Emotet Malware IoCs 11/28/18

## Emotet Malware Document links/IOCs for 11/28/18 as of 11/28/18 21:00 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 11/28/18 ####
```

http://0539wp.ewok.cl/wp-admin/images/En/CyberMonday2018/
http://anja.nu/EN/CyberMonday2018/
http://aol.thewirawan.com/En/Clients_CM_Coupons/
http://ard-drive.co.uk/En/CyberMonday2018/
http://arhomus.com/En/Clients_CyberMonday_Coupons/
http://ascestas.com.br/EN/CyberMonday/
http://ashdodonline.info/EN/Clients_CM_Coupons/
http://atox.fr/EN/Clients_Coupons/
http://belcorpisl.com/En/CM2018/
http://binckom-ricoh-liege.be/En/Clients_CyberMonday_Coupons/
http://bisgrafic.com/EN/Clients_CyberMonday_Coupons/
http://christmasatredeemer.org/En/Coupons/
http://consultingro.com/En/Clients_CM_Coupons/
http://craza.in/En/Coupons/
http://dharmadesk.com/En/CyberMonday2018/
http://digamaria.com.br/En/Clients_Coupons/
http://drraminfarahmand.com/En/Clients_CyberMonday_Coupons/
http://eco-pur.iknwb.com/wp-content/EN/Clients_Coupons/
http://en.worthfind.com/En/Clients_Coupons/
http://fractaldreams.com/En/Clients_CM_Coupons/
http://gameclub.ut.ac.ir/En/CM2018/
http://ghassansugar.com/En/CM2018/
http://g-steel.ru/En/CM2018/
http://hdc.co.nz/En/Clients_CyberMonday_Coupons/
http://hospitality-industry.com/EN/Clients_CyberMonday_Coupons/
http://iantdbrasil.com.br/En/Clients_Coupons/
http://intranet.champagne-clerambault.com/EN/CyberMonday/
http://izsiztiroidektomi.com/EN/CM2018/
http://link2u.nl/En/Clients_CyberMonday_Coupons/
http://ludylegal.ru/EN/CyberMonday2018/
http://mediniskarkasas.lt/En/Clients_CM_Coupons/
http://mideacapitalholdings.com/En/Clients_Coupons/
http://neilscatering.com/En/CyberMonday/
http://organic-planet.net/En/Clients_Coupons/
http://patandsca.exsite.info/En/CyberMonday2018/
http://peoplesfoundation.org.uk/EN/CM2018-COUPONS/
http://prakritibandhu.org/832911NIWNHOK/EN/CyberMonday/
http://pr-list.ru/EN/CyberMonday/
http://qualigifts.com/En/Clients_Coupons/
http://radio312.com/En/CyberMonday/
http://ru-m90.ru/En/CM2018/
http://shuaktyolke2050.com/EN/Clients_Coupons/
http://site2.cybertechpp.com/En/Clients_CyberMonday_Coupons/
http://spectrapolis.com/En/CyberMonday/
http://stickerzone.eu/EN/Clients_CyberMonday_Coupo/
http://stickerzone.eu/EN/Clients_CyberMonday_Coupons/
http://student.spsbv.cz/giricova.el15b/wordpress/wp-includes/En/Clients_CyberMonday_Coupons/
http://systematicsarl.com/En/CyberMonday2018/
http://tande.jp/En/Clients_CyberMonday_Coupons/
http://turulawfirm.com/EN/Clients_CyberMonday_Coupons/
http://www.anink.net/EN/CyberMonday2018/
http://www.arhomus.com/EN/CyberMonday/
http://www.biswasnetai.com/EN/CyberMonday2018/
http://www.fhinmobiliaria.cl/EN/Clients_Coupons/
http://www.getrich.cash/EN/CM2018-COUPONS/
http://www.ludylegal.ru/EN/CyberMonday/
http://www.soton-avocat.com/EN/CyberMonday/
http://www.spa-mikser.ru/EN/Coupons/
https://fishingbigstore.com/addons/EN/CyberMonday2018/
https://p20.zdusercontent.com/attachment/314047/wtT4UmVAZ2oFlQshHDuiDRRGF?token=eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.._-o7nXap-TDhVi1RZsBu6g.9i4AQwSI6XEveSw4roeMSxuUaTKglgSGMFqK-xO93bSbZT3M4HiSQePA7Xj5UjLeyqjNrVVRaBGLkt-coJHJsGnSXW9JOHeZUTVdWkG8L7GQE_b45-mqA6iW7oniALrumvsgdDePbp67V9RVQpPUcaZVc_jT_Tkhl73gDDogN4QG2TrHFZnKxvu9R3dLsHwhVXZ4tH4rhIimo12VNp-RO5R7hHo84eTX2snlbeGdvIVeBn7nx5hklRz71Fj5mI6v2yDobupjUhwLG5dhPdB4-Q.uKiktaBnp2VbdqDMJ3qjEA/
https://p20.zdusercontent.com/attachment/314047/wtT4UmVAZ2oFlQshHDuiDRRGF?token=eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..dXQ9JfyTgES7trQMbvyw1w.s7uO3WOno3H01NFtzvYvxDPw5HzKwpqiaANcWDKXZoZvdlnNp5BpeSYGQjR285kx1qI9oFFRbnPEc80nsc1_MdXR3CTyvADVAGIJghgfHLLYPU00jLxNhVBZKuf-pF1RCtMkzFtI2Rb-byup9tKyExfS3Oxy4zUf6nns1arRyzYLyq8Ec-G3xmdFYr8itciHcBGeKbKCdXYbMxSP-5uYraizMqyr9b1SkNYUtuhZv7AB-2LUjBZJPNEn5AJhIHKR3OGMPxpgmLQDKGFW9-uz5Q.uLrIytNBeTSvho0ADssXcA/
https://thdidm.zendesk.com/attachments/token/wtT4UmVAZ2oFlQshHDuiDRRGF/?name=Untitled_3LO318363.doc/
https://u6737826.ct.sendgrid.net/wf/click?upn=lhdnqZsHExoH9VBLA7u7dTBNY37cqjG3jGEtNz3Z8-2FuB7-2Bd-2BXT0gEzD7ltO1OiZpAyXcrgZvgtEXhu9UboszdA-3D-3D_qMw-2B4ZhWc4XC9c1IfAT1X9O0wPIIjhpNYomRpNLX304uWOMrGk6jxVsBxlzfWPkXzeEngez-2FsjJxuxmnHopnsrw-2F2-2Fg0x0yCZIuA8395Ym407-2FJgH4Ok7sYIPCWdKeBV-2FxsCfHgj7YE3-2BS42xCSjkMIlZH-2BwyRS2Y0zzZpYp-2FrDfMiDWEZ0Na-2FyhUxb5v1g6i8RK5bBiI7q2m70Kr93RMfVG2It4bLIR-2BawqtZ-2B-2F7VM-3D/
https://u6737826.ct.sendgrid.net/wf/click?upn=RDIXhGo6WqZzshVykXvF3X7sPxvIVT9Fc0jNXycgKNcNX9a8m-2FzixfDldPLMl2cz_wtwqSCb5O3eTsfVUYutjUcuRh3OlJrhl9gut4DV0GHWnorHhz-2BVVuUlG0P2nn5BJ1aD9dS6v8P6SBLyXfJEMZ5JLgbiHBJ2y-2FQ0aYaoKjCShqgxOu71B-2FZKSi-2B2jyFzSdUfjq2RTw-2FyJzv9c-2Fvx5rn7mB-2F7iH9sE9F805XR7MvkJoxr0gn5uLE-2BBmTwec5nRqTW-2BXS7PZIf1fUyRst-2FGfg-3D-3D/


```
#### Epoch 2 Document/Downloader links seen for 11/28/18 ####
```

http://1770artshow.com.au/3464XCARMEBE/biz/Smallbusiness/
http://2.moulding.z8.ru/6RXU/SEP/Personal/
http://2d73.ru/files/DE_de/DETAILS/IhreRechnung-MPO-23-91687/
