Daily Emotet IoCs and Notes for 09/27/19

Emotet Malware Document links/IOCs for 09/27/19 as of 09/28/19 11:00 BST

Notes and Credits at the bottom. Follow us on Twitter @cryptolaemus1 for more updates.

Document Downloader Links

Epoch 1 Document/Downloader links

<none>

Epoch 2 Document/Downloader links seen for 09/27/19

<none>

Epoch 3 Document/Downloader links

<none>

Payloads per Epoch by Document

Epoch 1 Payloads by Document SHA256 - All Times UTC #### (Newest on top)

Creation Time	2019:09:27 12:29:00	(Attachment Only - Doc based - Product Notice)
SHA256
b699437d9e76d81c64a6158fc6412feabdd144f9f1160b251ffaaf4f90ddcab6

https://livingwateraromatherapy.com/wp-content/a58l21119/
https://cosycafe19.com/test/o24/
https://vitality.equivida.com/wp-content/1aq116/
http://www.urcancranes.com/wp-admin/1kvvucx62/
http://vitainspire.com/wp-includes/3jj73/


Creation Time	2019:09:27 06:22:00	(Attachment Only - Doc based - Protected View)
SHA256
76932fea712d925686bf2b16dce4d2563dd8b5f8b6512ba7653407d41b6bbca5
8776612a3adaf367d6386b03b8b5148e49a13a7bca7bac9612de9c6504ebdda2
b1c8c47bb43aea8f739bf7d729c4e39696ed10f8dbc0257628be9bfabf7d4594
74eb998065cef26c3040937be5415d6ba2ce3ec980ca04e9845c3e9d868b41ed
7e69ad435dbc5de832fc694ff1004e5935282a6f2e951d3df73c190a25a1cb8c
e03ca4ffa0b124b94a7f599a681e5d066fa82cf0ef59848304d9bee767aead99
928ca2086504585dc155ce347c8e98b36ef6ace69d8976027a51542032b44dd8
6a761916dcc2a96db2806c1c235fdeed4550ac48c13b30fd9a3d11479bc90913
03a9115b9a91c7e3207d1dffa0ac769a4a752a9c43e5be662804dd7822ef05bc
91bcf6c9c0ca997b94392bf0217e70ea1bf3e4c7243ae700518973d0c5c7c561
f70fd408dfb75b26e4104ebf8c50dffac2b7c55834e395be82a1cc111a706e66
fa25914b673ddeaa894f1b3badbb6446a94d258010bcdbdf5f6848c17d1d07c5
01c753bf7272b771bbca8a3f33aae6087578e686c5e4fd09b943aa07dda2f787
f0276a9bb083e3b9210c5fdb5495d363ba5fba9e67913e7c50c96a5efd5eed46
9556280adf08a42d9423b7d57e7b1b3d0a8989449582d308f93e6e7a131646e2
5a9cd810dfe5f5fd7b4ac516389c67e6436f36f64588b3a5de2f071ced26cad4
43976642956b2216d1851b0f9aae192bc1312cb95f64cdbe6b24153288783179
2b46d86b7773a7decc375609c3ca79b17585112042d4582936b3b734d3096520
4f6c96fee779306240309e00a40e9ffa6ea20c2f1d0e09fd4a4d078a35483724
f0975b088aa0776b74f23f627516f43a409d03ae7b66fffdb1cb42469de4da8c
2fdd6ce13b33f0eaf1268d897d013bbafdf6587b8d202c474bedb8b2068ea437

http://ta-gigantic-dealskp.com/wp-content/pi0b05/
http://umroh2zamzam.com/wp-content/q1ky86568/
http://wordpress-322022-986759.cloudwaysapps.com/wp-includes/aqwuty80/
http://www.717720.com/lty39/n3kh015480/
http://vpsojhaul.com/decay_sym/v36089/


Creation Time	2019:09:26 19:46:00 (Attachment Only - Docx based with embedded JSE - Product Notice)
SHA256
58dc68c126eb2988bfee6632c0c579a0c2e2018bd097aaeec693a93de09c27e5
4b1d6a6e7b60bc673d8937711a01d2ad56798add8bb672e2f92fdf871ef88d11
a0703d7150ce06752f04e53ea2ad6f102551e1bdb8588fdc2e6bf90668e1de7e
1be7caaba5194edf4387892d03521e968be5fa4b784a833b0c6321285694a660
ea189ff2f4e5009ff86fde8b424fe719aebc45d09e026f18e1a7c9bacceea7a7
298762d4a2ff39b2de5427c13ff95e75a4f4ac07b5f64c46d82ee1043fc52ed8
dd6e1775d250540b67d65432b5e14304c8db6b9656b6c05147f9668d3a4a7af2
eb6febc1ad3e0558c56597f62c9df9cc3f8a3f00c9190e4891835f97c3097e51
41bf5ca7cb6b2e40ff05958007af2680ca0cef7161fca55ed798cfd8fab33de8
01f1cf00d31cc8a0e217396b815eeaa047d6c5ab543730b399d92bbff0e4f573
dda0f5138b71bc79783035aec8e5eebed8406ef2f51dc75d5dadd179e22e596a
57db8471cebf35906135f8d23395f0695238ac94c37af7cb0e68270a526f23d3
aa5939a419865b42f07bba0e5b344675bc51edf1cd793336ce2f53aa8450ce81
4331d5382007c68ac994c5a45e86985d8fcde1fb478aa69b394a19058d807f67
afb17855bfe0728490e1c7b0ddcd7c5f11c6aed66530929a7f2665b4cf0dc9cd
f918d1dfb52b73688fbc44b3d912526998a1e8e4a3096ef6d2002705cd3a978f
7d06e0759eafca0709823dadb15c5d37c7a3cada38bad9bcb4ca678d3895bfb0
1cfe976389fe9d737b7419de0fac59fa4dce4e78c73714124b1689011e3ce732
1bca357b280ea92f2d7924c979aa02c0cfbe749a7cfcfe20a7d87250caef2229
16a9929e17b9fcc99f8d2eb5ec86b365239b0f957b187594f77319540ce5e5f1

https://themodifiedzone.com/feedback/wtpgy009/
https://garagebean.com/ymti/n174/
https://staging.icehousecorp.com/wp-content/pyte3/
https://www.lightnodemedia.com/wp-content/uploads/398/
http://staging.xdigitalstudio.com/dawnfotopulos/y9y795/

SHA256s for Epoch 1 Payload EXEs seen on 09/27/19 #### (Newest on top)

