Daily Emotet IoCs and Notes for 10/10/19

Emotet Malware Document links/IOCs for 10/10/19 as of 10/11/19 00:30 EDT

Notes and Credits at the bottom. Follow us on Twitter @cryptolaemus1 for more updates.

<none>
http://159.ip-167-114-144.net/wp-admin/av9fy8lno_0powfk-38113076662/
http://2014.barcampcambodia.org/wp-includes/FILE/wu2ohxrqz03to_d94d4-7953737743/
http://aaoleadershipacademy.org/submitok/LBPBKL52CI9/XlHOAYQhmQFarvbHBhQbXOqJpz/
http://accountingwit.ca/aoldcgd/DOC/zrkjxavi9_ufkgrrxt-12656772911/
http://aconcaguaultratrail.com.ar/alfacgiapi/paclm/TUZStHaqIXCNNdoWHvktd/
http://acryliq.ru/wp-content/lm/RXZqjRJAusXUbMzSesnAqls/
http://acvehurmapazari.com/wp-includes/Scan/HnpVOmsxeNlbyGnwrDHq/
http://adnc.cn/wp-includes/sites/oCiOWamFmacfhOPuIHuobncSgfglR/
http://africangreatdeals.com/e5571/LLC/bSojJjzJ/
http://agdust.ru/wp-content/lm/8unuul2mzbc_r7o2w-7475566801610/
http://agenciadosucesso.com.br/blog.supleno.com/DOC/uuOjRyaEPSto/
http://algiszudovisus.xyz/wp-content/HwMbGtaoqJTlpgzfsbpbrzHZrZ/
http://alphauniverse-mea2.com/wp-includes/lm/rq0rfefv_ifzyb0-4133554223659/
http://amoretours.com/wp-admin/xKLpqmmxMMJzxCO/
http://angelcarwash.ro/8kl6ek/4BA4FFEGWAY/dYzlpKaChu/
http://apartamentygosciejow.pl/wp-includes/paclm/qxa6tmxzbl89usceged2y39_e0uv8j1-346864923756/
http://apekresource.com/bq2lfsk/64r5m14k3fvgcen3usqpgqrreya2tj_2fd4gjst-010235475/
http://aqualink.co.ke/wp-admin/parts_service/izpuika6s5a784yms2_y3ri5z6xp6-13597969471/
http://aries07.dekpo.com/wordpress/797764975962007/dllco6gu3smgemiin_jk9cstgw7c-7426411677/
http://aries20.dekpo.com/wp-content/paclm/thyfwvorb9qpat16c3h6khrh_y7rbsepte-5408553583213/
http://ariscruise.com/wp-includes/5s0z3pj20fej58dia0xkm5w85u_cw5g1-9983370256886/
http://arsenalwrestlingclub.com/2017vabeach/lm/ptribj4o7s_20bk4gnk1u-5448340464/
http://arsonsinfo.com/baw/inc/dsw8wqkko851i2w_1umy2yl-685987851/
http://artesaniasdecolombia.com.co/webalizer/wamoryztYaNnAbfvVzDIfgRCoNth/
http://artrosmed.de/wp-admin/FILE/sjpkur4oxc_9axtqtvigq-4961334883258/
http://ashkangroup.com/wp-admin/JTU7J4K8PTTW7OG/g9mjr3f1nv53yvxz0i6u8qwuqo_rd8g4tng-056765795912120/
http://athagata.ru/blogs/sites/AghNOyjtCaCpgNtevKgp/
http://atlanticcity.com/bignews/wp-content/cache/wp-rocket/esp/7bq5xdhzt_a1r5tbnqm-8203979739/
http://atussa.ir/wp-includes/esp/wn8ob4ubuqjalk2fko_cqxwksbc-0875621593/
http://avaagriculture.com/wp-content/uploads/LLC/lipccRuylphs/
http://baaresh.com/dml7xv7/esp/JKaAUaoHPvRYrPwxhlksbUrvFaelqH/
http://bayutronik.com.my/wp-content/lm/fzbngsllpv388227hnzzcb3a_w6x7wsbrbo-15585690126895/
http://bestindiandoctors.com/backup/sites/0ne3lm629zejg1q4u_yi3z0-44753301545959/
http://bestroadtripever.com/wp-content/HEYEJL7JJ/tfSDDHGQKqdsXWCeSJsFPBnrntbGnV/
http://blackwaterstation.com/bbufyk/pg89dftf8n9aadm6ztymqkil_70oo3b-1985440990406/
http://blog.sportsphotos.com/wp-content/uploads/2019/09/alfacgiapi/paclm/lqlsd7flr8sc_nmy97-40329353930998/
http://carsiorganizasyon.com/wp-admin/3rsqemibg6q7euh_ga3y5mk2-0241822430/
http://casinomel506.com/class.fighting/parts_service/xeslvc68pslqjkp7196llaz6lq29_t3n918b5pi-91259416058636/
http://cassiejamessupport.com/blog/DOC/wZwKQlWAeaHEKWoSo/
http://cbportal.org/3dsnp/documentation/wp-content/esp/MWqYcltvHFhOCdKeRijTxBEqnBc/
http://cc14927-wordpress.tw1.ru/sitemap/parts_service/xz27zaqyodkx_dqihz9v5k-9739697543323/
http://chooseyourtable.com/wp-content/FILE/7bvrkolj126xr6hxmb40x7ssc8xo4d_ednpi1nd-39732505477/
http://christiangoodness.com/wp-includes/Document/SzyDiIlmSVlOqhWOLLBUBhUKgCXk/
http://clasificadosmaule.com/wp-content/sites/szs9n6pvn37fgafd911ss_osiby1-753587659577/
http://clients.siquiero.es/hizv5v9/paclm/afcse9eba1qsn_owbo6-69170965/
http://comeswithplaylists.com/wp-includes/esp/7sht98iadw2ccxzj3wj0fmswq_1esutw-24834270/
http://copiermatica.com/sox62c/zhpKvRNzRMZnGxZ/
http://culturallyspeaking.net/qezyj8/Scan/rBZgwcsakwmPfkBXVsakmAL/
http://culturalmastery.com/mt_images/paclm/tmdFgvqJFirVbCDpLw/
http://daniellefernandes.tk/wp-snapshots/MUL6MAZE3IR7F/jiqCVtUHwLvMEKqJGxJsc/
http://danpanahon.com/grvdc/INC/v5i7izyj8483fnveeeldk52qi1uzy_2fhh5u-5883765997570/
http://dautuvenbienvn.com/wp-admin/v1je27pxxzatki9uw58tib_m2r21-869536710/
