Emotet Malware IoCs 12/10/18

## Emotet Malware Document links/IOCs for 12/10/18 as of 12/11/18 00:30 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 12/10/18 ####
```

http://13.127.126.242/EN_US/Transactions/2018-12/
http://429days.com/US/Transactions-details/12_18/
http://51.255.193.96/wordpress/US/Transactions/122018/
http://58hukou.com/EN_US/Messages/2018-12/
http://96.ip-51-255-193.eu/wordpress/US/Transactions/122018/
http://anigamiparc.cat/US/ACH/2018-12/
http://ballbkk.com/US/Payments/2018-12/
http://bepdepvn.com/blog/cache/En_us/Information/11_18/
http://bratech.co.jp/parttimejob/En_us/Messages/12_18/
http://ccv.com.uy/En_us/Transaction_details/12_18/
http://construccionesrm.com.ar/EN_US/Transactions-details/122018/
http://deguia.net/En_us/Details/12_18/
http://dekongo.be/US/Details/12_18/
http://djunreal.co.uk/En_us/Documents/122018/
http://dpn-school.ru/Telekom/Rechnung/11_18/
http://emulsiflex.com/Telekom/Transaktion/112018/
http://greenplastic.com/Telekom/Rechnung/11_18/
http://heke.net/Telekom/Rechnung/112018/
http://henneli.com/Telekom/Transaktion/112018/
http://indocatra.co.id/wp-admin/Telekom/Rechnungen/11_18/
http://jjtphoto.com/Telekom/Transaktion/11_18/
http://johnsonlam.com/Telekom/Transaktion/112018/
http://kientrucviet24h.com/US/Transaction_details/12_18/
http://kingfishervideo.com/Telekom/Rechnungen/11_18/
http://kosmosnet.gr/US/ACH/12_18/
http://learnbuddy.com/Telekom/Rechnung/11_18/
http://levellapromotions.com.au/En_us/Clients_information/2018-12/
http://lutgerink.com/En_us/Transactions-details/2018-12/
http://madisonmichaels.com/Telekom/RechnungOnline/11_18/
http://megascule.ro/Telekom/RechnungOnline/112018/
http://meiks.dk/Telekom/RechnungOnline/112018/
http://menne.be/Telekom/Transaktion/112018/
http://miketartworks.com/Telekom/RechnungOnline/11_18/
http://minet.nl/Telekom/RechnungOnline/11_18/
http://miniaturapty.com/Telekom/Rechnung/11_18/
http://miniboone.com/Telekom/Transaktion/11_18/
http://minterburn.co.uk/Telekom/Rechnungen/112018/
http://montinegro.nl/US/Clients_transactions/12_18/
http://moolo.pl/Telekom/RechnungOnline/112018/
http://mswebpro.com/Telekom/Rechnungen/11_18/
http://myfreshword.com/Telekom/Rechnungen/11_18/
http://net96.it/Telekom/Transaktion/112018/
http://nygard.no/Telekom/Rechnung/112018/
http://pamstudio.pl/En_us/Documents/122018/
http://pepperhome.ru/En_us/Payments/122018/
http://planasdistribucions.com/Telekom/Rechnung/112018/
http://radarjitu.radarbanten.co.id/wp-content/uploads/En_us/Transactions-details/122018/
http://raldafriends.com/Telekom/Rechnung/11_18/
http://samuancash.com/EN_US/US/Clients_Messages/12_18/
http://skygroup.company/EN_US/Documents/122018/
http://slittlefield.com/Telekom/RechnungOnline/112018/
http://smpfincap.com/wp-includes/En_us/Messages/2018-12/
http://starstonesoftware.com/Telekom/Rechnungen/11_18/
http://stevemanchester.com/EN_US/Transactions/122018/
http://strike3productions.com/Telekom/Rechnungen/11_18/
http://sublimemediaworks.com/EN_US/Transaction_details/2018-12/
http://tasha9503.com/EN_US/Clients_Messages/12_18/
http://terifischer.com/US/Clients_transactions/2018-12/
http://thebert.com/Telekom/Transaktion/112018/
http://theblueberrypatch.org/EN_US/Clients/2018-12/
http://therundoctor.co.uk/Telekom/Transaktion/11_18/
http://thestylistonline.com/Telekom/Rechnungen/112018/
http://ton55.ru/En_us/Transactions-details/122018/
http://tpc.hu/EN_US/Transaction_details/12_18/
http://tracychilders.com/Telekom/Transaktion/112018/
http://triton.fi/Telekom/RechnungOnline/112018/
http://turkexportline.com/EN_US/Transactions/12_18/
http://ulushaber.com/Telekom/Transaktion/11_18/
http://vasicweb.com/Telekom/Rechnung/11_18/
http://websayfaniz.com/US/Payments/122018/
http://windfarmdevelopments.co.nz/En_us/Clients_Messages/122018/
http://www.anigamiparc.cat/US/ACH/2018-12/
http://www.app-utd.nl/En_us/Transactions-details/12_18/
http://www.beautymaker.dk/Telekom/Rechnungen/112018/
http://www.dekongo.be/US/Details/12_18/
http://www.delphia24cup.com/Telekom/Rechnungen/112018/
http://www.estab.org.tr/estab2/EN_US/Transactions/122018/
http://www.etkinbilgi.com/EN_US/ACH/12_18/
http://www.freestatecoaches.co.za/En_us/Clients/12_18/
http://www.indigomusic.com.ve/En_us/Payments/122018/
http://www.italyrestaurante.com.br/US/Transactions-details/2018-12/
http://www.katajambul.com/Telekom/Rechnungen/112018/
http://www.khantil.com/US/Payments/122018/
http://www.luckyslots.club/EN_US/Transactions-details/122018/
http://www.mothercaretrust.com/En_us/Details/122018/
http://www.mskhondoker.com/Telekom/RechnungOnline/112018/
http://www.skygroup.company/EN_US/Documents/122018/
http://www.standart-uk.ru/En_us/Attachments/122018/
http://www.topsalesnow.com/EN_US/Clients_information/12_18/
http://www.wikiservas.net/Telekom/Rechnungen/11_18/
http://www.zengqs.com/En_us/Messages/2018-12/
http://zuix.com/Telekom/RechnungOnline/11_18/
https://u6195215.ct.sendgrid.net/wf/click?upn=gDVu0bOg93Kr1-2FiiEIyB-2BVrm3A4bp1FMtw5OSIJtPZTDAg0tjoW27KYSKEHxU76fqTvgaiS8E0CNULMjnxRAAw-3D-3D_qe80j3tbggoe73ttjudT-2FFaDm-2B9fdVHh-2BBhauNll6IjSJvHWSyZB9hc65z-2B9qrOI1WZKR4XQKLmci47cXfZlHOx49XtCwclJRMmlUTx-2F3tapbuXJuvpa7syZW963BFGczt16bX9v9PcJrutJl4yKuth6G-2Fr5GFbDtgExgXq15zoTLirkelqWCBKUMGcZI1FI5b4K5ZSYR0HYKgcGZIZRwy09FEoHGR5j8DIUTSMfdEo-3D/
https://zone3.de/EN_US/Transactions-details/2018-12/