http://2d73.ru/wZfhpVBOos/SWIFT/IhreSparkasse/
http://59prof.ru/sites/de/Zahlungserinnerung/Ihre-Rechnung-vom-27.11.2018-FK-74-33029/
http://acupunctureofdublin.com/161831CKOZK/SWIFT/Business/
http://adap.davaocity.gov.ph/wp-content/Mf9UvStZTy1Yc/de/Service-Center/
http://afifa-skincare.com/doc/de/Zahlung/Ihre-Rechnung-UJ-12-38458/
http://allhale.bodait.com/511YVSEFKDE/PAY/Commercial/
http://anggit.rumahweb.org/3409K/PAYMENT/US/
http://anora71.uz/38NIGPXOOF/SEP/Smallbusiness/
http://anthonykdesign.com/621161FEY/PAY/US/
http://aol.thewirawan.com/sites/Dokumente/FORM/Details-VKH-41-39728/
http://apsportage.fr/39TZPAQRI/identity/Business/
http://arbey.com.tr/awPFMMJLeur8aOcFm/SWIFT/Privatkunden/
http://arpid.ru/837C/BIZ/Commercial/
http://arsenal-rk.ru/846FNDC/PAY/US/
http://asesoriastepual.cl/931UW/SWIFT/Business/
http://auburnhomeinspectionohio.com/3734YEHMKLK/PAY/Business/
http://auburnhomeinspectionohio.com/AcXZkW/biz/Service-Center/
http://ballbkk.com/egSsf3v4hDETgFY/SEPA/Firmenkunden/
http://bevington.biz/1IJIOI/SEP/Smallbusiness/
http://biotunes.org/6686550UMTZDGWH/SEP/Smallbusiness/
http://blog.sefaireaider.com/rEYWh2qQ/SWIFT/Firmenkunden/
http://bluedsteel.com/2690975NM/PAYROLL/Business/
http://bobvr.com/jNKNUhf/DE/Privatkunden/
http://bookyogatrip.com/66OF/SWIFT/Commercial/
http://bool.com.tr/o38SNdPiD9NY19e6K/SWIFT/Firmenkunden/
http://brandsecret.net/doc/Rechnungs-Details/DOC-Dokument/Details-PEG-25-43182/
http://bratech.co.jp/fanfan/admin/products/zDIW3JU/biz/Privatkunden/
http://brauwers.com/bVQi1jrYeYvYJscc/de_DE/200-Jahre/
http://buki.nsk.hr/4339JDOH/oamo/Commercial/
http://cantorhotels.com/SgSXRZZXlOjvllJ673HZ/DE/200-Jahre/
http://catairdrones.com/3015SFBCRQCB/identity/Personal/
http://ceatnet.com.br/0I/ACH/Personal/
http://ceciliaegypttours.com/8426Z/biz/Business/
http://chalfordhousehotel.co.uk/101GIZQPKH/PAYMENT/Commercial/
http://cipriati.co.uk/default/GER/Zahlung/Hilfestellung-zu-Ihrer-Rechnung-TT-03-76823/
http://claytonjohnston.com/9590178YBE/oamo/Commercial/
http://cllinenrentals.com/47295TZZCH/identity/Smallbusiness/
http://cobblesoft.com/3XHdZ9k3D5ptKo2ysGF/biz/PrivateBanking/
http://combum.de/11SQ/com/Smallbusiness/
http://completeitcenter.com/ZLMMIlpWsmiFUY2UF2/biz/PrivateBanking/
http://crmstorm.com/images/84KI5no5uw/BIZ/Service-Center/
http://damernesmagasin.net/5DHONZ/biz/Commercial/
http://dankoster.com/032607C/BIZ/Personal/
http://davemacdonald.ca/default/Scan/Fakturierung/Fakturierung-IO-71-70026/
http://denisewyatt.com/P8Vnk05jbY5hO3WTfs5j/SEP/PrivateBanking/
http://dewide.com.br/52389TFB/oamo/US/
http://di-fao.com/Y67edSO1DUpurSXCw0NY/de/Privatkunden/
http://divelop.nl/p1tugEEgLDCMrEE6/SEPA/Privatkunden/
http://djwesz.nl/wp-admin/doc/Rechnung/Zahlung/Hilfestellung-zu-Ihrer-Rechnung-TD-52-51926/
http://dreamsfurnishers.com/ezJiLVAVxMGt84T/SEP/Service-Center/
http://duvaldigital.com/52683KEYZPP/SWIFT/Personal/
http://dwellingplace.tv/doc/Scan/Rechnungsanschrift/Rechnung-fur-Dienstleistungen-QX-61-43869/
http://edtwodth.dk/60549BA/ACH/US/
http://egger.nl/doc/Rechnungs/DETAILS/Details-KK-91-00137/
http://element31.com/TNlp7y/de_DE/200-Jahre/
http://escolaoliviapalito.com.br/24QUIDTSUS/PAYMENT/Smallbusiness/
http://etsfitness.ca/SocDSyJb1HG9uGBtjgm/SWIFT/Service-Center/
http://eugroup.dk/066U/WIRE/Smallbusiness/
http://everydaycoder.com/doc/Dokumente/DETAILS/Details-GMY-84-62686/
http://febre.cl/93749RZV/PAYROLL/Commercial/
http://findexotic.com/files/Scan/RECH/Rechnungs-Details-RYO-51-45867/
http://firstclassflooring.ca/32NNRSRAM/identity/Smallbusiness/
http://fleetceo.com/cgi-bin/926GDULUJGT/com/Commercial/
http://flyingmutts.com/076360TAD/oamo/Business/
http://g8seq.com/62376AGYNFL/PAYMENT/Personal/
http://gabmonkey.com/7095OWXYRHKX/oamo/Smallbusiness/
http://galos.ekoyazilim.com/13W/biz/Personal/
http://genebledsoe.com/1631186VBZW/ACH/US/
http://goldskeleton.com/sFTjM3z/de_DE/Firmenkunden/
http://gonorthhalifax.com/ffmoJjv8/de_DE/IhreSparkasse/
http://goomark.com.br/default/Rechnungs-docs/Fakturierung/RechnungsDetails-OGM-46-34540/
http://gueben.es/2245507LEMK/PAYMENT/Business/
http://haru1ban.net/files/gescanntes-Dokument/DOC-Dokument/Ihre-Rechnung-vom-28.11.2018-PJC-51-05387/
http://holosite.com/534LOS/PAYROLL/US/
http://hopegrowsohio.org/2735BLOIBESP/BIZ/US/
http://icpn.com/StP4fOv6uM/biz/Service-Center/
http://iforgiveyouanitabryant.com/177095GI/com/Commercial/
http://ilgcap.net/05715G/identity/Business/
http://imagedns.com/YNosrRj22lzVMWTVeJA/BIZ/Privatkunden/
http://imetrade.com/4652J/biz/Smallbusiness/
http://improvisos.com.br/doc/Rechnungs-Details/Zahlungserinnerung/Rech-UDZ-30-08834/
http://incridea.com/kmIVjj8UyN1hsbYp/SEPA/Privatkunden/
http://infinitec.com/support/api/sites/de/Rechnungsanschrift/IhreRechnung-UW-21-61663/
http://inserthero.com/default/Rechnungs-Details/Fakturierung/Rechnung-fur-Zahlung-PVX-09-48639/
http://intotheharvest.com/8540TUF/WIRE/Smallbusiness/
