Emotet Malware IoCs 11/13/18

## Emotet Malware Document links/IOCs for 11/13/18 as of 11/13/18 23:59 EST ##
*Notes and Credits now at the bottom* Follow me on twitter @jroosen for more updates.

#### Epoch 1 Document/Downloader links seen for 11/13/18 ####
```

http://aeletselschade.nl/EN_US/Transaction_details/2018-11/
http://app.hawzentr.com/EN_US/Details/2018-11/
http://asesoresycasas.com.mx/US/Transactions/112018/
http://bandashcb.com/sessions/EN_US/Transactions/112018/
http://bryansk-agro.com/EN_US/Transactions-details/112018/
http://casashavana.com/cgi-bin/En_us/Transactions-details/11_18/
http://duanquangngai.com/En_us/ACH/11_18/
http://energyworld.com.tr/images/gazeteler/En_us/ACH/112018/
http://exploraverde.co/EN_US/Clients_information/11_18/
http://farneypc.com/EN_US/Messages/11_18/
http://figawi.com/US/Information/11_18/
http://gomus.com.br/US/ACH/11_18/
http://hesap.hawzentr.com/EN_US/Details/112018/
http://hetum.co.il/US/Transaction_details/112018/
http://hockeyprospectus.com/EN_US/Clients_Messages/112018/
http://imetrade.com/US/Messages/112018/
http://inhindi.co.in/EN_US/Documents/11_18/
http://jindalmectec.com/EN_US/Payments/2018-11/
http://micronems.com/En_us/Messages/2018-11/
http://multilinkspk.com/En_us/Details/11_18/
http://nigelec.net/EN_US/Documents/11_18/
http://ooo-geokom.ru/EN_US/Clients_Messages/11_18/
http://outreachhs.org/US/Payments/11_18/
http://pegsaindustrial.com/En_us/Transactions/112018/
http://performance.mn/US/Information/11_18/
http://pleaseyoursoul.com/US/ACH/2018-11/
http://rtodealeradsforless.com/En_us/Payments/11_18/
http://shahiraj.online/EN_US/Documents/112018/
http://squamishplumbing.ca/EN_US/Messages/2018-11/
http://stella.sakurasaki.net/cgi-bin/US/Transactions/11_18/
http://teleweaver.cn/EN_US/Clients_information/2018-11/
http://toatau.com/wp-content/EN_US/Transaction_details/11_18/
http://topcleanservice.ch/US/ACH/11_18/
http://vokzalrf.ru/EN_US/Information/11_18/
http://webmadrasa.com/US/Clients_Messages/11_18/
http://webmail.auto-dani.at/EN_US/Messages/112018/
http://www.aaag-maroc.com/EN_US/Messages/2018-11/
http://www.baglung.net/US/Payments/112018/
http://www.conceptsacademy.co.in/wp-content/uploads/2018/En_us/Clients_Messages/2018-11/
http://www.etcnbusiness.com/En_us/Information/2018-11/
http://yck.co.za/EN_US/Attachments/2018-11/