0053377b0e55552b47d59a9ab8d9125f979c66ef0037fef505dfcb80843565bc
fead12f34de8e4e438ada7939882e49f2056556def23b65921b2422489b7997e
9ed0dbf271d5c572bc576e649748a6d4bb56de09a576b26780c5aaa094b81f30
0a759439154bf119757d2ab36c575841d344e482523dec3aa30b4904fa0dae55
3b77974bb4f7386ef54e0d0a02680bc8b0b4e5b5b6f5bdc05b1ef0c8312dd6ba
ac094b0cf789ef3eb4b471d69d0fd0c225fb48b16ce67b9fe1f84a8963c200e7
442456d75ebe6108408e76ece414da3c4640c7137572a8ceb769d131e11065d9
ceaafa5405740a84cee6df4598de7d8dd498528fe0c46e4d122195e6b5ef4ff3
1d857eb5f19c8cce2ad19dd678a72cbb4524b5e855ea96cb639e78cac5a270fe
130763f8d4a2327b4d5d30700473bc24439101fe46687146bbc064f1031cc14e
2a34fe158dbfad0f4df3b944ae74e7581c8e1d764f49e56e467cc052d3a49f0e
08933e3b08af50ba458efb1c703092120eac1e45a586db042d3aad0083714cb1
c38ec992bdb13005814d19f7d184d1dcff9420ea7d24dfbbbae88b3581687bc1
24fce9d17930ed737d16a8aceb87fffdc24ef220a74198d66285eefc6ea02d5e
29022af8579e1ab0f0c5cd799603f3240c4da14785e9e109b1b8f010a22a32d5
7fec7a743e3abb6b387b414e166c8ff0cfcd846110b60626f6f6ef345067cf45
2ea3f215cda2da27c5ea2b788ff121a9162250170203227251bd677f2988379c
be1e183741a18d8c71991bb9c2e62d4f3b2618f32b2289dd0de5798f9a6bd2ab
bb14fa98c9d1add666bbd1e600d323e34f4ea03995296bff5c0dd4afea41a055
fd7199691789e203238b9d5e941cb5cbbde73ff6ffeb0c6e4476dbbaa055e0e4
e94240c630f2e4a7b8175a0fac4f1661b623ea25a7c61777f5501969b0f530d1
985b6e49ab052341c9f47d3bdd664a326bcf1f62a8030b37a5775315f3a1450a
6550c685df1cc45729ac9e0c5df056df169d78c77011dddfbff38faa9d7693d1
cf911194e7b75d81a6d2ba8fff8cc50a7866bd1fa62284ea709cc396ecf1cdf8
be797d1cbbb4a27e83e89282c607519d3bafb0197df3f8621ddb7c700ba41c5a
8c4a0fc127694c0acb57c84389f98b969c6a91d5c420b0ed8b6cf8f228fd89d7
b742810f7198f92c7ed14889ec8d4223b205859198ffefa07031b68504ea24e1
7053fe990e9e124222c9ba3e287ce2d71c1998c4d1476b7210cda38d68a78a5e
dd24ad5fc387ed8fa69cbe6cd1f472f6717b77ccff399ec61a5d9284c4e47f0a
d0d78f513687588bf3574985b0185963735add561032b2abbe81a9924800ff58
bfcf747b050bd5d6b9d1d4828cde8ec06677becfc03bbd20598fec5f039e6c97
edc9c923f4401b2a3cd4d622f08a14ee6049f6f217968bdb990f7f1bbf4d0ebb
004222c4f6b6df52371132843f2b7cff9d390b308438791df50fc9a9a38d47bd
045bbd5a393624f00b14397ef1d818c5417e4e4a47087aa2c9d06b205a7f3d69
19f90b44c1f4edca6b08ee34913d7203d54a78d1b99ccfd098c4300fe77bce0e
d640f2410fc5ca1f429d2ba02ee583e7b2ddc58faea0e491b05703b199e50a41
e87cd3ecc4133ea134c618c24c84cbb3813211ddf85f5b0830fe43391894574f
874ae3c7f9fc6530cc685377b1450477bb43532037aae301e7f0d758110368dd
6bcf90d152b3b4e2af46aa9809fb1e4dd4c685c3e831792980dc218554f88ad9
f0883e3fd585b9690dcb490d7e14e5c4b67f1adf3e89a4ef4e8d4419ce1bc7ce
2a41756599537f96b1ae9fa8ee368d6a6cd8a4104acbe9caa5260a46287de013
98e9f6fe99e7a0b08526c0345c0f2f3f1626a6bf0a642b11ab06462cf417b26b
1685b8500df066b5a9d770aacdf447fa8d9effd6264302154de0988e2c8e5d95
e01b1b91e26f1b56fb3763e2f1ff4336fb264ea35ed435a1a60b9900a28bfe54
ceec2d3fefdc1e1ddfc91c97e9da08f4ba3b2673613aa1283fb745ce6b8bd4a5
26444137d6770e81f9701f989db62e990cb1d7687bde388bb66d64445f1ab829
8bf05900add5fb1ef880712619d95360de1163910706016bf2d934d2470eb068
0797596b9742d4bc87f6bbfefc2c0ee0f6808d88fa113adce4993741147f369b
a3efd500ea1aec4b924bc27ccf2c94f6b394795e6bcf7f76fdd97c8e447d41a3
e0131ddb982c6f224f652311e17ecf091a4361ee839371041d425a0e86ef5074
01a9f2d2697a5b890154241ca3bb3fddce8384fc81b1bf5a129f86d604977246
5326879702865022882f6520f690974f0156bc4fbd564ac5b2a257eceb8e4445
a31acf428934d5a2cb55d500b53d965188871809db3a3fd38ae6cd65a663ce39
457d18a0832e7c5de4ae9f375fa133aea23f898edf2f369f2be2b1ff04e22e43
642dd979a72e0ef0b79bf28a5cd0c760f21d31199a53bacffbed775ade8e1528
e86ff0f90af7b44bc350a013d2ea1ce020a29cf4ecfcca429c2c57fc018214e4
a4b597ae95bea91eb00e4643ff8fa262b70501bb81e585043a7eb981ad0343b9
c6dbdfabd512d7c94f7ef50a904ae052dfba6279b717f8dd87d658eacde5358a
b67345669e16d74b7844600ee03605c82db1e3e2f3130e2bddc776ce8804d493
f37ecf7d77fc0cc27352bacc74930d23a397d1c9955b53e5a092d925bc5885a8
4fb1a3a434b8f4493a0e1443fa88e18f61c638d4246b70f47045d5174de27621
f040f74237cdb712b79eca21f5d56016989496756731dcfbad1620e24d79a433
8d874c0a3b4bd2a88407aba30c8f217007b4dcf97a3d371dbe2d3ceeea659201
eeb3d0edce403ecb774767bcb343121553068b2e3bd5746af66db386a8ce4a95
418f6cc6e958e2872b1dc6afcfcf3860649eca24c641407933fe4c434753d38a
c750ab09b2e413ad25d51b703b467437d4372acf7c1739f1f13e995875848a34
86f89ca6a7c1cc4a63d05fbab0f77bd43ad34778521f136431539bfeb1008e5f
7ac9614d8cc39e48f1ee6c0ab01bd74a8e1c54adde9f4e74335c089fadc4614e
bef9f0a5c6e00c3e4a48d9159e3a90975d26b7188dc451053d759721feae0db3
2eedeb99da41fd6223c797e680ce8b4c3781d3b34ad4403554947a2535991f3e
f71ea74e305c9f60d90c123cf5704f52467dcdaae0f25030ce19680093f705ba
8558b033acb87a5dc0143b290a043d88b166b924bc16a34e9c6b2713c24e2612
166fe75f56d9b39e6c01f43af99031dd362c2bb061cdd7040b7448029ec26b8e
75b37ac435827f9827a069fe00363b07f679d2b41caaa1689bbe06b5ebc1f501
94a7d29a88ca489cc433b7dab449050409eae308d9f5a08f415f2e552a757a34
0f4d3ac226af1faeb82a997d677e27be30778367fd37817f21073654f86aa76b
3c68034dd7583246f037e87102668d311309fb9996b5da385e2b44e7c43a1c90
479c2e41fea95560da9accebc6759e0c46e7d507349a816df53130bc5444603a
ce13ed9d70f792d89375972cd579b257ceb2434dab8f4eff1398b472f751b188
8e162ab6419e9fb8e667410e53a4b9d5f9c0783202f251270522c3a09028f21a
abd1424b1f25b3aa337a1202642a18a73f8ebe2913e0f0f0999eaf2859044b24
f1b14457a9e6496ba22c83c9be738a5e55ac4c7fdff1a3587c4f5aa5eb999a10
99b4ac5aba6ce18c24c4514916da208af5c2211393856863b4d6247ee750830c
6017c51bd2f69918fd86f3b5bfb13e8e905c8d54d61f12bcc665e80d81d44830
ca29c1e5771532c66c14a65d744c9ce9fecaa07397b9dfd32f6ba8a597763b3b
024bab536041a2dc4d2b54b7edb1dd4905e9dc5378dffb0efc7f439cf9b0934e
896d42c99fe7048c0e4314322fc5c1a56c61e8ae3fdaa283afcce94c423badaa
09338ce056c96ca0b20346d822a0f760c0e9cf4626084c51ae36d6751e39e07d
fb4d62e2945fbbf73397e7d61ed327b0e1ca92152c41fe6b0d5dfba1728526a8
7df8c4662d13a2353c9c854461599d50ce0a7781716fa484413aedc58edebd74
37893413b919ad024a07f272301a86e38ebd1bbb6e4a5b05b580411ff4963aa1
60fe4671ca312a5db70f12bd4b371105127af120f26abe416c04744bc1ef080d
dec592823001f25905220056be5104c5aba931161f55f121d54a7916500f1e87
26d627a4954a5c2f00af432a4a1c598cdd851b474670c9d1f47f3ac6719515dd
8f274f396f94130985226b60d7d7be1fc59ed309ccef3c01d8d1b8508571ebc2
0539bbdbb12f52b17a1e6b7454c7e9c4135687676e08334f140e209ae9ae6e11
feca584682de6fdea862e22aa9a0fb51861d6dca59cab5c1c8fea2d1f64a24e3
b452c8a5a97142908e6e4b549a8b6393d8c2d375fae8c00906f9c4a6158b7d24
ef11f6a701d5befc8d7ecde6afaead6fb6e0733feb553029028e9afad4963db7
2a0c9d5bc7f1d149b307d5e4c2abf7cf13ed9bda02825103fc8d11b2a9b79fd4
d10d83926a4e487c69d11e3182c70f44cd3db3a7dd94311b2bab0085200a2a1c
973c9bc25ad23c1b04782b65b8586a6396e6370d9e8a22e47f48cbc7b9df2b4a
d87b6d15d9e49ccc5d5aae6b41900b9f6c399f671e42e72d3f1a7ab893b2ccf5
2f475366ad8f96ed42d80becfa33e68c1fe90ffccbdd890b06206bf9f999c66c
10c34d958a7a131abfdc7d14f478aa1027bc3ddccca21449c7cc7f16e06d4fa9
c749835f762ed050f093f191433e9c97c7ddf9bab6ad42a2deeb3c3eded9a445
148add3e57c9b217efa42082d173cc74c4f3c5a03a24cbeb094d9178704b5992
aee00be67907ca1fcae4c0221067d2de143e189340193030bd2001b41a238600
b454680499896ed836eca02645cb495727e3c44098750e74fc588a2366d5dbba
1ad4f17ed79393a667f03918d6b1446add2fe7ebde77a93e3556d35521376960
2fb899d13dc1a60809811338e558068d344a99e2b1d5c3209aaec9210e522084
79124477e8f904d4b08453c6712385053d7f03f6107e9ebc4fe179f3e6d5cab6
d125b47abeb8db2c35f009033bda4022045ac564b2b36838715048a4ead46a4b
cae8c8f84e18ec6f88dea084f29a51fe56caa35a71ad7939647c49e36294c884
96a58260d63b042cd2310ccbfc2f4b3ad8feaf95765e808fb929e760183a3922
38e995137c40f878cf4742a2f4da8322099dcf1be4c68820c5b20bace3f41e2d
a6b178bebac045987878f70c693f74559138352564b9f7464d91f674b212642a
0f7ade55ab3bfbd545517ff6a1abc4895f91019845e2577b5d51b29c9da95eb8
96f8013f5ac6bf30582e4a87c6fef7c6e2e87dbfb9d041f3e199ac99fc92d710
4eb937e75e2da2114f316857aab8ed2a9d274983e3fb280fdcda9faa86d26cd5
1c2a5a31d86fae5e7f76b18a2c5adb8b35da06f796f9064c29a8126b23e09e1f
2a5117efea9e342bfe79d1aced09e46e6dec3e227eba3876f02d93a6a74bcf61
addc70188890ce68d4b1da4d4f3c6d1829ce6c0424fd82e762f3f1a6f97b6e66
fcf1ad9c308bdc8e619c2d5274513f00309ebeb6523b605b917aa37f95a226cf
8a1addb0421a2943edf77271480c445268450e422e97cd2899c68dd809505514
55bf7c298232bf05d6efaf28f6c9495e6252c7fd8548293d6e6147205b2d3127
8d9b1dbffbf4258262f8f0a74dd69a9e4014c18f0c42894d99529ad680f314bf
9759dc11f1bc208c53dbfc7025fce920f3eef377915486fba94191ec17fa2518
8efb167095a525094594e65f816b6bcd752c7bb04213733b7b2738a1d7251c18
bc9278be81f9f8c1121d22d0a63e82ee7b431e5b0be8308d918910740b8969b3
7082d9183eb44b475def18de1228165948b3d394d9a2d6a105ad3f7909ef0ad6
07232676ebe080f65f24d0d5ab1037ecb44b25c0f00a3349cfa13fe2d961fb85
21a47ff0ed0a9e2346f6057072d99576d1e01aba08bb9466135c62c1fa0be7fa
3c482beb0d57800183d97d9e608e62138a42973c57999e564e866dd79642b42a
229afc933db660a8357c15ff37073d50771e3691c7299392d321e34a60ea27e6
d627e166be539aef64b960aaa987d2442351009a644c19f937958807eaca5981
e6beece58f19ec935f9dcd89c26e7dd35a8d3a338827fe074bcb3dc7aaa0aa89
4195388e09107905c775716dcb55dffce839145ebfb7fb1e50182fadb404b2c1
9ce0905e8ef8281de6e3e02735902953e4c311c9dabb491d5a195c2b3766e3f4
8a7fa73ed7037059b05338f2a519779ec2e707d75c3ce9b6867e0f39c1a8b42d
55d542829367e6084dfcf45d0c1ede5c4f48fe86ad409ef0b66021a65ea8b347
2bcb9cdd1ac36718ae56fe3060406f5c81ed7cbc52edba52dc8c338abc7519c7
218e961b189fbb641273e012c8c5d3ab3bb3de97a7f085c3496ea4ac3413b9a3
88eddeb9bc6023b985a4e9ee2d327dfd125ecd146365e64b4838783541144a66
7bbf9e18466e58a9b809340f5b605393b207894f73f1ff144fd684e8f95b14dc
028e35068278e692afcdf74f335b29cde75f4b5a797745f17b9a992facb405e0
e013bf3bcea49d41273307ac1393b444fd86b35027834121a61f9da30ca6ef99
8ffa15e59653ad899d2e33af3befba1fd169c82526f69ba62c1f7a44b2ee6f9e
3138888a9757cc553192a40e5f66226901315864f4a7463de2a05b7ec8656993
012ac911fdc7898b8618b2a3b2267745b3a91b88d8f10fd74e653605ab9b96cc
43376013bf23564ffdeb4270ec29947a98cdf87c40c172a51f59cd632fa880c5
a9db59dcf17ffe36ec78f865d550f1dd21046a0d5856ed4066a8f1a0ac6638d3
27ae9c60ce3ae0184e2e3e753f95c56b15c14f5accd36e48afe4959cec147d10
2e789a7182339ce04a498ef5661984c350871ade5888248b95a64757fa5ee9ae
c4dfb8f77bcdc65fda5ffe18965799730655082385295ef5ff1dde47f0fc88bc
b36d6165b2e7ea8badc6fcacb84251bb358ee47f5f55de2dd2df9fe0e5acb7a6
5001780609e73d9913a53a4dac57271bfde18b063152964941bc5cf2e74bb078
a46470b9ab7816c8b1911883d6ff69bc8eb1889995fb7a0b6d598b8c73504cc3
efb40a182b242fbeea19b30c18fac699dcf4c12258749ab818ebbe2fca8712a2
ffc1a7ba99190ef74904adb5dbd7307c1d75563535a97ab421d8a59df138d7f4
7c9e705b0989d28106d6ee639cc87b5a99d6ecfb6f62bc2e232d6fd6b0b7fcfc
8014edfed734df2e6fd19b27a234e6125a69c8ed49977a1050bb43ac1fb355bc
9fc27c7e68d769c29bf2347ea6f6dfa65c3c16e65f45cf23f4cb9cd2dd4dbbf2
5dcf8507bb5c84eedf15bcb0ca0b24d4089bc5e3949855d138fd3dbe1b4d2cae
d2cbfbde6632df9cca3918b549f4c1d1514f715d30e373a739bfb738e7cd0fd5
94878c6b039bfda601d1db0494434c40a478cf726b988ef5d038c4b895afa7b8
99a047c1eff26a76ab315e8876446a0f9c30c159879ad09524004aa6ea35ac78
55daec1268c094269fa1a35e400f8bfa574197ec9b8708e751694ce3f973fbf5
71b61e65d3db8340fc6fbc6087ddcc99c20ce6e0156df0d9121f35e47e43eb86
31b6c90eee9274ad948d4f4a9ee6fb083d4d7759acd7a8aba413b688ea210687
1a7137712bc49a3cec41fc6b0bfc38d5655e76c69b1b1d499623347eed6ab9ef
428945c113d2c51f8cb532a4741b336e83eb2a08b356a699ee67ab1cffe377ae
1037e8159381ae7a7c946abaa9e9c7566710ec6ffe623a485cbf8c673e18b531
1a832cd5356d04fbd5f49c08531b6e66cf0e641c75a260e44579863dcc992112
0a94e49a1c7d51cac17061af3c10e798b276abf300638cb20977a4d70d82d71d
43551e2d1f107ef76620f874f96086d4e3c7daa26ccc1b2066976e2f47309fee
f8f69031118750911006f60b7ee7becae63306ee54635e46362d5c71d8024cb4
a07cca526308fba077ac7cdcb46b739b6ad64f80a19dec4067c2ef88abb71ee5
535bc7b9fc7f5333895ff14b5801e8c0dfeb0cb6a5df512b02f3a5c80d57a5ff
81c821e1a1fac181b41764e7a6aa2240ae3127377f6468643f164fea6f183c90
e2dc883e14028989e93698a07e1936d664c5afd2bf927aaa0291c4e19645c49d
7174e48158c64eff93964bfdfd70ae131f2be076b2025e2f078c97ba48678053
b60bcfbe04028939eb75bec3242c2fb6ada744567df870e9d9b8f3de1aa68c6b
195b0658d54621a728f82b3b3bcaafb163a837339d774cad9039b624272ad260
9e2f28a3b1bd3ac7b8b7e9ecdc56df9fe5cc97b6777015015633fddfdf72abec
acaea39ecb1a5f75b961c1ab8a2613005ce338afd16e85a7d17b1a702fc221e6
296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49
7eda8c31c28fde3edaa137250e095b51828a0d44eddb3a7258af78d641ae7aa4
eb9a2a23000583c744b09008afa61f7a78ba1eb559af202866fb7181b9e35286
988d7d96ff57054da296bbe4791b2ce08928ce80c8ce6acd77916d517e7921e3
039c11d74936ac9998563229f26c29fc6cc6fae0c4ab72bf35608f7ea28b38b3
27d6eabc0d630df304d621ea49cece20764ca5578ccdb0ab883734d560622bbd
90029ac6aee703eecae63ccfc9e06d175a120b28be4df44451a801e097348dd3
ee801f1c2450e9dd3a614efeb998ba9cc1b7041a34477ca7db1fa1f4a3649e5e
f819dc0693dd74a10b8de6dc2c8df9d78c03ab633765b539b946f6626175a263
8a415653357cfa40857e8c7d457e1b9943ab1492967aa4c7962da8272d0d8379
3bf6eb823e5c1c07ad608cfad5a359f801d9c21304b6124b8a5e14280ba25ca0
e48d673be26fd07ee3a1f812622f6bad6a30fe809da91919a3f2c2a0068136ab
a20fc4c0e340a77c28ba0bd33bbb16b9df62789a45ae8ad3e0273f1d88c4e002
f1812f9fc6e4d1a17440f2eb725ab115e559932043fa79aea3a826bdb68ca076
0f748ce71f874df502804e80e62e8fd00c2e73c82c0f353e0562f45a590971b8
d0f8fbefa2d5ff462dee986284bf8a4ba3f9b766f1cdba4d4ce89ce0e5694b93
082078f4942318a2ba65b716bc5c714bbfb225c4b4a9b901384678f4444a5a38
3b4d17abffa547ef9071ba4dcf52c88bf3cdb4a79d9c377f23ffe8111a3d24dc
a29c119ef8a50b07937a1db158a87ef7df872704a5c997848d19b745132be8b2
ad4ffe49c851e0f6454aa811848c2ba1e2fac09de5c002a6325da1232d7c1883
2b47cb7dfe9e402aae81d561861450945244ac6cfa509e367bfa73b717fbc577
496b9afb37f56200fb92d5e35ed2f1d3e5f4914aab1f5297eeb8eb178cef5e49
f327bd0659e10a2ae8476b9ecf77301d600c833ad3398d13f79fbc97b47464c2
8fe921b33dc814f2df7bdf14e70618ccd605078c5e214e8d1993fd7e0c1c325c
a4d2b1f6b5d40b9273ac30929a8a86d37fd6305e425b4fdd981cb6b2a8e9f874
0c597e295d02e000e7ee22f6a71f67dd78bf523f943f96c07a3d6623924ce450
f0820852f75847d55099ba2dfa972db6dcd3b7f670e83385008f1761ba9d6ce7
da3f58db17494cbd824d86f658b996901a8329cccd56922d89e375e6d5c175ab
07530bfd2818095a205c26bda43ad17ac762cf65c8a5a00eca2e7053616b3d20
c0cb68a684503f145eb6c5393cba1d220c54c5bef288f93ea3813b5a1e80bc01
f4413e558b4a3628bdb62c2addcefab5803c46197670d78618933dc09719a41a
c115f409f6170fff1c584783e6a5ba5b06c71ac59719b94e12843e1085a6f690
f76524cd300ca84aba5c909ae1d33b5aaa42430758acb36f8ac460d7f656f1b2
79846184897ed9437c15a2d21e2da6d9442bc57a267597f0720a6aabd87df82e
194d989e2e42674b1e2aaa172aeaea94de7e3621925925d9a3551517aab8c1a9
16d7ee0780450457cc6aaa7321b57264df2d2c6e7df8c014b1e93060300e66d2
75dfce3063d7895b77a4269dac35c78ee058eefadbcace3dc9eda325c25a9cde
3fd20d118217f733cf087a26050472fe4900c9e76bc79d695040fa71fb6488d2
8d94c9244311ba4dd97d6a208584c0138c51be624bf149d871e2ccb319c069e6
a6982bc6898a82fec123f170bc5d9cc28772dba6a31d17d70079ee80f307fa9f
bc916075af08babba3d12e8bee5ce166e709a54e2313e3690beffd3836c7d057
0ed83ace2d9b64a554b0c44a52187e529d13b313695201c14aedb72c8db0a389
588111223ee4db45e34de0543e686806b0aaf7af3d0beb54270870129160aaa6
c26d04e92cd51a7c9d205ad825848690ebfd8373c8d528997eecdf4789c6b246
48599c76577cd282de34af176544180e74000aa8e68d8b1be0f62f8c2a049772
bcbdd065d720ca9872227814c083de2ca85c9430eb6bc574be9d694ec8833d84
f4c24403de26cee4bca1a14ea87ec2f23fdc5b757192a050611360aa94d76dfe
e28a3d130ceaff29f0ef62cb54439afc838b173b7c75ece12dcbe722a95e79d5
1dd7a34468c47a5a0405da54e3a4dea0f8e14de22a648d11680e2764ac4e289b
8d81c2ff8defc77cff651111325aa451cfc497089aece3e2f2641630b8634522
13db4ac317037bbba4e19b3bd47a10769c1912d7c12ff40f141b808726f7425c
b8596355dbaf81499a5024426e52a2b42f2b9a7c848c2eb7a7439a67e2e2785e
f5ae29970a3cd5706ecd0377611195f9b13c342061bc89f2f952cf8a31b3274a
49f16d8b1b6743d698acf59ca9d7ead32529b54276111af9acb48ec2e795db5e
838aae995c59203eeea504fc05108a95b74906449a703981fd03a184f79d230d
a6a90152f529262dbb92f2ea4cef8f762c2b321774953aece6ee44d8016aab75
532196b3c1984dda2c6391adaf574dc5eeb22ee9bcc9522eed57944fcddc54f3
4d2e681916df3d93b4532947209378f9c277e156bd1ac84cc10e4599511dc9da
5121495bc61d820a840c8b26cb51bffa76fbd2ccd6572a0322a1c17fe87e568b
b20a5f5c04b498386dd506ddb415a65bc28d693c6770ce9c2b70168e77182e5e
49a6441427b7cbee8124c2559dffd68852dc8f70ca45ad2ab06e74867c1a7e6d
2cf8aec3a98d5c8ff53f70b110884cc9bc3b4f1f906d0b6b02d263cde6738198
21ac592d396ea13d7fe4ae03b7f5c25afbc35eb361b70c1fa951297e368fc3fd
1fd5ff0fa2e43f906c2d561106a09dcaed72686a7e38fded41b0a01dd576d072
de775784b8ba2be26ad0ed13f8978a1ad22840eb39ba34f3500a77d1a845e3e3
296d94730504ecfce76bf3f1f9e3f82c76e4d3e2f6df544a9c2c0dd277c00006
60868b5417a1248f097566eb8fa34d4407e2edf8d4ceff4fbb250c034df23cb6
17ab665697aab6b089dbd8762d335bc7cb211c63d21b0d2e04517acdce27fd25
1b6b32674ff758c4f25426a291027267178363240aedd3be8331b04e474d8678
1f6d6e285d3f876fc286ac7bd96c6ad770be96ba341d06b320ecc9964e1561e0
b3c7f2668f0d67083149950a7bbeedac543ea049f751940aec3487f3c542df95
77466a98b313f37dccb9828fb7a178e179e37c3beee6840d145d597ead8a003a
d1e77ee6f3a10fcd8790d8cbaea1493fde517f525f9e1c5a9295d676ee91e739
e9d5a06a703830d389d39bc1c46c9c2a4601fe02dc192065b5f9ac23da67a6e2
9dce1e542f2fecc9159996175f06f84a2f1df2b2e781c37ae5dd935fd0df7d58
ff5c8a4d253f2f53c162b043f0a28bf8bec7170e88669a40b9c7352e7081b4e0
25267d427653c7239c4b7c30eef866540c0aaa1872bf08c1564f68d8209c95ea
622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594
26e7be20727879ceebb301228950f01a9efc0d706e78ce54a90fc8256329b243
22ce2da43d7ea9b5dfdb88e5baeff56353b1c75f96ea9e0b2a60aa3fd481aff9
cce73b8a41a52a6314fa3241cb98605807757bf61c138a40bfb7186f38e723c0
04dc89caf62f0e10f6bcb9541b2234feacb88b44178c76b8624792fde164a36b
08181c1fbf8399bb180ca606a2732f269131fb4786d6327f065506bba46a939c
b9c71d925665a06217bcefd89baf3a79c5802f5669d2d36bfac70982d858da41
c9ff2877b3eda8f7dc95d4b44448c8d862d82f0ca1f319792ffd8cc022abacab
ef2d21e9537be48cde6cde231dd05cda62db14ab8db6db0c63cdb3f87736cef3
8086e33dcdcd1f7b10dcf77faa93e12bffb2a6a1a2d106b6edd68c8f0ed33d23
1d8185290778fab430dfc52e66d3ae2aa5392c54e986f1a346fa74c48be3365c
f1ba4fcf13aad38cec907700da6c8e25eada2d4fbcf08cc4cd1fd60d6cd5339d
9ca3a440cc61e99d4f88e5853abb4edb07f1f1a4ad0bf0ff71d42ffb99a4f4d8
b279db26265a2617563d91dd35b6421abde700b208d8b9879c5b68b9ab050160
e1e7965229b748644b50ff16da5cdd141cdf6d9e641a0f23d0e6fbd73635c2c0
8a1a4d27f6124c7cf2825ce0fcd2183475f1074b9b8d286a2cd9db71c6b8a9f4
b0633a2e9b52fbbf7201e73d6649dbfd92510382f034c04c30350e0899fbdfcd
438ff9339e9f9596d8c601705c0f2aa599ffe8bffeb43b2f9413cf2fef4d3578
c6bcd97d346be533aa00d91518c2d7a457108e540ccbca635634ba96006dff44
0522f8957a64412235cb1441c88cded0d18459f15419e81edc5840be7c0d95ff
fda9d0b232a2a9fddbd7ad3b6620404fe18b7c40c0617a4edf7cd54b167bd5d6
9b8f7f70cfae867ef0522542f2f8d6c87f3ff993f7c285ff3e975562271c315f
75e5c7a018bde077c7e5e88de60c89fec7e80af43ad00ee3ba85229ea2fa0271
136502039f65904829a341342ca61931a04cabb894fca610313ed9faec5fd39d
98e739bc26f52c535f97a95d371a3fdced763f9da24fda32334d749e9202e420
189a4dc88c104aca956ae5fcadf5297cd7185166d26a9c9633488052a44ef998
7401e2777558cf702546160105474de6b2f9f535236a10eff3e584c9c9d2b26e
5afd4019497d495f62eb21af2419d6e4b187fb7f2eb84da71737573a2fbcc54f