http://dayboromedical.com.au/jygtv5r/j07aov3phy_ybt9lyxq-82887136095/
http://deinde.tech/wp-includes/2791428436250/waapkFbUkUSUjlIbVpdFASBf/
http://dep-photography.com.ar/ub4/o5zjfikcha943_1ginwad-46250979/
http://dewibebaris.com/wp-includes/parts_service/85pmg8sr_2cod63h0t-58924151/
http://dhidedesigns.com/wp-includes/gr3i58adi7hyb7eqrixulx_6idouu64bd-35789009/
http://diezeitinsel.de/wp-admin/document/4b1hs7073aq1fnmer4rv9k6f_lmrc8inum0-887675682613/
http://disdostum.com/blogs/lm/khtnAGvipOpDnzbCFMC/
http://dollarprice.shop/wp-admin/93729048517/YcvOSNbdInMeBLRZjfMCDSIE/
http://doralfitness.co/fjn/Pages/SqLkdVMHTHNiyBnbzIf/
http://dplex.net/wp-content/poz52g58vlevne/dr1acb63nl723fij9cy53d64u_benhukrxc-225456009668510/
http://draeger-dienstleistungen.de/wp-admin/sTZTRlKyMLmeboqZMpmibZakmGgbD/
http://dreieinigkeitslehre.de/myhomework/sites/wh1xl84ca_obv0c8w-6838298780/
http://dulich.goasiatravel.com/calendar/0571495857/vvheovzfdstnzmdqi/
http://dummywebsite1.x10host.com/btoj16/l1azht8cdcu4nrrvsxxovcxr9_7g00ob-0998670367605/
http://eduquebrincando.com.br/0flwql/INC/9vjwlstw7hsgpdvvyshgwrxr8by_ucmcw8zc-4885450946185/
http://fadmohealthcare.org/go/sites/IKGqSWgzQINABwBNx/
http://fairfaxtowingandrecovery.com/yk71r/parts_service/VxzbcOUxjOnAMy/
http://fletchertours.goodwow.net/cgi-bin/DOC/g1zl1fxvp3lwf2p6bpd2y_te7iypygl-707195601910/
http://flipmypool.com/seeing.class/INC/NWGlRGuuQelDJZqtVrzCUtswYpx/
http://forestcountymunnar.com/demo/XHOpCeJTaRXOvTNhriFAJ/
http://franchisorsuccess.com.au/wp-admin/Document/a5esn3kg9ynkiwrdnfz_0zuluzm-33316890/
http://frcc.in/wp-includes/sites/boJLZrtWAegShfhQcbFfFM/
http://futureartdubai.ae/cms/Document/VcBelKVxFmFjfZtIaqlb/
http://fyconsultant.com/wp-content/Document/lmeg90m59botbag4ebu70b7exa_8zxq4t0o7-047851064/
http://gangasecurity.in/uploads/paclm/SJICBZuOOWsrWsefQvBjcwx/
http://geethaseetharam.com/c7p1kb/esp/0z1fo6rx66ql03_hfyuk3o-9956557068515/
http://glw.com.br/BRINCARTES.COM.BR/xNQCLzqgzeYjRCbBOFGBGrS/
http://groffscontentfarm.com/wp-admin/parts_service/bFiQiftATlBOAfyNzL/
http://gulluconsulants.com/wp-admin/sites/9qf62cv4240d_67orj-35294248529089/
http://hanoihub.vn/wp-admin/ZI25WG7XLF2FD5B/rqUrQsFeoTAYDGHTzAvRSJpuyojiX/
http://haram-edu.com/an3mkpk/vth4ecksh34pjbd152wgu0ilwdb2pa_hjd2opln-0927959715/
http://haveaheart.org.in/haveaheart.com/esp/g1qgmf4vyjg6ktgbrp_dfdcxo-224311742/
http://hiztesti.web.tr/calendar/9015667889/fhpo6rl22b4adm7ucpi8e0qzvf8_vceqa-7199575809503/
http://homengy.com/wp-content/Scan/YraKrdONfzytO/
http://huisuwl.com/wp-content/FILE/yoiirefyep_jbjdp5-65813790/
http://ilion.tech/9t59i7e/lm/ie6pzr18kd_f3faf-43169793/
http://inakadigital.com/home/PPVDVfCFuvljBHynhGhAAdkJFk/
http://incipepharma.com/1mchjx/paclm/o8tdz9sip4h4zar_91qfsd1-48171146495/
http://indianmineralsnmetals.com/wp-admin/paclm/atkfzp3ifvhsi5_ff1jd0-495395954/
http://infraturkey.com/deletecomment/parts_service/daaMnHeDzR/
http://innotechventures.com/wordpress/INC/a09dha0dyq1s9cse6d_uz5f749d-804860206381448/
http://institutosucesso.com.br/BRINCARTES.COM.BR/INC/kx2hikofe54xjhb_zsp76v82v9-15352293186406/
http://international.uib.ac.id/wp-includes/467501246984/18zekk1wa2k7xjh0nj4tqwc6_fvr6ux3r-008335497826446/
http://ismashednc.com/cgi-bin/z551rm1hmrv373_e8hs2-7538061518636/
http://izbetalia.com/wp-admin/U9HF2CYJGO8/fxb1wjra2vr4i8_l3dn4k-31323674516304/
http://jadeedbjadeed.com/uap/Document/XdMOLGXYGfRWgazukFjJgqUGokvVNN/
http://jannatkhah.ir/wp-admin/Document/e48g90qexkt11wu422r3ge9t6fnq_i8xn70-054707653103/
http://jeevoday.mruda.org/blogs/FILE/DtyDjYveCtJHOUp/
http://joycaterer.in/roawk/XVIwyCOdHETPOo/
http://julienboitel.fr/8loun/lm/ezogYiYWOoQktIRfaZbdqDSNQ/
http://justvirally.com/luxauthenticator.com/esp/t6xy99re_a1hqt-20982173/
http://kairod.com/wp-admin/2mnbyvwluikqcptooc6zgqi5x_n0iovu4-89107313/
http://kalaakars.com/product/paclm/OsgsolBLaaLPFKdOlJwXMYkSHxBl/
http://kardapio.com.br/cgi-bin/ZFSEDHQI262ZD/fxFIgIitmzKWUxAJFruo/
http://karishmajaveri.com/discuss_lib/KzsFbuZVtvomqGnO/
http://kbkevolve.com/wp-admin/zjmxgadhuv4pnbzp7ynpdoik56795_gwb8z-673046389663526/
http://kela.edu.vn/wp-content/Pages/oNaVNIIKJdMBSHiWxmHdByJCiKE/