```
#### Epoch 2 Document/Downloader links seen for 11/13/18 ####
```

http://128.199.223.4/51MG/oamo/Smallbusiness/
http://153.126.197.101/WltxzbAkLT/de/Service-Center/
http://159.65.172.17/1956MYCLGUS/PAYMENT/Personal/
http://1stniag.com/i8IGzz/SWIFT/PrivateBanking/
http://agis.ind.br/Corporation/EN_en/Invoice-Corrections-for-48/67/
http://agrarszakkepzes.hu/Q1iM9mt5a/
http://akaltourtravel.com/DOC/En_us/Invoices-attached/
http://alkazan.ru/83832LZQ/com/Personal/
http://amtechesters.com/xerox/EN_en/Paid-Invoice-Credit-Card-Receipt/
http://arbaniwisata.com/wp-admin/DKKBEUPW/de/IhreSparkasse/
http://argosbrindes.com.br/multimedia/Download/US_us/Invoice/
http://artntheme.com/Nov2018/En/Summit-Companies-Invoice-3811503/
http://artzkaypharmacy.com.au/zNY1qCETQqcfglg/SEP/200-Jahre/
http://aspcindia.com/files/En_us/Open-invoices/
http://assisdornelesadvogados.com.br/INFO/En/Past-Due-Invoices/
http://b2streeteats.com/E5yC0sw59X4PFh0/SEP/Service-Center/
http://bakewithaleks.academy/LLC/En_us/Open-Past-Due-Orders/
http://bandarbola.net/4KMA/PAYMENT/Personal/
http://bespoke.masiavuvu.fr/5RM/ACH/Commercial/
http://bihanirealty.com/wp-content/uploads/32708ACSWK/WIRE/Smallbusiness/
http://blackdesign.com.sg/uQ5rguYN2BRT4nSs/de_DE/Privatkunden/
http://blackegg.in/Nov2018/En/Invoice-Corrections-for-85/47/
http://blog.comwriter.com/wp-content/8490712WNNN/ACH/Personal/
http://blogbbw.net/0474121EZMKUDJO/com/US/
http://bnsgroupbd.com/files/US/Paid-Invoices/
http://bo2.co.id/qIWAwHyATEm/SEPA/200-Jahre/
http://brandxplore.com/LLC/US/New-order/
http://bursaguzelevdeneve.com/471255HAH/biz/Smallbusiness/
http://bzdvip.com/xuGOzWi/BIZ/Privatkunden/
http://carecosmetic.in/sites/En_us/Invoice-4986023/
http://casellamoving.com/096498ODHDZMH/PAYROLL/US/
http://categoryarcade.com/912K/biz/Commercial/
http://charliefox.com.br/pM99Ir8db/
http://chebwipe.com/1KG/SEP/Business/
http://chemclass.ru/newsletter/En_us/Overdue-payment/
http://cine80.co.kr/wvw/8132AHNYO/SWIFT/Smallbusiness/
http://clickdeal.us/0bfubJVeEEEn6vOdLA/SEPA/200-Jahre/
http://cliieperu.com/files/US_us/Question/
http://ctghoteles.com/Corporation/US/592-78-003774-682-592-78-003774-075/
http://ctlrdc.ca/DOC/EN_en/Document-needed/
http://cuoichutchoi.net/wp-content/uploads/Wj22J2Jc/DE/IhreSparkasse/
http://cyannamercury.com/81MQIQV/ACH/Smallbusiness/
http://davidjarnstrom.com/I2XUphxVvDb2xe9ai1x/de/Privatkunden/
http://debellefroid.com/LLC/En_us/Invoice-Number-67220/
http://djeffries.com/nanawlotfy0QauuHFd/biz/Service-Center/
http://djwesz.nl/wp-admin/NSenVPsoSHGhpoX/BIZ/Privatkunden/
http://dorsetcateringservices.co.uk/8wIxtQ3k8lRj6x/SEP/Privatkunden/
http://dream-energy.ru/7kJF7n3F/SEP/IhreSparkasse/
http://dzunnuroin.org/eXWGz2nzw4/
http://easteregghunt.ca/7V/oamo/Personal/
http://eccdetailing.com/tyoinvur/6557032QNJ/PAY/Personal/
http://eidekam.no/xerox/US_us/Invoice-Corrections-for-46/49/
http://elarce.org/INFO/En/Document-needed/
http://emilyxu.com/cxDjtxJd/DE/Privatkunden/
http://enginesofmischief.com/BFwVHW1VL0/
http://esf-ltd.com/INFO/En_us/Invoice-9762238/
http://estelleappiah.com/oldsite-06-08-2015/files/MLgFnnx4jSdVtsQYU/biz/IhreSparkasse/
http://estudiostratta.com/1LROMPGR/com/Commercial/
http://fenicerosa.com/76SQMWCR/com/Personal/
http://ferahhalikoltukyikama.com/517138LBPXVKLR/PAYMENT/Commercial/
http://fert.es/HPwPiWzc2nVxnMoN2E/SEPA/IhreSparkasse/
http://finacore.com/finuzs/zKtmyxlI5il/de/Privatkunden/
http://fire42.com/4327973OZXPQOK/SEP/Personal/
http://firstlunch.ru/yK1S37hF127BMKYXT7/de_DE/Privatkunden/
http://fitaddictbkk.com/wp-content/INFO/EN_en/Important-Please-Read/
http://futbolamericanoenlinea.com/Nov2018/US_us/Invoices-attached/
http://futuregarage.com.br/VeOy/
http://fyzika.unipo.sk/site/9YDvpp4U7/SWIFT/Service-Center/
http://gapple39.ru/gUgNxYwE/
http://garnizon-arenda.ru/Nov2018/US/ACH-form/
http://giamno.com/826993SSTZJTKS/PAYROLL/Personal/
http://gillisgang.us/6EK/ACH/US/
http://giti38.xyz/DOC/EN_en/ACH-form/
http://gold-furnitura.ru/assets/backup/1522048JKFRG/PAY/Commercial/
http://gopukirans-co-in.learnproblogging.com/Download/US_us/Outstanding-Invoices/
http://grandmetropolitan.co.id/wp-content/Document/EN_en/ACH-form/
http://gsverwelius.nl/4LHTYE/BIZ/US/
http://gueben.es/pr7RRYlowjIMG/de_DE/Service-Center/
http://hamarfoundation.org/086416BY/SWIFT/US/
http://happymemories.pt/xerox/EN_en/New-order/
http://hipkerstpakket.nl/newsletter/US_us/Invoice-for-you/
http://hockeystickz.com/610GASMC/SWIFT/US/
http://hoookmoney.com/GUzrooM93/
http://ibws.ca/4KixZknmCW3lpvozCbC/de/200-Jahre/
http://iclikoftesiparisalinir.com/AiF52tK6sNenhTpK/SEP/PrivateBanking/
http://idico-idi.com.vn/OWJkmGGl4LAksi/de_DE/PrivateBanking/
http://ifcingenieria.cl/QpX8It/BIZ/Firmenkunden/
http://ifixxrepairs614.com/92UUPT/PAY/Smallbusiness/
http://ihaveanidea.org/wwvvv/6lnQfZWB/biz/Service-Center/
http://informasi.smapluspgri.sch.id/hG1fieym2C/de_DE/IhreSparkasse/
http://investicon.in/wp-content/plugins/workfence/509DNAHXVHH/PAYMENT/US/
http://jfogal.com/Nq2XVe/SEPA/200-Jahre/
http://juegosaleo.com/va2sYCtNM0SFogKwpYa/SEP/IhreSparkasse/
http://katandimedia.org/5170RYALNRVA/PAYROLL/Smallbusiness/
http://kebun.net/023LN/SEP/US/
http://keymailuk.com/212DJSPVTCX/ACH/Personal/
http://klining-expert.ru/FILE/EN_en/Invoice/
http://knofoto.ru/89637AZAH/SEP/Smallbusiness/
http://korczak.wielun.pl/57GACIZE/PAYMENT/Commercial/
http://lahlopa.com/2160CMPRTBY/com/Business/
http://laparomag.ru/7gCAzan4fW3nBS/de/IhreSparkasse/
http://lasnaro.com/476043RZK/BIZ/Commercial/
http://laviina.com/647147OXLJXF/ACH/Personal/
http://lead.vision/mobile/iIxAKt7/SWIFT/Firmenkunden/
http://lightforthezulunation.org/e3vGL2kw4Lzjox/biz/Firmenkunden/
http://linktub.com/blog/wp-content/004444BN/com/Business/
http://loei.drr.go.th/wp-content/0052962DKCBVSK/identity/Commercial/
http://lunixes.myjino.ru/D69kUsZix6/SWIFT/Firmenkunden/
http://luomcambotech.com/74OBPTY/SWIFT/Commercial/
http://manhood.su/files/En_us/Inv-551540-PO-8A832461/
http://math-elearning.com/scan/En_us/Paid-Invoices/
http://maxairhvacs.com/DOC/EN_en/Sales-Invoice/
http://mgc.org.au/gTubBSslqNT2G7skTWe/BIZ/200-Jahre/
http://mini-onderdelen.nl/xerox/En_us/Invoice-Corrections-for-86/86/
http://morghabtour.com/scan/US/Document-needed/
http://mydatawise.com/wp-content/uploads/2016/12/BAeCW5sUgN2TkwrNA/DE/200-Jahre/
http://nhpetsave.com/8844IEO/PAYMENT/Smallbusiness/
http://nilgreenberg.com/LLC/En_us/Scan/
http://nutrilatina.com.br/349A/biz/Business/
http://otumfuocharityfoundation.org/LLC/En/Overdue-payment/
http://peconashville.com/Jng07/
http://pensionhinterhofer.at/8L8XXmpEWyq5/biz/Service-Center/
http://phaimanhdanong.com/multimedia/5946442WZKHBOLP/SEP/US/
http://pibuilding.com/38F/com/Business/
http://plantaselectricaskalota.com/newsletter/EN_en/Sales-Invoice/
http://plco.my/v1/wp-content/uploads/2015/5i4ny1v/SWIFT/IhreSparkasse/
http://polka32.ru/LlwnvS7Uxnymm6C/SEPA/IhreSparkasse/
http://pornbeam.com/GjI/
http://prevlimp.com.br/kaualqc/
http://priscawrites.com/77nYljPIJ6A/
http://proffice.com.pl/2091826KVVFRYBA/SWIFT/Commercial/
http://property.saiberwebsitefactory.com/7Ka7SNYsz8Kj22B7Vx/de/IhreSparkasse/
http://raidking.com/sites/En/Sales-Invoice/
http://ralfschumann.com/DOC/En/Invoice-for-t/o-11/13/2018/
http://remnanttabernacle7thday.com/050143ZVEWD/WIRE/Smallbusiness/
http://repka.digital/2jBu5yOGKm5/SWIFT/Privatkunden/
http://retro-jordans-for-sale.com/files/US/Outstanding-Invoices/
http://ridgelineroofing.org/mIRDYt7DgnxfMpQg9/DE/200-Jahre/
http://robotics138.org/sites/EN_en/Paid-Invoices/
http://sagestls.com/wp-content/Hylk90bY/SEP/IhreSparkasse/
http://sahinhurdageridonusum.net/TgG4eSEmkXVUzmdpwXs/de/IhreSparkasse/
http://sainashabake.com/wp-content/47939IZ/biz/Smallbusiness/
http://samdog.ru/uuqFH8yY7L4S/biz/Privatkunden/
http://santaclaracabana.com/doc/En_us/Invoice-receipt/
http://seegeesolutions.com/DOC/En_us/Invoices-attached/
http://servicios-marlens.com/JLjrMR35bxEBuSFxrC/SEPA/Privatkunden/
http://setembroamarelo.org.br/BBJCFeEOS/
http://sherrikane.com/20SPRM/oamo/Commercial/
http://sightspansecurity.com/iGpKASJxRnXI5S/SEP/Firmenkunden/
http://sknfaker.com/newsletter/En_us/3-Past-Due-Invoices/
http://smartcare.com.tr/gssJT5/
http://smartretail.co.za/Download/US_us/Scan/
http://sparklecreations.net/XpdQgE1/
http://speedautomart.com/7KR/BIZ/Business/
http://starbrightautodetail.com/RPsmsYBsBI/SWIFT/Firmenkunden/
http://stefanobaldini.net/components/aXRS9vpVjI3v/de/PrivateBanking/
http://swiftsgroup.com/HUrWpAv4H/SEP/Service-Center/
http://testspeed.sfeer-decoratie.be/EdORQGfu/
http://tomas.datanom.fi/ovning/iuUiPbCkPNUyfdcX/SWIFT/200-Jahre/
http://touchandlearn.pt/wp-content/uploads/88441QUBZUNWV/com/Personal/
http://trainchange.com/758L/SWIFT/Smallbusiness/
http://u2434969.ct.sendgrid.net/wf/click?upn=WD6m8SjAakLxmIWnIo-2Bhx28pOEn7kpWTh16DjNMnBiRHrm-2B-2FIa2rYjV8DOgZNp6r_uX-2B-2FOWVk0wQO-2FiLAN-2FRXf4GdZ40wtMzyBkhASagjL9D5FcYhIkjq3YH7jPizD6wnjNDf8tOowyhY4CuijpI-2Bq3qQa1jiifRbj-2F2vfqwupVGQA5tYyQPKQOSDHJOh7WwIUs7S6p5esx-2BNv-2FyIg1dj5YRP1Tm9wbsG8F5DuO-2FrkAJ1Ib1u0QF9rfZvPcxp8zF9K7Na-2BDFCIsOxe-2BYMzlVRmppUjrKWN7Rxp2WDzunTYaE-3D/
http://uia2020rio.archi/673801JCQZ/SEP/Commercial/
http://vcorset.com/wp-content/uploads/LLC/US/Invoices-attached/
http://vegancommerce.eu/816988FM/com/Smallbusiness/
http://visionforconstruction.com/doc/US_us/Scan/
http://vov.is/43YXTUSK/com/US/
http://wire-products.co.za/845XO/PAYROLL/Commercial/
http://woodkids.fun/2MXJ/com/Smallbusiness/
http://www.agis.ind.br/Corporation/EN_en/Invoice-Corrections-for-48/67/
http://www.altitudpublicidad.com/JIcOoRlQV6sd12qdysBV/DE/IhreSparkasse/
http://www.belangel.by/590UUROZEO/oamo/US/
http://www.bzdvip.com/xuGOzWi/BIZ/Privatkunden/
http://www.conci.pt/2752LRESK/PAYROLL/US/
http://www.coronatec.com.br/wp-content/yQlSVG6STaHQK/BIZ/Privatkunden/
http://www.c-t.in.ua/28064NUTYG/identity/US/
http://www.emilyxu.com/cxDjtxJd/DE/Privatkunden/
http://www.estelleappiah.com/oldsite-06-08-2015/files/MLgFnnx4jSdVtsQYU/biz/IhreSparkasse/
http://www.fieradellamusica.it/481DRDIB/BIZ/Personal/
http://www.finacore.com/finuzs/zKtmyxlI5il/de/Privatkunden/
http://www.fire42.com/4327973OZXPQOK/SEP/Personal/
http://www.knofoto.ru/89637AZAH/SEP/Smallbusiness/
http://www.le-blog-qui-assure.com/7273PG/ACH/Smallbusiness/
http://www.linktub.com/blog/wp-content/004444BN/com/Business/
http://www.maxairhvacs.com/DOC/EN_en/Sales-Invoice/
http://www.meico.com.co/wp-content/plugins/wp-mail-smtp/33NGYR/identity/Smallbusiness/
http://www.moratomengineering.com/1628920LHZHNATG/identity/Personal/
http://www.pensionhinterhofer.at/8L8XXmpEWyq5/biz/Service-Center/
http://www.priscawrites.com/77nYljPIJ6A/
http://www.property.saiberwebsitefactory.com/7Ka7SNYsz8Kj22B7Vx/de/IhreSparkasse/
http://www.rainbow-logistic.com/6246439MYD/oamo/US/
http://www.remnanttabernacle7thday.com/050143ZVEWD/WIRE/Smallbusiness/
http://www.retro-jordans-for-sale.com/files/US/Outstanding-Invoices/
http://www.ridgelineroofing.org/mIRDYt7DgnxfMpQg9/DE/200-Jahre/
http://www.sahinhurdageridonusum.net/TgG4eSEmkXVUzmdpwXs/de/IhreSparkasse/
http://www.semayakas.com/vl5W3GWHCVziHNk2G4Sy/SWIFT/Service-Center/
http://www.semra.com/LLC/US_us/Sales-Invoice/
http://www.servicios-marlens.com/JLjrMR35bxEBuSFxrC/SEPA/Privatkunden/
http://www.setembroamarelo.org.br/BBJCFeEOS/
http://www.showersw.com/files/US_us/Invoice-Corrections-for-18/74/
http://www.swiftsgroup.com/HUrWpAv4H/SEP/Service-Center/
http://www.xianjiaopi.com/41964H/PAY/US/
http://www.youngprosperity.uk/3KKHCPBLX/BIZ/Personal/
http://www.zerenprofessional.com/4408FKJYPIRL/SEP/Business/
http://xn--28-vlc2ak.xn--p1ai/454337ESYOSMTZ/PAYMENT/Smallbusiness/
http://xn--------5vemb9cdabihb4bclaglcbccigolbem0aeqofk4mwa6ldq.xn--80adxhks/5984JQJNIO/PAYROLL/US/
http://xyhfountainlights.com/4846RXA/PAY/Personal/
http://yuvann.com/Document/US_us/Invoices-attached/
http://zerenprofessional.com/4408FKJYPIRL/SEP/Business/
https://argosbrindes.com.br/multimedia/Download/US_us/Invoice/
https://linktub.com/blog/wp-content/004444BN/com/Business/
https://pensionhinterhofer.at/8L8XXmpEWyq5/biz/Service-Center/
https://sightspansecurity.com/iGpKASJxRnXI5S/SEP/Firmenkunden/
https://www.linktub.com/blog/wp-content/004444BN/com/Business/
https://www.pensionhinterhofer.at/8L8XXmpEWyq5/biz/Service-Center/