```
#### Epoch 2 Document/Downloader links seen for 12/10/18 ####
```

http://13.114.25.231/COMET/SIGNS/PAYMENT/NOTIFICATION/12/10/2018/files/En_us/Invoice-receipt/
http://13.232.88.81/456573/SurveyQuestionsDec2018/En/Past-Due-Invoice/
http://142.93.201.106/IRS.GOV/Internal-Revenue-Service-Online/Verification-of-Non-filing-Letter/
http://159.65.107.159/Internal-Revenue-Service-Online/Wage-and-Income-Transcript/
http://2.moulding.z8.ru/Ref/17183085Dec2018/US/Invoice-for-z/w-12/10/2018/
http://31.207.35.116/wordpress/PaymentStatus/LLC/En_us/Invoice-for-b/k-12/10/2018/
http://35.242.233.97/Invoice/82162284/Corporation/US_us/New-order/
http://51.68.57.147/ACH/PaymentAdvice/scan/US_us/Need-to-send-the-attachment/
http://advantechnologies.com/IRS/IRS-Online-Center/Wage-and-Income-Transcript/
http://akili.ro/masrer/media/INFO/US_us/Sales-Invoice/
http://almarina.ru/IRS/Tax-Return-Transcript/
http://anewcreed.com/IRS/IRS-Online/Record-of-Account-Transcript/December-10-2018/
http://aural6.net/scan/En_us/Sales-Invoice/
http://aureliaroge.fr/Invoice/12326100/Download/EN_en/Paid-Invoices/
http://beldverkom.ru/IN98/invoicing/Dec2018/EN_en/Invoice-for-k/r-12/10/2018/
http://bridgeventuresllc.com/Corporation/US/Open-Past-Due-Orders/
http://cuoihoingoclinh.com/wp-content/IRS.GOV/IRS-irsonline-treasury-gov/Wage-and-Income-Transcript/December-07-2018/
http://enthos.net/IRS.GOV/IRS-Press-treasury-gov/Tax-Account-Transcript/December-10-2018/
http://etherealms.com/Inv/132623054/Corporation/US/Inv-23528-PO-1T381902/
http://etkinbilgi.com/Southwire/DIQ204616619/INFO/En_us/Invoice-for-u/r-12/10/2018/
http://fixxo.nl/IRS/IRS-irsonline-treasury-gov/Tax-Account-Transcript/
http://fsastudio.com/FILE/US_us/Past-Due-Invoices/
http://germafrica.co.za/rnYubpYJvE/SWIFT/Firmenkunden/
http://inspirefit.net/IRS.GOV/IRS-irsonline-treasury-gov/Record-of-Account-Transcript/
http://institutoamericano.edu.mx/IRS.GOV/IRS-Online/Verification-of-Non-filing-Letter/
http://jeffandpaula.com/InvoiceCodeChanges/Dec2018/US_us/Inv-963637-PO-0G609389/
http://johnscevolaseo.com/default/En_us/Invoice/
http://kc.vedigitize.com/ACH/PaymentAdvice/newsletter/En_us/Outstanding-Invoices/
http://khdmatk.com/FILE/EN_en/Summit-Companies-Invoice-71821219/
http://lifeinsurancenew.com/IRS-Transcript-treasury-gov/Record-of-Account-Transcript/
http://lucdc.be/FILE/US/Summit-Companies-Invoice-8233310/
http://mailrelay.comofms.com/wf/click?upn=020OhaSCvLJwXru8Pqq0VYYUFBLhDlxbRKaK7SU6yqDVVBrhpPBdibMCaKuTyVCBwryziHDLppv077UaQ4JfLnjQjGtQl0UCk2DTO8rDbHg-3D_rIw2P-2BT42gKMRuUz-2FkXSFtol5eTzea1yUWsGIT4nOuGBkfdhqTUDyvCjU2HhTo1-2Fxv86zLaNK9UV6B-2FJzSQHApCpauKd-2FouGD6ej9tMzYeLodHppzHjCubf1Z-2BhdBSTcuPiUNKgcidkyGtfdg9hznjFzlgACrmEE3CzkaWenduSwlSk7E7x6NbdnzuCqazrqN0NyU7B-2FdTvqwxg0U3JgaczKrXRqXukJTss-2BO32PEn0-3D/
http://mailrelay.comofms.com/wf/click?upn=vjDVQG87cuR81zOVLPmxSp-2FIVnlVQuF1xphExDcYC-2Bwl8XdEZAYOwgTZ5uEBnhSN_6HkQRrOI8aa3th4SgBOH-2BZGsSKjh2CJN3pR4oc-2FcOuaHvwa5FTNwFV6DyCMdl131Bm-2F7XJfupY72FSL376JugwpH8a-2BCmB5Nx314c3rntRA3crh9Hs3NGD3vvDMnSA5-2BhpdZuJWBV-2Blg3W2WIPJKv9aMcIAlgf2rmqk4PKrhwhvAOymu62dOoKmqmQGYk8fkpZprDiJjxZhF25wSOzuSqA-3D-3D/
http://mattayom31.go.th/Southwire/YYZ094715649/Corporation/US/Paid-Invoice/
http://mgupta.me/Internal-Revenue-Service/Tax-Return-Transcript/
http://movil-sales.ru/InvoiceCodeChanges/Corporation/En_us/Service-Report-8493/
http://mymachinery.ca/IRS/Internal-Revenue-Service/Record-of-Account-Transcript/12102018/
http://ngayhoivieclam.uet.vnu.edu.vn/wp-content/ACH/PaymentAdvice/scan/En_us/Scan/
http://parisel.pl/Corporation/En/Need-to-send-the-attachment/
http://pbcenter.home.pl/3573529/SurveyQuestionsnewsletter/US_us/643-58-323227-737-643-58-323227-033/
http://pimms.de/44535/SurveyQuestionsDownload/US/Overdue-payment/
http://polkolonieb4k.pl/wp-includes/IRS.GOV/Internal-Revenue-Service-Online-Center/Tax-Account-Transcript/December-10-2018/
http://pollyestetica.com.br/ACH/PaymentInfo/INFO/US_us/Need-to-send-the-attachment/
http://pos.rumen8.com/wp-content/cache/Invoice/9116455/default/EN_en/New-order/
http://potterspots.com/newsletter/En/Invoice-for-you/
http://prezzplay.net/ACH/PaymentAdvice/files/En_us/Summit-Companies-Invoice-6224854/
http://primariaunh.edu.pe/IRS/IRS-Transcript-treasury-gov/Verification-of-Non-filing-Letter/December-10-2018/
http://projekty.michalski24.pl/PaymentStatus/files/US/Past-Due-Invoices/
http://publica.cz/FILE/EN_en/Invoice/
http://pure-in.ru/PaymentStatus/default/EN_en/Service-Report-3737/
http://pusqik.iainbengkulu.ac.id/wp-content/uploads/Southwire/ODL23145025/xerox/US_us/Invoice/
http://realistickeportrety.sk/Download/US/Outstanding-Invoices/
http://remec.com.pk/Dezember2018/HQLJQOJM4599537/DE/DOC/
http://renessanss.ru/5982391/SurveyQuestionsLLC/US_us/Invoice-receipt/
http://reser-si.com/IRS-Transcript-treasury-gov/Tax-Return-Transcript/
http://romagonzaga.it/test/DE/HDUNOCRC7818695/Rechnung/Zahlungserinnerung/
http://ronyrenon.com/INVOICE/newsletter/En_us/ACH-form/
http://safetel.co.za/xejV3WvzSI/de_DE/IhreSparkasse/
http://saigon24h.net/Inv/7193708590/FILE/EN_en/Open-invoices/
http://salazars.me/IRS-Online/Record-of-Account-Transcript/12102018/
http://sandau.biz/Inv/3998163986/Document/EN_en/Outstanding-Invoices/
http://sapucainet.com.br/De_de/CUFEALIOKI1814018/Rechnungs-Details/Zahlung/
http://sato7.com.br/ACH/PaymentInfo/LLC/US_us/Invoices-attached/
http://saveraahealthcare.com/IRS.GOV/Internal-Revenue-Service-Online/Record-of-Account-Transcript/12102018/
http://sciww.com.pe/Invoice/500875705/default/En_us/Past-Due-Invoices/
http://shawnballantine.com/LP88/invoicing/newsletter/EN_en/Past-Due-Invoices/
http://sigi.com.au/DOC/US/Invoice-Corrections-for-39/45/
http://simple.org.il/invoices/5769/1637/INFO/US_us/ACH-form/
http://simplesites.ws/S95/invoicing/Corporation/En/New-order/
http://skaterace.com/INVOICE/default/US_us/Open-Past-Due-Orders/
http://splatinumindonesia.com/newsletter/En/ACH-form/
http://steninger.us/Inv/5721747767/sites/En_us/Paid-Invoices/
http://surmise.cz/invoices/7482/8632/files/US_us/Outstanding-Invoices/
http://tayloredsites.com/INV/64747FORPO/30608892568/sites/US/Invoice/
http://techniartist.com/X307/invoicing/Corporation/US/Past-Due-Invoice/
http://thecreativeshop.com.au/Invoice/237010511/sites/US_us/Invoice-3117736/
http://thelastgate.com/invoices/7601/38904/xerox/En_us/Invoice-receipt/
http://thenff.com/invoices/34552/8380/newsletter/US/Sales-Invoice/
http://theoncarrier.com/Z835/invoicing/newsletter/En_us/New-order/
http://theshowzone.com/Ref/4398277557doc/US/Summit-Companies-Invoice-68865564/
http://thetonypearcepractice.co.uk/INVOICE/79004/OVERPAYMENT/newsletter/US_us/Overdue-payment/
http://tinyfarmblog.com/L57/invoicing/INFO/EN_en/Invoice/
http://tonerdepot.com.mx/EXT/PaymentStatus/scan/En/Invoice-26691195/
http://track.wizkidhosting.com/track/click/30927887/saveraahealthcare.com?p=eyJzIjoiUklYQ3Zmb3RmcHZQRUE4dXlUeXRkM1ZKNDhVIiwidiI6MSwicCI6IntcInVcIjozMDkyNzg4NyxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvc2F2ZXJhYWhlYWx0aGNhcmUuY29tXFxcL0lSUy5HT1ZcXFwvSW50ZXJuYWwtUmV2ZW51ZS1TZXJ2aWNlLU9ubGluZVxcXC9SZWNvcmQtb2YtQWNjb3VudC1UcmFuc2NyaXB0XFxcLzEyMTAyMDE4XCIsXCJpZFwiOlwiMGFiYWVkN2RlYWRmNDY3M2JjNzY1OTdiZDQ5ODY0MGFcIixcInVybF9pZHNcIjpbXCIwYTYzMTE1NTgxMzUwMzc4MTU2YzYwYmFlZjllZWE5NGZlNWYyNzllXCJdfSJ9/
http://transformers.net.nz/Southwire/UQZ81864891/Download/US_us/Open-invoices/
http://travelcentreny.com/InvoiceCodeChanges/sites/En/Scan/
http://triozon.net/Inv/6113986180/Corporation/En/Invoice-21367776/
http://turkeycruise.net/ACH/PaymentInfo/doc/US/Important-Please-Read/
http://tutorial9.net/ACH/PaymentAdvice/Dec2018/US_us/Question/
http://twlove.ru/InvoiceCodeChanges/default/US_us/Invoice-8848077-December/
http://tylerjamesbush.com/wp-content/plugins/gotmls/safe-load/Invoice/8326532/INFO/EN_en/Important-Please-Read/
http://ulukantasarim.com/IW73/invoicing/scan/US/Invoice/
http://uplanding.seo38.com/Inv/8044286072/Corporation/En/5-Past-Due-Invoices/
http://venomeurope.ro/RQWGCU8303387/Rechnungs/Zahlungserinnerung/
http://victorianlove.com/Invoice/039981590/Document/US/ACH-form/
http://visiondev.online/EXT/PaymentStatus/Document/En/Invoice-Corrections-for-81/86/
http://vysokepole.eu/Invoice/27026268/xerox/EN_en/Invoice-receipt/
http://webeye.me.uk/ACH/PaymentAdvice/LLC/US_us/Outstanding-Invoices/
http://wellmanorfarm.co.uk/COMET/SIGNS/PAYMENT/NOTIFICATION/12/10/2018/Corporation/En/Invoice-Corrections-for-79/74/
http://welovecreative.co.nz/COMET/SIGNS/PAYMENT/NOTIFICATION/12/10/2018/default/En_us/Overdue-payment/
http://wolmedia.net/PaymentStatus/newsletter/US_us/Paid-Invoice/
http://wp2.shopcoach.net/Southwire/DWT59606095/Document/US/Need-to-send-the-attachment/
http://www.actld.org.tw/wp-content/upload/PaymentStatus/newsletter/En/Past-Due-Invoices/
http://www.anewcreed.com/IRS/IRS-Online/Record-of-Account-Transcript/December-10-2018/
http://www.europa-coaches-nice.com/EXT/PaymentStatus/scan/US_us/Past-Due-Invoice/
http://www.inumo.ru/Ref/9713629122scan/EN_en/Question/
http://www.lickteigs.de/Bx4YQVUH0/SEP/Firmenkunden/
http://www.lucianutricion.com/IRS.GOV/IRS/Record-of-Account-Transcript/
http://www.mayurika.co.in/PaymentStatus/default/EN_en/Question/
http://www.medi-beauty.eu/invoices/67764/17989/Download/En/Open-invoices/
http://www.mi2think.com/IRS-irsonline-treasury-gov/Tax-Account-Transcript/
http://www.mwfindia.org/de_DE/DJFTZGYB5888212/Rechnungs/DOC-Dokument/
http://www.paiju800.com/Dezember2018/IWTMPQX1952607/de/Hilfestellung/
http://www.pentaworkspace.com/De/IWMOLVJ1180710/Bestellungen/DETAILS/
http://www.prezzplay.net/ACH/PaymentAdvice/files/En_us/Summit-Companies-Invoice-6224854/
http://www.reparaties-ipad.nl/IRS/IRS.gov/Wage-and-Income-Transcript/December-10-2018/
http://www.sigi.com.au/DOC/US/Invoice-Corrections-for-39/45/
http://www.slotoru.com/Inv/5782835251/LLC/US/669-38-457616-400-669-38-457616-731/
http://www.splatinumindonesia.com/newsletter/En/ACH-form/
http://www.stampile-sibiu.ro/wp-admin/network/INV/70380FORPO/514605685281/Dec2018/En_us/Summit-Companies-Invoice-4518912/
http://www.ternberg-open.at/Ref/7396733331DOC/US/Overdue-payment/
http://www.thairelaxcream.com/WFGPYSJYXH0366309/DE_de/DOC-Dokument/
http://www.thenff.com/invoices/34552/8380/newsletter/US/Sales-Invoice/
http://www.twlove.ru/InvoiceCodeChanges/default/US_us/Invoice-8848077-December/
http://www.united-bakeries.cz/wp-content/uploads/COMET/SIGNS/PAYMENT/NOTIFICATION/12/10/2018/Dec2018/US/Invoice-Corrections-for-/
http://www.vysokepole.eu/Invoice/27026268/xerox/EN_en/Invoice-receipt/
http://www.wmdcustoms.com/OHYTZIDA8472501/Dokumente/RECH/
http://xn--80apahsgdcod.xn--p1ai/ACH/PaymentAdvice/DOC/En_us/Open-Past-Due-Orders/
http://xn--e1aceh5b.xn--p1acf/Ref/5561605408Corporation/En/Open-Past-Due-Orders/
http://xyfos.com/PaymentStatus/xerox/EN_en/Invoice-receipt/
http://ygraphx.com/IRS.GOV/IRS.gov/Tax-Return-Transcript/
http://yildizyelken.com/PaymentStatus/FILE/En_us/Invoice-for-you/
http://zhasoral.kz/LLC/US/Open-Past-Due-Orders/
http://zoob.net/Ref/81710274DOC/En/Invoice-Number-793429/
http://zoox.com.br/Ref/43687246DOC/En_us/Invoice/
https://13.114.25.231/COMET/SIGNS/PAYMENT/NOTIFICATION/12/10/2018/files/En_us/Invoice-receipt/
https://foodtalks.ro/IRS.GOV/Internal-Revenue-Service-Online-Center/Tax-Return-Transcript/
https://www.vdvlugt.org/Download/EN_en/Important-Please-Read/