Epoch 2 Payloads by Document SHA256 - All Times UTC #### (Newest on top)

Creation Time	2019:09:27 15:22:00 (Attachment Only - Docx based with embedded JSE - Product Notice)
SHA256
3a2b4455ec4be52eb82a14f69f30743613afc29053769fba56ed210217053edb
1707b1cfc5f69c50142131689b30a0cae5b2c8a19cf385efbfb3eb60d2f08065
6e45cd5b3b199c6827264ed2503c617ba046962f1561982a551df52fb96c9c1c
56d542098dc735a2f8831a01c7f4bfde0c326ce434eac37e3f354bb376f5b8f9
e202c632c950b1ff800a5e438a0d51e08103ed5a73b1b5ca9eac6d09222a37a6
f781ea79ff0e03297c5c6fd936a161b96dd7ec1229ccbc8985a638519384cb0c

https://doubledeescatering.net/wp-admin/xighlFze/
https://amenaacademy.com.ng/wp-admin/51fi_omuwlc3o76-057409/
https://wamisionariwakatoliki.or.tz/wp-content/ap03t0sh_l35ujf-132986437/
https://traingrad.com.mx/wp-admin/zKnHXPIiR/
http://www.linuxproc.top/wp-content/wx3i_5lwxkb76-2791760/


Creation Time	2019:09:27 12:25:00	(Attachment Only - Doc based - Product Notice)
SHA256
75245548a0f0e7ceac4e10ab81fbfaddc91bbb4842d036d313ee2203f25bbb5f

https://apenzel.com/wp-content/vk26ywq0d_quk080gy-38/
https://cdabd.org/cgi-bin/cypMhxQH/
https://mcqsbunch.com/wp-admin/HgFRchEqgr/
https://squarepickle.com/wp-content/dNcUgQOpE/
https://cartswell.com/vision/mmIXUDZenc/


Creation Time	2019:09:27 07:27:00	(Attachment Only - Doc based - Product Notice)
SHA256
af4907e765e2156409aa5631c18111269bc4bfcfa27b9de4a2ebeda075eb463c
9c51dd8d4d499914c35d20b1951d779a72916b4527ea097f86bf7672859f1e96
9e6a410cc61f7be5c5396b3e3896aed786b8043a0f7b5326573e2bdc24999dbf
bd4a07a231eb4c8c9db95c05fbddc438325308a7deb1f2b956b4f41f58341a68
1c4d3cd77c8d01ecf141c6aca8342545b8818459c746970db7568d72b8b2986d
ac68bddc9467fc2e9d7417ec83075c7a56df9ffcec3f61595fbd6b3e8c22970c
67d70fbd5e975bb6199253887d39f265df20d7f9e2461ac1a9bc97a1a9e236a7
979fe9474e0369e1b5dd26a9981f3add1fa592bb752239391ff83ae37f950f15
bc977a58ac1935ac1bace6f08985d67f66072e075b1fc199440a300f16d79d85

http://siwanaloaded.com/wp-content/woRGfyvdNm/
http://solocorba.com/wp-content/nt9mkg1ox_f71fh-971704144/
http://cms.namfai-hk.com/fvrky/fsSwBVAf/
http://www.rudboyscrew.com/wp-admin/3nbrwa_4s6ehs-92/
http://web1ngay.com/viethan/wp-content/uploads/q3kqsizsud_fojv0iq-7570766/


Creation Time	2019:09:26 19:46:00 (Attachment Only - Docx based with embedded JSE - Product Notice)
SHA256
c0695985c8c431097b15d4d9276721c9810ffc8d6204feacc7b8b3c23aa5a731
ac6ae597ee585fe8c47af74751418f3ab937fbf51e0298412a1f3aca3e43b416

https://dian.199530.com/gem52w/hKbYXfqiB/
http://www.pics4game.com/wp-includes/jxy9_21dr89iu0f-6967550093/
http://www.ns8080.com/wp-content/fncgo3g8r_gb7huoh-11321/
http://www.jeremyferreira.com/wp-admin/z8t6_bku6kzxj0i-08611/
http://www.fbcgsarl.com/nofij3ksa/ce5pl_udmyp48qi-6369991/

SHA256s for Epoch 2 Payload EXEs seen on 09/27/19 #### (Newest on top)