http://kkindonesia.com/public/dist/Scan/eSReWctkncxkDBRhroEqmBZOruASHM/
http://ks.od.ua/mmenuns4/parts_service/PMIFzNnqLKLTiXtfGbtv/
http://kshaun.com.au/wp-includes/oanx6k4khaqqj0vcslk_lsi2qv-19869488876/
http://labstory.in.th/wp-content/uploads/paclm/8wir284b2zbdmvqk98_jjmnralgm-76572020596/
http://ladariusgreen.com/eb2hb/rj07fs0ce_nww3m1-5712796730131/
http://lahayeasuniversity.nl/kyjps/6405985227638495/uehawusmtkb_35arf74tc-90120561799/
http://landing3.ewebsolutionskech-dev.com/hvgpz/esp/dobh6pgi3myqnq_4j83s7r-303897442189/
http://lavinotecaonline.it/wc-logs/yHlKCeOlqUfc/
http://ldswordsofwisdom.com/veb2k/sites/jTqSZIChmcgVHmdbnLOlyScaLOQJX/
http://librarianlibations.com/cgi-bin/DOC/jUDImOuWfBcEKyhmlmkcS/
http://liyun127.com/wordpress/sites/kjdfxtdmrbgnkaco7g40_xh2q8-091034485204590/
http://m3creativemedia.com/780a0b/4nuwnadjz4_45lhp-76334341292/
http://malaysiatrade.com.my/wp-includes/E6BHBR3P5D/j55kmaiam4b3zhk8kn1506_6xwdt5-5903849534452/
http://matterofcraft.co.uk/gjhxrd/VtsyxNcaER/
http://medproverka.ru/wp-admin/paclm/ozl6m93w5u3grixyek9ly_kossl1mns0-25008869240445/
http://me-mana.com/k57flq/esp/jgl61ag13b33jkjh_87woxn-583191210920455/
http://menanashop.com/wp-includes/LLC/pINCbMITwqcpKYXFmSjr/
http://mimewsbank.com/wp-content/39795688324338640/SvXQxVKJHx/
http://mixcoisas.com.br/BRINCARTES.COM.BR/5t1sukt77bl_jaarp-324017441/
http://moneyhairparty.com/class.local/parts_service/l08vz9rlsq1n0l9_ot5almv4cm-275176722/
http://motherlandweb.com/wp-content/uploads/et_temp/DOC/6ya7wahtvja0a37bd9dcfp3vu_x207gp9ec-61869157/
http://mrpak.ariyotehranbartar.com/wp-admin/lm/doksmfl3xvipgu_8dmf7bzmk2-90450443788/
http://muscatroots.com/xs0pdaz05/TVOwYvLv/
http://narayanaayurpharma.com/calendar/parts_service/efn1penarkmzt7c0l_dhomq8iak-13656166/
http://nctribalhealth.org/wp-admin/lm/dmSEZKvghQbOUH/
http://nekobiz.ikie3.com/wp-includes/esp/uofMWYGRvYAHqMC/
http://nesarafilms.com/gtmjn/parts_service/yzk9i95u7vi5_dgwbm-179083338/
http://netrotaxi.ir/wp-admin/DOC/sjmo8y8becp_s9h4b-6163496576268/
http://newlifemedia.net/wp-content/uploads/2nlryogpp3tctfhgkho7np1yxk_d7b63-69994479406/
http://newuvolume2.com/lfq2zsr/k5c4utqblnyklz0edvn4z28ownw325_xbyfzv-790289951/
http://ngoinhadaquy.com/wp-admin/INC/NMmaLgowcJmhrnL/
http://nhadatbaria.asia/wp-content/lm/QJExpwcAQpZbore/
http://norbertwaszak.pl/tmp/LLC/BQpvwHGKCQDvKNpfIGhqse/
http://onlineprojectdemo.net/Nationsroofing/FILE/u0ose5k5vtij3iq0pcj51ba8jr7_xxaqjk-9587131473/
http://online-sampling.com/wp-admin/INC/v9fy0a6vnqa3ghke31qdubs_l5elz5nsq-71544530327329/
http://overwatchboostpro.com/ynibgkd65jf/sites/2bmfkc0j7qe8_58yyhd4-3344823406/
http://pcf08.com/wp-content/esp/KvWYPbbnRWnjIbWt/
http://persona-dental.ru/Ultimate-Haxor/jq86wi5id5fgbzbpb5j8snurc_6xalnd614-190582300586909/
http://peruphone.com.pe/5hdf7b2/DOC/XGxZhPXkNKqiiGFnKeIH/
http://planexsolution.com/wp-includes/1ilfse85asv3s88b4_9zy17nrdy-6688870025/
http://play-movie.xyz/blocked/YzvEWDKSTXcafjESHSCkDNuA/
http://propase.de/bia/FILE/ptZVDCIuIlLDOepyAVQaER/
http://purecbdevolution.com/wp-admin/lm/65y0ghy2qacbnkg7v4_8y7ee5pw-6519195461774/
http://rajshrifood.in/wp-admin/DOC/1kw9cd6ess62hdl7ndq2_odev4x6-08464367783509/
http://raudhadesign.net/lywnigrh/Scan/xfhtdjgaowz2i4_quvpc9rg9q-348921002488736/
http://reflektorfilm.hu/wp-includes/IxdxWQGDRcoVGLUpVLYkrad/
http://republicanecroterio.com.br/cgi-bin/parts_service/podi5felgysizq_6egzj8uq-0480511470645/
http://residencelesarchanges.com/wp-includes/04FX2I29ZGPH/st6vav91o3s0vrzvbqk84_a0pj2ex-4071728036/
http://sailandswannew.miy.link/qsx/Y1VCW59AXS3AA4P/lTqxvIPUqnDRDSDrfJtZPvSwtcWiGC/
http://secimsenin.net/sh/Document/ao1h2qgl04_sb8xg2-3669366022/
http://sima.aero/aviso-legal/esp/8g0mtggj06s9fynnknpo_56btyn9-8064074803/
http://smpsglobaltrading.com/wp-includes/AMwivrFEYWcJWvWEybiA/
http://somersetyouthbaseball.com/trademark/xFpgxSRMQxoJhfZuMxqiR/
http://sopisconews.online/wp-admin/esp/voxrhn5g9i5uf3ijkmvqyo_9d5guk17c5-25286319/
http://srisaidefenceacademy2015.com/wp-includes/ZgiPrgpubIIjiUvsskedVzKtrNXR/
http://stn.methodist.org.hk/wp-includes/paclm/DiRCwDyKAicTtGomLsQAM/
http://susanne-zettl.de/emptycart/l1u1aodwcqre02d_bye6c3-605766707562343/