```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```
Creation Time	2018-12-10 21:00:00
SHA256:
2e766404c50addd67ef227c566ce09080620b4630c9de43a78502606ae6e282c
518f2ea20c1edf6749ad20255c7599023bd283b4144c6d6aaf7ab5f3e36380f8
d2f32a918e5d68d85b5ca908053f2d7f1cf9349334d1c97760e23391d1187a88
8a80d6ac6f675f4d686ec42e3bfe69c0f6f8765deed223fa5244661c43a65130
6ec235345457ca640741484a67a90e25a3826aa01f495da92c69b4af9586cb3f
ade1b9c410834646d644cd54184fc76209fa64bdf401de5ebaf9553bddfb92a0
22d083fb9781fbea67acb81c7aef8ffaa2b38305955f4c4fe704f204faf518c5
02201956c4b0d15f0e046f92cbfe774c32601612e41d34f8cfb943d444da7b34
a2b928a8f2861f0024656bae18e5eb1784832ad2140bf1805120999c708f079c
580f37eb668de1f42da0d8e5894d5bdfea442f5e9b43f88bb02f152f404062dc
21f44321d05ffa234019a05d336bd9ec45286deb6ad8385e701742355fa6a1fa
3f300accd6239c42e4d8b17c29ec02e3458ad0d98e17c5d6960e6c7752a1288a
d284bd24a5058dea1122dccc87a98984963130371ca88282e8ac6f11d66b0780
958c683bbf204cd0357c0ad4876140ca3ae39e43700dc2cb544c8a15e4b80af4