http://ipaw.ca/8SFUJKW/PAYMENT/Commercial/
http://ispeak.cl/PSe3Sdh/SWIFT/Privatkunden/
http://janicecunning.com/6978GLOIE/PAY/Smallbusiness/
http://jimyn.com/49793FYK/PAY/US/
http://joansjewelry.com/dCNOpkJEG9SYW9xSS21S/biz/Service-Center/
http://joshsolarlovesyou.com/2ET/PAYMENT/Smallbusiness/
http://jsplivenews.com/wp-admin/297028KAJST/oamo/Business/
http://kenshelton.com/298862WRSKLGFX/PAY/US/
http://kevindcarr.com/0GXMPKI/BIZ/Personal)/
http://kevindcarr.com/0GXMPKI/BIZ/Personal/
http://lunixes.myjino.ru/41RUC/PAYMENT/US/
http://madrededios.com.pe/7VQN/WIRE/US/
http://martinbaum.com.br/p2zH4CnjXR78/SEP/Service-Center/
http://medpatchrx.com/245PPS/BIZ/Personal/
http://micronems.com/6477CBCCBK/oamo/Smallbusiness/
http://nfbio.com/img/upload_Image/edm/pic_2/doc/Rechnungskorrektur/Fakturierung/Rechnung-fur-Zahlung-XD-23-31268/
http://northeastpiperestoration.com/site/wp-admin/network/pridecity/08WLGU/PAYMENT/Commercial/
http://nowley-rus.ru/administrator/cache/47241VFPPJKZ/WIRE/Commercial/
http://nowley-rus.ru/administrator/cache/MSF8syjz73/DE/Privatkunden/
http://paboard.com/6AR/ACH/Smallbusiness/
http://paraisokids.com.mx/6054SRVJEKIJ/PAYMENT/Commercial/
http://potens.ru/Cz8bWvoRWt/SWIFT/PrivateBanking/
http://profstroyremont.com/3545005FV/WIRE/Personal/
http://rhymexclusive.com/2LNiLHF/biz/IhreSparkasse/
http://seekreallife.com/files/Rechnungs-Details/DOC-Dokument/Fakturierung-UX-71-67708/
http://sexshop-amoraplatanado.com/04BBBI/PAYMENT/US/
http://shells.fashionshells.net/files/Rechnungs/Rechnungszahlung/Bezahlen-Sie-die-Rechnung-FC-63-03655/
http://shreeconstructions.co.in/737ZDAS/SEP/Smallbusiness/
http://siamnatural.com/5769OLDEF/com/Commercial/
http://sindia.co.in/buxiUN9LHl/de_DE/Firmenkunden/
http://site2.cybertechpp.com/8996INME/PAYMENT/Personal/
http://soverial.fr/SZOVILU/de/Firmenkunden/
http://standart-uk.ru/files/GER/DOC/Rechnungszahlung-LJE-56-49726/
http://stickerzone.eu/95143ZZDHLURQ/SWIFT/Business/
http://taarefeahlalbaitam.com/5075HHLT/SWIFT/Commercial/
http://talentokate.com/7930RJKLBLIH/com/US/
http://thestonecyphers.com/333ECTUPI/PAYMENT/Commercial/
http://tubeprocesstech.com/sites/Rechnung/RECH/Rechnungszahlung-KNT-63-95287/
http://tyronestorm.com/1546444QP/PAYROLL/Personal/
http://westickit.be/39670QD/SWIFT/Smallbusiness/
http://willyshatsandcraftllc.com/default/Bestellungen/Zahlungserinnerung/Rechnung-fur-Zahlung-YU-74-56369/
http://worldcommunitymuseum.org/09OXMIGBFQ/com/Smallbusiness/
http://www.beluy-veter.ru/47694UUV/PAYMENT/Smallbusiness/
http://www.emailmarketinggold.com/KEWArkF2ea/biz/200-Jahre/
http://www.klikcargo.com/doc/DE_de/Rechnungsanschrift/Fakturierung-LFX-64-19295/
http://www.leadonstaffing.com/7MELDDDZ/oamo/Commercial/
http://www.soverial.fr/doc/Dokumente/Fakturierung/Rechnungskorrektur-BFP-71-88472/
http://www.standart-uk.ru/files/GER/DOC/Rechnungszahlung-LJE-56-49726/
http://xn----7sbfmn8apdll7h.xn--p1ai/OEXAhWQa99QgKztptVv/de_DE/200-Jahre/
https://customedia.es/0API/BIZ/Personal/
https://mandrillapp.com/track/click/30505209/icpn.com?p=eyJzIjoic3dMQS01SDJVdG5oZGxHaFJhblh4cnZBRkZ3IiwidiI6MSwicCI6IntcInVcIjozMDUwNTIwOSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvaWNwbi5jb21cXFwvU3RQNGZPdjZ1TVxcXC9iaXpcXFwvU2VydmljZS1DZW50ZXJcIixcImlkXCI6XCJhMGFjYWVmNDllNzA0NGQzYWExM2E4YTA2OGY4YzhhZVwiLFwidXJsX2lkc1wiOltcIjBmNmVmMzA2ZmMwNDg5ZjEzZmRkNzY0MTMwYzNkMjRkNDhiNjQzOGVcIl19In0/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-28 18:53:00
SHA256:
e59336bd89fa0feb5f90e1a03437e13d8d30e491d1a3aeaa0d49e5917ee33907
0760a8f38da649d140a6b9e45e27a1a4282bdb224c57b63534958517c53bf744
67450884d2888c2a95a3f37b75727f9ded92307eb4567da59c19e707ca2f7c3e
e61a5ea32d75a7fa934724802d3577f8ea2a535e4210735f32d2236b09a0d40d
0c5330f8788fe693abe7b0fc4399039d5fc19d5d03ac04479edc0951ded13658
a6019b434836d2d6b76d197928a565d130452d0687623250737668cf663a73e5
fe194df78bfdd9d71ec0e0d35469446831741a7ddba69e62dd217a27946b7010
87f2808da698efd7606556429bcadd5da85f52130affc747f537f9c5d9c35ad1
561a3a5269e77e0789555a8791fe2d0b51f4e43607fc58ad02c60cf3aad8b5e1
e2e6631e2a244973f067e54428e355c5c5bc1d29dfc158464f4c229e92db33d1
3868c51b316804b167758c63436b83d9d9a04bcefaec0dcb1ae1f3b76c188beb
4e56a0f0981eb01c8e38d5a2fdf68a87c352391b80a04086dc5523e64b33725c
827f677f0525c6f6db13c8c2b9c0bb8b030e141ec28792d67e8b62fda46ee7a7
05ec329ef9368a7e00c250d9acbad63ef5a2eedb024ef73785502d548952ed33
f215698262264822540c81b6a1626fcc1caef22aea78a1cf2f4254962b2ca795
380d8f4853dd162e233a42ff2258531237bae388af31ed15de509465eb841ebf
05b2a541ab2dc3b35a1907ac695f92ca50fdf7011f303c34c53e8de893d3366d
60b476d7c315f53d241abaa61fbd8fd8330079287874c67e076dd190ecd2a45d
fadb738630eaf7b0c85eddfc50aadc115a069a8e0b00372ce35098d21f909eb7
3d3b99ba8e79d5dd676d986266fac31435b718bf35ba87cc8f39bc614a59c627
1a2cc6e94edfe6f1ff317c32e1819bc208e3355ba54a12f355768f7cc8a4fdef
b8462a7f2fc00f6dcbf1626862b2faa49fc4f6bfdaa22be16c5e4546519544d7
