcafa15e138661ca29e7cf00e4d028d0
4cc4cab57869d92ba59f28acb0a1dc78fade61b7ae680be73bf7238e99adf3ff
9e2b9db83c25d32df57a043c7c39cb485dddf518620f25053e6c696b97251f55
632b6ab219a4deb483948748e5e7e5d1755e845b94e30c66253b4ecf978f2a69
40c060c7aa0baefd45d0724454b4431030c63b06cc4b6a3ddcc9fe947795e58e
3d1affdbc48ed4728f372108ad79729a5b62e479fd306262aedb0c28e277c572
8c3eedeb5411fdc58a618a9a65afb0b8a5f1ac7cf7b9ad2e4cbb385868fbd4ac
5a9a09c94613e27f5382790e39fd00d498013a7b001586d5c5c4d8911050fe58
05921771c263205e1f6771dae996bb030e816bcfa423f4a87410a4c226f9954e
61ce77f72b2f3b113e5878da7b67dba8bb0b693150f38dd256ec9e1620add292
16e464d09b940bad7a87f3918b0ac1d0da3028a9740b0464ae28227a3459543d
eeb258899522183e941515fabc5c5bbb262736938b937c0f81c15139076eb25e
ee88237d87a2f4d7ca4a369dd14f78f97f282b6acf3abdd75f8bd46d744f2f25
92123e8ea92bd5067fc65b8bd65e828e8713decb0815156e2e942a06a13a5f52
f599d210f6ac27177bf75ddebfdb0b48122a236f8bbe78e6e612e0f38f56cb9c
1e15765b76828d9d76e1fb2c6f1f66c0ebfe9ccba9495fd1efffd350b91e03c1
fb26a7555ec814755f0a07e7db41d57b40961f8fc8abeb19fa724ee2a087e306
0e14c6717403a5e05f99f83f9cdb29c4bea390ee8ed4e393eb0103b74b6dd702
7533c783d6feed5e20c62fb0d0a8faf5f7c871b1197d8785d55dedde9d70600a
07254807ac5f35ba57e0fd73197752216a662243cb99802609a4440642443705
22947f214cc090dae0a02c3ab4fd9d7903f9da0519f8205a24860d84c06f0070
6f9f81788e9e5eba0befdd0b50f72346534b15d4959e2c0f8b9455de2496fbd4
0a5362b858cc54c9ebcb9699ec29a74fba13fc11972bfc47f735955478ffc53a
3a427d8049d30279d6df0beb5b7a4e970bfe4130a619434f4fdb413314410d1a
3147053031c356afb1b19b44aeeccc80e46ba94a4127683e66a26c0e1598f2bf
63edc9adec4704e055cd0e0290fc67c130a82df4ea3618814b0935322f9fed8c
b337943c31bda0a8fa627c50f0772f37b5560c0a6873f75eeb73d6265a02a6eb
75e872042addf3e816aaebb3b2b59e3f05316f0255243eaa36f2d5f59505a887
8f722acf7eaad4d0c967c05d6d3ec946b6b695e7ff36a857495a305e9f0efa1c
fc187a7902d8aa78472e47f2a9dd6f9e388b09a034f5b997fddfa055cef38392
38b20ca0fbaca50e5b195621e471075833a9d42b38fe51ad60380d71fe4f4dc2
8bb2c1d5ed3498fe0d52352c58648d934eec81b207758745859d0ef1fcdfd43a
187344df6feb4ad3319ef841a5710f199d607a06c28833144807064bb34b8e0b
f9ecaf62118d82365616608bcc74357c575bf2683e1c0e96e0ecc95744e5378b
c2e683a40830b8f678cc13c59c879eadd7c42d762d3f7161318449732d35794d
13406e932d2b6bf6cf05089b71b699e29a6db1e0f3d4ff2cfdd9974a04f63308
9a766113b0f6d8e9ec89a46ac8e40e770a8b26f978eb61a4011c02d34a5ba1ec
60513096091a0b0a5e75f72eb618f0689f7a8c3fdb4ca52340a03a7f80709489
d05a429afdf9777c5d4c092024166eaa8631944776b7834b78445e69cbbb548c
d7d38e04c6a017419e6ff481477420e3f2de2e52cc9b978b99f7c5bd13f0469f
2fc961f28f90c11a45aa73b7096dc2ef4a24a89640b4f07622049e1ac5333c99
f0888d603da96dd50a6d9f2ee99b173169068cf4d60a95686d1e1036e7018f51
1bbab6a0646d1423e4574b401a088f1f3814a4cbd42981d774631e60834f75e9
a7c5b05ce28a32616a80ab030cafc1a61664c5cafc87efdfa553e14c198be10e
655b0e4163fd240c9d0bd944e6d1fbd5762d277fcc21e9fe0670a0835122e52e
4642cbbb211e1d6cb78aca14e05fc11e76764a96e847235c382f88101264f2ed
035579bb5355dd3f4307bb6126bc6bb1044d34b369be14606d8660036a26cfc2
e317b8973080263d42cc31537c704d556bfc3903f54c001519d3d978adcbfb30
fa0d024801162520c3e2f51a6cbdb9e45bf0f72a89582cc6948ce70194f4c5a9
24a6205949531a790cce96bd8fcece3b1ae8b8389309c8e8326be00a9f79b077
1276bde5b2e346bec01324694f423b2600d076967b46cddeb0d09513080fab92
9782bc6025e8d3fbb852225c4334769471ae635636baf9631e5e00943b909fc5
918eb68042482964a97d3a97cdcf396c4f6096b31305dc2b2f5980e9cfb63f54
d0014127a61eaf46d3060ae15dec8a477b49b842ae0276cfcc52f052622f36e0
a8e63eb8e3f0ab00c780230386c71584e7d3e8935a478b7260f858ebe57edbff
3d06fbfbec4434b4afd59a71a8b8994662e8d8b827ff57e8e97c070621092b1d
f7fb3ddc54f95086d1692ab1bdc388f36c5d3615ca7ca3963b34631defb04730
7db0bc23139d88273f770552edcd75bf00d09b6a8b89f25371c6bf8bd1ed59e2
d5a882ff61ed661d1bafe246a3cc839805a81727d118b67bd089eb372ad72669
0f106cd8b38655c63a2d44061d0be8b95cf32b7ffc3b1fc234e0f0f234f943f6
303c25bf4b20acb21d663dc884715ead6df7ab03aa06309709c759aeac30bb7a
b6a3a502707c6c2eb598314742e3207b3e463803789ef180eeca01f28e91b7a5
2de1ba0183b3d589c29525d1579a59a05913a71f5e7acf2aab19868bb260d5e9

```
#### Epoch 1 C2s ####
```