http://auburnhomeinspectionohio.com/Val7Hn3KqC/
http://welikeinc.com/4meAlxzT/
http://samsunsalma.com/HdT3m3dj/
http://hyboriansolutions.net/jUhuVm0Qf/
http://da2000.com/eFj467fO/

Creation Time	2018-12-10 18:15:00
SHA256:
2e49b29bade883307f5e3fc45e84f47019136b765353cf86214809206ee084b8
96c0be2cf1d871c2fb575b588fb55ef31c45cd4233d03f2bcfc52257f3a93b92
3e55b6695a17e250c78127abb9142acde76bbb5be079e6be9f84a09f804491b7
ee9b5c09e0c0d5f3b0465953e0c71b9d603d6a73df4a9b89cc50143a09c871cd
22fe93e70c58b470efdc04b89e01824796c40540e76132f49c8d6a2e104b8653
662a51f471e9cd781a5fccc6b493ba90d881527a092f52f7126a397e05017557
e19b86fec64606a8eb6c02edd74a0ac9ff7cf7c1b3b2695eebb3f106fa293de5
fff99c2dd3b145b561d4214ceda3d7d169a9e83831734724837231f8dc958f93
3ad42e3124857602b97f4a068cbf48c31ceb6e3bd79e1ff721a5ec578022a4d1
d965c5564da779b4e1d2955b4d99898e983a3d4de225f11249c5193f6b63fdbd
3640d23c26f80865cb5e01d4708f1dc4f7e3dd177867049f575e2a8c4632540b
aea875adcae895ff3795d9910d5719363bca08a9f05d27320935cd360671fac5
49736f5cc47db24bc4a3eb68ca3a4e0aaaf74471d5eea5cfb36aaceac99e7f99
38694a104eac3ac79e546c97fd292c7c5f31ebe1f3a3fc59a169748ee0ba12cd
ef40ba87b67b9f936f68d3ceb7dabb3925bf35a89ce7880aa06be47c0965fff6
7da5de95e6cd4b5b7c89e2ee6f647aaf54fff62a1b1e56e58b7f71eb9e928444
09f869816d32dcb422e3f846e39f8d003f015a6f9d99f1b6d2a2806476aed6b5
653b143858ce644f65424618be65170a2e0a3588488221cd61c833482612c315

http://segmentsolutions.com/dphOIf3q5/
http://www.devadigaunited.org/T9O7E4bj/
http://www.consultor100.es/6MWJV8Rk/
http://www.300miliardialberi.eu/ZzgmELL/
http://misyaland.com/xGApuKC/