23efe4dc0cce5acfd3efe07dcc295f39c41bcb2a74a6762a8441774282dae678
6032a233efde43b94048f3defa46f951a21668177147e5cc3266980b9d588547
bd07f07801d616b9c483958118073d0c65da84e00c7f44fa40d1b9acf86b2602
b232dd250f71b95be8625f0fbd291d619e40bbca4dd08008f81abe2706b74e23
0d25169bfac225c1c9a861a27e018b7483d1da48c93682e10c0bba243fd775d4
035e57c58a560144e71f54dd5f526e5f0885c85acf7eaea17d5cfe311d082e89
748baabf32108233c4895306a253ef97d630454f81ac99de7ef03035d5e9d228
488d0d1bbba1690e689b9e88b5e6129e1dace788f562dabc6be1dc18a9a3e5ba
9d8e79b8dd5cfaa6614810e66519490d0fe6c820211a55cba3750b0f3acf4773
119813a9e2709ef2a036d46568972e358b3615a134dd5e301efc7634db4ffe18
a3d688544dd95c67f601451fe0869a19f4b30bddf47047d96aafde460a8581ea
ade855d17d0618643265f4160f7a3c4f363b3352b610872bfe9043be9ca8a2b6
4107328c4099d8a5c2904f758404c1cf8298bc7fd65d7f5643135a4e84b63a4f
a1ce4452160f57477ecdaac0e6aafa11e167366527fd33f31e71da49bee93686
205c7bc5c88ab0207bd81c6a4786de54fe72ef7d872a4a441f17893f4b72ecec
af3c160759fc91b813efc02fbab593350ba3034b82f9586dbe131b454a59d68f
af714f0dc0deee1eb9a4e83452ed32c382d2d308643aaeda04937361be636aee
915bc3c94bdf1ccb30639316f2098ad1183f83410193f9713be40ba90aa23322
98edf0117f23f66bbe7d1893850f1e71ead92559510042a557f64c02a25d8948
df256322b9c254b3da10c6f32baf8144cc3c253893298c1ed45945e26cd93769
9fb0f7ca6377d03b96dcf1c7ae54a78387f17c0736232f4499bfee1cb42464f4
f133bcc93325bee73b2df63fcc983598a47e20f83bf4cb22a410de91079cb3f9
b8c6ad54c8f3e7feb9e1b7654bdebe21ed09546c75e8a0476895f275c69ddb0c
4fb3bbf705687f68ec1b6b883d238c6eb23b85f45f36227f9bf5c23c0ec24af1
4df5f176c20e097775065630ed3da37dfeb5b9861a77fe2f26d2a740965ec5be
7fedc5b48448002ffb0b9bc006e8ea0de85e372c3c5e45e4388f883906aaf612
fce5c9bbcc92322bafca6dbc4b3e771d49c31c19ae98f561d2f9a74e4d606a47
fdd667d0ce74f3e400f093383afd2fe4b0e881ef23f9d27feb0302f23b5c08fc
83e8b21256f910b94586ddd282b5410671191ccda1d8f33f95731e4501d8b5f3
b7f9a0e50a928938c34aefe6351c12ad897b6a3ea619327fe5826b296e711255
704c1e7ea11f8cda170a20b3553c0754e20a02bb0894d88c76b7d60a88d323f1
dca5adc74b0b0e2f338929885b30beb1dcdbcce9df08f926e7e8e538cdbf1741
86147cb9a6652c300be320789bb0214883cf21dd8538ec4c3d35dddef58b310e
f556829c0c2e0dbaceadac80d4d42fe58617fff4833c29bd36552d119122675a
ffbbebfa786686b548cf7f36313b49936812ec7cffd7303a05209e14617f9ca8
3667536d461d6c55c4d706192134063a6060a1dfd36f4f342f072ded15818a47
d9d451f73419470d399c8795240ffda1137e239d27e987f508901d3a6d0b4cf7
301fa8a604e02098dcc02f2832e2ae3345e37cccbedab889df453d417c97f00d
ea72a6a381322c3bc74a595a77796d794fcedd1e9b3a3d4b4da20f19943e127e
d90af84b264bf85fd48b591da3cce6d57a947e4996043db28fc77c48012cfac7
6e6d3abb25d5d5f9eac670fb2f659fbafacca922c386ac1224d14954af876ccc
e2fe115e16699bb9c01bcdac6d21c7663b27ecfd37edcbd807b0994db56774a5
d45ff32a68383ccf06f382e82fb56ec024b860d71f6ccabd3a2b055f4767d1e1
0aa93c78557446014450f0d962ad2d4a655495b2ddf7eeb7a2788c3e154783ed
5f0eba296bf26606776e3c5ec79425c80e603d158a238a0b482e24fd8b5037bd
116c369448a415574e4157e2c061c9d3a3334ffba036655ad93471abc6b694df
f9a5a968c1fe2e908f70106eabb9a58c2678b8cc1c376a36418a7c859f6900fb
323fb2a5dcee58c783dfb740432ddf71d4b88cfe1879bc69cd1342b529ce7c30
e8f4486f5580a9d826e5a7d67473900aa52492b66074e8773f0572f0f57c7235
d293be67147a0ecec2d17029aa0a1239c528d50b9cc6c6c9a62c3bf2c93557e7
675c8aa7b6e150c5bce36d2573f6e0343c91df2771e37000b2b057bf6e3fdb7a
c273039fc9b93daa660082eaea2491f13fff95ba244fc31c8bccae2f68ed689c
ff45c6b5b7897b2e3e5d620adf6fdfaf0da0074970982ab426c02102333d2b79
a59b100f98afd36a11f3216a9097a1dc05f15afcaed050890681b906f15e0cfb
c205a36b68812ac6890f7616fd45b1c31127456c5082832c86f5f5e63cbadbb3
9433fe00378ef0a5b38baf8ad4b535f76bb05495f8a11c3e1b31c937d922de9f
9f9fcacbec8cac54af56fa169a1559f3c01b830c9145c53424edb8fefd08d971
8d754e7c36a36029d6018b84768ce6caf5c94e33f712940ad1fc1b0d80d23156
95fac585588d09debc22c8493a42ee22c8f28af0eb8b003c4c5935a04aba12fe
78f4b8a9d493fbd02f1d880f3c9932ec1224751feec4addd0b15c13d4c5cfe02
27534eb4a2b5c773e1dd67c774eb60ea9045d9371ad8989667233ca85e821304
49a68b7c65ad8c90105b9326c6da0f161ee199c220adf1da2b536e0ea72b223d
5d118e830a3ba26b69ea4cf0ab75d6599c2e89ece094cbb48c1b19771064633a
de36f783a6086d89588491ad4766909ac2e9f4d760894a414de2015eeef9f6be
e5aaaf7a80bc1767701d87046a59ce67d1ce747203dae0782ffde3ee4a08a84b
ed94d1bd191a2a83245b5134f0ef33d90620db275276da4879aca9fdeb382194
786f1da19bd468b248635ff81cd561b605ebb9efb1856dda646dcab3e20e433a
ea960f284ce34c0c57e8e79a6cefadcfccdf83ceeeed379d3afd72061eb345dd
4dbe0bc4eb9062f79533c802fe2c1b5fd0f79213835a860ebfb7542c20711d98
0dd266915ea342edf40c4c182ea588abd2e024bf137d6f97987b861e5dd45342
4d7a2348f3a084ff0089ed621f9cab3a573a74dfa42fd94137e0827b39f41d89
2d203c43000497a8a3837047d0edb4b7a12060e7afc04b9d4992efa0a23001a3
35764df3788d4ba280da29d7a43c66ee42f79a9a7f1ee22ef567f7bcc6701ed8
6d6802efc006390abb1e763d442c50108c83e7042c52de1f88b72f198e35fa02
6c172cce08a0cbfe73c4e2ccdc63b30f363bdfabae7b7437ed2c0ea6ee6c32b9
a5cbb7271b6537d2875e34e72fd997898e6eb3712aa845b9b1474b36dd84243b
4c6bcd51d13d1a9c2ae3bff6d8495a9efd021e18d5c821b56049e3354c3671d1
d5f978adb747538f5d588bf98e057e8421f3ac1eb0e546675186d97e47eeb77b
cd223b728b31f0393f88224c4ffea1c446c817908d15bf8d34f1022aa7157fed
8086f16bbda9844df3b03cfdce558b029b8974ca086f2fd9c28770406d6bc39f
655290504233594aabc56caee84bb4f58ace8b9eb74f2574f69edba0837e2d6c
c1ab9b305f707c32ac2548674f15ad6a259946682dd81018a6f88febe1f5cd6b
595ddd8cfbf7f780295eec44678e765ccfe6b29d3a9bfa9edec4f6d4341e23a5
cbee6f6ae6266d812fa035a2249c71c0539e0e5c8768c9fa467d92f492195cc4
cf9168edfca432c5cd90e607afdb88f0a3944c3c40c3b3b70713bdfcf84fa119
2edd43117016148a104e908355439f8bc849b3c36e2b4dd71c01473b3e9948ab
4144d8a4af25c6830241f689733193e5651426078e19799f940e4457ebf4241f
1922d322c884628736f5857eeb575fcd8c2344cc3f7ca41b98c65b96d9ebe470
a48d5a7ff38582c503589b3ebdd8d8bcbe67394b17c28f98c2f561c868c48def
836dae2d0925c62fec836fc09b90d55346c0ec26b3ca71afc84e61b28de47b75
d3ea0b37dc5213d4abe010a0a352dbebc20863e5edeb1661be631b89bdeb6c07
9d52b496a52bcb8ebba5ad647d9c4478c63c3964ac0432076f4436e5effb19c5
4175a0334c056ff737f6adf78ccf36a912ac366d6e06c2c2eb320966a875ff5f
328f478ccd3c95438079eb75f5cfdeb7396a1227bd30853f042ec726da4ebd1d
62dc12900aae4d12b94f7c75a9a58b8593d6c51fe9b400789ce6c3545ff36842
f89cd1f699d1923de797d8fdf815a6e0a5e2091b863d73e50f594aa399efe073
3ef2e433673e8e37a1615f98e74abb2f375f39ba220b8ef037c4d5965a455384
b95e853dac2248476ef1208051658b1f9a958f2a2f4c94bd0ad6f3abe28a2b41
84a6c6681200c182c0206dfca1f5e27723688646c12b3ba1fe3f3292193ee475
55943a86eaa65bf7b44fe38ff582a94e2e3a7a5468403af26db9c81ca48b374f
849379d30313e0fe6f57b44b425d3f7b7ccb6733dc50cc4eac7368742ac9bd72
ec5edd9b872774dc01de7adf3c9239175b4b57ea434cd9ae5df0fd0b8377bcbf
2fac2a764acc053655fd56ae61a38ab0f3b94cd12fb1161efc7e23ef68f12b3f
59079cc12692439ebb3ad7b982768be1b1fcdd7e128d3f5fc701c5fce6fb0ab2
a9dc68030deb75b8a7245db359122145b94874e30004cbd25483ff392c5fa3db
da2ea2f9a6a16c420164a80fccbe0b7c4a5921a126e3d45bdeb242d5b7ba0294
c11c96533ced4fc8f094302bdc1bb4b9dfc58336e8356953c447804a2d2a73bf
7fe4a4d5e26251844af0c64648d321b38062aa18ecea41f7cd5e3e1ae4f37697
ffd87e6573b64ca439bbb139f590618596e04461e9f26ae3931ec983179569b3
5bff8388dfb18028a2dc86d1ffc5bd4c847322953300ccc1f0507b274c4e044d
0901ed945f6c5321d22a6a6ad3344cb9c407f14da85e56f2ad6a0cc0c539a6b0
dcd90769337dab80f60ccddf9e9ac0038e76bf3f928546583aa2d1c94739ff26
9721c413e1aed69553788bf3029c1893aaf6222eabd52cc4cd312d6bc87e5952
d953512fb9f8784e178b1f2fc1be81b7b38ffd1c3ac0d7fccd1e6cf2d1e78a38
201437955ac7b991ed24e4671649487fc1023c56799294315a1511e44790bbbd
6ee6f9d4bdd5c346c85e2850bf1b151992fe30550fe77b5b5a7a625e1853726f
9e3a219f97ff5d955d2b280b07e27d85f4436515939ace7f80b30d1115fb55db
b30c8290496c97c1eb91dcf087ba3f0efa8b0d4f9f0777f47e77adec77698802
b3f186ee0da7f2f938e64e37f766b2fd5e669c7c505bfba5e0c86ff99c75aebf
fc14bacae36137ccb3f1f8ead4911c35c55b2a0ba608a577b4a1d180740d8b27
81b8f8d1de2ef7932aa78732133d169546ba68eb7a79df1030322f85870a832d
4bca077f49b8bdf5e7a398eaeecfa01e7a648f6ee745e4a5e14ef990dc01318f
256e3f8dcf149dc18affa6e8ec60391d8977287fe9bee4fbfb16c1f57e60d9c0
08673dac9c8e365edba654608fceee2126b7c7f126574f162812a6a6d132bf68
080ded52e3c4ea0352583d5f77b40645dec49b146cca5092de9588df371a3876
c4242b6a21b30922335accd1edc0c300804a4062d6542783503c7eae7bb1f2f1
f76446d76160b1158ab5ec749667885825497cc45d080895b1d5a973fae89292
57ade62949bef78b613fa1ac12013387a97ad1239c1ff55375311ba7c4cbf5f4
165584e9138fdc015fa86649f38fcc3a47485d21c21b89d5505b394f64b6a538
fc79c9a22d879821611beadfd360c2cb8e819b37be9d4ae109f172a9046970d1
46968953dee4f5e52c06fc374955a7eb1834ae1819a6f190f67fd690aa658744
28132a2f452cf64ca2286d7b0a9d147a8ea832de325a7d395dd30ab5cf5b0071
8bce041dfb3914a0a73e109bb0a35cd77efe3a5116ca4a358370e5f7326d2e9a
2107a0c37e416ea1728b4200ad15e15838b50de23969383925ab5e82a8bbfc98
f0c121cde42b207e701b34a99648a572b614c853d4d363d852bfd212e4b66e8f
e9e7b6f3111b2e276d807e62477167e5768dd4aaf7a5e6f55ebe999f7e9a7524
d50b79e0f72ae1a821d18b469223824dec9f233387645a85db3f7ff42d5d4fad
614756611306e450735e8563f8d13c4d587d9440a9dee5aab966185965c09346
73892ea8e999aa9a592f1592a87c32b4d89c64873b9978328351bb51361fd7d6
1570bebbbe2e69334544c8f74fe44590bef2dc8dbc1d01e57101b56bf5fa11af
207f8a7264007a4bafbd2029154958a107fa9361e4f66b367dae8e5358b162ab
01e5c3ca9108f1475f1f133169810c8181a75fe15c3b333edc712dd28ca2b2bd
6849a061332245988f45c0419a5ed71429d65c069ec396d000f0f2b469077c1f
510d79adfdc6f70e54a584676c5d6a98dc088625e341d156d59bff2dacaba738
86dd11c14b70e966061556040a20cdda32fdc1680e0ef579d4c8f653b5d56d64
bf02c5d4ca515dc6971028beaa2f70564e2fd05df9065a2f0eb238610d52fafb