http://tapclicktalk.com/clients/DOC/yxnwvvy5wrni8vr0ofa4_9xshl2gx-804312145/
http://tapclicktalk.com/clients/DOC/yxnwvvy5wrni8vr0ofa4_9xshl2gx-804312145|/
http://terasdiskon.com/wp-includes/70ukxv17hpfadohp8_0grfdczb-87832073669/
http://test.wephyre.com/backup/8QU786M03HE/HTEiDRYCzlTEs/
http://thailingamulet.com/wp-content/lm/KrgzDpxu/
http://theamericanaboriginal.com/class.popular/paclm/IuiixzYpyLeeluMuS/
http://thefortunatenutrition.com/wp-includes/INC/v52zrunwac8ck4t6oq7g3_ny72vb-968513619/
http://theinspiredblogger.com/sitemap/WtBiSWUQGwdly/
http://themerail.com/html/paclm/3i4ayvnks81ux7cbviethr_moi5l5d0i-18563907119/
http://thepatch.tech/electionreport/47480700816/zfy21hb1wb5pj1v_qk5d58-80130453877/
http://tootco.ir/wp-admin/68195895123/zde5wj3jr2ry8qt11flm87rvru1_4lf8mww28-593565500034303/
http://unitedstatesonlinesportsbetting.com/d7928/FILE/eRxzJZyxWSzzJcVzL/
http://unitypestcontrolandservices.com/wp-admin/Pages/pBdEnoqjFNpwiNaCFMXzWmb/
http://universalstreams.com.my/4no/INC/xm1jwdlp7p4fyu6tj8wyppryu2e3_aund0xjk-62653393384/
http://watchchurchonline.com/flc4/LLC/kozz6eabsjf0df3zs930221bti_kaoeskuaho-104905663584/
http://wayuansuzs.top/yt81v/43IKS79MBOL/ia8czsgbkrw_cxjok-345811528191565/
http://webcosolution.com/dup-installer/7904776135/shftju2dn9yudprlfqogi0psep61z_hc5glj3y-6312486593985/
http://www.aaoleadershipacademy.org/submitok/LBPBKL52CI9/XlHOAYQhmQFarvbHBhQbXOqJpz/
http://www.acvehurmapazari.com/wp-includes/Scan/HnpVOmsxeNlbyGnwrDHq/
http://www.alertaempresarial.com.br/wp-content/dMdZvSBQYRdJqHF/
http://www.almemaristone.com/fc709/2ABSKYI6IQC/XMDdZncwncsYPGbxvFGOGD/
http://www.apartemenverde.com/ari/JaMRyepyyo/
http://www.arsonsinfo.com/baw/inc/dsw8wqkko851i2w_1umy2yl-685987851/
http://www.artydesign.co/wp-includes/TuSVCJIYEEtxDhNCNfyiSk/
http://www.barisatalar.com/cgialfa/Pages/y5qhqxar0zbk6zcfwhvow_z0vvvgqp8-4044048881493/
http://www.beisity.com/iq04/parts_service/HCvLUwhyQXgkNmVpv/
http://www.beneficamente.it/softaculous/LLC/65kqbob9s9ty6p4kvdjmwy5z5_yh35cexp-2207888895216/
http://www.bergamaegesondaj.com/wp-admin/wRnjoGikQJPXOndIEvQAGSxeC/
http://www.bethueltemple.com/elt9wu/NCEFJRM8E6C/btq08r6eu0j2kp6juqr_gwkc35-772058243057/
http://www.carsiorganizasyon.com/wp-admin/3rsqemibg6q7euh_ga3y5mk2-0241822430/
http://www.convertisseur-optique.com/xaivhost/paclm/juQikGgjKrLVjRpdZrLPNNtUCtd/
http://www.copiermatica.com/sox62c/zhpKvRNzRMZnGxZ/
http://www.cricview.in/block.function/paclm/5nt1xc4nk2mdm4jze2_tb1b44a59n-0908762582969/
http://www.dayboromedical.com.au/jygtv5r/j07aov3phy_ybt9lyxq-82887136095/
http://www.diamondegy.com/wp-includes/yvoARKmNkVtSrZIITA/
http://www.dipeshengg.com/customers/paclm/cxDXknmMpgJCGLrsXOHGoicZqWSiwT/
http://www.dollbeautycollection.com/subscribe/esp/3ok8vaq3kx7l9nr5up43or3cjzauq_geagp-3939994883808/
http://www.fenster-tueren-hamburg.de/font/parts_service/zl65158aed1jut1wvp6ce3po_m613t7z2qy-23922787292/
http://www.fotisinfotech.com/calendar/591221349756/FcamDeouiBLX/
http://www.geoflux.co.bw/wp-snapshots/sites/TAcggdYBudzROraWBBwmgcj/
http://www.glamoroushairextension.com/redir_mail/Document/kShXMWxIJhRoELoUsEFRMo/
http://www.globalreddyfederation.com/showheadstone/FILE/9c3i8602qj0y2aza932b_qxc5f8t7-2953719888/
http://www.haircoterie.com/wp-admin/sFfgexhlfqMtMaqkkL/
http://www.haveaheart.org.in/haveaheart.com/esp/g1qgmf4vyjg6ktgbrp_dfdcxo-224311742/
http://www.ikwilstoppenmetdrugs.nl/bjgk/Document/vvFCTRXesylo/
http://www.ilion.tech/9t59i7e/lm/ie6pzr18kd_f3faf-43169793/
http://www.indianmineralsnmetals.com/wp-admin/paclm/atkfzp3ifvhsi5_ff1jd0-495395954/
http://www.jcie.de/wp-content/sites/re3jpzr4ip6u81gt39bnydp_j5tl3he-76534962/
http://www.jphonezone.com/catalog/Scan/iJyTvexdhwbIkEt/
http://www.labstory.in.th/wp-content/uploads/paclm/8wir284b2zbdmvqk98_jjmnralgm-76572020596/
http://www.lavinotecaonline.it/wc-logs/yHlKCeOlqUfc/
http://www.luzevida.com.br/catalogos/banco-imagens/esp/jpPeetTBslFMYbMWyoyfrHZTA/
http://www.marra.agency/rdwgwqg/Document/yVAZDWmziJuMsmfrEDYJyGgNTVdd/
http://www.moneyhairparty.com/class.local/parts_service/l08vz9rlsq1n0l9_ot5almv4cm-275176722/
http://www.mtn-ins.co.il/jo6mj/parts_service/3z5umwgrag1jo7piifplyypxf_l55e97t0-758367702052/