Creation Time	2018-12-10 12:40:00
SHA256:
3f964c9dfb9f196c41b6e83ad28b7d31790420c2023a0448595cdc27bfd36563
0e2ef95154f6763e0becc803eb98756d6336a99eb91477e3b2ed74031dddef70
d84e62cc5ffe539fe815e9a222a3d996f16c7b4627801370fe4413fc73448610
45edbd518e9c9afe5fdd0421198a2be815d880c800f5c42696d1cc8b7accb924
2a3a8f12aac0e41af29962e229c5b0384e539d5ea2200f1a5dcc7193bad1648e
c85365222338b6bdd48a748310b725d50def4cf6dd23d19444257d628e6c2ab6
6295038430446bcadcd30a19be3118c7d03700352ed23295b3e6cc79e04870f9
e4a3dddc09336e7a975053373f1343f7eb5513599fe5320f5fd7ee0984fb5336
49678b3cc7766703bfd2f0bfd013cf669ce4e8bc948f7646bd4780abd0a6483b
7cb27d6cb8da0f9d1f10e2645e34ab272b11d5e9db8d2f949213f4e144fe1e27
ca40b275d2958093c36e72bc0859dc3f15a59c4c1a20e41b2edfd95590b2f1bc
7505b1d7ebc1cbe05b964ba0b4d33e78d34f1df774be6452fc1538fd576b0491
eb8ac54b53b8c3039798f755722a4cd740cf140726a7628b4e3ce706190147cf
9bcbd11c1d1ecc0fcdd145e7336ab089cb807d483bed40b481d8d0aa7b3ff7e1
ccc0b785147091839c12ab32af6bdc77a02de5b042a74ad4eca6009a43c9c308
da67be228a1a5cd05ed4c7c100d4e3cfe3a9ad5692743ff49e54c5a035e26eb3
6891b71a9793ee457e64aede693de74bbb13dcdbc1a8a7a34cee40dec7a203ea
1d7c4f3c773fda0181023f36fee48b72e03baa9c8a877962e9c3be28ae18972a

http://paiian.com/web/site/mlqcv4M/
http://pnnpartner.com/dmQJJKFcXF/
http://real-websolutions.nl/szLKxow/
http://ngobito.net/rVuf3v8Jf/
http://symbisystems.com/4bguR5g/

Creation Time	2018-12-10 05:53:00 (GER LANG)
SHA256:
696275fb57a08428de2ed9dd60cd669e3ba021059a6165d9f7b0dae2ac25f617
8ec67b295a2b9c18bc525a0f746ffd462066bd6d082fb2338707ab4cc1d75067
bde5a6c8a31f6657379366fce0a8ac35faf7da1c52861e0a0c196aff7b6c7360
c860389b029990769b016239c0145db938d2176dc88957a5fc3c808641d62f60
6af4e6a1949fedf5ea3b4195ae85d51c36e15a2ddd8b7e2b1e4ea27189f71066

http://ericleventhal.com/UUDpRAc/
http://childcaretrinity.org/yzzQkMGq/
http://wssports.msolsales3.com/TheH96ojJ/
http://2feet4paws.ae/SCwjQUxe/
http://miamijouvert.com/X9Uq256/

Creation Time	2018-12-07 19:26:00
SHA256:
2a22be1295c6cfacf3fc52cb1dbb4c5ef26f83784eb9ff1ae2009ebea1359b68
5e3e0f0004f9ccc6d49ba5d68dc566cc58af71bf03af31b5febe4d820e28fbb4
3b787cdd9467d46141792d313de5ac4a3bd8d082bb17759399d54675d42ef42c
677c92c4243d6410eece0b1e64ea7f8542edcd009af8b3b2359500eb9dfb8167
56a155883645d311bc80c06b48c8371592030911758251e5f9b9a059b0243ce7
326e342c4b7ce10f6d3bc74097b87e524eec7b897af1f8bf43411a96444e5b38
6b9b7e68ba6730d54c569cfaa439d2fdd20bef04b78c40a6f816a56cae2592be
768700b08230560fec356b0876da54ed16a84ca5aa95a3101a056823a775cdfe
a298273fba811a57dedd9b66815ae54d289044c5e1710a1c748d3756c79cdc49
30a7f4ae5734ac6e1f6ebddaa747745a02bf2b7d00d5bb584e9e88fc5875f318
4fbc14afc041860eda73b9471fbb83f0bd2ff9acdb5baeb3a68f0116ed97bc53
a3873624e6bbd7513d75ed44f7aa81bd5308586b974793f7be4a50d608e66abc
780a5038941f0d742863951025b8861a2990265615e42834c535fe741aae92ce
ca261d784ccc08b73be673076165e33eba8b340fd229150fa63a050d4bdb60ae
466eb5fa9fd7f4e8ac9cd01881e5b84352272256fb939ac6f4a2e850e1f28545
9bcb3f6a10269c4fc9f901748f7da0c280c57894e76343be67bb415d27938fed
ade6ed8ac6cb9784f94571780dd18a951e3dc8d424172270bc98668dd9a80704
f09d3a702be03d7ed58339c88a8796018aaf6ba98faf0a61dd2d10dca5ba90b0
29b2c81e773e1b14adeb17c16f93cfae6fe0af2b3fbd886868d87a57e20800cf
7f7a0f5e6b4504bd49e6b6fea0910a6edbd365ee61717afbc79a1ae97d0acd97
17b80113f2f0a5f22c6ee8dc979a1994fe6740f1f62e4bf3160dcd7e84aadb8c
82c231d33d09314e8376bdf6cce2b82d62d92f8a9fce760e98bfae4dca2a9d9f
a6a3caa920589fb154965983eaf7df4b2c7464655949157f7bcd5130c2929706
06931ceab2aab4aa08c6fe91b3c59a63c51931bf32eef022aebfd78ad3f2a629
320b35c8c5146de33eed58792af1dc16801b5d950359838c58117e305a6369a6
ecc1b8d9dcf35b0da769002f338afb7d7c0dd9edb76bcbc79ef2460fcaa0002c
5f8ff1ef51141c4819d24f5aebefc11dd654eff470bf7dd2bf68f5d7e213961e
0cd65801f363ec8baf87629bdd31da24eb48c4e232fe7788b753c74717defb50
88f7c08e711bb92426806d665995e2d373ffc4af92aa6e0e141fee27b0dad0ef
688770a69b2985abf2ab475f0b7f855918d9270b8f5324686762a476d1eb4c85
57ff29945c354c54a176fb48e33cc047b74bf95cf88dbc2771419a21d08f73a7
d70f0c25d91b778e5991c3947b89823a372efaf67cf6336c2a44fd479b9105a2
fa6cf4c5e0b5095feddcffe2ffbd4f6425db8de5ecd4a6c9d1be3144a4f0f007
4711ae2828acecc28724f4a7df9a2f350c93c8e6ea945278bdb2824518c4b8cd
3dcaedfcb382a18661cdd38fcd2acb02d9b58b3f069aaccd06dfefe331ad0d04
25d7739ee8c7798d26aab5499e0af080b8a01cce30fcdf4c08c3e98db4333aec
cefebc8f2b70693fa4826272e750c817720c33f9df9ba0af600aad8bda8cc25a

http://www.yolcuinsaatkesan.com/2605/css/IyBG7JXDMt
http://kc.vedigitize.com/pp5YzKbFMC
http://www.app.contentpress.io/No6Zzwil
http://13.210.255.16/17y5hevU
http://www.rokafashion.ro/z8J0cPX

```
#### SHA256s for Epoch 1 Payload EXEs seen on 12/07-10/18 ####
```