0edd663ae8623b791a1efe5e6c73960ee4bc47e8e78045e5f140baaf1193dc3e
020e9c41b54a3e1f37d089de3644d1bcf241a1a47440572cda8a7ad3ca19ad41
31cbdc7401361fbaf59d08b79d2081527147f61d2b951de1a9477648e5b218a8
10f8e75e2c4aa59ceca6d0f272b80bfb2898b8797d275b9aa6a42278074ab711
46aafe312eda24511a2335bfceae83087f505d054e384d0737c035d078c813b9
987c6ffdb14cd076612cf4d30cb6e505f62c74429eb887ca5fd25f333debe1f1
5465df0ef31196b9004310e1d28e8a91d9981f1fa7d7e3ba72df6304c3497c15
68d4120d2473366be68e9d79cc4c197cca068e8268672f2540c0ff615b74e649
04ae3026fc9502f115794757e29bef4a6ad6cf3047fb7b444b0ddbed9504c631
e5c7c3711a12550d58af06c573c99e8f9f8ec611c4a3bae0e2d00efb12eeac7d
dd850a2d509783d8550103d4ab78474d137fc6b64849f8c5f00638cb4dda1886

http://levifca.com/y0tYhnWQ
http://mfpvision.com/yAkPNiSmm6
http://haganelectronics.rubickdesigns.com/C96xSAAy2q
http://catairdrones.com/sMQ0n8nNun
http://radio312.com/mp0NHN4cHX

Creation Time	2018-11-28 14:11:00
SHA256:
a71210b55ef8d9b449e7a8458918ded113f197a1ada03d1a3727858a228d2635
4c7b52c1660690bc42f0adecc7118c33e8bcb6a2356e9b61be2cfc221ebed47b
ad74833df916f5cd66faf2b59a036b8a043ecdcf3685f903182cfaa94902a70f
a3e1f6108e96d58620535f919c948e8c481dd137cf301146340a03aab6c12c7f
99a1952d28ad7b0134e7afceade4683042accc436bffcecf04d3bed90d872840
436368fcce2b9b2f0e44c50f6bdb0f31af572833ca452f881ac9862f0e547842
afb95c94e6873c86590d0ab3bdf56bd83b1ada211fcc8b413fba54d244471ce3
183e0fc20ec74fb144c84ff0178fa5050201c5d7dd680d8d3f0e3f28c34be9ee
73468dccce3a649917105bc4293e0a20f2c164a5efa9d6b1b27e49614c2d7986
8526b2d3c3c9ca94c9575a3b0bfeaa2a6f8d18d83bf507d67c2968964f1d5d22
193997a31376d099d1f81739149848f3181c53a36c3a2b6bea8f60540277ab17
d3538462fea3bf586a2fbf95d71340b19009eba14938e821afef2699da9cfcea
554d28af5f98d3bf5b89e48979b3909d1e3985de0af11bbb57421c8e1be4ece8
2b0a63c91508bb789bd77a9cbe39216adf916497b983e9557ac4f0c246c30461
7e731fc60e3d3d73ba71aace0451ec41342c3e83617f563c17e87194dbed2b86
f84d9da919cd85b43a4d8d466846d5e2b9950fae9b53b35c2e6d749e6f9b2550
3e9a26775741162c09266cae956e061fcecdec592be51ad97d2b6bf1513bd3e9
6bdf9f44e9ce75d3fa2888a18ab7fb2474176ab2792d3395d9ba4e823a7dc01d
3bb57288f218b0c2f0ca1f29f70111276b4b0b333359ac79e310d71cc1f172b2
ea64f8eac525cfc6ca581969059b1709e1a0927cf85611eb7548b31b431ee0fc

http://kiramarch.com/3f11kFZb
http://egtest.tk-studio.ru/XXeadeuKwQ
http://e-video.billioncart.in/7VIcOtMZ8H
http://shreeconstructions.co.in/737ZDAS/SEP/S6rjgxh
http://borich.ru/dkYtO2YM

Creation Time	2018-11-28 12:05:00
SHA256:
7b11207b603642a122569fee4489aed5e8f5cee80c8491a2d32cc71cd2703e4f
69a6270cbadf43355854402896c52c18cd9d6bb91c4e2ff3e1a230e9280aeefa
4654baa718d984b803f0d509876dad00d43f2da9f26d9ebbc32e621a52e09aee
52fd538e5f0e0a205116cabb34d259aee299d2fc2022b8a3dea29306040f3466
205d33ffd8546f2c3d86ee93fc2b6c7210dd730194ba7dd2061441c7ecf38b55
209e1847b296a533e6c055c34f25ca035e09f43a7e411d81f23762fc6fb9300e
53c57d7c5405668370cbe26849d86feb25125e38d2914636992cf5bfbf9e0824
ebf4563039eab91b1434b6014c517801c53f294940681ca94587904f24b5701f
e11480b3466662939494ba7c2eeb278c2060b59318d5b890a7e60fdf0af12b90
1d67b60d9a1158f39998dde2f5c39482b67e8628afe46d3b052b361ace3effa5
978cbba734ab9dd85cdb26b21e61e61ac08aa062fad11c0a7e8c4f754e727264
a4166a9ef195eb27d8dbe941c967691dabcdb297d73ef4d8205bbca07d35a1f3
ad6d5e13ab463d790092f6290a80cf8c9c2234b7c7cf1bcd7017871998b05001

http://hajdarovic.com/Or1MxAO7
http://guruz.com/z1h3vmM6
https://idoc.cc/RFgDe4nq
http://digipaper.com.br/xj7aF9fA
http://gblackburn.com/c43NXLLa6f

Creation Time	2018-11-28 09:45:00
SHA256:
eb6adc191908cdb829f67adde19b8c76ad951685e812965d5f81438390c96a64
12c3cca996303c1b958a4abab8fcd32a350c954a6a03f668969135c2d2d0423e
1e86cb9b3fe56221cd4ca73c4e4928516bd85b0bbe10f7eb7b75e82233170aa0
520fa0a4243b0bfcd7bad69c2bb60206531282b51932303f127a9926296e30db
4911f3662c16c30728fc3fe38936ec7f07aafabfa81ca2a1d668810b8ee5d6c8
41ce53f707915cb0b510ab82ed7e19a4edbccd8d59428184d1a7305f30d6432b
c1768c64225c979e18d77cafc5c81153f7048f7227317bee5839ee0e76251285
22f8b8c80ca756534fd425d3a56415b925f4c21737f507637894e499d09e0fe5
526268b8989c108fbad9a598291146429539cbf24166a43d019e5be3f915677d
2e42e3e2a10d2946f440d8e1cea4b814b627dd649128d87825f2f7a59c12b833
a9e0b8c46653d577ad42671a47517cdc46ea4c9ee322f3f584537ce9fa5d0e06
7ef14728408a6e20ee08b238d0e2ff05782044c6cf8c222c515055aecc365a8d
e597f631d1c73045ff24a9ad51c463336ca03983d80c7cf1e719b99d067329fe
c3a5191ef7ac0b28eaf5c53f96cfb21b7319b56a5decedb58bc3e8fc19a0a9da
bb9928e4ac9a65a3a45de00375f6684f717249dab2d644be512469a0cf82408a

http://borneowisata.com/3Vi6B88
http://carminewarren.com/S3MpTtz
http://actualtraffic.net/5hAEMoao
http://bowsbride.co.uk/5KXUiIhvIh
http://volathailand.com/Imgihpl

Creation Time	2018-11-28 06:38:00
SHA256:
450b05d952a52d01f6b06a8530682801138d4e2acde73a19f3ea592a572150c5
367a7423d3eeae055ebee570869284a087161438a044443f374660089a824b9e
f28a1d2f30189826909b179e6785d0c31d9dfe39b3840b61a0c888e59e02dbea
f134db0ca14202dd1cc19952b8403993a7898779a60b1f3821d6586c42b0d80a