```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-13 21:39:00
SHA256:
d8d4b5ea78b2db59271a090150ed9b9664541e3d0264ebb554db887ecbeb4c23
188873663307c1893db3a130d4806291607a56c683e2c6a602fde8419bcf5c27
124313eafce4114857786cb95452688b634b9e2a401e56c9e2bb0e7c5530156c
7926bfc0d12d85e2a36ccd9a545c93f043afd4cbea1f8fc32160ee41ec697d0b
98f88ed33c928d30eba1bfd763d47edbca091a24a73fd78651cc7457ebf47206
0436654757058822a1432389dd1affa7ff96f4acc7f32c30b7c53e4b87196ab1
73986cc2e3b0cec179f346fef3234f92d9468a5e1ff05c0378cdc2b51914632f
921d9780574e1883b287560f93095614cb1a27a77438b92b2836cf3c4438a6ed
a30a4ff2ddf595741b7410bc15f79ef02907bc372c6eb121c303aac977268051
cf35ed6a0a5c2e236e1b99ea3c5a1f05a079a9d53f776ffed1976952e81630e3
b8c28056208b4e534521d31c6e579d7d91da8cf8996eb7a23881817568e930ef
2bd17c2ef70b599dfb5b97e3609fb1861c315fdcbbf1809723b8185070ae20d2
53c1abfe0e7d4a96fa84cc5d41aff2fc51e1bafb1567b8e1d67b42ada1777dd5
81009b191802ba12cd6a90c85ad80a1fa1d65db88fb3a9c8a5fe27054d952902
300388b942f47a19f60a42454eab019005a2c4bb1df28d221586e2b326d812b9
b2110c06c15726636fbaa24569b7dc0c7c4e38099f8ce6328ff568d172c73970
b211602974dbd9f6967288147f9e9599ed5696614c32065fff69b94ed6095ae7
603f9d733df9ef338c2afa807b2c1ddcbd50f2ec30fa4e3d4b9ce742d5be2cc8
9ebd763da881a6397ca589908c0664cb728aee15990f911ee2f83bb6325f2609
62fdc83c620fda52ad3500a6abb547a4884b61cf1e310325e637bdae8f81623b
72a85880fe96b7c8fe236d4c6cb288a34d48d5b64996905cbed56b2f647c49e6
6150c6d1c94dcf5f64614216f2299433060bbb93a5621880389289cc696268c0
d184ebe9aebb0325714043355361d6ace0c304e15df1cd73ae59fa068dec54f2
558a904381b193dc9e4421ca1ebfeeb948fd098ed9659eb8bde11b130af33237
885d369660b4f9d110aefc5e6f4f0633d60ed6ffa2715fcb9386a064acf82543
dac0733d8734aff890a5f00f197c6537894d14faadf6cbc478c88056cf3589b0
6aa4c4fa8568f60b18fd7050c650d2f5240d5e8d2ec58a27ce48096a036b53fa
0412e605d7b016f3fe1c22834530b783229752bb73aa887244cd03f656968f3f
92790e4826f5f1433bc70a3439d815023cb9bde16c73e7f3b75a7d01aedb8ecf
cfe5b2f3b0dc14ab42e7ce88b115c057b71761eeddb5e9f0dd6c6a38ef3b19b7
bb7ec910906b1eb8665e5deeb6b65d0ecc4c97a671d5cf160b0fbc6b86ae7227
d8b7f3213403e7f03e25b996fe7866395bd61973e58ba84b362cff20293f5807
71cd20c2e40523d462fbdb3bfddb7047bb824bd26e7001fd1c83b8f8f6e5deed
20772d295f794df456c1ea8bbbe10008b5f627da507d99bbb0a961a4943017c3