03be0611115dabcee2d0f5dbb0381b8de19f4bd32ac10f40d7aac4488277b894
933d9c716a8b15448a191a0b9011d6292a5e212f04c14ac3fdcfda37c8a2c5fe
b56decc46e278dbbe8d14b86120950500749c78d874b539908671e5b26eeebe4
e316db57e6fbf30b8178abb370c0f0b1407e5c27bd0a5849b3c039c4dee9c3b2
0081350f98433162cc21298a31ab9bdd8ecbf1872bccb9e8042f53c31d8ccbe6
0306c826b449e9834412baf0e8bc460e2009f5346c56a8962396bc10c9c9470c
42b5d01d102f599d93feb08af4134b23c410443770f55355dab7289ff19f6414
c41882bd5514c7564bb4f461eafd5eae5dcf3ea38bd1eadc32db3e20b6a961b7
d0899c518f017936e1129118163d893db3028867b986e5781eca51c06fd699b4
b12ebed7c3dca94d891439431459dbfa4271ef0faddb66f9dd7813da6a6b0a9e
77e1f4295b2a0bad95c0583ec866800acb5914e46b24de35cc7648eefe945d2f
db39cf4f9fa8b570c4a110c61689526438861a7cfe61df74f634172862f0333b
05dce5184504d8117c4d67dd4b4c031ac74c50051a712ff9001436f0fe617415
6dde8868cd1e434fda67f49311106fce5f56d87717bf8022b6180c03eb478f50
b2ce1903baa84296d5a3e4d8d9373ca9442ad1a9bc9b27d9f871d447112da1be
9d6e646f908678376262a3a3a4330085ad0728c422219715857e870688833a7f
3a120b3a836ccc6fcf501d52698aa9a03a7d8b8f6e101ebf5da3595db182aaf1
7fca3b45ca5000a7d52fb16e2a2065e8ef24c3f55f2f6581f25602eaf02be544
f545311c9c7ba57aa72756748e6f57352d660e4a6b7ba6dcc7dbf322c3c802b9
7b19b5a7486f7cdb9aa9ca1771bd07d59096b4e10a31ff7c4166db35e9d74ead
57c98c215363c4abe266e3517db293a617cb58e2738032b5b38ed73e0ac0df6d
6e8f5f6c115f2b1db883f4a89a6ad998d19aa657284dc933eb92393b5b48a77e
3d6d495946d5122332f5ea1838da150c46b87440bbd534c269f0d8f9de8cf43f
8f83e8b05246eefb3d5015bb4a9615eb4309f6d72442fb96c0d7e8625043ef34
0bc271246558c0d871d375a8bdff54a23c7a6fb902e79ff1a1bb9f50fbed2f4e
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2
ae5f02646382712cff017a5a2672ffaec490809724f0a56c569eabd43edbfe99
8523265d46591c2a36576a4807c324d43393fc560009dba0cabc42979097cd29
9f57ac58b33072e496ee21820788dd6919d44623e37374611cd8f9ea777b874a
97c6a5a3653c8bb19ad65ced1dc81b463a7f9e18972ed921e2d8b0257efa5981
3b3f0f958a473fb797b197589e98fe185efabf2b6481864cb87598ef4ca7fc76


```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-12-10 21:10:00
SHA256:
cc2405f09c798ecc2766a908277a56e5255dd97a21757e293ad7104105982faf
4f9e90fdea5dffe26c45708e6ffb06fda9ece8db28f52282426826ea1f09c69b
5db8e82da29b84edcad955dd15ce35f22429a0d55ebbf7a4138130ca533dde0d
ce930600f3276d5d60abd3ca5f5f3885493198e5f686c7fa817446f53f3eccb9
80e3911ae9f497ef95f294bbf0d23eec3b72c398f2ade4fc959cdaffd287d547
aae99acef6c295567966311797e716cf7f929d872e35d5a66070eb5b31f0e687
88be98adbd949ec853acc153758beaf76b3a2264d874a726292c9348bb4356e9
73c9ac34cf377bec45c99076e8a8e1aea6370aa483f5eb26638fe14767aaf99c
4acb34a5ad58767decbe0a134a53198f8cbfb3902ed3c33170f4dd153a6ed1ec
f90b4e2348300224409f6b24f046ad3e0e0fa5955919b9747582489fb6d7896f
6bc6ebc35bf3e324b586b5b609ca34f0e258686e1629816d560e6d0c41222501
aa286272082cca85eac7c696fc5a1017a9bd966cc1385e0f2a5731da5732cb9a
39c6fb1616686f9215267abdb8bed605a92a2a61ce9a31aa224e5e7bf5cab38e
360035165ba00c544f7094ca9b266c6183fe8123d228b64bcc6a9da227818a6e
1e2655fab10ec9da57b5c40b5b21be8eb15f843099d6c0a97fc79de97f087e82
c15e3d116467d0f50b20ef670b7bcbd74ca9f6aa5686b7932b2518f74cd6e888
1e81d8655afcc259bac31b1dbd8f3024f4a85e2e5e19f89aa487cd58f3fc4a8b
1ce82e779cb17501c0b2548e6e081a2ec7cae498f015f96afa550190b8a5e0ad
096714b94c2dd4e3a2f666b1d8598a2dd824109f946070b3139eb802ed20927e
bd5c4b5bd4e8239b87cec01747c64d98db9202105fdeb01308535dc3356353c1
05fbf69ba94638a93443bc0b3cc97cf4b1e140133620db00bab3fef0529f8583
d0db55784134fa5e3568ec7ec0d88d6665aa87f136dbe05807ec4d141ab354eb
122c756c88f5f94a39e1b107c1db7628613521b5d9c85402e252b87fb83c007b
dce8e8ee3f6996c414afa1e92e527f9269df0e4205a596b00c5d9ece1f3cccb3
c072adca0179a17c59bf53ad5428d2e4070ab55f2169d7a5704a8ca526ea9a10
d3bac6d14e6586279dddb3c3e0f9ddb579a0e178a664953b69e98988123f2d39
84ed9cd3abfa4f6b84460ae0b747230fed7fc469e32b767395f7afe5dde247e9
ffeac69d7a31cb513bd9fa83baa053ddb4adddd35c0d9c416933a9b83eabbcd1
14a74ba9d54a1f9b8de7846d46fcea94d15f5eba4f4c1361994721c6c2abb464
885194cc0fa0d5c3f75c2153fd17db324427b0a648c917d196b2341a1b8ede4d
58674aad9b17f181eb82a583bde0851e387b67569247829d3c1f0fed4022b00f
16552a612e691dc1d70d033ac4306e0047f0bb532a59fac53aa85f61adb09078
3ac17a9ba5176a35b11ae0cd448b697eccdf3928dffa981aa363fb8ede12caaf
565b69806dc552489e62facbb678883a9725f776f8e067ba2ab6319ce2176fad
c65bc24db7d92869a677355342481fb74146b869515fb9bdd64812dde0f44b7f
16d1eb33627f995503e9bcef79bb799e72482b530c50ebd43f34ffe576bfc0a7
2676c3383f24a6c7de1bbb881192c53892cadf82c71b90e72e5147fdc39ccc3b
254c189fcab836ff9d69506217bf7c4662b057dda6ede51759c2b6f004a35a16
dd07c09b322a4086eb1f8927c75d71702d27a395a2c5cb44e90585fb529b6861
f44c4e4dfb7fea1efa2f19edbf542ad9805eab720a79d6551b1aec77511038ff

http://wpthemes.com/QdO/
http://tom-steed.com/Qb/
http://bobvr.com/9IRHSA/
http://alexzstroy.ru/5oe/
http://herbliebermancommunityleadershipaward.org/xjg6c8/

Creation Time	2018-12-10 18:00:00
SHA256:
f2f6736c1240c2bf3e54bb8d0a760083dc6d332f1ad8885fe81cdcba61362a51
3367e8f06f2f9532ae0720a01935109594072a2e988f065d93832b59abc651ea
ad42b73bf6feaa1109e49c115c83a6217c78a50eecd702e0dc3775582ed26ce7
212741e29395ea97399d1dedb6a76d6f0a8ef546800d0e74df9d77967449f108
483b822a7d121995b976d368de781da0c837b45958d76b8e424a56adae02c86a
2f5f7bc261e5c215ca5481a57af361fbb25950578cb49e5de35cffc9cf99ce9e
990ecf42548bead9c42520119ce8a07f63a07da90d1d2acdaced474af5b48a1e
3e578c4cc44e8c73a10d5bc8155f0beba31d8ca9b40d91a2231bf93b97e40237
45fe53a320684b36663ffe02061c1df145d4c3ccc3aa855582f19d3e12210ec7

http://www.srskgroup.com/9d74kPY/
http://www.stovefree.com/Zg/
http://www.rohanpurit.com/gfnpS/
http://www.misyaland.com/q/
http://teambored.co.uk/Ps/


Creation Time	2018-12-10 15:21:00
SHA256:
7fa9f6ca0966cc7011c96e208116d70e29cd334c78ca9d8d1d3d9b051605315e
f818aec91859baba841b6cfa46dfa563b112115b5f6ab7b18fb45b3623db9fbd
612a76402c2ef853208f14b21ea067992bd708e3dae30d40f04595aa9aeca83c
b014c6c40ade09bb8050cbc9d12ba99ef3b075c9310aaba510ee0a38891f8215
3a65aae5fae66a9e3f036842d2537d8d795ffa32e1be3b1f7c09d6cbc1c4a21d
d61fa86557c32e6f43e09b3dd8b1a09417d196a92e7bf56f4117f323070a8a00
136135f4f233d1ad7a6a6325a6a6da4595b7f516ecfdf902225918ad81c37efa
1545d437dad67c91642e0a83dae530df4aeb37f2d75f20ff08e69a4dae69da35
9e9aad4b969e6ee34caee623f89ee3b2c02103c03b5011d217ec4f2b9f491005
9c6e5c676fc8b0cdbee3678f45cdbcdef1ee7c5f507b119a63bef97e6b99f607
210994a23c6691ae89260c0ed00eed862a76690b0e15105678192bde55dd51a2

http://wertedits.com/l0LMxUT/
http://pingwersen.com/w7X/
http://oolag.com/1/
http://oliveirafoto.com/rQbI/
http://jomjomstudio.com/vnEmBPA/

Creation Time	2018-12-10 11:51:00
SHA256:
fd9f67314271a610c2158d795487eea2d04999c03a27a3b82ed9da77226bc213
20aa5b7afc6ce9a275f2a00c73088db75f12e5e5088f66b579e9879607295ad2
4cb7cbd42b73c950e0e73dde729d564f285a64c237d7d10584865ae5411773d0
bf899afa2ab4b71e18bc86e1aa2d4f790c91054580bd2cbeec08c2b3a3495ce5
dfbd8d8ddea08167f658decdb8c31ff722008441416a381bc672df93a7a381f0
cee84b38687dd2780b2a5d95181f25648e44132d4f82c15c9f827c3b11dcf452
5a74f1843640b0b9f399a34e2c1afb3be2c571f6c0166fee8ec06aa5e48b1361
f0e3dc3a8577ebe368dd364594f40f71d4c3459e3f28429d2586a0ece8d1c853
db81085f32c484467a36cbc3862d15021e01872b711aa25c7ad36db84c39ca52
6b1366646d578331dc93cab7d0d8aeb9de65d29fb650b195dae0c1db4fa5c8ae

http://billfritzjr.com/z02GOziY/
http://chedea.eu/7/
http://usjack.com/iadl7lAT/
http://www.vanmook.net/8LGM4H/
http://weisbergweb.com/fEPPM/

Creation Time	2018-12-10 06:57:00 (GER LANG)
SHA256:
f7dbda4ddb754d60559786c2bca4285380e23848871b20a55e0c93783f9a9a95
a6e94ac5f2b401150110ae82ddbf666c35becde051c37926ac929837dcbd5ace
5203db3c349727deecdddcb0b08bd9d0845e779e092abb9868dc3a5754bafaf5
eff8b7f462b6c5c70c529a624865093e6156803ecd993b54637f2255cd19238d
d36c698e62950596ad98fcb86d949dc49035dbcedad3ec60c95fcc096a15ddc8
2cb484e8670788f604ca303e08ad084bfac5cb74109db5d8b3e2ad3c6914e2ec
d4114a559b8264f18f51692facf0e2919d867a70b4b11c41c9d281fcd4289d3d
6a4cfa165f610a56b278c7f6ffaeacae455a7d75fd22358183f59a0b7fd809ed

http://wpthemes.com/QdO
http://weresolve.ca/kLK
http://tom-steed.com/Qb
http://herbliebermancommunityleadershipaward.org/xjg6c8
http://psychologylibs.ru/uSOU

Creation Time	2018-12-07 18:45:00
SHA256:
044e655d0fe512ce8520d60059e584f4249692b719a651625b5af8f611bc50d6
6900f9365990d8a07af60206f212c882a3f9fa94094ad5f0c830729bd07a7ec9
89d8c90d091111f17323aae268bc8732132c82b6507a6e4773378a2e288e1fbc
0bcb3873a71d7c76dd09069a0232714798dcb84e8d1bfe23afe9926678905fc1
31a5708017dccecb00745d4de9fc537f8f6bca063ebca4174e0a255bdcb68a66
0c12a101913d4ff5a1613c5ca147235010635efb9d85d6925fbdc979fa56182f
80faa5c5d5b3706f86bea365615516ce17e326fb60920dd4ab5324ae10b0502b
72bb1315002e0b741a29fd87bceb1e548bac6207d0548f44ad87ac13c2462fe5
7033d30521f5317ca3cb9cb901a7ed4f70e3081072502239ae5b6364819907b0
ef5945dd2a8e6bc06da0ae94bb2eb29ecbab51787656c51ddb37b503fb5a1abb
0f5433ab920108d28f85dd26b966eea92d5b6b4139b25d3c0e3d5633d49264c8
05344cb3bd789c3f0a9631ec7fde840dff51da5080d7eb4dccd0af0b5e130c01
754c5ad69cf061f0a47fada60c8d078751fff34db40d1b8d933956ef21a97305
5e119d878717e28eb77dd19ac43f15975451bba4b342a6bcaefced27362419b1
d993444d5aea1ba0d232856d5e601d96a91955f4303b3bf0e5671c8b8f12c660
8856b3f6f02dc1485bfa3db4fd4dc5b9e7eaa4bca1d34908033b7dfdf8256a9b
41dace64fe38f8d52fc1badc418a93b5cdf2d3b3369447bc1cc614f306a6a8d4
470c069a01b379d4f30180bbc16f1ee98b65835098e25efb3963c14d1d840846
5db80b532aea573c2cd5e7cbf8a0db45259312528f363196b49e67b6290ef5c3
20f97c018dfe769d330ca4cba363b59217b2760962f5b0f757dd0289807a9320
826811441d977b0382804446e85a4f7b699b722ab10af8e51d55dcbcb533143f
14f4ca94903e0d46fe1a24bc6b0468ec0166c2cd244fd5774d209b39600d1f90
66bd32f7038de80236af8561bc6fb817aa74428b7bce1293b08cf7a0846ef8ca
6d8521c2625572ff99f4f070ebf55c5506d33d985e9a911b85050879caf6446b
bf3be68b7c4213331aa70774dac0b6b40e39fe2855a0720581a6d961cdbb1ed1
00e1a3a095d1cc37ce788baaecb53b5407c7a04a627bbd50461273ee1c5bf478
4f71793d4554bc23f92732c8af59d198442cdde1ec13020626b40292c8625a79
cf88e56a49dfedd35d6f17bb23549f69eab86fc825c73a6ef4d1881458e072b9
2c1293204660fcb2eb1bd7ddeeec7f3cff7047a232a2d4bc870808da8a9e20dc
cfdfc3a8ae2a6f34547511e3dbbbcc5f3b8bdaa3f37d6e724026de86b16bb6aa

http://www.khutt.org/0lz8WgN
http://www.viromedia.net/Hj
http://www.progettopersianas.com.br/KD3q0VRw
http://bunonartcrafts.com/u
http://robwalls.com/lf