40496bfbba1a3e00cbc7d08091110769d03736cb64b5403e2b1dcd284b121b0f
339448ee60058019d1c74bc8098a8382ae13a9089a80c2059536466a3d59cc15
7563c31dcbcdd1d2dc5800c3582e53805f9b2cb70c3f9cb6a85afb7b74cb4d9e
604e5df193e4b6ec14a2462c9c63cae28997b486ac71e513a7c451a192dab92c
9a0f919c5e9245b9a121ab3be1c01332bd64014922d8590391c110dac861e318
f4522dd3f93ce30b5b5d41f2d51f10eaa1468c52b33d3c475b8053fdcc6086cb
8153674a47566acad9793dcc331590d2e22434df2859f2785c222dab0320c956
7fb4f06b3ee9c5b36b220c93e919733d5f5ae8b44743a5bd7e88517486d85de4
8012163ab8dc322435ca2d415af25c08377509b5e80be9548e73a037139859ce
0174e91bfcb14b21c2468fc99e3c3a3ef74591f1d870dabcd2b684c60c5b3dfc
810cfd54bbcac9f1bcd4d9e6f5e0d006e01c1ebf4745e93cf3a1ca932402ec57
84319d1826bb9dec0812462a908b37f84344ebfbb8001e492e4c7a7ff3c2101d
b474c520f9e5a919d76f38c2fa4d6cfe0373083e9ecf0bb2e399ec0cbeee60d9
0df65695bf8c2cf825a0c4a54d4c83db166ea1679e81cfbb62cd944cd4d52370
b17599037ff559b2c48cac0b0ebc090bac96ec40c970d76548fca6d1e6232aee
9df647ee5720e3becc0df51b0d2d397dec9333bb7c0e6d39aee33e2d115b397c
82e1e721f08e4aca02728541b1341effb6c91744eeaedc307e6120f68889d91e
52c500d3466401b851da2f8d5933ceb3fedbd689371c2635d440df999f90ab21
4dba2f0007f80d4d7440363bb4791cfa9187cc02cdabb7a05ddd4e16d8f94cd9
5153ffec07c711fc1cf0f425fd1df96feb31425387b6bb29a9a99268983a0890
54f5722b4dbbd4a807b34e569075cb29d1ff6357afdcfb31dda55b1c1aa272a2
17d7505cd28d44585d811740ac7842274ed5aa9bf31952e0a20f1b932324e2ef
9de6d05e3cf99c4c2b4d064bd0f5ebed365e806e4338daa92cea3b9c63c5983f
68cdc46bf15965d7d590f8e7e519fea5b10dfd449a06064dac8ddf88c4fc1650
05ac83cb919aa89baa5282721018435d4a6240913485d59b45a737351ee104e4
3106582becfaf92480408aa752314610f1d7670fb05d73596a3a43cb86f2d40f
ea6dae7ad6e6f5b441ed79dbd01054db59b19717596dcacc72774bc93602a0be
0483960bdbd07e7bfbfc8e46a1d4b1b9be4578f239c74775ed57fc36da0257e0
6d84f4b1b749cce930eab73a1fc20d174510066317f1c3bbca3016caf84373fa
b5e1d2ceee893b38e76dd628242c51e2b875818b676e2be8def30418491a46b8
b4b62d3d74e432f118dac28658f04ce906590f50dc3f82fe93ba1f6f37771664
55b514a0e9e805b20bb1d5c31efd0a0b8d473a0d7199f55d383ba6465fab4794
5ce74f3cfa1714d8fa736884dfe97fc6e8b4443ec39eeb8736879e50711823a7
db476afa9fc2ce5f76c2bfde13183edce86be76e661b5a0a077a10f72517636e
22b85c3800b8d4c0d92b84d12ef9e0430237221383679d90cb95e0dd2ccf6063
d8b57854510bb53b8aa6983546b2ed66a0eb39c39d4783bad193b58e611ecb36
36f8b37a434dda851da5473fbf68f6ac98204d1b692542dbecc48114e1633189
f911112f9a32181969405d8fa3fbdb46998760e84ca77f9ab86ea5e20d79aa01
d1bd5c08d8cf95d9b1b261a92c2f7fe514015d3f5b8111f377750cd2fca6fd75
11e8ee1b7e58d72c6f3d5826fc52a59429e731e3717ca1ee2aa858f0770dd072
7e106b7a48a7fd9b7f67262bae123642157e4a89217659600c16ebc13a9e033a
2db02c597586884c286aac5934f6a8db403d4d639796f45fdd20e50ec053e4dc
20faa083db6e5097fae1b17cdf97b406edbd91546d835f0e1250816382505332
29342476c3813509c7f3247a28ffefb372756b19c75b846bfd86a861b6fba03e
b0c09142a5b57f3889a3cbc5e29edb62ea2a725eaf60b432a2cb52a85d0f3cd7
f03f89b99771e189028de8e93010c3ed3cad7ff51c48bd19c0d5589e885bf065
6e466e887250acc0aecab728501185c2be891ac46a6483abe4d494e5e6004cee
8e1142c4342117c40cfa02edf761188af3f7703fb48a1278b16cbb5bedbb50c0
22b2acf0853ac70bf58904e4245450f1159ba680d2db8033556cbee98b9a80d6
1415768cad4c3f3829b0a83f2ed9ca49b8ecfaeeca398df3a294f20f5b1d6172
c404a4e64038c10f90884ab4942e6843326f090366134c4674cb93c882a374db
3082642a4c863ded9c4e3cd13d38aae9d64d1a1adadfa868adfd2c711816d0d6
7328e431bd025487b2c5f1fbbbe880dbe05f29df9db9ab89268713cf99756ed4
8ba93500c9b2c9262ce0a5ef1d792a2d5d2539a8d2457f8fb319438de8bd4c34
d293e0539860f0d9e377e240b315c3f6614978416d4fde34b0012d49526a6a9e
29ee446f3cc6da94a9c20bd793b7e7d618d037c47bcc60e649c994c24288720f
b162324467a9ef977faba6d3d79fe0160996e6199f1c291fe9f1ce3d91f1fa69
b3987ea35907d001ac675f7a91118f6b08181dcca837bc3ee4561171e8aa27a4
4a8b6a49cdb315464ac9ee129e428c34aad90a90970f4aafb871e28c9b7b66b5
72a9173d00a5a0998773012ec28e2da51b98de07e106ea0c2550a072b6525caa
23dfc9b6ad7d5e2589b7aef7e1d0f516b8cc8c2f0a2211b25065473d5b300d53
29ba4f5bf23218d4277d805c3926b06441d8f3574aab4acc62f0a1d523f3504d
f9e177932f17d134aa77422074a85c76acdb84b3d87228ed753528e93334577b
5f4adf85975f2b14383c5b7fc705cad7a642f099b2a1fc7332b3bb9a9c23a95a
847784bc79c01ec252a65987c56e54c253b5b9718f294ef58c396a1aa1638af4
81ca495655590321ae041c4924a278467ba8d21939225d95d5258f36a8a4a27f
a777b825ac172fa1ce8430d3f3e968288eb5297ee0f89e4e5253a0a6c7fd85c2
288fe48958a3d9559578fb793096100a166bc03d6a1a7f8a34e82ca9acc9903d
a2e0ca9d7fe296c2f00dafa92a49c7c95566f7803237fbd5ee8601c0e7e30fd8
b8bf901fe5b4e303e6bb41c9a64a85ef66bca01a6b5dd0db61c89b8284886ce5
badfcea30247e0828154e5c84c45efcb9be131cd5f89de6f9c7de648d6e8c027
927eec82b6f357292c43d26c30d379fd7d99288b5a1d9ea381122f78bd365fca
ce72052fa0e639df18334dec5d9f289e83cc086c0a041c1998d9f3dfac161123
9edb18ddbec3330dc6c62c074a5e3396eb15c290f93234a57b6eefcf2e767aa7
aa1b84eb6e8517f2941a7e1671234faafa54179a4342a634232f0bd3f3480daf
82369731aa1a5300da3b2006472ec54069be1c505b731404ef4943401647d2fb
17b3598e74724d966139bf44e7fd1b40a711e7dadfc914cecd655dc60c879c3f
a06ae66981e86fb2ac12c16a9b36592e78fdacf2535a33e1e8573b79c516bedc
4cc876a8eba38f69b4b275212e1b78704607f99c82c69504e86790c0192cc05d
e37889786a64256453b72dc253d9ac34df0d86f8039cb7ad573c947f070949f0
bd7c554295ecfc44b7d3492be7e5f9ce70fc959b2a21de594654734954b9d43c
702b36ad5872192353f2b5e451c3d42b633344201d4193e5d3b66f59992d10dc
75f6f3b31742a0f7d84018a6e8617d9bb21d6e31483aae502308994343df3ed0
a2aa49762ad031464bd4758780649fd1cdd035802543ac9dec8a7e9295608721
dea1da9833090b57a9ed68d1db0b28dea9f16b3712dca1d95bf74f3988b508e0
a08db9bb160ca7e071cfe58598b22218a245f79017cf384eafa0e17a25919250
f7d5e14d6a8831fa65c217e54f5ddc77c12b6f1eebc0174eefbc8258f6dfd8a4
34ca6499e5acb18894a37875349dc3b69fce7838ee9b8564cf408c92e15af4f3
719c2563f12621029ed2b57002ecd07074a63124842405d81ed724469b36e042
fbd7b97f11b0109811c4e0ab280c5d348149c09c0855df5749c2aaabee8bd7d0
f97a59dd91d1660bec8a677ea149cd2d68ecf80cdad5e40c13ae064157243bfa
d275eb2e80124b05e2f1cf4345c8bf8d373fd97f590c72cbdf15b95809ef1eb0
5c169664ddabbe1e5f5f156e403bb1a882ca9cd502b13f3c1aa88e1c01e8b929
89fdc6e04c201b7ab0313aad28c9e9592f62ad3d29c62db66befe6d2ffe2d62b
a07fb5b7b68e3f582cfe40f0c6ec0d3858e3f79a4ff637c26d8b0f56bb173b3e
5b4e0ffc649ff5ea80712df3f396d7a6afdb3702a556376609496788b250eb2d
9f082ce52d5f6c232f5434d76ac9489f86bd019e32fb65f3cedd0c48b75fc002
c5535e70c7204e8ccebd6d07e19624a0c6ea3c12782be5fff68651f65516ac9a
35f7b49b44352877eb8f306490a223f3b1ab2a4e81d227faa943db3697f034ba
957588346bb83805babed086be9415c4bd787159c03a3462395eb6070d32b75c
5b701b9405e0b0a82c9c1ca28fa73418919252e5324bc910da344239df71af2c
e6415f4d60fb8f322a72344196c18944ae521d68eeeb7e0bce77f533782d292a
bca12128c34abc61c7a123196851673acf8222a58e6ece14645f9e7542cba59a
7ff78cd9345622ae983b07217d323fde77d28819500dc292fed766bcfde35012
e9f63a01ad6f7e027c3a44afd8760a275fac979ba072bb41546746721345c549
6c2a70652faf8958409731e42878f87de770c44f0595bf87d2fb964ed8548138
10a7a49414c76c22977e72178ea42a9d4631fe0558e3a0ba7eeba23aeb09f65e
eb27fc9ccb3567a45f4d34d53e953eac92f6927836045dc2cd644e0083d8566a
4c43f9b1f93bf2298eed9b0aaf04cc169b49d60778ac96455a32f1e963883f4f
6d82a2f684867d5ef354887ced9749f4a576b244877c5504f11c2bd6bd439f13
e1b6c51f3824fba7276aafbee206b11f35a6ec06113bcb35547d3b3857f6e301
52d5af7758ead1f8e4d55fcaf803c045f05091fd84ea9b2511e4c357f663f267
7a245281c83c832b0dfef5779f8de613e26b222d6674faaf0b30ad783087ad72
06c9c7dd3917afec71e2e1e7210aa8803c36c9bdee776370815b94f230c52480
6a14f77aa13f7795f46161b210901c3a30d65fefcacafc27745f403c530b8b7d
b8f7df93b528138c3f8b4cf404bb5efa8d083eb5b6717286a0b9d3f0e63ab2f8
8d452fd889a1f1ad096277e5465e0180643e40547f2e50515fdf6f1dd72aeed0
46933dbd2a7b38c439f93ca632f84071dd631b3838319758e2d6803c637ab968
9f1827b94a8d8c56f2f4a46c2f13a3135f8e296c5126a94209f0f3c2d83ff5cf
a07a2adae47706ce08421b7ec7495f44a3cd3502164da03b41a5d9d26304b436
26012e9c09ac5c50b3c661822e13d69de10d668c38e451ee1c6a64fa175e16b3
3a0a2f985e9766b0a5f346b48e1b4ab31584f47dad22eb9d966fc7e6dd28dc00
387a918c675b31e534fabc660d15c1b1e85ed236f3b6dd4051949747c471bad6
730c7e98299bef0807bb71b8dd5d119926f02df36d7af2db63d71e6e38d7646f
a36200cb22c02ae1305edeae68776bfa0a435d6319e87f3d1400885c114b7745
f51dc7ceda05d739d0805f7f6b29f016177d4ac601e170eca7d926243a49e609
6951c5732fc3d3437b5246f900eb2c77d5200c8262b61f7409117b5ba6e7c5f3
a9b59bdf1395f7275793421158548494d92646662939550080fe325673fa81f3
b6e154c911dc72a27bc072bea74ae77ce9f3c813fc97e0843f4a784664b95d70
d3d9f267ac7027bb17e111a775ce33a397da3c25e341b3bcaa15752a3778fdf6
05d9a2bc3cbf2413d39259ff019b7c6c074d790cc44fed55b46105c1611332d2
52aa361de36de048bf8c25c127498dbf5bd740365ae4d4878968216120e703a9
8fe4a21852a9dd91b40a48d409f0a3f5b6aa2256ffda2dcc5a91e3e22c03f16c
d1a404a8d37794907eaddcff2767b68354f65e38a8bb71ebf601fca12787ba92
8ba40de18181fc251eb5821811fdbf007e8d0a0f158800a48f188b97203491c8
e382932936528e924812e5967a25f9e0296c34edbaa62fa3e1cf0b4b37700f7a
bc9b83531016d85bb121f3b4aa58adfbc5f213c06cda7881904cfcd5c2f0f8d7
6313e5096cce4657a0a63be78a0a4c59fb8c80d4c7c037f28fbf71055c1eb636
381fe5b3c4d640baf1495ad7f3e111af78c88df250895d87979834f952953580
52f419d24bb6eaf0c73fed496a4894e7188fa638d403e1f6302e9bbb79273ee5
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c
411f6a4a7dc34eb923fa0bcf2c8341f84fb0b5b7ea1f52a01a8f0284a60a39eb
44178ddbd349b336d5b5dc4ced16bd00fb1a4b94328d4a566a39420f1eaf4544
2ee9a0e132208680a26b69f93bab71c515ff63e50cd7bf62cc8bdf9f0c88b18c
dbd4cd062c2402f3b3cf17c0ae67ae59727b68a17dcdbcc400ba6aa850c12ba3
dca7c4fe568449875a2c37c6a023f812ce6ba116344dd91414be014b247fab56