http://sanlimuaythai.com/JyqB8LsI
http://kingdomrestoration.co.za/CYzuphdS
http://erhaba.org/2Mg2x4ixjv
http://vagler.ru/UrzfhrBBg
http://danzarspiritandtruth.com/dP2ORoS9P

Creation Time	2018-11-13 17:15:00
SHA256:
1676284b801aab4bd7c6460af08886e67d9b000765cc1a9b948e05934ae63a3c
0730ef1e657eaa4ea3b4428fd0abac7d18e270c6130f3ff589ecc362663da82c
3b44a9fcfb20f5fde395e7253e5e1c54a1fa8e6f81467471d15f9b25f8aeb1f1
b9b582863f8d8223f385618df4eee98b7c8d5560dc1c8f559e1f58193a884786
a2464c94fde0f80348803abe8bc18dca201a417a9fe01bc3cfd02cd5b703f40e
c71f671903ddbeec462ad26dcb777f0ff16ecd9297af5afff35175510e28801d
f0708d458c012ecd2696b5f8906846b56bae1f54b6200149d1250491e48fd1d8
1c2161dcc61d2e27c495486309e9ebf76ad1c9b497a1f381c3a13ae8c5dd7738
867d462d152a8ff68913510d66abc416200bb9a43f13b6486c93fe8791136dbc
b0beaa29cd7adcdfeb4327d5dca245ceb1bad523880ae9fa027c4e064edb7853
10e4cb4739383bb20ac24f68ef7fbdbf706c98fd99d0af4b54765b46ef10dfcb
56d209dd8183f988088d5465f0035062f3c52c7541924a851cb7bba4564dac9d
b835188aac344d9dc3cef7b2efacd87a5f41821d3303f7775781b80d07e2d9b7
9d8e69481c6796be9e7a0dee2c05557082bb395f5d49f3992cf7f6fd18de6057
ac62cac45e018e37fcd122461f36d8b54c94a44cccdb4029c143609cef5c6eff
1f09bdbe1013422deff83817196f4c3bf6a9c83481c485d69851c0c0ae9d5f92
88745c4517674eafb26a3b2c6be9737c3a42c4e681712f129f877c93a2f02909
1ee3fc710e0f5cde8b7020931c3af14d39fc6e50011b07757c320a3f14b07da9
2074fc77244a06c505e78a81d8e97bb0869aa3f7812aadb2a8b8e8a1cf3c95ea
28b434b6d8ba77390fddefe16ba0e488d507211b384d34cf3eead7fc5a95a998
f697b30d8450b787ca216c2b91a8999c1667bd4ac4b06ce6299cc74f17b1bbde
e3d00272c5761cdb1d439f8b4004143765ae7159c39ff45d22f0a75476d4c2fe
9f9f27e0d6f0c2e4bb4a07b1752772c9afc81eaf564c9cec691394f08ca88901
6a7e5ef02caacbdf4ca551b2064fd66429b5cb210a6238ae5b16388216a2a204
f951239110e7a23c5340a896edbd42bff938a36f904ce0a3ec2dba970b345ed5
90310503a68d36955bf82635a2b95b7ec603a269780d98b1c00f9a83469f1b80
aa7ae11d8e8116a9b522c2af6b3a708d8e6d77a507834727595a52dd8bfa0a78
85394bb2752fadab66ce8f58b5bf2862dcbf1abf4d82df82daffbd08e6ffeb0c
8994289b7019b0d3b670919ea1524f4e8de8e27807396b71f9c33d5b09e9503b

http://akucakep.com/JhVWKzotm
http://litmuseum.kz/l6lbBW8pJ
http://medresearchgroup.com/h2MpbvPu
http://cohencreates.com/hkaT0CiG
http://www.cainfirley.com/lEGcINYm