```
#### SHA256s for Epoch 2 Payload EXEs seen on 12/07-10/18 ####
```

4a9c9adc0400e5f2088d3f4710890acda0cf16a7fca7b31e5681a097e2d9c272
84af1b448ffaa74102134ec54bb385e2f7809d562cb687b5e28a22e82e9a7967
6057ea836463233bf9112c91a96215393add2660d2ec384fd32e9426e2d173e7
764b726b2c2921a50c46cd4ffecdb50f9b87b7f236206bb6a3c8fa63783d5c50
cb1ad911d67c16a0d65c912760df22ba21837e8de851fad57826f768ca216d87
2ba8caf0e8e52f0aea690e7f70a69ea1f95ed38099c6daf61a7a66a209b9ed25
93f0e83504251033cc9379021831241c4e57614e7a24a06264bc88fc1bbf333d
0e56e0990b0137f7295498d7d56546be69ab9b1c94f368ac6c178fb564e1e212
060ffe9617299e875c762d06634a1f831f77b7eebbc763687e1b313c83499eba
f1bc13057ba3597b2de638290ca7b6b9cecb02858a0855c349fd28f919648520

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

109.104.79.48:8080
130.241.35.152
133.242.208.183:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
181.44.96.147:8090
181.48.236.93
184.145.137.151:8090
185.86.148.222:8080
187.220.99.192:50000
189.159.133.168:8080
190.1.49.204:8090
190.100.136.117:8080
190.171.216.50:443
190.56.255.118
192.155.90.90:7080
198.199.185.25:443
198.61.196.18:8080
200.123.150.89:443
200.126.171.225
200.91.50.2
201.170.181.168:990
209.239.4.118
210.2.86.72:8080
219.94.254.93:8080
220.247.246.243:443
23.254.203.51:8080
24.53.48.176:8080
49.212.135.76:443
5.9.128.163:8080
69.198.17.20:8080
81.134.93.59:50000
81.143.197.4:7080
85.97.123.102
92.48.118.27:8080