104.33.204.83:443
109.104.79.48:8080
138.68.139.199:443
143.0.245.169:8080
144.76.117.247:8080
159.65.76.245:443
164.77.138.194:80
165.227.213.173:8080
173.248.147.186:80
173.94.53.3:8080
181.16.4.180:80
181.29.214.233:8080
181.56.165.97:53
184.161.177.223:8080
185.86.148.222:8080
186.103.141.250:20
186.137.133.132:8080
186.138.205.189:80
186.23.186.99:443
186.96.198.72:990
189.188.140.179:995
189.208.239.98:443
190.111.215.2:80
190.117.51.248:443
190.144.66.30:8080
190.171.105.158:7080
192.155.90.90:7080
192.163.199.254:8080
200.55.136.2:443
201.184.224.178:80
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
219.94.254.93:8080
23.240.26.210:80
23.254.203.51:8080
41.60.202.26:22
5.9.128.163:8080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.28.3.120:7080
72.47.248.48:8080
73.115.132.124:80
85.105.205.77:8080
85.105.215.241:20
92.48.118.27:8080

```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
181.168.129.146:80
189.159.195.202:995
190.147.23.76:80
47.180.177.96:80
50.116.63.9:7080
70.44.163.160:443
73.14.76.77:20
81.168.92.58:443

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

103.224.157.244:443
103.53.44.20:80
133.242.156.30:7080
138.201.140.110:8080
147.135.210.39:8080
153.121.36.202:7080
167.114.210.191:8080
173.255.196.209:8080
173.255.250.241:443
177.242.51.8:8080
178.62.37.188:443
181.140.37.228:993
181.209.169.123:80
182.184.72.199:53
186.113.255.229:22
186.43.207.22:50000
186.86.199.79:80
187.142.0.234:22
187.209.46.240:21
189.141.175.53:143
189.153.60.187:80
189.156.39.161:20
190.156.169.212:8080
190.46.30.14:443
199.36.199.104:80
201.192.156.113:8090
201.220.83.133:443
203.143.86.111:8080
208.78.100.202:8080
209.217.209.214:80
211.115.111.19:443
217.13.106.160:7080
217.165.127.223:443
40.134.64.58:443
45.123.3.54:443
5.230.147.179:8080
50.31.0.160:8080
59.103.164.174:80
62.75.187.192:8080
66.115.86.249:80
67.205.149.117:443
67.87.70.199:8090
69.198.17.7:8080
70.119.86.15:443
75.104.218.201:143
78.188.105.159:21
83.222.124.62:8080
87.106.210.123:80
88.225.223.211:7080
94.200.157.250:21
94.76.200.114:8080

```
#### Epoch 2 - Spam/Stealer C2s ####
```

183.82.123.254:80
198.58.114.91:4143
213.136.86.219:7080
37.209.252.79:80
64.228.72.40:8090
67.202.178.142:443
78.149.210.211:22

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/06/2019)It has been awhile since I refreshed this section so I wanted to update it and bring it up to date.

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of payload
updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications. Epoch 1 is
currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more rapidly changing
version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period. This seems to change
back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen to move bots from one to
the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same time period. Here are some
observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://otx.alienvault.com/pulse/5c807ababf7c29471bd351fd/ - @SecSome

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Today was a light day for me with malspam. Only 14 received and about 30% were attachment based. 1 was PDF from E2 for BoA suspended account.
Most of the Malspam was again from E1 and the SendInc template. The malspam came over the whole day and not in groups. Nothing special really
about any of it.

Again docs were XML based again and 3 new payload quintets on each botnet which is essentially normal. What was really a big surprise was the
HUGE explosion of binary hashes on each botnet! In the past two days E1 and E2 went from a new binary hash every 10-120 minutes to a relentless
pace of every 5 minutes. This is something I have not seen before and it seems like the EXE distro got a major upgrade now. You can see the
sheer amount of hashes above in the sections above. Normally this is even a high count for Friday-Monday and we have never seen this much
in one day! Current rates put the count at 150-200 a day for each botnet/epoch.

E1 C2s changed but remained at the same count of 47 combos. - Recorded above.
E2 C2s changed and combos decreased from 54 combos to 51. - Recorded above.

Keys did not change, we seem over due for a change.

Updated what is Epoch 1 and Epoch 2 section above again.

For more FUn from the crime syndacate that keeps on giving tune in tomorrow to the Emotet gang.  TT

```
#### Sandbox 03/06/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-03-07 at 03:45 UTC - https://cape.contextis.com/analysis/43366/

```

```

Epoch 2 C2 run on 2019-03-07 at 03:45 UTC - https://cape.contextis.com/analysis/43364/


```