http://www.nacindia.in/wp-content/Document/BLlvvglUKWRQodAx/
http://www.negiotso.co.il/wp-content/DOC/gu8pcxthad_5w3wfhl6r-37256897/
http://www.nurturetherapies.ca/stats/LLC/MkgrmiiGYaCRxRBfbgVUwsxUr/
http://www.okiguest.com/host/Document/3bl9lt32k3l14qvqxt7p_o2tnrcy0-773672729/
http://www.omurakbaba.com/awsioftp5/LLC/LSJfnenKDGpOsgvan/
http://www.paparatsi.club/wp-content/ADwlQQbulGn/
http://www.parikramas.org/engl/LLC/3ah7g1shzd0n4lg7db6_mv3xpum79-40795232/
http://www.pristineglassmirror.com/cgi-bin/INC/SyDcaBFPJdwQpt/
http://www.salviasorganic.com/license/INC/0fbsvvw1uzkhc8nf4x8hiqoa7obf_8flumf39v-3657734246364/
http://www.skipit.cl/ynibgkd65jf/1937595848468465/hikdahtt4zyu33so8klnk6_ago60-94537216593935/
http://www.smpsglobaltrading.com/wp-includes/AMwivrFEYWcJWvWEybiA/
http://www.soleilbeautynyc.com/config.noon/parts_service/vxs1bottyi2u_7wf0pxh8r-84007613556759/
http://www.thearkarrival.com/cgi-bin/LLC/ylrgoja9enddh7s_0mzp5b57wx-9202647759509/
http://www.vvsmanagementgroup.com/n0hs/sites/lxr1pq0892y_hfwhs2r-552354839089/
http://www.weiyushiguang.com/wp-content/esp/dpCQMgzOyBTjO/
http://wyf.org.my/1ax/parts_service/JvdnrMRYEeNbppDruhUdv/
http://xn--80aejfgqq8aef.xn--p1ai/wp-admin/ZQ4UACK2TTYV/obh0t6c015hdkym6kf1ye1el_zsgfm-40589087/
http://your-event.es/newsletter/GLHEJHWvnHZZKWfQNNN/
http://zenosys.net/wp-content/uploads/sites/YPnEGkApt/
https://aajtakmedia.in/wp-includes/js/tinymce/plugins/hr/ndnaRzhWofpncrWIMvqABN/
https://aisect.org/7382321/LLC/ek4ifez1owg6rim1_0euh470-0264765781/
https://allexpressstores.com/wp-content/Pages/5yehsssebl3kihksw2b43magovf4me_h7rvbx-3275981900/
https://alphauniverse-mea2.com/wp-includes/lm/rq0rfefv_ifzyb0-4133554223659/
https://arewaexpress.com/wp-admin/fxcDxjiCijKxHrcNzPQymDUAwgS/
https://austinlily.com/exceptionalnews.com/esp/wvMHMSeXzdVz/
https://bayutronik.com.my/wp-content/lm/fzbngsllpv388227hnzzcb3a_w6x7wsbrbo-15585690126895/
https://blog.jainam.in/wp-admin/Document/rweAAfIYkNPFIfz/
https://bondbengals.info/wp-content/DOC/d791lv48m442qbv8tddodhjfmbs_dfsa5w-33037959677424/
https://centralcoastbusinesspaper.com/track.config/paclm/dDidnqMOzFjgNExvZwjjKc/
https://championsifm.com/qvotoxy/DOC/wryNTTLZ/
https://collectables.nojosh.com.au/wp-content/SYqlHrEWUyQ/
https://creatarsis.com/wp-includes/Scan/8u8xdhkrd0cenccr6f3lblsms3c5_ogb3u7a-16925328382795/
https://culturalmastery.com/mt_images/paclm/tmdFgvqJFirVbCDpLw/
https://dautuvenbienvn.com/wp-admin/v1je27pxxzatki9uw58tib_m2r21-869536710/
https://decorstyle.ig.com.br/wp-content/languages/Scan/za7w63pg79e_f4ia5-01669369/
https://dewibebaris.com/wp-includes/parts_service/85pmg8sr_2cod63h0t-58924151/
https://diezeitinsel.de/wp-admin/Document/4b1hs7073aq1fnmer4rv9k6f_lmrc8inum0-887675682613/
https://doccando.de/artworkoptions/paclm/9h34n40bluy2r4i2t_gai71jhe-72695553514070/
https://dplex.net/wp-content/POZ52G58VLEVNE/dr1acb63nl723fij9cy53d64u_benhukrxc-225456009668510/
https://edealsadvisor.com/0589623/LLC/5ppdqz6unzkg67di1q0n_npcrhtdq4-34656834/
https://estate24.com.ng/cgi-bin/46888948420828/ow46cwknjulmy389yix_8p8a6ent9l-4970654724950/
https://flipmypool.com/seeing.class/INC/NWGlRGuuQelDJZqtVrzCUtswYpx/
https://hebronchurch.ca/dup-installer/INC/9my2alz53ycdju6our50wnufx_h3anzt5s-63739670/
https://immopreneurmastery.de/3u4ck8/Pages/14dbz0v3p8p_k6samkh-72286502/
https://kalaakars.com/product/paclm/OsgsolBLaaLPFKdOlJwXMYkSHxBl/
https://kbkevolve.com/wp-admin/zjmxgadhuv4pnbzp7ynpdoik56795_gwb8z-673046389663526/
https://landing3.ewebsolutionskech-dev.com/hvgpz/esp/dobh6pgi3myqnq_4j83s7r-303897442189/
https://letouscoreball.com/wp-includes/Scan/ioAnqeYjTSoSxfLIPWmBWVzdIqwtce/
https://luaviettours.com/wp-content/SPP6HNIKFP0/ZbRxHCDvEKEmnrYiE/
https://m3creativemedia.com/780a0b/4nuwnadjz4_45lhp-76334341292/
https://maacap.com/efqce/7MBUVNPO3/zwNPEeZJxpJkERimLb/
https://manhattanphonesystem.com/qmr/Pages/gvzsjjrub4y0xzploqlz6h3zh_kll5bh-3307302776/
https://mbve.org/cctn/Scan/jog52jas2_i4bs9a-22970863048126/
https://mediabook.ca/elmar_start/CtXQNPXUwFpvogICOQWxzDSwIHb/
https://michael-rodd.com/wp-content/DOC/17gopy0323uc_m0kmn-06583977130834/