Creation Time	2018-11-13 11:31:00
SHA256:
8f1b63772e49b2c7ef92a351a23f4e9961ef92170628b794e39943ff3a293aee
308c3ede8fa82dce65f4885e0d86f0c225c7f71b99885a0ee5320899cdb77098
a52f328715d109b6f09182b9e22c326a337d9b172c36515a7f9afdf693abb682
7d19a77472a97a42d9e4fb84d832bfa4d9e8baf73692228ee3605d2158f6878a
cd86e10aa88d02567f70fc0da0a2951bbcadc44c8c2b43946ca7098fe8ce39b4
2ca6facf648f31f56fc8bf121382670e22d36d8edc6f0f71e3ec19cbaef414b9
39ba9ed60158e37433e663241e3b6e12bfb17060ff7e40a38862882eccd94920
95c85969b553fc18114f61414924bdee9216b569102dc42a4942394c6d587c1e
44a8681152b6fd623d6b542d077ca364770ad4ad0ee01de479ba9dd1994374fd
3dc5cec51628fcf2b4285d932de7bcbf6d87d2451cf398b34d0fdd6c40dd752f
df3a5156b5f3b5b7245bd546807eb58133f4b6920076d96b418ce26d61642668
53b685cf6c0485af2ccc1befdb66b659e5fe1c383735844e4e74acdbc82a97bf
09a8e29fdb7c678e6e40bde47da38e86047415eb91818aa4019045ad600f3f10
4008b4f9540da090ac02ac0e8518d1b10b5b624ca7ba63f2d6521fcc5855e242
a035e77d313f001f1073ccd39a5ae629f8aa3a1ae0fb296beddd086b79175186
9fd9718cf5f538187052ff6f45d53f32b73a29a8a7d99bb35b913865cd48c587
d3526e9ddb080ef9798aa3eb75be37c7e7f5e7a49eeb93a622ea370a74040361
f3219906b535b5bfddd1fe7a362bbd128301bb0da7243d51442f17326555d411
3e04d4192de7faeb88d96475d6f8b9569e2b7a501d35f631421c848d45ada0e3
d787f37aaaa575b0a19aa886fbc8b78743a0834f5f75462ba34d9d894df211e5
c01f5c817fbf1dcd990a74ffe57e534c4e004768f0ca166419c485ac28c4359b
65c11af5321b67cf155aaa2c13203f9818cf778b31cb9176c388f1f20766803f
2f03c4815bf8f4c08be7dd30cb0edebe7606314ba6c3c00a6a8359dac3c15f02
e5d1c70d7b89adbca71e7e967f366992e7adbeb19cf5a26ae938fe7a951a4e8e
85bbd0af8763b1871ca53be796a0d84c8e184bcd2c96ecdd43ccd5086b6bf524
3b5ea15f043967a2730c975a9e3e3a984759b03fdb72f49632736a53828c643f
770e1bc904dedddf0dd122c12c7231524a1b10546816a604668c4cebed0326fb

http://mindhak.com/Ammv5OK
http://ralar.ru/Puaie5a5U
http://minitrium.com/MKDXWpgwn
http://volathailand.com/OWujbyF
http://hockey73.ru/D7YNuEw

Creation Time	2018-11-13 06:16:00
SHA256:
99e5b7f275b7bf370c7f5e23eee3decac349afec2cb777a916412885337081dd
bf8c5a5c79218e9cf9eb874f796ddb678ccd1108ed6d261ba33c581b5b6bc33e
3254700705dcd4258714b6564c601fc743bee3e29bd2bebed1c243d92986946d
c00752d7d50134fc31ee8e52eced5f97850d91034e7187f6476dade5da765f79
f23b27556b176dab9b9a52404bd3391b887545f64e27e0535b126eee8a09c6c5
c3074b60b158881330ed1a580c18528deb07e269a63735243822d1010c9df6bf
7ae3c6afd9653c5eb1f3ea4bb9914d383424a2607c33237c717567a45fdd3fbc
17a5d073bba4d195f70ec7b3397de5c95c4efcf0206ffdbb0bddc81b32690d03
5a161f103176b5be1bf9f1323ce1f4c80f1d3314b80b0f3206cd0f65499ca33d
31068745f31d224af822a8141c51b187ca9050ee9660d3fefbebeea92db0c27f
453ec21d27406e7b4fbcd9e3c504369648d3d674562f353e8e85a428ba28a0ce
90a63f9c3cf8954d2a9dec2ec8aff5720d3a48b73731540fd73fa3fd2688c1a1

http://xn--j1aeebiw.xn--p1ai/duxkxUmla
http://lasertagnn.ru/uczuwCAF
http://mkbeauty.ru/c2KOfaBDb
http://fortismech.ru/MNPY9J6dZ
http://pravokld.ru/Q4IQlRpsPz

Creation Time	2018-11-12 14:10:00
SHA256:
7e91f80158c95301ead0ca00670b08f779ad7dad64dfa9a8ed21dbae605ba91e
80b25f3052802119817ccb8b0a15aefa52485b3b99b1996000ebd04f3c071a8f
78fc9d35b602ff002a3363743a7dd0b7d2876e2ec25c8bf31fdf87cf8199e150
8ef793a7c87ec400d106aa3385af8f413522fd4b4e2f0f1aad52b35bade07ad1
100a98213947da106c51757b676ea1ff3a23150f91031e19f1994fe4547a8db4
98563e495f2c0f84e5f4cb7cb19a7a8a2db7a5fae7ca7253073e9e7b860f00ed
19faa831843fe9d0a0f4f541bbb3eaff8ad4e6ae316d987849d86efd16d42785
b8bcef645661675753323ff06f16653d9bf6b6ceb5d25cada7e0aa0b0707024b
d86047a5f809aefe38d835820c3a15813c3061fa56678861bb580ee9b7bf6d36
41d2cc831c4578c754cb7aca8dc9d6e4acfe9898d3071c0c1961149cf586c4c1
a32532f815ea7ae8804038c2393104a380d23daec7e03c995405f9c903f13e21
bccdf1c448b608748a40b308bcb14d1b3ca5435c9f0f2c2b1223b74c55cfeea0
7ac091dce2259fe7adf3956754f90952a982e7891a70444a58f7f7477652a9b8
9cf8530b347f0dd634479684e0f330d59373150abe39dca1685e33d870548b2f

http://art-n-couture.com/xZEenLet93
http://cargomax.ru/jGudFrU
http://localbusinesspromotion.co.uk/yYdR0Jizzd
http://iepedacitodecielo.edu.co/9ToeEUowUq
http://ecconom.ru/sIjHq7jPz


```
#### SHA256s for Epoch 1 Payload EXEs seen on 11/13/18 ####
```

a25625f7d1e3bcd30477059562cfa0d0ec618fc076d73b3ca02beabde7a5a601
8906c39fab5491d47a9502ff8914949afc920914257d31fbc7f92d8d58576b68
7c359f37bc807c4c2daf5b8f6b705f70f4fbf6fc62b4e02d48cb6b9679b274b0
ef2301ce298dc73ed2022e5607400e8ce00a563ea2e6d78cfdafcfb7612fa829
86b7c8c206ee81e2396a1c16a1014d3759479db9b133cb1906ad33e06cf915e9
5f0df0c31c47da2cf9e379f392144bf8d2437d436d9ea7c14ff07f5d04a705e7
90cd190bbe7190a601443c07b7c25822d48cc638316e2f3b6b2a57a57ca5365c
585c42328bd8dd38d5b0f2188ad9354f4915a1fd77d92449fd7eed02f13c4945
cbc421401024f1d0138668fc4ffc1193e8c3953ac4c00f976a17fade07d247e4
4f8b1a05faa6e9c673a2f3232ae393d88e4c81d2fd421afa7769d1006a1d9136
90cb460dbac42c6f4aed906f527aa6eb022f591315300634212defbae8526fa0
e6137ec35f0a2c3d71a0dfb5347e6ef06ac92e3dbe68ed65c7cd88bfff986700
057f3d8fcb021d3d1e0cb46567966749ad475a18356e279f8655fba701e74c7b
730e803fb01d464c3e095386a0e87dd187e85d760ccd9729959ec0fb89a66834
0397e6c6e97c535ac1a3ede4fb433a5d07383abae613b72950f2a08fcbbe3409
87fc0dee854353956b960abb4b33c41a6fb6891771b6ef802c76c21ec90d5560