6fed4da1c5dd5056977b4de56b8c84d77c301435f3bfb91da53590ac6e36bb3c
9744fc29717734c6f7887e6f031904f8aeda321c0703a6b156b2ef918d4b595f
c562d51cd490dee1caae145984d86d93eb0598b9768e65764c98a7062b0b0a23
912b2935a76ce2a52d461d87b93e20ba77ed5b6a15742e063b1f359442831951
2cbfd54683c8293f915e5db7051b5df94ac6c15ef505f7adf96d1b1d9334d1c4
862811b3a5b5683944f8d1b3b35c833bb63c35fba9842a38af9cfee8eb986094
73393c6ab78385ad7d73d097d1809f326a162fee6a3a2acc1af5c6dcdf0ef448
c271956d6563a2319dd107e3a6f1373c35ed70d3adcc79dc49a617116883de22
a54612ad4bbf76a8afafd948da3a6a6868427e15b107f1700df0291fbd09f7c1
a781b99af725ed1d64e83dfd9ee788e7e32c88bf7d7733c9bedd00d7517ec78f
f32b4aaabce92d023867d066481be97df4c551cd4a4357b111857dfb644c7c6d
60162d4529bd8ea10746918e64bc8b5276a4d519a66a79bf46ec2d1d9780b290
1e803155bba04789b31d59e98b882f7b97da915bbf3eb6f7d5256d2a0d52c909
16eb8c0acef14f7a9d8fe889169228c8283fcc6558c141f76dfedae6c52ed6aa

http://mcnamarareport.com/KLzHpl7z
http://evayork.com/se3Vc3GB
http://daltoncra.org/Gps3LxUI
http://xn----7sbcihc6bmnep.xn--p1ai/O7Oe3KUf9Q
http://dealerdigital.com.br/S1PrmHbMxL

Creation Time	2018-11-27 21:08:00
SHA256:
f72f5adb73375b52832cd23083e1aa6bf59e18eabf34778d7a8ffaaefcf6b132
d8b4bac11d748000bbff465596e83bdecc49925cabb571c89c117dcf2ec0e89c
4b6bb70862b8b576eabc9b0c2074e0fcd3993fd7910875a21d3bb1f05c677aa8
641b3827cc57b54413cc2cea42f48144a4baf5d4a68d5c7dff07280528b7c014
5d49c8e880ea6f82869ea96c0e362759d3d650bb5be3c88bfa0975bc7e92821f
7e0e5cd802c9f16d0ae405c5deeab8e393930958cc673c7caf9a0df89fdf38f7
d4133aebb2c1f6a7eee06ca9ffee1eb79bcb8d13b68243a0b43b6db4707e09b8
f25195c8d8aa14a3b7af8c959dcd2ee2c2cf5fc2c875821a7ebd741223de161f
b2349bf667004eeb8f890d99d5fcb683d67fd1c5e706f432d3b081fcb215532d
67ce3a8c9cf8faf3c2dab222f45e714854e828f87335b5ad43d8a2ccf5889290
b05b52916357d74e517bedf824770621dd57a11df97aaf5e0337fdcb72e519e5
73e4b5597678ee075e658b8ebf5555eae5be3493ed53a7490be0ac02834b1089
300fc2b61c49e0a32363aa74464f89d8c5636aa1cbbfa752b1cdec3c0cfeb816
e52c18ac1fd448dffddb696c170222097e65376ce6a7bb54e561f04c9b7c7eab
e8f48d2527f3dd6acef3a98fb1caf5b3146170a45677cfed21fd2d8431f57b09
d8a4df5af5d0cf845d793ef34a2c8ebd5f9ad7fdf417d77eaf1223444ce4969f
c41941d0dea00669a544d6c8d9b4b6d635162fb60f3f500b04062aa49379bcce
0da44be038d0321cf029dc1498af4b7c45ec709134ea83646f82c36b599febd1
177cd9593518d9a9c257bed944a382422b4084f54c3912232e5cff7540132de9
48a2e85819cadf1a9093587e2fa33aec6170a6525c5f69623aba71755a56f801
c441432b6cd2caa6abc45b2aa35362a87c9134d85a0e27b3587c02aa19be2e7e
74cab6e5378c3f19642bbc98a382c27f0c9696ff2ed70e9b64ddf0acdc2e48e9
0cbacc766bd3e23b359ba2195e7af8b60a35c75067eb81bb35a59da2ffda7c49
0626106e0fcbc70f58fbb07aa60cb96a72a66baeec53c9acf933a75a5cadae43
3fb842cee5cb57a7573ff9d2712a5a20778e88f920599ee3caef3fdc8d011924
05cc4476eb3ba9ce333ab8d21cd7a79114c62ea73a6f902cc41084df1a08de2b
339a4a66f7a5911e64cc390a5ae26c9537dfc40d78bdbe7dff37e92d4ffde4b7
7b24036b97cb461e830dc8fcb1320f8039814ef71de7c896c84275555d1cec5b
5a61784703f89a6d3b662e1403362e5373165f1be16c4c59e1cd2e2492742266
83be53619de46b5c04fe3f0a6c75f8e29b6909508d8470fd0b256e46a9a1d660
53a41deded3141259effcc25aaa546b0eea67e0b551a92da6ea347b75a8be9dc
a846f35f048ed28269b72cf0fb922d964599bfe05dba6c904517222fb2376046
290f717bb5f1fc7e777d8f7ec84d2783d06c5d3ef30d23d1715262db2af61fb2
272ddf34625066f8b27ac2de996c30b43223b9d83601337ce05b9ef703985fb8
29500fa224729900fdb264a63148b6b2a6723bebd3f333a38e60848df342815b
3273e36283f53d159a20ce1c0cb67733fb976fdf8fe1953130817c4fa9aa4323
adcf6ec0875d89b2243661b4a87983ff23450fe1c120a97ffde3aca0e913e83b
2e38421d9ca923e82a7538194ac16c1211be621291bb5cda68ceb501b9568f84
766b4d1dd71d55fc39fc418fa0f5123ee0b891aabf8aa1434e11617b05e96a19
8ac1610f45da93c1f18076ba500334e9bf7eca2a4e1638f5a4fcbb0312b636fc
24f7fb2e9b12a1586ae3e579f948b70a0014c31b273707e92754830dc9f2180e
a019afb388b3a48894b294960070f15e6db0fde2a3d2db94b4a0d3b2b3d7cade
b310ab2f07f18a081e7a48e89655c3d330933b598d6f72e4206f02ac611b9522

http://akleigh.com/LmHBvqEv
http://chakreerkhobor.com/zk82JspRS
http://aldia.com.uy/541Ft1KEi
http://abracosgratis.com.br/L69kgiz7sV
http://arcticblog.nl/sjlLkeBL

```
#### SHA256s for Epoch 1 Payload EXEs seen on 11/28/18 ####
```

68d27ee84a09414459cbd880214ddcfdf5a48f36ebe8d6b79389ac9a56a6836b
07089c9689dba0e609e8cb56a80975465220b49377608e902415832a09fd8184
b773c3406e289cd100237bec78642bf0cbc95f0c408b20165cc3d02b89d35081
193a7fc6b3a80046ebf7b780d57159c4513019ace5ff28317ed36bf9ec6e794f
c5f5540e5bb5b986048ac2f74de25f9c4ce8c9dfbe46cc06a8f2eea5db0b85d9
aacc11daa94778bfc64def696f7e33e109e4373b612936fe4bebd985c3b2c1f4
30d05b574849418bbe362c471c8b95b4c67a3ff0680fb20a426343692ed8cd62
417d6f0bd7430d2da110abe074a79be90d5ad236a8d286880e1f71da0647680f
db7c4d47e25758c86a666dc00b69802f3f6d2c875240c52c44eca7633b5b3af3
14dc3d02043615bde5996d3461aaffbdd524c8764656f03f11ae93ecea93dbd7
856df04c921efe00354c4eeb3ca2c1fc827d7901946227c28ce6ad25b59cb056