Epoch 3 Payloads by Document SHA256 - All Times UTC #### (Newest on top)

Creation Time	2019:09:27 06:35:00	(Attachment Only - Doc based - Protected View)
SHA256
24bd39ff088279d01549b67f962bf112235a8648729ebc848bef5594e2d958b5
cecee72bbea4b43406d6df12b91789cdba3fc08b142e7547286b4009f5b98fe2
d93513dc88a0c6a77a898423968ce34785af6f4550c479f4cebe3537dd210c95

http://hoghooghonline.legal/z0ctc/sxz-2owg9p-22352955/
http://vanividyalaya.edu.in/calendar/9y8esz-lpn4-01947/
http://softcodeit.mobi/wp-admin/8gvawgq-r9y0aaf-7730/
http://parrainagemalin.fr/__MACOSX/ExSRKWV/
https://e10tv.com/test/n8mg91zjhg-u3xvyy-205705655/


Creation Time	2019:09:26 19:47:00 (Attachment Only - Docx based with embedded JSE - Product Notice)
SHA256
c7bfbb6efc7dada22118ca2a99ab25bcd2f7a7152765064c076d324a3b9ea4a7
489edcf055200571bc1e9926003bbf030b21e48b4b3d220d0438d4a7698240f1

http://www.creativespad.com/wp-admin/fauvw3-tsj2-224/
http://www.zhaofanju.com/wp-admin/4brqp-ejztsg-4872921204/
http://www.rudboyscrew.com/wp-admin/bQKSliO/
http://wpmagian.com/wp-admin/4yji14msbp-r4wi-928448812/
http://cms.namfai-hk.com/fvrky/929895tzx-h4m1cga4-800476220/

SHA256s for Epoch 3 Payload EXEs seen on 09/27/19 #### (Newest on top)