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-11-13 20:04:00
SHA256:
b0a7bbb57eab0e80fedfa62a103370ce03f3c4305bb7573df2ca06091984ef82
a8d41c74807199a20b0acf02245998da966747695f10091f40571ade26405b84
c387e1e35c7ff86526a7d66399f12017806fabb4faa111ba2b27c8b936ffecfa
9010d662857d169de5384af78985e25b14410244b04da5dcf5300c1ecd28c00a
72bb04e8f82c63c3d571f3f9012b29f5bb2205d6c5e0daa62cc9ccff1905a8d0
90614d3da32d107339702cf14724fd43ab039fbf8d0c0cb0d6a68d28eb015cd0
7fd9c66627122571d0553708b5d6a914744142da39c17892011d2371f2577e10
9098752cbbfbb8099362ac188870c6c478f0dd8869f5215253e667b18555b199
8caa54397d78b09b4c2553ae804c91155d3a3adc9743409bf5991246458010a7
208e7e3e7345666f7fd0cf907f7becabd5bac717ef7b93505147ec8c55e61edd
9c0e5f94114c04c85c371da0aaf14c9133ea9422068e1749275229ce9bf9b246
23e1c6797d94bd21ab78243b6dce416e324dceee237e992f6415a3b319a66119
c9f15bdf45c76ccdc730b207dcf923ef3f693256f857f6e13451e8ddcd63ac0c
b679621146dfa7ac24749f85a45f77d61fa250b7dbaba5be3f4435756314fd3c
31ffded5360755d13f745b2e55aaf2057287e24e036fe4dec67b4cd2d8092ae0
cfdfa3cbd4b0b21e2c97d2601e301811ac9789ba96168ea914c6f8e573eea613
1b4d3463ca684ef36734e2b985cf820f4052bae4d6e0192975014d66d0e5d030
3b870679f96129496ddf74b48ba55aeea663c2516ce84d330f114e515f8ecbfb
401d503bcd4929012c90fb19e86354b36d54c20b794366e13077b78b5793a338
11a59ef847e28e196f0b415d6aa5a25319f341420004a6fc560084afa4a99a96
00978b70a8b9cdcc1e160e075174c541697678e04ac120a82287234b6f02331d
411f548cf47f8aad3d543efadb861aff3e8002086f2aca7ea9ff7bad7abfe9ab
9132d9aaff0da8d518c25a43f4e689a9d984761f1463f2869986302f8a6b4393
8d54dbecac5b5de6b80bcbe6771285af41b257c2504a957b677eb18f186670f8
d95311720ed12c7e3be657ff086e9b7781b89103be988ad10c7ecd60acee8512
9e1f14d1cd3ad8e440348e7e978988f568ac5e6efba821be4ef59137dae2c237
bc58c43093f08e6714e0ffc32478b5ea717871b229e8604a64e006428421ea65
8502a5e8bf9cc18e0c6c2cabe98a35cd68330b6136592d777cc4481501798dd8
e70c5a47725db4a5829fc82014b05998999c8383a8678bd5db21b452229987ba
af0a769f202088ed042626ccb8ca2f89b922ceaa638ebe1feab8a95468f6b981
2dee37e0b2eb3a0c8eb0866ceaa6fcc8fea4eccf7ce0e26f367ebd999ff31e8d
1f2b775d0847cc25e9b7d8ba653c25c5584afa2c725d4d6414b0c03a7c7eab21
769ab7ebfc199dab18fe6d8aa3504bb81def8abb95314b0d83cf1acc8e9b1ff8
07cbd6f2845dd592170ae62600f6599d234e3bd710bbdc8b869cc8938aec346d
452b6ec48ba4df4e59c1a72b7a810cef0efa1d6538aec3d838cfabdb25ad5415
273241182e581400c07fcfc16a8e24552e0b78c78f0e79eb97aeb56dfeb51167
e1b7154fad1606f317e61db6607e4e6b3d0c5467f905bc5ea50a988131a52a58
80030eba410e5b62ba0a68fd678ba9ea7c6cb80cd0287f3542af57fc2b76b216
3776917e868f0bc93860afa61faa0f31ae0889c52fab09bf8d8f7e5ebe962ffc
6aa43fdce6ff514a9467ffaee5b6fdc1a0231b282cef1b1e9cfc2c4cc4a76a41
b1b6799c8e78883e87a72b3d861c19ea1a1d8c9833a7c9855a53075ebd28356a
703a7b33caa1505ef32ad2a5569084f9afb3a023d27b08a5bce7ef08d8f5d08a
040e4101f137c670f9fa54d03e7c665ded7751f17a78e97a630a793bbbb560fc
eee7b032279786794d254209563470521214bdf6e6426e50e6e628bfae7ac94d
215b09eb78a63a76c0bcbbcf4267b8b8e2facdbc78aea6a6c1b27b538e9bfa49
fcc182c98b35c111f4b0e16e9c2e1db625070080b374343f63390c1f4b1b45f0


http://klempegaarden.dk/nZ
http://tastamar.com/hZEikxCA
http://avele.org/Fg
http://elsoler.cat/7JxzZW
http://ntslab.pl/IRIhtk

Creation Time	2018-11-13 15:22:00
SHA256:
2fff73b623f4cc6542acb14a201ee262a84e7dde65a2e69a8cc72e897274397d
06e714e79291b3f0b2d3eadee58f4c3ff5eb5e3ecfc78da4626978a8607082d5
16111659149fbff03cfce1f55a7f3c09cd9685710b2788ea86c67720086142ab
9ec61df541e65018dc5a83dd9a9c6cf5e83ede128daf86c66a7e89d66a1d393b
7f7c90a62054a940588ae1a70df41965656a24e070c3b958cb90e3107db4dd89
ff5a9627b2c8c3871d4dbaea80dfc3c94f35f7f80d9f92203a1a638e68e4b3f6
58486ea97355ef0a0c02b35fee7a8bde449f393057e46301f8b400a2a943e0e3
f357ae158ff99246fc2df27ff482f022933fcda398b7a1e58f23b44c94840503
6cef507754b64a20a5cfa8d9052566d8b6acf80718b81568ed37d17a8c8c2844
61453c1d5d3d5bc2eeffca606746ed5a72457650af5143ceca0638b325e65af2
ccda3a211f121c6ebe4ee1a6df2cf4e1d4c1cec3700ee958874f8c7195e3055d
4d629b98467f250de5a4be029245a011ab6d73b4fba081017f9a1ba8473a67e5
af00b5d3041063c2c7886e86db353699da6728c23093fc014c506c4ad92fbd0c
52711ba9f267e21ce1115ad8cbc8d043354294cd28b99c0876bbbd6309bb67ab
8c8b3bba62e7974caaf10b0745a6555676e96b5341e6b7715d600a4a33429f90
ac6132c4e987d8eef440467be8e34f800187cc475c81af99e4f7ccaa7eab055e
97ce7e4c3367861178182c367271ac2b10c56f2d706b4f05fb4df6f5b5695613
d92b0336b411ef22d6ad5a5bca97b64fe41aa412ace1bf04575ea2c15b76f75d
2bdb99873eac77182a204456d906be0fa8f1924686bb2cf68dd28a487ed00562
dcd553174478e75d6b8ea135276d833b509149d6a2d6851a01aa5ac74a0687d8
0a16078bc290bdffc9634445d114c427c73d947c588cbe96d1bf7ce250a5e320
cfc7856c47e6599cd76b0982edcff622c5f1cb9fb9773a5baebae59901b9866f

http://www.myhscnow.com/oldsite/P
http://spolarich.com/hgTHxN
http://pragaticontainer.com/clFl0rg
http://www.tudosobreseguros.org.br/wp-content/_uploads/4uehh8m
http://kaminy-service.ru/q9