1390737c78593b40585ffe66d6d01266e0f9781d3e07bb499b4801bd9f53c72d
2b55d0be8e4cf12724f29850f02d6ae5042597307f9fdd2c2d85bdf4554ea0ed
d0a1bb21399163923e90c19ca6196d8a169d565110120eea36f6f3c24656f095
550574bdb13499d852ce7a725ccd6f6619056c465fc12a6fb92ad188c90d7bac
911b4200ad00a7f2193a33e304cebc7bb1f139f068c6d6fe612beb2faf923d6e
088469fe49ce58502d4762447dda7e2f8887b82be8cc3b1935cae4a4c0b5d7db
6432d8e96dee356a13abd6eb50e37e36d72efc3a9eca5635325ad2541848f07f
e90a2ac00514f1b5b8b8c82f5a09eb8caf538415aebaa0633cbfe2a2e92758a4
4ec1ad3c19992f329bc92469697f92b368d76ce48f0dc7a18da25045cdeb1025

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-28 19:11:00
SHA256:
970349e79e9d58a9a6396d1f562d5877abfd8092c7d569943465ccd72455dec6
6e4426d0b509170954d62979cc981ae4a1bce0fb5011ff60ce2e7d8b1068f0c6
3cb543aab4681abf2755e320977242765ec5756a2dda5a904fd12ab53c716f07
787f15153a853931e8adf9cbc828896f6cd56add50dd1c1c9914159f0ae20244
eb738ec5150a99c60bb7b9a8cd076a7bc954f1c8a5d1e0c822cf561e381a2a29
3a936152c592116b685e5d0a83dfc783144404ef9ec00f81032fb99083abb469
ac288870f5f2dd94c88de35fb7b570a20404db34e0178f24af2a0f6a7b299e28
3d72e6a4fb8e394a10e7a0cb10d06c679d4fa9d3a9b4106fd1ccbd77f2a89e24
ad80d18bd431f2600c23c0a8371e377829c845b1324f2a46ada9d3771458e078
129fcb58ba2074504c41b444f55a37ed4b5a5355ab23f4e778ece31ca8b10ea7
6b20c4021c01cddcdb9e40ca4824d2193bd6f6b22a9ee467de88ecf034953198
0a1b7fd8a03068233328643985e462769069dc5cd69ba59be77a0769258ee8e8
e1f4790668195b3a49c022614f3a1c8fe95dac4b75e9039f7ec3c982223384c4
e3fbb04187c2592ee9daf62687608e80b694ac8a5d359e2d1532f32ba5e173ff
496cf8115e4ff19b1d246020423865e96a439b2825a98aae31d7364a9631b89a
9b64eb80e2ac4c1b6a75894dc46023480ee9e469e0a4020bdd5136fd9464f6aa
399d814e9a78565366b3ad186b88dc5779b05a2b063e57c1ebb0974ffb3123c0
2c9efb2aef5bba02f78949229203adfea44cafc5bc8971dbd9aa9c7133b58eef
4ec2e7cafa0e8645934b502b053d254413fa7ae84f0b15cf022e43cc85589fe2
47f9c699367077cffd9acde3349e02dbf316ded30e22e61f128a498972c5fa59
490eeacfc2cba863222e3c218c07f38ae55a3fb494ab4d9ddedbd1cf7b005e8c
a43875e884a667212e8ca8c218fe70e436fdd03155f7d1c0717007b313cc8a82
aa14c6e376d9520e8d85aad3530f4b74a9287478c921c4387803f42c3bae3d5d
b77b56b3c27716ef6b7f0ad6d14dc36ebbb025f63acffec3e7fab0dd56caa592
ec4636eb1b30486240176e4ccac6ca8e6081d0614325f49a033baf009e839d56
7bb8383791f2b6c82c5d717efeb5332f074ceacadc2d324beec22827ac43bbce
d39aab4321080093f8fcee9d4418d9618c97506549cea5f69016ab305add3cbb
5996c8879bfc55c9dc2ce129c1466bd747b1fd937954433952d5fb2284cf80b3
eb64de40ebd993dd895e3cb19c458afbe288eb19785511f0b9b3de81c0c1f56d
9d2182a455d12301215c4c7beebd86a840b26cd3c7a3993d3d71f805a31bdf07

http://clanift.cba.pl/f
http://www.yogananda-palermo.org/Ra7
http://www.wmdcustoms.com/R
http://school3.webhawksittesting.com/J
http://eddietravel.marigoldcatba.com/E

Creation Time	2018-11-28 16:27:00
SHA256:
85f42b531e8d1690542a2849b370f3ee7dc5ef18d002000fb875d6caa006d2a3
e68601d5a5329ec2b0484afde5702b0718a067c702c8710679e74377e4f8d481
364a5e265966224182f9c5c63abb2ce371d022424b9fcb0ac276418f92a3de96
95b8c69700b6d3208dbf635a849b41450548aa3ddfc904afa78db6528549a03b
643fff1a196971894e3bdf3d125eecee42331cab055ed9542b929c11d90f1b2c
ba48388e677530e3609a786b3164b02ae781bed9995aec6de127ca5c89a491ab
fbc97e91a66cb6f0eed3b43114f5a94390da034518185418b21f7fd5223d3bf1
5cbffcc687ab382d59dc8a54ae15d050937d5f910de0ce00f8f218aa67088d91
34d78dba53ede9cad4ae3dc8c1bf8e96d6dce814940542764fe0ba26662ada49
d40edfaead94f7a35f4b442cf66e31f5501c8e93aa2aedabe3d7d2156af7f8ce
8c021761355107865e581331ec2a57c83f7bee4de571e34ab7b403d90a88ada1

http://ampersandindia.com/5PFj
http://fenlabenergy.com/u
http://j9050082.bget.ru/Y
http://villacitronella.com/3
http://ericleventhal.com/owk6ilVt


Creation Time	2018-11-28 13:14:00
SHA256:
607d009e702e486590e1810ac1e2adfd1be74e7935198712d9b9101cd9783195
d9664ad193e4e7585f148144f865457b9e2daf28da1d51f31fd615eef02d9c68
cd3b95d712b9b5cc5b3c267435b47c7a2fd6d687ab30ad2a245565d4d02da915
67492dc1063d18a5bd3ad81f55e4302b6205d07e6792620d5a382302143dbd98
32e58a167f86f12f049e4a387cff6082a600f0394cfaa2cf8a8e68f5f5d16bb4
8b935a23745078dc41d51db8827c34c6292c1371a78645cf7dd457eb6b0c76ed
a67a4af9b9ba444f8465d4a82ff157714c2c50b75d12d3ad1f3448ef38541c32
0f6fb682d439caaaa270ed61a8f26c589be173aa9a7e41543d7071bd8c550f24
cae919fc3376a919de88a3f4398459e87fd3adf533f5417783f2ef047c04b76e
45f07e013786a44b2d93056a9b5b55fc4fc51b1213fab3d8084447716893c476
5e0eb08b8bae2733e66a9f2325e8402a0f17d1aa7c2d24673daa6a7ef5f05c6d
2397ebffa634bb7e9eedc0ecb267f8bb717a18ce2ec59c7ad72c05adfe9dd9c3
246e1d21b2ecadf897a9bfc3e94a0f60f225858db4f293bc9d3153a6dc175848
89726199fcf9ff3c7704d80ac28de698bd84b5bff226c35e58920c21d3c9065a
bbc8eba125df2728ec8db8155e22a88470f8f203fa01e8bac302aeee4f676a4b
7dd66e46230910c82ace05f4202de37348aa956232ebb54dd7f75329f513af9f
ec6f96b3c3c160bdf13de109336c02edfd678b3195bbaf42c6aba12f5f737574
20bfdd95bc5e360d64ad41343d6398602eea03bcc5750862a844a45fb9a16cb0
25739b16847f54a039b762455e28352ea9f04790d65d4326a00f93f8c1b85f1e