7c65534896d3b90f10cc527f14272bf6dd1df126497f5098e1d0d03a0b69bfea
91a2aebe48890146233e9954acca721a1dc7f79a3b0a40345bcd2383c428339e
295ea0746951c73888bf128a1be82b56de9d463fc72a5fee966ac05bfaf43fd3
e25a86df0881031bc8c8372df7811ad90c57c5a766162ad5c67524f2d77cd4fc
f91334bc55c7c3ff2ddde07648f199ed7d81f48a3b0c7807bfb19b64e9822b88
630a36c14e907f8c18acc44f0de7855b2b5b1417d3c38d5b2109b7a2f06f8bfd
8ffceac56551d4212bf6bdeb8d73a74c414fd26a99c3b6b2c484306c548e6efe
a7d3440cffdb20dea0839d29a90940f679d36e77aaef97c8941d675170818f0c
c7cd3d00513eea5732b32e1a648b6cb37470bd8995bdb328d6e48ea0b02f90b0
5dbbd5e7bbad49d73732dcdf609b7a34ce4c361ae434c5f11868b929fa2a4b81
13dd7f009d415750b1b6461ca85dfeeb293be32f2bfff659907efa6e1dc5bce2
88c680ded81ca24d7ca38d25bfcb843bcb42e612e7a896a08574a93be8d0edb4
82da979e9a4e663b6eb87c7438bc5b89263e5bc58df157ea8e973e5399d693fa
ad110ae3d110f2666772935cc3ddade80f2a5d06f8f17c8dea48e809cad926a0
6b342884679bce82e6e3bb1dc2eb8cb2c50ded76baa7bfd044583dace2f620bb
d2a7adc7e7bd7e423ef6e04e5276f9eff699465e384d5a349a5f8451649aac82
ca121c4651db187641decc4799187e96e482934fcbe46515ac0143e603b7f7cd
9fcab40d1de0cc9e3a74c778d3fad816c481ff7a4bb5290be92ca46cc11ba1de
eb318852e95d5c5236bb4830cc6765e43f5706875b657c0c935d01a3bd177881
8fecc9cde318dc54d5dad0efe5d196f143f8e4ee484403c3313460154801876e
d26818c6d332697ffb0f8296d78fc130a2e5e8ed4f2ebc444b105663986aba1c
3ec1509084372dc9ecf345095d6f55ea54821eddba5dc52f47e387d5c004f295
e37d22692368e7b3120725aeefe41447d3b4aefa1fd09b1166c79feb23281690
2c0ebf4c1340af9c291ad7785756c1f958137d0a9d32256dd7d836628448273b
9d9b286d1c31a14060d6c1cc9442edcaa001a59ce52b5f86b090964a7c5710cf
5c721041c0d1df181d659a052d164bb067ac9006eca773f3d332c919848999a4
c7a7127f925b18073c97daf423e0b115dcd14ed807a6ac0a83e2b821b1853974
5255d76155afd910ee486cf7d00d018b332ab83e6f3bca5f7e39319dd4ea9c33
7e0e7c8d7cd3c740eb2fc4500678cb59425c7ba64bef61b58afc31e6ed5dd289
50f23be0daa87bce9e1ef192353ea5b3b3431993912a8898fbb7109d4d096714
7b6a4cbdb3089da72203844e14afc9a280adaadde752945908ee0d4efbc5edeb
64d13a6b57ed12b55a0b8a0ad715bd1d629fb7497b4271d1be35f0e5e2b1e64b
64365b3a638c285a39950813eeee6205cd37b647a717af4b10a7e5a673d40cd5
1d43543b1843bf5969193020a008bb159712b7e758500a8b9690dd85310f7b4c
4af4a0663f81909896cf53daf52e8a0f1b50f0d2fd9296367861dfa1013a8005
4e43b1c0166f1a201a39a847851c13f92b914c82ffbe19c4e48f5ac2c77cd944
6f2e7759898980a0aacdcd3f69adb1eced5edfe40c321a9671048e3700cfc852
718bde7a632512a36b1454211b98725feba1eb0c8f067c23bec7f308bfd1293d
e8c1cf4d99a7f7c5d28e1ddc80823ed99e9544fc15c0a642383db895183f0bf3
89dc06070486417ba00d425a9e728d5fe2724e457b160354e25f80bbf2b738ad
48b45cb5592772ad0af3cf36c2d654a407bf5951a382f1af11759cc3a9cc8cc9
b2466c29b3693cf253ac4117f87dbd6654cdd42e16e19f8e1f760e72b8da2952
f4cdda1987ddbd97124173beae6ee8aecc1f1d837f2b057de4291debd6edb773
583b8348b8262c02a7ebdc49ee73f16d39bc3121e27eebd0a9eeee853ca7b989
7f0ad3ad22d4d9ceecc3d9524b51f1c3d84e86fc4587d392fa4f5543f3f6d594
c9496737fab3004df6cb7fef10d470a5a9c15f01c8e672213a42b2e660529324
421d9e108d8f8007b6a7460749d56bbd55603d72fd5d3b1ae33a6db7388031e8
533e36bfcc4bf700718be022753ed070b1460d385e6455656751a64a1df40530
7601315227c4080f2ff911957a4d1c694edf47630452cd52551740bbe07eca6c
ed9cc4a0bae532df3723171962de8f9bc5d2dbde4308e31ca663d193fadd58fa
77933f222ec4b4b5b53c66868c273f3011f12df4a88eef481cd7e714079b521a
87a35079b4da77bc5987ac780d488cd2edbd6d060a311750acce083e062356af
d6c0125899a27657936360f3b501926b0d53c735a939b7ac675916edd5062d69
19f85e9f9b5d54903895172bea6ff1ffc81efcfb848c7cdf66e5750ed9c8b0b2
b95a3dd2115d7fb54009856f9042e3603659b4b953e807497008caa1485ab9a4
2564a10cf730b22512e707c8e527392c9bc2120e440fd75bb913cc8bb4c5072f
d5fe1c4a21f24c5c6be0080b308a1422a8a1238badac2714c172cad2c4a2ea6d
4dcb9fa80b906f434c4db0edbc56e3b5f540d642019d2db594ee5fdd2911fee1
9424022832ad1c5483c7e2a14f70666dfef0edef76b3da14fd38757412d49c7b
318a62ff184e0c3e36c8ed02e7290728f2d48807b5b80d2b94ac8d75d7711fa9
322c1ca91ce4e40809e2f5dee15434ee11f84203e5e39341130e393a3f55659e
df570693f3cf09b16c88c546583f59846cb41b8425f21ade8fd974a535a2ed33
6888a4de12502ed657e9b670e5cd70326be7a107611d19737214ab9af2ba7ac2
aa33e6ce8d7aa8a6f8267b82b3a3694e0c83e2b823bf52b84bc92d9c09a61590
99955d6880391d108a380eedd1068b021bafe2ae09b73402dd59ff2d636e3da0
ff6f386feae19d028f16cf69482bf4f1128085428b68ea4f0245fbfce14b3cc3
f8be23ee7200114ffe8ad36dbd288b939eb176c429bec0bbf33cb815cb38e3ef
0e8fc75bdde06b882aa11ed0ca49d205f0a91be5df24358c89fbdb5bec91ba14
1a90ecf94d84cc9067ddb24ec87bbe7bce02c6847a3c7c069d8496ad750655a0
f5f6b332d9ae93f74f2b83cc67a814a2f6b45a55b19df24ab5b4910cd9321d1a
63bf34e1b2b491b3930ed2d66346981ebe61fc65fe993a8cda49900c6c9437f1
f97f65fba9ff33b26a7f10095d0eae422e5aa5fec9c00eb7128d00cb44007ac4
805cf436b0cf8403149298e6844101049bd4d2be9b414a95c6e630b1a37fa6db
92a1bae84fb641e4c69fb12909ad350fea989a5ad6d51c0bb3cd9e98f3f2d68c
35d27ba807b48accc445569368efb3088c0ad32f4e7536886ee64939c09ca9d1
5e938b35653190fe126043a1c51a191bb38d483c1389f05495b954100da7e019
b6f2e91b19e885f1246a213197d00215ef83fada4a605859cec15c1031911c55
7d8f7a53c1fc1ec264548731d673763b561db17e42fb1f56d4dc44c5fd7c9240
3b3ba3913efcaf41b86aa6fc83920d98348cfeec052fc2915d7d721b861140d1
8292afc00bf3256746d95ee5ad805f946d02c57461af4bfab8307e917f4e5bf7
98ad8496dd68fac4f0a839f32e8118cacd86b37bbeb7f05218dd19514a213533
27d3e43bc0743428f2b1892b53afd2c02fc1e994378b0763178c765514d5cc5f
347e20e6352da5f1495d0d48d6706c1e8342c4781c2926ce5dbb9080ab275119
59e8dc10bfa78cc4fb00659f3a5e9796f0fe855703abe353819a6292d1f3d2d9
eadaf6d12e2ef41bf1f009e4e69b0ae4c66f6a80bb3117c63d5e51b8f9c97b56
ab4fec15c7373fdb01e1abb0fd7705e56edd40684aaebda6af3688ab1b2cac53
5f7c951740bcddb3919f038df3765847876054bee3cbfe71d0a14e8585d3e445
d857d15ddebb1a04f311fc0fdff40b499d7f9e1d7ade94dab510b50778218d59
1f892a4987eed7af3d4b1b189a21a7e2c3efce050db662312485a85f1b8be3da
8c231d9fb5f0720db8ee02f6f014ee8a2723dbb371a5a6086268efcc778ff24b
14fc6ef39549a11ea4c24a42bf91f952e1b3ec4126dfe55e660248d35d866d0c
bfa6a984891fbfdd27468a0c1a8fdd26c9a7be47d0df54eef9ac58435d0fa96f
5f1485ee356202b1e1f58af53e62675ac8fc8486b2f55343181f8db8e25a305e
95bc7d13538b771c9276b0710fb582c6d7cde182512cd04aa0720f94ffdbaf66
97dac09a966e374ca4e74bc2d73861800cff92b62c9aa8b61ffce0d24954f580
98552997b4cc9baec754fe3c4e43bcb0ca0f940b08d2f91c7ca3c2a3812562b3
d3cc17e5f8c33a4576e9182d1571f1d1e2a7000ac074574a573e57e24000337a
b43c6003ae85e25d2935c21cdae2dadd9f175aa0c044994f677c61d2ddb0c807
36d741345843fcab8c72a6618c7f6cee69d90455f6cc189e2b764491a05a75c8
a6f3cd4c2ae8b90fdb49e9ccc5cfc467bf56c277bbcb654a04e51b87524582ba
97cd60594f7347aae7f7d16ddf87fcc9f3d106f7d3850209be4007559f68061e
3fcf460c2131d1086fcea50610b1e510846e79c12abf5ad3ccfe73bc8721ed01
da5a8a5d2132cc5364a7fc3eb21dcab318d8a74a789ba574f0118449cef5bfab
7c47a85e46fa82c9a01a48f28295eff86604288fe2803a0e1ed764bc7622c2bd
0d2242b30749254489322252ee472e088e0cb37366911f8bce4fd1d441db3ceb
6dbbd595a23ec495982d2639ff8ba1a333e286256b3103a60b2c7bf950bebbb2
9e606062300c4f01884ea805d0e16b3fdb33a7eeb3f5cc994b927f8aa8bb3936
499987aa8b6bb5f099a937c58519a9cc701e5570615283ae51b37ca3a92dbcf2
8d5f57171c1b8d817eabcecf536e2060c0a497a2f56c01c7bd5c9ae4e5062339
dcb8c1915924e77211b42b90d5962115dc989f1b05b54f8ca545fee8c0f51392
fd403d35bbc35d8fc653dc2b76c4a5ba40fd1fbef64238eb0f99d2ce1cbb6048
42c608bf044f3ed5b63435f83e9a1e6822962dcc81f696cbb9973720968470de
2bf45e07d6f06ac126a717a9b836f102948d9da028b00ac1a8cdafde5661d83a
2333b344612ef8e56d333ef8561a05ee133f1631620971d673065c0449270678
830ec6fe91f20c8cb1de8e2b33f88c12f71fef0477b342522643c500769c93b7
f4031532269cc25309fc0d4b0a4cc921888a5df1957cba8984d656c5d68b0406
3422c1c5972af81414716de39cde3ce3ca692087c8a663b95b5a49cfaa48d7c9
d8df20c19c1f997d29f05f66a17dd80bb7b9125a094a130d1675e6f40e8fe386
d6778ea654c72a7c46408c88ebc57ece388cd7a05f2d7f00fa0911bef880affe
f36e74b5d628510659ea65e1b92c6cf880a6b7c4b138d8f24d5c4115df834a04
f076b7723d4e1a85ad666f8b563d8aa6aed086c604304e84609b1d3789888a0f
44a35b780271857cb97f3ac6f2e16c70cf2ba4381c1f0bd8a8a4f8716ff878ec
569eb031e3c9c51b3d5c77518fc6b07e73d21328813ea9f0313030a79b282705
1fc2841f5bd07322b6d48f6ff04f4100203aa6eb969751e37267b4277a5425a3
732eca5c4934ce52338311ba000734f47825a289fbdc5d196351d95ef8c4cc0f
b0a5b14764be7bc15d94278d0223f508ed2bd775e01894886fd8930e2fed3f4a
a121440f3df80358910dde88fbc340a50e6af50db737485837026b49d345cf5d
3f0399dbf90f47df387ed75b68ecf5f26f90d9244bbffa1a8866d733d3a3d68c
acc54fac1673e3cf23e3d88009ab9ab7af91ffa8c023054cf82415557f71503a
59760dfc46ae8d2d76de4f0a5b8470dd6633c17e65fb6840128e641a64175ff6
91789b5a821f8feced2c1e514b9c92d06f4b211876355d82d9eb23385eb5f6a2
578e6d38fe3b3db3185417e059b1fb174499e1fcdc55f34adc68fcc977bcf774
735aa7c856fd1363a36ca2a2947a6b90d8a87f4556ad580b5471b07997331373
3cfecf440bbf67cf4f3f360b3759d7c196f62ad44e93b008e72ee9f4219235a3
559107f0a51db0ce63f7b4b9d3ffa242da3ca9d5f864c6f8a3b069ebba6fbdcb
5d14604f400a5d49375420edeccb36184a45277b25c5278e91e35c622bd88347
309d278df4e6b76445690f5496a3e8c82c18870227b3af207c7f0ad4e48d4e66
98e1b42bec08f6ba37b76e862b4ec07a57495a8834ce3af7dff9c50516f2e51a
957107e9f81f0d54e68a155a156a2364640b0e9a465479327fae8a875dc06458
decc71a8669f2d61e9ece613f0a2c59bc9b141c9c2f87194480565659081b866
480ac951c1750a68b8ad6e919735872e3ca3ba116059f1326562190c689d1f06
a5254cf6b4f83aad584e6b3273c17cf82cbd415c87ce830dea6772ce18adbccd
2eb88be47c06c2df730c6efb63b9df6db4cb4938766be3f0d0b729a859e63a19
789b362b2096a0c42c2e2f5ddd96f15fca8d4b0c9f85cac5e4353e4f2d1db003
b05a2174a2154556789000f9213f1e9d10db855eb6adc91285ff7587074fcb49
1ad0c30fe8e96bae1080b446c5fbb4c25b1f355c987303dda7b733f0c303768c
d88c4f908411f16ccb6d73596dc94d9d154dedf754607f284285c15ae99c1d40
40ae4fd0902fe6c7d466e02c0085d52d8b8893c8ac36e2effe99794deb355a8a
e49c0b99a0cd37fc25320f49bab5b848286ae363f3dcbb5b892ac97e0b4bc5a5
e5dc7cc9ac87de36c4c370595b94dfefefb1de0e60756b0caa249641d8158f28
a42d632bce2cc64a330360f20c39f7e2a7ccbf47711ef27c06fa33510fe37e94
328e25408fed2e5783d95c61e4958043efc12f192305b053769e1280e28ae2ee
679de81867b09713c16fa27b7c2af6782f2a4df67f497afa5f9bea40331b3dc1
4bfeca30dd525760d9fec1049e5ba71a88aa314df8cf167c3c79389e7b5802d3
eea76460b71c260892be288ecb4bb25c071c4f06e81f3e16ada1e4756c2396b5
0e3096a8328a0206bb6fa0ca91b2d6e15e0a88f4e3c43964cdb9a1c405997483
e7859a9cbd25264c9ba4dd6dc480fcf13da14b49d5c6f9eb150099633082d792
bad4cc76350b376b1343989ceaf19f03956b86e772e0fe1ca33166e66139319a
e03b0954ceb7eb9d48e6d71a032d660fb7db03150c9d932d35366b7894dd9eaa
b2cb4809a4926745ebf1125622db05e749be626de803b59a920b037c5620edb2
107c14c6ad2e5abfd905a2b0297975990e2c409ec421b71c6292e4ee024a98de
056da85ba883da40fb7a229b84faa3e26ec3679747e802f8c34b784c9b95386d
7ec43ceaf3db2429409d89860c7f4c17e15aaafd238c1bb06ac15ddf752b0e12
84c6abcd6b8716cd9f4d205b0447f188efe2f9aad6db7b46dd3937ba5242f92e
18b494a353b0fa74821cd4db4231f65d5dd57f74839f378ad1b461d831d035bd
b374cb44e15cf295d58d171892c3e8af9d3c5f4534419cdcf423fe8bacf10a28
023d71cbd266edba95b3ffa5cad2f33330afd1f368e6c9249a246510d98cb36c
6dd84c822481cec4ffcb05c03959cac979ad4bd6d60358aa39f7a64c65124214
16eeabe9e2331b000276802109f78cdb6127233478d3fa8cf2aaf72472af03bb
5fbdab36ff5756ac8e58c3e56bc4ce4963969499022789a4cea7c783c6c3d7a2
ef251166ffafabb29ae5d79b604942194d4374dbcf5c5576743769a340be2cee
ca4bf3626402ce5513e692b723078dbc4d538ccc6dcc0f5704ce0379af82bebc
5ad34ca4e4c800e33cd47d6fc1ad16f76cb1deb2ea7b269ea2e7ce1781ca4268
afd60113bb8fa4a8e6dcf5aeaf77bf025a26214c8af457b86010337446ad65ba
63ec5f74527786cd6ab903193ca009df581afbebd9b4b314c27b1dce2682e8b4
8345b20137174badc1837184fd2f2082da880d20fda055cc8404d7255df22bb4
14aa3a4dff018642f085b69970a5aff3f34c7cd40e09e34ed9e06b4ff7e48841
921d0bc27d9c2ca26a8d5af2856e442460974b666390c437dd5dcd2f66c7a07d
ea6f1c39dea8fe6b413f9a41c476b9a1a8b17374bdee8e3cb12037529b509816
d705dc4553bb7e3c2576a91dee82cf7b812ec6e05175e082225acce7338e707a
85051853713cb436ab003e46f5bdc91b31917860fa2ca00b6b2fcd14d516ae2f
150b05cb4c325e57496aec158962f89dcfa0a3fe7d32d2905a8b30355413681d
30a462c49e6e2ac5865e50500d824af4a40e7523ae6e6e265e7ec5b0c102e285
20502e7f39adb4f3d6d90fd6f54b731c539cc15d220629a8b513c4e47cafefce
f5d4f5035123afb47e56a19540f6d383a475c51c7e946b508bd1dd5ace0e1199
6523e89de05a4e4ec72021e11f9ae909e9e2aeb6dc7d2744de740fa6d2c405ac
4c0315102dc8b4e942567106b6f4c731c3f75f115d1a31f35509a2747df4a893
2a83f7aede68c6937ec195dbf585b47db5d4eeb2938eedec698462a250df84cf
d295d73bf7739590e7fd5246b717f229fb95c0ab4cf6b6716b7478bed8d4f8ac
e8b3b530e4b78889f928f936d95f36c640d1d92573aca6aba8dd8b0854edad51
d10ee488993bcbedc93c53fdb54e54cc79011a7b10a18541f8c65a863fee0e0a
d8d230c7fe0d60405e8a74f58dbe2dc2685239c8fc0d34af6f856219e37f7d3d
3a0ed545b9828a668f35549346059b2bc4e035ce5cceac1bd1e015c61ba9bd95
a17cbaef5743494ff1a668e6d50dc9d805a58418f1d159d508854e835d7bf282
f5fea791f0d88e032041a89c2b6dfa7ab8de6fe21c2fc3eded03a4de2bc53196
eba703c2c22d480fc7a0ed8e52376a7811136c649d36eedb42cecd50c8371e3e
3b43d31e9eec5e2a162caccb3daccd7c893b6416f9edb209d70b4f9b1f884f75
949669a6cac851b21b69ed7a96e51ca5331ec103794b1f4dea3bc0b4b9e8149d
be1aaa7bb484a19e64ac97e50ff5b45d68cb6e2b31af8912afb3f6a3f50dbab5
de25173de554d87311bb6aed1d94510f3154cdac4e59137af68cac1893f8b1ab
c40ecc79b399692f241d53f9e51940d5b14a91df89abd9762bb3adc556326926
12d9f81d6303f88c9cd3bd12bbeba1fcdba48fc908be8ebf428745edea3a00fb
c3314aa9cc813d9e2c3fcb844c6cf3686ffc2a63d066875fdc58561f6e939752
a2be00120e3f2e6e7eae88d04103bff6502abbb4e785d67a9673df8ef44bf3a9
464378ee3566b925641c0b38032155d115f137475368822d0767e94db0f721f1
d79acd1cdaf62984a9bfc491d2a138926d6d980993a22bb8b0bf16876e0059a8
14b1ff1a7eb014c761cdaa49a27b0d0360a1ab568dbdd4d197eab757e597ec0d
ac9b4f0337a2083989c3efe37fb280e63c32a67a3a71844d03dbee71afa8a117
ae98d50f830fc69490a4bbdb55370270179f28bf605fd020ac4d2ed3d138cc2a
3fe7f41c0def545280dd7b7b30a4b88812b9b9d7ab2d44b2e4c13ae75d802380
b96777520184fb3e6b6587892ea1380bcd59155bc51ad1f729b831acb1032f47
c324d4ffefdd64329af2f5fd8e4d91ed4f55eae717765dbf87ce565b544857ed
f124f41fbc27caf7e172a9b04824e7e3de726f972607e8fabbc05605462a7c2c
5cd1866f46417e2490997611c8e021172ac347e693d1d152b275c767a06f4862
af87fcec0edfc64b1907a6b7a845ce6691f727d1434bdcd974b4d99e44c8d46d
b85a532ad53d16560c9f41fb343ce092fc16dbd20e1ea463209b5e38abeed5aa
87cd24e1fda31dd4763155141056883bdee93feb85bf1ecda5740ff913a050ec
ea7b10b019d6a8d3afc5af76ce03f39ebe05d2a9e89c73d6a24dfc2fa0a9bf76
fc521fde175bed3804e3715e3933b63a66cd6f0ab2e1efce5c55223463fdcc8f
af7d661cc006d93176c4d528e0f9d5b9200ce392feb8e45e38787fcc9e593c59
42e8d56169eb2454e3a75fd98dfd46ac20b71f2449e234c1248d144ae4db3c5f
33a4f9ccaff7478f3f560a209eeca8e8c7bccc4efdc002941c30c8f35acf03d3
780ed4d61ddd2cda2e45ac06b08df7c56c75c12c8aefd0792550a20fd4e5a2b1
ebf223916f8708ca476d5d7e5a3957254560321fd8615e142962c8fd964e7de9
d8f75e807ca4312657b03788a1477c8acacc38b9324f10cb36c1bf95b7bd0250
2023cd99d2646c85f1b999bbe5b0b154403026195967edc8899e9d78b5bcab2a
15e4d7b8d73b286ab0bed6e76d9ff7cf9d65ab60a5d34e14fde122e70bcd2d66
ec6d2ddad3c0a9bd19429524d00b08c6ed8c3670946c4d70ce9a2375f7d4c02d
f8b7524983ea72548821683bacbfb7b41c65183ae45ec73fa80abe4cf47c58f7
e46c59d4ab7b4455fe04d2511d7ac7caa0d478bfc919d764418efbd61be76cfe
b0378eaf10ab75f57cb67eeef356e000e4d100757339a83da84caf3b57ba9eab
70e207db0e6a82f3593243188879fe92bef53bbc6b4ec6d95e5ad83473ffdf77
3c6b0358ddb1bcf272b6b2563b777708b4ef5a04b6f6b9dd2b54b24842ada7af
432b77fdfb95cba0116cec0082f9920c28f1f39400f279e2ac15c0e641863435
7b59046800d1611c7e83931c405f21d97f8b03ff08ff0565d532fd0340cafe70
011d7642d47a1ffce2308162bdc09a0468b3b36ac8bbb81561aab80b17a61e40
ccd55f06f497d0cfaeec0c4940fa1f8b2caafeb93d61c2323ed05e3d12b888b8
682af7ab864dc30de5cb86bc32bbdaa0820892af242a4a1a5cf6c36d8539631f
3a9d3471ecb76f1151002d3e8bc488ec71d505637c943dd77efbfbd865397dda
9e6b50d4f5ce73c4cd035f97d6c62a1f25bcb2e19c4ec817d78414e55b33a531
d960c062b44440aa5dd932d60e0a598072e8433ac7e4189852b895ef9688725c
05924974b2b617d1f5e77accf6aa2089bce2dd3726b474fea6781d6759f864ea
0ec4517f2ce8dc1685cd8ea3a2d6c17ed2b4fd90ee7461b03c0313b61f40c169
55a80b03ee90e27367da501b1c944d33bbaa8d602a02ea827aca646a40381eaf
9196d026a0d4c40ffb61340e6e00319fb4d30a3386640ebe59edfd20fc9a87ce
b6f04dc0264821165df4deb83eca6a89da97151f26ce291c858b65155d7399dd
92a7feff7bd677b440c790d1153a30b2eed79b07c1ee823c32bbf82e47d275d0
7d46998e26af226e1fcf667979208465eedbe7d0315e7a3cbf7076ae77cfd1f0
d8165a876c40412820cd04cdf81c6f20f5754516088c157e7cdbbb7d371a7046
8fe1468d5bfbd221bce9c7b0d20f424b5e9ddd568d0b800f09e4602e0afa64ca
f65a365b82f0aa8b05b4932df1e6e65a0866f30bc3edc30f4bb121e8269760d3
72b6a5851024f3130233100d743d0faf6fd22774a96d99f2db95f6c4b98fb71f
d9aca19ef76d82cbac3b68a526344d451c93f9c90d5462c872b16bf8abad50aa
58c5a0fc8246b81001993165f86770cfe745af784f18040bf13e5c21f34e1914
a4f6c9092ac9f16c58c4c0c2e48455095ef4ace1a9c5959abb2f6cdc85989e27
36260b25d9e1ab05ba17f5afe178d3d6f4c63a04f04dd8e350a8539740e11d79
d9d603e2e0636210e94d28b846133457f60d1d8b11003f0d874bbe3ce74286bf
3b76ac7479c1922685c3c9af9e2f0f3f8994c7dfa05d97a999f641e6f483799f
9ff75df73deb5d520e052ad7a13fa88659aede92af971b3154a97de66e0d2221
96682497e30ca7f216fd170e25627ad429a71a617146de524cc2fdae35615ae4
a81403df0b98c736302547af8e659854c0880a8b53c2573c8c3c5ee050632754
4f253cbe38dc2e33e5f8c762dec7a1608ee1346f56b48c1139be30c69615eb6c
17a36482abae23c6e24a204f5764123cdbe92ac9e30144f88892a02b898296c7
874bf0dee80facb77ba36112761319267fe0382319eeeda324fea743053d8ef1
3c1db913e788d66e323d0404a7bada69ad26a760cb4ac9bac025fec4e6c6f31d
4e95f54e7c92fc808eca61814cefa1a235894de1ca66504fdfc9f0d8e825d449
131d0a45cee6bb8ba17e26c9fa0fe6ee91141bf44177537b0a78ed90045d124d
3100dbae5e9b0f5e8e6d4252ea37d57f307c2a2f8f91676524d4de3fbda8fb51
c9e37a8df3fbc82b6042316da4dcc9e06f87d9116681537f0dedd2bafee762f3