Creation Time	2018-11-13 10:48:00
SHA256:
3dce827083c4656245c600db0793909ee151855ad333aa5cf8e562ad655589fc
1162d1507278d5a388046945c32d794856cad9271e3c8b69b149e96eea7f1260
a3527086fd5d2bb4a96542aa5d3012f7e35b454fe2c22266e2d011d4f3463900
ba37611ee1b8ab0e6993791529a91526a32046db417f852428ca8b10c1fee9cf
0a6d1812559d81c236c495ef207e3c34949312467c424d31720a857f2495e67e
c64d837f6ba4721f5f3f5ad21f9557deef59379f96d849a8d3c5abd5bb60c61d
2c6615e76502826b7ca68b612c40af5875202e28b1c093deaa8214f3fa15ce76
5a33c6cc1a0705748d7e8ff0e4d190ce2312afce25e645c3ce4fa0ae41d2debf
6b4df43d9f8290834d920cc26b9e915f1d298dc45e8f799d88ac46bc0be696b4
5c4f23be3b3a460a5359846c8e23b5aa051433101e9640d6962696ed6b117911
9ca07555be17d80e5436d40be25db861000fc97696dce85f4a911acabb057270
3096c3c2f6ff839a69e2555b6932cc52690b049c366905f08b4a480aa1842bbd
7a74d8498d5516c7f9933846fb49ea5b86cfc666741f935c24247afd72af9f9b
c6e342d998eb2d0f13a159d395aabe8e9ee8674b0bc05eb4eb491202d132e7f4
38c8ff620fbc2962749436b7f55c088313fb09ad5d264844ad510a5069e1f675
964cc3fdd6ce76613e80316bf816a334a1722cb8c36d8de5a08f5c6b7a8c8400
ac160af199bdc906b2623720a283c74c4509649dd5bfb66fbe6f76e2089d2157
51cd2de065c5aeaaac85f61a782e6576ed5010124e5ba6cafd40320f3c09e45f
2c81034ba1edbb02fe1dd86ad28c9e76817fd747bdcd8b893f5e7495ecd2a73f
cac2b022ad20199e07d20aeb99f85becf65da8fafccb910676a78111d7010236
7e66cde90a43a8e428ef9796649ddf3d26db4e41a611492ede279f75be8d35f4
24ecee20f22701425f53da5325ae7485fbd59b40321b46cea13111c645018a78
6a429bf2974f68fc053a6143aaf1c231be24505e96000b0c7a4ab566089d88b7
31c0cf8f7b4f759f0ac39be9d05fee738c0eaca35492a0f35e1e5de1716022dd

http://www.bluepuma.at/97Hf4F
http://www.naimalsadi.com/tqX
http://creativestudio-spb.ru/KlX5
http://www.sphm.co.in/KsEg
http://www.secretariaextension.unt.edu.ar/wp-content/XK1uBZL


Creation Time	2018-11-13 06:28:00
SHA256:
d8829e9c2929163f31b001419bb2f9bf88ebf9f92bc1783229ba42b8e1ba8029
543beab4afdffb67c0b1cdc05a357404c7a9830b50f3e0125c0d57f2fcb8c19e
8b5f0566da62ca13ae6051724810fbc9c51858e1b63bfdc04af5fa4d77292ea6
7a142698e26899993b4d4b78276c26cde44d3a8fc724bd392e6eb7a5161e0b12
694b8f39ce7777eb15439d7e0ae9728068aa1fbdbc7894198dc3bb31575946b1
dc8df15abe68fd07b4ee8116937a99986b1b30fdfc68b3ba096eae05a0255a2f
e9556e3634058ef2f2d958528af2cb8b7f4dd64e4b531febe70effeddf80f78b
0aecd7f2224c5325a8e47a5de667ae0fdece42c346f9f7018c97b0fe52161679
5207a4e8f313b0e9b9ed458ff24f3b2ba08f91ba193d4d71f230e7605e82be2b
288fcc2760fab1e7150ac27d08d39a09d414aa0b936b2571bc3b11eea13a76ab
de6f7806459fa6c8293ac9a640ad642095a2825b3240bbe3ffaf06597318332b
22f71dbc8cdf424f082060570658a08a22ea297d44d6f47206bd4a901245eff6
c99cfc73564c33fc8a361fcf916658769e00e65e8aee086a692002dc8209e161
9be7f05eb5f9639b3336fbf72f330f3144cf91af008c8d15efffa5676b5d1dd7
1251e50cc6237baa0c516d6a898d97c4854e014c690eec03f92e0ece9f5a0801
ddef4d5d13f37b145e50bce81b79c4b2108c76f17bc2295c9c20424bba55935e
2f563f4a82ceddd50911cdb99270b3478bfc1b6c9749477956758438b40b5372
42d242096c11eb0aa8cf609df75ae7b099f33bb8440381cda9900593c820c180
49acc4d59a4ff1eb21e411af798f2919a745b5c77d7a0408d3e53e8c0abcc670
f887e50af1c99ba73f280e28c7b0581b392782dba0bf2effc72d1719d039152b
4c485a7b3829e236dada42faa7a516a8e420dc807d7ccf04ef8c11b497d5f84b
7e0d1c335f40d83529a449e451ae0d678fb2fda345d7881708839da86ff6b549

http://therogers.foundation/ZFFmp6
http://helpimhomeless.com/wp-content-bck/q
http://dsltech.co.uk/ODyG
http://paternoster.ro/Eb
http://carriedavenport.com/DHL-Express/mCBqd


Creation Time	2018-11-12 23:04:00
SHA256:
025df887a34aa804d44bfbcd11e4a80e5263e10bfd27fb3ebb7c89e04db4ca81
64a7c8442d6ff3c72ff1a60891a934f8905b2aeddf71cfa46aa74683a3e06fb6
a5c20bab8750884dd2923d4916f9855fd87eadcaa5959f182200268be8d2ec70
608a25bc3356b31894a89756d683e393ecbe515874ace66a19bf2ca917ef022f
73525849030e938e284bdd4bc5cb3af23ff94eca14fcce7d927717ea6d3eb259
1731081693bb027c42b2ea98643415f24d5e7cb9a1edc290db5a189d3ab28ea8
d1ffcaff73bf439151f3b3f809446a8c895f94ba463c8ec3bf2e9f4a6b4524b2
632d4cb7a5a88758b8394bbd8a430d7c7382f28903cfca8c7647e6b2c4901d88
5eb358d5d5732e202a7ce7afe07280baf355992740b90c09bb04311e5731e270
b482750de54ae5c8dd12466bf6e7edb219ba31bc2655e5e988fcc491548e4f37
cc4b92e40ce2beab7cf1dbedf349f086d01facb7b31e94f43ac698e7e5367473
c8929d08c03d7f37876f3c4ff4c03f074fecb820c32128053f5fec703346b581
d368043860eabbddbce883260d1618d8101dceb24acdeaf3ba20d2771f662947
ef7bc8427d82a575c156b8d97abce626eac79d3a94eb278c5366e85f488ef5a4
5ffe52f6fad30c9ccf60a3591005c4234de45fc436e15849940a13bde7bb5976
d1c6188521225562b06ba5290035762b80029dbb755eaa25111aa566d33bfbac
209a3123b5471578764fce10acaa32d756eef90b714dcf08a151cf7b34ad9ec9
c8da434a07842e6510350492b22ed4c21d240a6206b188173378e20f094ddf26
d98fbb3ba2795c9b6805e6ff8928851fa91ce1f2d8fcfabe8a2a7d90c8bd1be1
bd237f5779a828b32e043c01a3d5f594e8fd011a2a7f821405413424b4212967
4f33224b115ae763c2aa706285794e00b6a533e772c7c4b1a8659e66b93bdd18
4b692b65dd5f6d598c74bd66d4e9dcdf3d5988d6373b86c3bada40887f9c8695
96dce57a5e98241c81a0db6ba55e1fc48a3fffb94e7c9fcbae407da6333691db
8e2c674d5a60c109d834d7b6b17a54bd5b5723d7d4ef3d7a6d7aee5eab19c691
78ff07fb1e00a6d4e172ff58159bbaddb6e13533ebde5e4cbb90c3dac6dbef99
8194b42405a1d1b7dc93e6ef023f880dfa17673d4d6025abe760bb375c663232
ba13597fc3d25a4cb41dbc951eb964d904a7a1b4a84fa86db954df34246e2a91
0d5385ae8d4c190a20e29a12285f698e0a9e3d21920c6195fa1ab0668e3b8382