https://milwaukeechinesetime.com/function.cheese/vHmHUDKXBfcgYtvnXicxWt/
https://minimidt.cm/wp-admin/vEewXdPlIE/
https://mododimarmi.co.uk/balloon_lib/Document/bUxoTshGBVombMuVRnjDwRoPbvyi/
https://myhot-news.com/cgi-bin/INC/FcVUENkzKBTPCJEVNRmBwfw/
https://newhomeblinds.co.nz/images/Document/0llybnsxc8rokkw762ye_s8y80u2c-23896512673589/
https://newlifemedia.net/wp-content/uploads/2nlryogpp3tctfhgkho7np1yxk_d7b63-69994479406/
https://newwell.studio/test/DOC/NtnDpOmWbTdPEdBxrLyy/
https://ostriwin.com/calendar/y52saoini1zrh5_2a2lp-58962777/
https://otstcfq.wufoo.com/cabinet/0eb493be-f173-4836-9804-d7c4ba0b30b9/
https://parscalc.ir/academy/RKWgiuSOZGpFVpIf/
https://pasban.co.nz/ciawl/DK8HZX359NEHH/cvMAJgVUDbLQRGyWq/
https://prestigefg.com/wp-content/parts_service/OHxabmDglAbmKV/
https://raudhadesign.net/lywnigrh/Scan/xfhtdjgaowz2i4_quvpc9rg9q-348921002488736/
https://residencelesarchanges.com/wp-includes/04FX2I29ZGPH/st6vav91o3s0vrzvbqk84_a0pj2ex-4071728036/
https://rotadossentidos.com/sob/Pages/goynn96tut6_msk2u-42620833/
https://sahnewalnews.com/wp-admin/paclm/WhiHuDrFSLGMvltCzrg/
https://sarkargar.com/blogs/DOC/3cqjiibat066lv6n0kevsk_26v5gn7ga-150219060/
https://semadac.com/ss8m/Pages/qirbjcf12en2neqczsmjepztygj_ra27nxg-853799018859/
https://seven.ge/wp-content/esp/OXuiYinvhNmDix/
https://sopisconews.online/wp-admin/esp/voxrhn5g9i5uf3ijkmvqyo_9d5guk17c5-25286319/
https://sudonbroshomes.com/chase-login/LLC/LkAeZgQomHrGMakBZv/
https://tanujatatkephotography.com/wp-content/uploads/2019/parts_service/pt217yhsveb7e923gdhu_ueaman2-448927697411/
https://thisissouthafrica.com/wp-content/esp/cIdlOwyKFrynRbDcF/
https://tizbiz.com/8969544/Scan/rQsqZcVwoTQrYN/
https://tradingdashboards.com/wp-content/5s8qxz9ndr8_qvlsoo3tdp-991967836352/
https://tweetperks.com/lbim8w/BSeqrBAbBvlXfBPRWmA/
https://vivesto.it/wp-includes/INC/yrjn98qxp8vt9nxbqxav9ckeepy4w5_w3w22a405-01911972831/
https://www.abelardadvisors.ch/wp-admin/parts_service/2q48ufgfmehx31awdw9_y8q4a0svj-349987752/
https://www.billboardstoday.com/browser/3kwuoqci23nt4hvu2v12c_e4a4a00xu-72996516/
https://www.cricview.in/block.function/paclm/5nt1xc4nk2mdm4jze2_tb1b44a59n-0908762582969/
https://www.dollbeautycollection.com/subscribe/esp/3ok8vaq3kx7l9nr5up43or3cjzauq_geagp-3939994883808/
https://www.dunlopillo.com.vn/wp-content/plugins/advanced-custom-fields-pro/parts_service/xIlpOmdKhSwyNwCXKyNID/
https://www.flycloud.in/traveloguespace.com/91635264599347/u8ucq03z7z76c_trb4t5oj-66656779/
https://www.glamoroushairextension.com/redir_mail/Document/kShXMWxIJhRoELoUsEFRMo/
https://www.globalafricanproductions.com/init.bent/INC/94gsdyo8a2mcffjb84iabs0v973wo_o72z8dhvrh-08376968703760/
https://www.gravitychallenge.it/wp-includes/oVzOmJgaFdvVYIqXoumSFIqtzbsoT/
https://www.haveaheart.org.in/haveaheart.com/esp/g1qgmf4vyjg6ktgbrp_dfdcxo-224311742/
https://www.ilion.tech/9t59i7e/lm/ie6pzr18kd_f3faf-43169793/
https://www.itmsas.net/wp-admin/Scan/0v54fipdh3twy3nwdu_qakbc-7002424175484/
https://www.jcie.de/wp-content/sites/re3jpzr4ip6u81gt39bnydp_j5tl3he-76534962/
https://www.knowit.co.il/wp-snapshots/44DP3D41QPT27/vqynagkdt6pqx7jdrjxvo1c29pn72_93l052mg0z-688399223/
https://www.labstory.in.th/wp-content/uploads/paclm/8wir284b2zbdmvqk98_jjmnralgm-76572020596/
https://www.negiotso.co.il/wp-content/DOC/gu8pcxthad_5w3wfhl6r-37256897/
https://www.newuvolume2.com/lfq2zsr/k5c4utqblnyklz0edvn4z28ownw325_xbyfzv-790289951/
https://www.placidocn.com/wshv/parts_service/ouojUnMsLdMFDKKXHWQCCAovbY/
https://www.soleilbeautynyc.com/config.noon/parts_service/vxs1bottyi2u_7wf0pxh8r-84007613556759/
https://www.studiomovil.com.mx/wp-content/Pages/ifcsx5toe_n4swmea-525270872885/
https://www.studiovista.fr/wp-admin-srcbak/qWDjMkTjbhptogTdapUlO/
https://www.studnicky.sk/f00q/04374738547357/ZEaOqSiZvgLiMxEhocJLq/
https://www.urbanstyle.in/wp-content/DOC/22wpiv8sxio52tc0qnd1owt_dqvemyo08k-22837492/
https://www.xinlou.info/wp-content/FILE/iKPpsIIqcWH/
https://www.xuperweb.com/og6pj/ctvn4fzzpht8r6zgj3dnpq8eefab_1llkzbapl1-01650495/
https://wyf.org.my/1ax/parts_service/JvdnrMRYEeNbppDruhUdv/
https://yay.toys/wp-content/parts_service/dr3unuutdshdmmnnb2k1o20c4_1fria-89718259422624/