http://hellodocumentary.com/hellosouthamerica.com/j9skVzl
http://blackmarketantiques.com/J17M
http://bureauoranje.nl/yKOo
http://campus-web.com/nzi
http://bendafamily.com/HL9hiD8

Creation Time	2018-11-28 11:33:00
SHA256:
114f6b754ab6af0bd9deadac91ff01ed620c088b31bedc3809adf26e31c601ef
37ba085662f7c99dd759658b00de190ce7f5298cda095dd430efe236712f81bc
eb39817bbd10f399a23d33df6d21e7ec5dee2aa20d2c490404a453ceb539400d
513107b9f49cff65c364b12dce7d1adaa75eee9578ffa08387e90863297891ad
84a7d15fe3a7714000a1d5192bf836698160322aee93177517416cfef0a0bc5f
dc944fe55a3d501f4548d3b16b74a6882f590224ce95a807d8fd8b9f851eda64
a513a8781eb34762b6120ff8c1ebf0c1fd9f3e36b87fdc92fc1d9075f34c4532
96e77d26c333917dec940b9c2613ca845468ebfc968f1eeb5ff7c849f71a8a2c
ec9734fe598e3d1e70543dd4a333f6adf716bcc8d91ce760a3e4d719fea903ad
130de932c32bf4c5dd2fc03e749794bbf2c0d40d6037a5060e48cba338450c53

http://bigbadbrokerblog.com/f
http://bureauoranje.nl/yKOo
http://campus-web.com/nzi
http://bendafamily.com/HL9hiD8
http://align.pt/MeH

Creation Time	2018-11-28 06:44:00
SHA256:
78ded38e6077913fd4e72fff6e72f26e7f897b6aa314375d8575fdbec1fef8da
6870e486b86e7d3058b85de7ec77a2a7aaeaca7ea84f3878642cf58334721140
d8a44f0aeb6e815234f93c9e0391173404bfef6e4d457b7a6f54b7f40384896f
b9371226aac1860c3b95915d83b575854b216fb63e35a031483e3ad78a94c03d
97a39274a4638c896ee1b79492c484f056680d92d48ce660095d2efc5f6f3cf7
f42ec423c404a395835ca917afce6b160ce7cc271939e694e3588410a4570fa3
3563f41d60c7cd7060c83532061a734ff3efd594c70cd917624e73cfa67cbf57
8835101ef9d1a98559c559e0033210e309f98bfce6bc0883f2016e2eed70ab2e
b337aa1b2e7e5b549c19123a72777f6bcfe742fecd7053f98a542f716fd7f569
dc0f9653e81eceb6ae3f32cb0d827d008634eb7bac8655222691f2956f1fe3e3
6253bf68bbcfd636755257cb0c216a53dbfd5af3bc8926326bf5ed7d0017aef9
c3a43038816d35c6152e2e4ff2a7d9c28ccd6205634f198bc0268b14ae99bd3e
7d75fc3e4ede198eba06010e397439d53a54c2cf671329ec5fb4f3cd121b573a
ea3cfc56ad85420b50e62e7693cd12e1a3fcb9f18ed5993fde91dd74424076be
301f9e7712e7aacb9d9c74cd03281ea8e8e844fcc74bcb20e30f4795018299b5
506511a8d4e69c388acc0388d0abe8bb76d24134adaaa369098f02de47a23456
a3f1d1091ba35e3ba305164bc4b814d3b5bcd67133fc330eceda8f93310329bc
3f68c55ad332d10e9cbc28bb8e84fcc22d83013cf3b0ddf757302c41cc25bed7
bb0abff6828caa64622d1684f9d23f5ea0838031dd8309f739db673baf47d2e4
bb030a6e2947f77b2bc10efbbe1909248cb4212ee4a428536e7ab16b60efec7b
06eb922bd89f7dbe5392080f798ae866a905abead57cc96c3390cbff3d0852ba
42c428df247a5af48dcbdda8c1597c9752d92a8d1521d941846a66f0cf2de08a
21e949c1a4e292b68442981d22fdcea48c0d794efcb06e174de2eb8886962545

http://channellake.com/dYJXj
http://www.missionhoperwanda.org/02jK5x9
http://acbay.com/m6U
http://akdforum.com/JdKpSEk
http://aconsultancy.com/Nm

Creation Time	2018-11-27 17:01:00
SHA256:
42d32d84ee67794599b5cf1fa39864e314df1068a37386bf6e8b03fa5a4309d1
490f590638bc3abee52350cd9c999940decf7e8a9329a10435856a74727c89cd
1d6caaedec0eb936a0a0ca2ecccf60a833adf36c632efb5314085189bbda5758
4fae63fbd304ee9e722e1ae5be2bcd10fab5e89048bb4e9a2a019af668393873
2b37b5e47da706e053501d97c52f4cf020223a25aa148fc5f6ee9b209cea32a5
c72fd091e8a1d736c019d67277f221e67c198a4975cb38fa42e11ed8f363c677
5e1a10e89feee4d0acae4d84bf56fa4dca4b08fb990be542f5e1a1b148992e0a
2842fec235767549d1df2c3e0c716f8a6371e222387031a609b947ab701d7ed4
d9c70e24df190f78ad02138c6ec144f6b19dd88513faa740d74f9e9bee62251a
83b514488902700acd567af94312d743cee6c69630c780e5b735e5e5a80162ac
86cebf5db4489a7aac05eea5b2f299a4319405510f1006bd54c79a66e187b169
b3f648cfa4736a5e273a8b11f322cf7f17fcd90421179cd07e40f4f334a1747a
b2f5a37d4ea9638e1ad645d7a0a0936f383131a62ed76ea8fafbcaeea1c574da
25a0e684e7007a063c606dbb52dfc87e2243f4959fb7f96770b9b529e3902dce
13bf6e3f85e2457d15440ba3e739666f02cec124a43c292e2ac24d2cbe8c62df
86ed14cfabe23cfb9e160108e174ebc0107bbdfddc02ef46ac3739cc9b7c1e7f
c09d090f67b5f7e6032f938ee039b599461a6970380a1795efb576b85ceeb188
fd2491d53848389b56902186f9da953a6b3e7417ab798f961a01b08f92952628
eab50fd5d53a966d390dc698647856afce685e74b45239da94dd9fef8a456806
8d1e60485aa4019df8429bdee34462e4cdc367452a1dad79e77bbf3ef6f6ca11
0eef70dca634de1669e3823d33b62fc86fbcd24e925a69963de14af446a4b23e
0f688ecde35e41ae417b9f35b3b818482b451905b5422ba8e815d51046b312ea
2fd0577834eb44fce11a8b9e458c39e4499203964048199e71e9559a346dbdf7
73b32ee2c234cebc0e0dfbbbc5b9047401b03ac3c544b1f41c634fa8d0420694
7bb8acaddc34533a9ee5170f13d3f1da0998e7ee59c1c8fe1d7674292d8ec454
136f7832a69db40c08fa76e0eb22b86ec1470bf991667d42b6f059d1977ba467
b43624a44d5abe60a49ab31e6c30ac170aed740ee21cb86417895378d57b4495
17f546227e662e7fd573e7cad5962f904b984b734d362073f1fb7083a35f6c43
a77acfb1d000e0300fb39d24e2bd4eec5afcbe9444d9fd360cad3b429d5f7126
96178583300f32f613a60fd9a987aaf39286efadf3b0fdcaab786277e6cc1a8e
8e4fd6f6ff9329ff40fa1ed5bc07cc30cacd205e4d24eeaf82e2ee12929b98dc
649e881bc3d0d09ee5310b7cc87734c14965add759deaef600efeceecf89f754
a75c0c2460123a283916e6d657c2cc1704e659762773278225266d68ed018d22