http://evelin.ru/I
http://sharpdeanne.com/28IqWw2
http://hotelmarina.es/wp-content/uploads/hDDPC2X
http://waraboo.com/0ne6CK
http://www.vcorset.com/wp-content/uploads/hJwC


```
#### SHA256s for Epoch 2 Payload EXEs seen on 11/13/18 ####
```

e6c95255a8926b0f99d7b83bd00b7062bea8e815838e7e8cda471edc32253ffb
21248a7f14f2159fd4768e64b1c531358a793c558966dca00aefcbb7ed217c67
d69a3f1620bf2a442cd584a0a657fc93b47d4f08f446ca84f1d5471e669a59b9
f2cbb164dd9defb79c2bc94f075dfaa84cd9fd285f44b8ea1d7ca1c81a537c22
0ea0d10daa8441022afe01bc1bdae16d5a858b77311c3f71a6d1c535e645e623
8378ee7b62782154aa36ba7e5ed04d2bd6a1315443f05690cbb6562f70701c94
726191c6315129ecc4b7733ebfa017df063ba96f6305d665d8c3d0fc9be62ce4
4fd8fb566e841aaffd322c8bb1bec93ad19b898939f7999a8b4159067a828337
cc96904177b98f5992a574bb2c83d12330d055afca4b8848177beea08b68391a
fec9bb2db4919a8fd1dff41a69ff2c7647908ab44e4ba1869a9ed51e222f4f1c
432b8f918486934770da075622ca542abde01065da5e790dc1756e1374c7fa14
c5f167ca3957df9e7c05605924ae519af1b1f24db548d090edf9646d6527a5e8
c23e8b0334a9435be4624dbd5def744316c0a5d2c6daccd531b1a74aeb9b4ec5
7435546fa454994c6d99ef1773a655e7e6d39866e4da9855e65cc7b14c86f22e
c7819f07a42e9443eb2fccd80a8af0025fe3880a8cdab5c36c6accebbeedad4e
9e253e465abef02d351845cb51699aaea156035837b2b33802789f4f7c505f47
d58beb0bdea3bbc6b4f980ebf1ce9ad0339a5368d8cf6975dc0cbb2845a9627e
17be2b8b04f05fc00177b3f239ff7766cf36576c2102067adada7bdcb2146e8b
56b40329ce363e7b70995c40b19da4a22631160d84db8d5f2c1b60953a9e6f2c
adaae52fde585129bef12c1be7237322393d7fc662072392c9ea53370bd0c9c7

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

104.5.49.54:8443
107.10.139.119:443
118.69.186.155:8080
133.242.208.183:8080
139.59.242.76:8080
148.69.94.166:50000
159.65.76.245:443
165.227.213.173:8080
181.229.155.11
181.27.126.228:990
186.15.60.167:443
187.163.174.149:8080
187.163.49.123:8090
187.207.72.201:443
189.130.50.85
192.155.90.90:7080
198.199.185.25:443
207.255.59.231:443
210.2.86.72:8080
210.2.86.94:8080
216.176.21.143
216.251.1.1
23.254.203.51:8080
37.120.175.15
49.212.135.76:443
5.32.65.50:8080
5.9.128.163:8080
50.21.147.8:8090
67.237.41.34:8443
69.198.17.20:8080
70.60.50.60:8080
77.44.98.67:8080
96.246.206.16

```
#### Spam/Stealer C2s ####
```

Pending

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

105.225.244.118:8080
111.125.87.100
115.71.233.127:443
117.215.4.29
125.63.116.242
139.162.151.141:8080
153.122.38.158:443
173.62.175.98
178.21.66.250:8090
183.82.124.191
184.149.17.62:8080
211.115.111.19:443
217.13.106.160:7080
217.174.206.181:443
222.214.218.192:4143
24.220.80.37
31.148.221.34
45.123.3.54:443
46.163.76.187:8080
5.230.147.179:8080
5.35.242.34:7080
58.65.180.67:443
64.19.32.70:443
67.205.149.117:443
68.102.169.43:8080
69.112.171.184:8443
69.198.17.7:8080
71.71.126.201:8080
73.32.166.189:443
73.91.16.130:7080
75.110.190.86
78.47.182.42:8080
81.7.10.106:7080
82.117.238.3:8080
83.110.100.209:443
83.222.124.62:8080
84.200.106.120:8080
85.105.250.128:443
95.141.175.240:443
98.142.208.27:443

```
#### Epoch 2 - Spam/Stealer C2s ####
```

Pending

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture: https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list. I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now. Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change payloads every 3-6 hours now and hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100% sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/da3myDSG - @James_inthe_box
https://pastebin.com/hV5nT8g7 - @pollo290987
https://pastebin.com/GEcivVUX - @ps66uk
https://pastebin.com/3VNkqcPp - @executemalware

https://pastebin.com/JJUgcT4j - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/tCn5MmdS - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/hRatJUgh - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/K10Wa70A - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/92eyuWT1 - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/EWqEuXiA - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/pYa70CFJ - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/BinULr0L - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/BWbqrUgj - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/dkN5STpw - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/MTcu5JE1 - @SaurabhSha15 Epoch 1 Spam Templates
https://pastebin.com/yfnDNgKi - @SaurabhSha15 Epoch 1 Spam Templates

```
#### Credits ####
```
(OC and combination work)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie, @Bitterman59, @devnullnoop
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @Techhelplistcom, @pollo290987, @malware_traffic, @0xtadavie, @devnullnoop
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @Bitterman59, @devnullnoop, @executemalware
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!

```
#### Daily Log ####
```

10:45 - Starting to see E1 Links again.

17:45 - Updating C2s for both botnets. Only seeing a few new C2s in E2.

```
#### Sandbox 11/13/18 ####
(all with fakenet and MITM unless spam/secondary infection)
```

```

Epoch 1 C2 run at 17:40 EST https://app.any.run/tasks/d9ced77d-495f-4464-9c69-4811c8ce285f

Epoch 2 C2 run at 17:50 EST https://app.any.run/tasks/86551688-ce3c-40e1-abf7-4592064b4321


```