<none>

Payloads per Epoch by Document

Epoch 1 Payloads by Document SHA256 - All Times UTC

Creation Time	2019-10-10 21:35:00 (Attachment Only - Doc based - Offset Light Blue)
SHA256:
923aa562d73c993ebf216e933fa04d0b596ac89e107a3c25f544971995c2f15c
db0e585a883bcfab2b887edbc4a0e3a43f89dcd61d2dc2ca6391dcba2c1d9138
a983d9f1bc31012a45733adf5b695b4b7485aaa6f2a4c276f1a81b3cfa27728b
ae5f8f439a64a1e5196a3a6afe07612506c4179d8aaf624d574fc1d157b9aa20
962361622bf5fbf25fc3db218944f9a2a4b0ae6da81b56b6be3cccd2f8dfc551
46fa9477e05b9070228497153b8cc4f48c51968ade543a817ffdcfac4d494fb1
17e906db449090cdb7804b46ef96ad5601f0be6bcab5755fa298a7f514268795
bb603fd76dda19c0934c12f0bb8be14cd35fdf61ba7d165c8e4ce135209d1df2
263c576d0e225282831d94663cf3890e607e622c1495e46349f6db5f2279ebf0
6b76cfb62fde46d91b72d988e975aa6efb9d3c41f9ee27ab07a95cf1c8f66091

http://mayurpai.com/wp-admin/lb8232/
http://mastersjarvis.com/7eds52/14/
http://lagriffeduweb.com/clients/w9pw59/
http://nyc.rekko.com/65r8ry/zmt61884/
http://onickdoorsonline.com/wp-includes/g0uyt12/

Creation Time	2019:10:10 17:16:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
7688865f59031fad99bc4fba4be6e1b9739534a4972d6c074db5f6033c06df4f
6e33d7abe6c021c4c8e87bb3a7046031797430046c347720d2249e2fe65e5d8c
eef7a7cde4f121a5f250ac9e6dd2ea3b620d8c90692bc681a8fab8c10947cfba
615b8d7d2d54ce63c7d42fcba6d3c63e04ddc4b6ae3b5f653ae089de9bb521d8
c3f37c822acc9713228c1a052f2a56ef91d2834023fbc100f4599b2cd5416a94
b23298880753492db0636e032a62ee8c9ce79b5ac08d9b2e55dfd79a73f8801e
34b117c7beb1ed70c18fbc8ff128ed1c0925ff9d8da872adc2f19aa505d44fd7
65b614f287c9f4afa6874dbd82d0bd2e124dbced94097e8364d349abebf48aa1
774e846d81fcdf7d15c7e5b2c88aa4decfc5b126155d0a7e6b6f5c9ecd08714f
afb41174f905db01a0a020c5d693caba0208aebd549ed7157f8482e7e24ce14f
5bcc3a2f03bce3653934a2e2c7af14ef60463489ef34501df3d3425047fe0437
b09e9030d3ec8a5a3275eeea01c793750e8679bdc76cb93c037a9f7ff32fe083
e858c559bbda58ee38cebe8a7aced98533c0c3a07a7f6e687e29a0f82eb7bde1
d5f75ac3ca6ce4a8966ec144c870d6159578baaef5f2612336647da09c044fae
44efa5ea90d98f01bd0bf685c2d1ea0d3a8ac6fa04596f91a76efa8c3f27c10c
42bf0d9ceadc2e9f8a23bb894ced3dfe3e3a6e9dcba4bc606cd08abe868503a8

http://icfdelhincrchapter.com/wp-admin/rp39/
http://newfaceproject.com/wp-includes/j2irclp37/
http://youvr.com/kieue/h789/
http://test.hotwp.net/wp-admin/qa0/
https://phunukinhdoanh.net/calendar/uujy7/

Creation Time	2019:10:10 12:22:00	(Attachment Only - Doc based - Product Notice)
SHA256
0d221bd0403b2fbb8fc1f82230c769c04bb1fa5a521e24675a55614cc620b25a
a204c72dee930b6b0ebb82f00571f3349757389507601bbe3a0debf2e31553ec
ee83fd2db43103df8c87ea3361480a6bc69ef93dab1470865768836ee8dc89a4
cdb5b3e18613689f525b991774fa4b1835d85d529c6a74f0361fff99eadd00d6
451d9392f1ab1e9b1e3ae3df489b17598fce307da73f998e94c3ff4704a48136
93ba4b575a197818365a2538dc452bc7fa6413e3d73da831c473f2e60b139176
0d6407f6199938867e94b7105c4bbee2ff8ae5a075dadd29a5e90a7c7e23ca19
637b942363d5da7cfa3df82bcc6c1969fe1208b89d60772e3a81556a5a2f9c13
5d48e06cdf097417ffcbd977cf46eeb726bbe257d0980ee4494f76f8e3788e3a
495ae78e1eff273ba24b02244432739479d22377a3a7c8d66471959f7a2d4012
b38771ce67cdd70b86ac5ed697254bca80c725f2c781d65fc8e030ac935d33e5
9c827b75d9ebe07826b92036713cee4d424c44422047b073b0395fb33e5c45df
adc210eaed4070b3f9ebc7899b55503946690e18a3ac61fc6e58f0718367e20a

http://shejipxw.com/wp-content/2m94311/
http://www.sirijayareddypsychologist.com/calendar/l8/
https://physicaltrainernearme.com/yabu/b36593/
http://ahenkhaircenter.com/blogs/fyte735/
https://www.compoundy.com/scm/i7smj4858883/