C2’s Per Epoch

Epoch 1 C2s

104.79.48:8080
169.86.13:8080
79.134.129:443
159.150.176:443
59.124.163:8080
92.51.40:8080
168.4.66:22
68.106.4:7080
5.237.27:443
62.173.247:8080
80.142.33:80
203.204.126:8080
84.133.72:7080
84.133.72:8443
249.187.151:8080
79.163.131:8080
62.18.56:443
123.0.125:80
167.53.209:80
188.149.134:80
230.212.74:80
36.42.205:443
82.97.25:80
69.214.94:20
187.198.10:8080
86.148.222:8080
0.95.172:80
83.133.253:8080
155.233.46:443
188.166.192:80
199.158.226:443
199.158.226:7080
235.239.214:8080
166.68.89:443
187.141.15:50000
1.37.125:443
104.253.234:990
117.206.153:443
158.19.141:80
200.64.180:7080
221.50.210:8080
230.60.129:80
230.60.129:8080
38.14.52:80
21.90.6:8080
57.102.71:8443
58.171.51:80
163.74.202:443
184.65.229:80
214.74.71:80
25.159.3:8080
229.116.97:80
71.237.140:8080
113.27.158:443
199.160.224:8080
199.175.216:8080
92.22.225:7080
163.144.228:80
21.105.59:8080
28.111.142:7080
29.183.211:8080
41.134.46:8080
41.151.103:8080
196.35.138:7080
77.13.70:80
28.51.143:8080
15.8.192:8080
75.143.100:7080
75.160.178:8080
244.60.230:7080
244.60.231:7080
245.101.134:8080
55.211.77:8080
143.182.254:8080
240.141.141:7080
85.87.122:8080
169.140.14:443
42.166.147:80
106.77.40:7080
250.223.190:8080
188.124.145:443
205.215.57:7080
83.93.124:7080

Epoch 1 - Spam C2s

45.108.146:8080
55.82.2:8080
236.185.25:8080

Epoch 1 - Stealer C2s

228.32.31:443
50.170.27:8080
98.148.157:8080

Current Epoch 1 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOzoTryw1r9RxRJPFKalO4+q7JaDZWSB
KZlEc22H6ITuE06tvJspue42TF1yk8xN+1bqW++QeV6Clm1uRswA/qoao/6p4eN0
h4zIO8PEaJ0C/9EO4cx9yfRLlVpjdEkP0QIDAQAB

Epoch 2 C2s

187.237.217:20
255.150.84:80
97.95.218:143
131.11.150:8080
236.246.93:8080
15.153.237:80
240.198.66:80
243.177.26:8080
201.140.110:8080
44.162.209:8080
139.247.220:80
167.86.174:990
202.153.252:8080
65.25.128:8080
239.182.217:8080
212.203.26:8080
254.6.27:7080
79.161.166:443
32.19.219:22
143.194.138:443
143.53.227:21
176.106.43:995
176.132.213:8090
76.6.2:8080
142.236.163:443
94.252.13:443
4.172.5:20
4.172.5:443
4.172.5:8080
75.241.230:80
144.189.58:50000
166.253.46:8080
209.217.49:80
106.97.230:443
108.228.48:990
145.67.134:8090
18.146.70:80
186.203.55:80
211.207.11:443
226.44.20:21
228.72.244:53
53.135.159:21
19.237.192:80
71.148.138:8080
251.43.69:8080
189.98.125:8080
63.71.72:8080
71.234.16:8080
145.83.44:80
160.182.191:8080
214.218.192:8080
51.106.145:21
147.163.188:8080
12.67.62:7080
172.240.91:8080
157.194.134:443
220.119.246:80
123.3.54:443
33.49.124:443
79.188.67:8080
105.131.87:80
41.213.2:22
196.74.210:8080
75.187.192:8080
142.253.122:8080
237.248.136:8080
188.105.159:21
24.219.147:8080
11.163.139:21
11.163.139:443
136.245.190:8080
104.59.244:20
106.1.166:50000
98.25.30:53
106.136.232:8080
106.139.101:8080
230.19.21:8080
156.97.210:80
247.163.44:80
205.215.66:8080
222.125.16:7080
222.216.44:8080
233.128.13:143
205.247.10:80
128.43.213:8080

Epoch 2 - Spam C2s

43.168.232:443
187.198.4:8080
228.205.245:4143

Epoch 2 - Stealer C2s

105.131.69:443
31.200.130:8080
131.58.132:8080

Current Epoch 2 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhALk+KlHgOKXm9eDkWu2yN9lanjwOm6W2
PV0tgr4msNVby2pOJ6S1MZQnQwxl7y6WWzT4kveAQhLmW8JB2M2PDOxZOgVMJH2C
AtkVW1p/P9jNJWVvjK9SmrbLdIeiKNtRfQIDAQAB

Epoch 3 C2s

179.216.46:8080
36.234.146:80
52.135.33:7080
88.70.226:7080
99.61.162:7080
197.140.163:8080
59.242.76:8080
95.101.72:8080
240.52.172:80
170.220.95:80
214.27.219:7080
241.232.82:8080
58.93.123:80
249.187.150:7080
62.18.56:443
113.229.139:990
165.150.211:143
230.126.152:8090
55.171.237:8080
10.16.244:53
117.174.26:80
29.155.101:50000
93.167.147:443
117.206.153:443
13.146.47:443
55.39.215:80
55.86.138:8443
92.103.7:80
96.118.15:443
50.163.106:8080
211.244.6:443
114.134.8:20
244.125.210:995
150.19.63:443
154.222.52:7080
70.88.55:8080
60.202.26:22
33.1.161:8080
32.229.152:8080
189.148.98:8080
38.134.203:8080
45.30.28:80
109.34.178:443
169.33.157:8080
78.205.196:443
177.253.126:80

Epoch 3 - Spam C2s

162.144.47.94:7080
41.185.29.128:8080

Epoch 3 - Stealer C2s

178.32.255.133:443
198.46.150.196:7080

Current Epoch 3 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM426uN11n2LZDk/JiS93WIWG7fGCQmP
4h5yIJUxJwrjwtGVexCelD2WKrDw9sa/xKwmQKk3b2fUhwnHXjoSpR7pLaDo7pEc
iJB5y6hjbPyrSfL3Fxu74M2SAS0Arj3uAQIDAQAB

Credits and Notes Section

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch 
because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, 
this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen
 
NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

What is Epoch 1, Epoch 2 and Epoch 3?

(09/17/19)
With the find of Epoch 3 today that split from Epoch 1, this section will be rewritten to reflect these changes in time.

Community Lists

https://twitter.com/executemalware/status/1177768601199271936?s=20  :)
https://twitter.com/Paladin3161/status/1177585601228328960?s=20
https://twitter.com/Paladin3161/status/1177724959088504833?s=20

(sorry if we miss anybody, make sure to send it to @cryptolaemus1 in your tweet and we will try to include it!)

Credits

Combination work of the Cryptolaemus Team - https://paste.cryptolaemus.com/about/ and/or specifically the following:

Doc DL URLs - @devnullnoop, @p5yb34m, @malware_traffic, @dms1899, @Paladin3161

C2 info/RSA Keys - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @VK_Intel, @Paladin3161

Payloads - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @p5yb34m, @malware_traffic, @Paladin3161, @ps66uk

Spam Templates - @devnullnoop

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and 
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey , 
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch, 
@urlscanio, @BlackLotusLabs, @TrendMicro and @Virustotal for providing services/software no charge to this cause!

Daily Log 09/27/19

General News

abuse.ch - emotet C2 geo
https://twitter.com/abuse_ch/status/1177512749238124545?s=20

rheinmetall (emotet? - speculation)
https://twitter.com/Peki75/status/1177667174783168512?s=20
https://twitter.com/abuse_ch/status/1177657897574162434?s=20

Drops Report

emotet/ursnif
https://twitter.com/D00RT_RM/status/1177531114933686272?s=20

emotet/trickbot
https://twitter.com/D00RT_RM/status/1177868903617368065?s=20
https://twitter.com/D00RT_RM/status/1177531515472961537?s=20

Email Template Report

Early files featured DOC/PS, later files were DOCX/JSE
PowerShell-based DOCs for 27th had additional URL/comments in the script
https://twitter.com/reecdeep/status/1177525796380053505?s=20
https://twitter.com/ps66uk/status/1177497787925069825?s=20

bromium jse analysis
https://twitter.com/InQuest/status/1177646440354582536?s=20

New phrases observed with text added to reply-chain emails:
----
We could offer you a 200 a day retainer. The project of agreement is attached.
----
I adjusted the document. Newest version with your fee is attached.

Link Regex Report

Waiting for more the next few days IF they come back.

Payloads Report

DOC releases:

E1 2019:09:27 06:22:00 DOC, PV, PS
E2 2019:09:27 07:27:00 DOC, PN, PS
E3 2019:09:27 06:35:00 DOC, PV, PS
E1 2019:09:27 12:29:00 DOC, PN, PS
E2 2019:09:27 12:25:00 DOC, PN, PS
E3
E1
E2 2019:09:27 15:22:00 DOCX, PN, JSE
E3


EXE releases:
hashbusting all day long - EXE updating ~5 minutes
all 3 epochs were synchronised, pushing out: 
~470kb until 06:20 UTC 
~140kb until 11:20 UTC
~470kb until 13:10 UTC
~440kb for rest of day

C2 Report

combos on E1
combos on E2
combos on E3

Closing

TT

Sandbox 09/27/19

E1
https://capesandbox.com/submit/status/955/


E2
https://capesandbox.com/submit/status/940/


E3
https://capesandbox.com/submit/status/941/