```
#### Spam/Stealer C2s ####
```

181.225.227.251
192.237.251.185
206.81.7.25
71.58.165.119

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

101.187.199.72:7080
101.99.23.252:443
106.243.237.73:8080
109.2.99.144:443
115.71.233.127:443
121.69.90.14:7080
165.227.191.145:8080
185.20.104.238:8080
188.122.51.199:990
188.53.210.137:443
189.142.157.203:990
190.56.149.122:443
198.74.58.47:443
211.115.111.19:443
217.13.106.160:7080
221.162.74.239
39.88.192.28:50000
41.177.126.139
45.123.3.54:443
45.227.225.46:8080
46.163.76.187:8080
49.207.182.22
5.230.147.179:8080
5.35.242.34:7080
54.38.91.176
54.39.178.177:443
67.205.149.117:443
69.198.17.7:8080
77.69.190.139:443
80.253.241.66:8080
81.7.10.106:7080
83.222.124.62:8080
84.200.106.120:8080
88.174.131.38:7080
91.236.245.65:8080
95.141.175.240:443
98.142.208.27:443
99.226.186.39:8090

```
#### Epoch 2 - Spam/Stealer C2s ####
```

104.174.150.202
139.162.157.8
24.35.180.220

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture: https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list. I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now. Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change payloads every 3-6 hours now and payload hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100% sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/dCPbWiLC - @James_inthe_box
https://pastebin.com/8yAcUT1N - @executemalware
https://pastebin.com/fN2NKFPs - @pollo290987

```
#### Credits ####
```
(OC and combination work)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @Techhelplistcom, @pollo290987, @malware_traffic, @0xtadavie, @devnullnoop, @gorimpthon, @Racco42
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!

```
#### Daily Log ####
```

Today we see both epochs pushing URLs yet again. It looks like Epoch 1 is doing some sort of billing telekom German spam ruse and E2 is still going after the IRS spoof with some added invoice shite. Spam volumes were at least medium to high today for my domain. I started to note what the langauge the document template is in if it is something other than English. I am placing this next to the creation time in parenthesis. This can be seen in E1 5:53 and E2 6:57.

@D00RT_RM released a great unpacker for the emotet binaries today and it is a nice easy way to get the RSA key and C2s. https://twitter.com/D00RT_RM/status/1072043465553395712  @D00RT_RM reached out to me early on in the process of the identifying Epoch 1 and 2 by RSA key and we compared notes.

```
#### Sandbox 12/10/18 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run at 22:47 https://app.any.run/tasks/ebfa16e5-b704-4afe-bdfa-3687e30700b5
```

```
Epoch 2 C2 run at 22:54 https://app.any.run/tasks/767031d6-a2b1-4046-8b55-985c62b83a50
```