bf3d3b7836a4342396d4f40076db332723d94676cc98b17046723c815ff02ca2
19e0fafe85713b355bffac9890ab1ac122e70d57628c068d6601b19a6e893cd4
764e34b44b7e5b5df83f7c0a000129b825885a84411d628c66f2484c41cd610b
6f556f659befb826825239cf2e045573a3963c8eed99fdfa7b006e084b8d658d
44469c59e556d1fc1d8cce07f6ad672fbdb98b2d84cbdd22071e854cc2b68dea
7289ac0eed4b26b5b63064e582fc04d8cdda1848e8db106265f472ebd917d3cf
f95ce3e5c5a5b027d486622047f4f1424e4814644d7113bc58e1df61e03dd076
a1948c523f6b337bea05ca4caad3c8f4a8c960c9166cefa2bca500f7c5e5e233
695766e9f8ee44c70968b26e333fbea58bc1ea972b58b79c0c779a6a9957c7e5
283979ccbe5833e270338156ccb03f384e3e738054c52d87b209d999ceb59883
9f49a36b2f03a0bd35ec3b89b0ececfa1b629fea62508bff30097e6a19161234

http://andrewdavis-ew.me.uk/4W
http://vitaliberatatraining.com/w8INn1Y
http://ekcconstruction.com.au/yscziIK
http://autopartsnetwork.com.ua/t9
http://avtopodbor-barnaul.ru/Y

```
#### SHA256s for Epoch 2 Payload EXEs seen on 11/28/18 ####
```

e3b60fe46c471044d46462de8b2dfda807d75b36dc0a6938b6cf20f554042018
8cf92c0b4d06b40a81cd342682d4f11851dea0571b59ed41ee5368a1622a1d2a
9074096f046de748da9f5468d8eb5def37ef223a00f68afe8453ce728f0790d9
665c756d1b24cf6687474bdbfc49bca91d9402204c2d644be673f6d64c95e49b
fe45c1718d3cb436dcf9d71146e3279bbdb3d0166456d166e1bfc6b5f76cae39
3fff9b668822147dfb51e835bcaf15d7237a3ddf9b65fb3761d51d995740ce68
fa5e80edc63c39fd70cd46456e00d2cd30b1cc4e8db0e48e133c5e0237476c0c
4b2b0beef7ce5d00fa22f18fb5447c04ed945e3103a40eb8bc44f2d348a46631
da8e85ee30babf6ba47a421f7df20284c138d5915fdda9b096b3e2a51e605409
094192054aba8b24d222173e9e691579980b848117c28579f840ae44809f887c
81873f7b40f11af7a1e3b17052fdb194ece504b1f3e343c6c0615f49cb8e372c
254532f354f60c11284a1e5b9b342f4c27ca73d921cfbab8cff792248f60fdf5
7d84ace71a8c3fe19e225030c34163c34f938e99268b1b2667d23a96c1b95e3f
29f80bfc2425287d6c2016e6fde5ee3221880e31b72d1f33bdb81c66809284e2
2763ddbc8c826c4fd517b6c7e3583f882f33269e2a1fe46292e02b65e7a3e578
37aa1febac3bd33f5633193fe456c1c1203dab522feb313f0c98b35a4e04e3a8
a1ea444e3ffb9408f6e7049d36f14b429cc62b2b221b5bdbffec1f6d330c8ef0

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

107.11.23.236
128.92.54.20
133.242.208.183:8080
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
177.224.87.110:443
181.129.130.82:8080
181.193.115.50
181.60.228.203:8080
184.6.79.105:8443
186.20.225.65:8080
187.163.127.20
187.218.236.242
190.191.88.126
190.2.43.237:443
192.155.90.90:7080
198.199.185.25:443
200.58.78.77
201.145.151.91:8080
202.53.94.4
209.182.216.177:443
210.2.86.72:8080
210.2.86.94:8080
219.94.254.93:8080
23.254.203.51:8080
23.94.123.231:443
49.212.135.76:443
5.9.128.163:8080
50.74.56.147:8080
69.198.17.20:8080
75.161.71.124:990
79.129.42.122:990
81.18.134.18:8080

```
#### Spam/Stealer C2s ####
```

Pending

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

101.37.20.145:443
107.190.203.165:443
108.189.168.117
115.71.233.127:443
121.181.5.53:443
165.227.191.145:8080
173.241.126.78:8080
174.109.80.223
174.87.45.161
185.20.104.238:8080
187.153.56.134:7080
187.190.105.150
192.141.209.252:990
198.0.36.237:50000
198.74.58.47:443
211.115.111.19:443
216.198.175.99:8080
217.13.106.160:7080
222.214.218.192:4143
24.186.203.66:8443
27.100.25.77:443
41.75.1.16
42.119.105.64:8080
45.123.3.54:443
46.163.76.187:8080
5.230.147.179:8080
5.35.242.34:7080
67.205.149.117:443
69.198.17.7:8080
74.115.246.21:443
81.7.10.106:7080
83.222.124.62:8080
84.200.106.120:8080
88.247.124.152:8090
95.141.175.240:443
96.69.89.156:8080
97.83.88.72:443
98.142.208.27:443

```
#### Epoch 2 - Spam/Stealer C2s ####
```

pending

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture: https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list. I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now. Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change payloads every 3-6 hours now and hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100% sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/NmsEPu7R - @James_inthe_box
 - @pollo290987
https://pastebin.com/wPU4jPGE - @pollo290987
https://pastebin.com/LZAF7259 - @ps66uk
https://pastebin.com/jkeRmGXq - @executemalware

```
#### Credits ####
```
(OC and combination work)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @Techhelplistcom, @pollo290987, @malware_traffic, @0xtadavie, @devnullnoop
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @Bitterman59, @devnullnoop, @executemalware, @Bauldini
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!

```
#### Daily Log ####
```

Seems lighter today for malspam received at least on my domain. BOTH epoch1 and epoch 2 have been focused on German speakers this morning which is a new trick.


```
#### Sandbox 11/28/18 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run at 19:45 https://app.any.run/tasks/45d1a65b-dfc1-40a7-8910-df8d9b0631ba
```

```
Epoch 2 C2 run at 20:00 https://app.any.run/tasks/925fecda-4a68-428f-9aa6-d5a386fd1219
```