Creation Time	2019:10:10 06:27:00	(Attachment Only - Doc based - Protected View)
SHA256
f434db17dcf8dd96368dae565e3389867e8b51621b428d795534dd989acea277
132491f7955f49ce6a3bcc4161690ff6c20c931683fabfdeaf502077054d75ea
715e126d1c0f700989ee8da76da4d43fa222550cd397dbb0d141d761d6f1ea0b
eb75c82b4b26392f140370de21a4b25413a678653affa79aac4d8142e69ea9c7
751d9515ba3972bc42722b19b21fa2221c05675d253227409e745ce78a9800c3
679a9ee93cd05c3f7e720edf385af8407d9f05bef407071804cf3761fc33aaf6
bd0cccd89f1221ba0fda7f9e8fb6d57a0468bce7c0c0624e5b02212976cedc6f
2ff31302e1b0773169bcb1bd35a15c1fdd9108c54971287fe89490eefb3f74a1
1be0d8e0f2e4fdb7a921153508d2ce92a0ba7bdbb4706d27d0525b02e9d5fc80
d7cba0e5a13683c9746c528d151d9dd7dcc76e8bbf3e7cde45cc93d894a18e67
bdb68e609757e3bf67b23ac92b528362b635766ff2c86a81561898473807ef24
d0dba39a79dcb1b4fddd995048a26191bb171498d37866fdc9e2051b97e30c59
729c457610a42643c40c8d31b2f32e6476c09187f0226c915b6060a9cae3d15e
4094d62a7e029718d84659d0ab0fa015cafc9ae4c06d7dd757182241ed892ca5
3a85496794f6aad4ffe7c9e8aea1ddc15d52f3dc98ef91569379a1c1ec1a259a
279f552bd97c28555de00eb102b8069035800502880c55897b5613b9ac9571be
0599e3c97c2ea8ce04aba6767052dcae972d5bbebeae6bdf6c4a1b40bf6a83e4
9bae3f6e34fb43c7b02f450c118a1f81c47119d9e6c5863caff11b581ea58e6a
6d9d4247a851c82b9174bda7e397bf41207bb81a2bc9b1e0d4695b867c62f4bc
87d07ea9bc6ab819a4ca20d629d1a0addf883dee9efa249bc6c8ea0899949809
1b4067d2c7dca9c165cd93ffc8214ac855dc28de689ffd14cc2e3e00190520a5
fd7c768bc57931e1b7dffb6c37b6744a2cb42542637eb05f3a528a1e3e90427f
2305de577b36ede791188390c0a8643b21c771c591c47706e4d7371a1b1b8ac3,
e1bc0e7385a97cf6ef36f3cec48869a15d03e268fc07b9b72b91a475c20befc1
64ec7b60c3520a85960986511c6050ef87c989bdcf792ba78589304551ecf337
642d7a46ecc29127fe5730c6860f66424d4822a552c567519467401274e0c65f
915c001ed2fca1c1f8e00f2518ed1a471c8d9c48677686dabddd0f82f8fc48e6
d7ec97aeb7b0dfa5e4e59c49bf8014281f9ccb85ddae7cd294713ed4e9b8e1ce
d6c29e13c04d715919cf820b44b7196782fe1b521f34d1adc9ec445644b8d37e
0e0fbbc70c88cc0a09e7e115cc4885bdfa29657fa27dbe64b80522051000646e

http://yukosalon.com/zoom_pagetext/kgd8qq455/
http://movie69hd.com/cgi-bin/6riuc16/
http://rankrobotics.com/z8y3srjng/8sgaqh484/
https://saigonbowldenver.com/wp-includes/xpsxn453696/
http://matrixkw.com/framework.fat/s154/

Creation Time	2019:10:09 21:14:00	(Attachment Only - Doc based - Protected View)
SHA256
e25aa1c6dc675c245e9ce83b43b0b80aee71865e9d512d654e3f654dcbba9287
0d7dc3e10c42a192c2a6d5193632d716fe518254e16a81e8751740ebc5db6d1b
3aa6d1dbf04cdb7a82aed0cb3b736365d6c5b92ab1f24db548c90b91443d71cd
ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a
e46e631a00ac65fed275d1a549fe019dc9bb88dff591056e76cbb14e28c2df2b
e6395a5a50b41bf7299e1ab40ad8f1dec740bffa4d2ba873682469db48152711
e376f6eab1e726f20ece6c7d17bbeae55c86e2da1796cae01f709cee66d73e4b

http://bluelionconflictsolutions.com/wp-includes/5sk54068/
http://www.winzerhof-kridlo.com/up/gqfm32861/
http://www.coscorubber.com/lzhfb/3lzijk275/
http://huyndai3sthanhhoa.com/pictures/p9104/
https://wearetxvets.com/bat.function/p1bjn92466/

SHA256s for Epoch 1 Payload EXEs

de12d95682e6aae296780972f42cbe9cc8dc9bee5b67a12117f65bf834d3bb9e
3f8636ad9a13e21a202b2fcc0544dca9af27d49b983d0d0280b68c5e759fd47d
53a39cac95df5873549dbf3c3c55a98c7d7fea9f09c9d5a32e27754941762fc8
8ba772fb7ad09ea3b1fc3b3a8c3c6f1b51eda05febe1e73fadd38008ef60d1ea
546c604339d0285a8ef648f0e539d0c678fd78cb3b58a3f025010e17fd6dbf63
f1e2e1a9f542954c017e627cedb9ccde92ffe466e7bca9b37ac18f5d41abc495
855b5de13351a2d49832b3bcf7bcd9c6312ff80686ce6dc851ea83cbc8bc7b51
d16c5603369ba023d716480ad50ff02346f6405c8502ec701a21892955f1838e
a0e7bd875c71c47dcaeb2112ff55e3767bc844e0c7e8e17a307ae83da6b734ef
a39ddc510349c9593a81ca67b7b1ddbf536f5f6819b65ec5c585a40fce51ab90
a336f962b81b678e98e4e8e0f4910eb276e3d71168c2e0f12208219a47e1a686
627730726ef79d9696ee7da9a85d37149944f8954d70144242249fea001f8e53
a1d4243b1e2380d5fc9d26ea036bd00c39f09cdcdfc1a3d2b699b5fc15cf29a0
800c0422838cc99b849010326ec0b321ca5087f76f8b3479baddaa089073038b

Epoch 2 Payloads by Document SHA256 - All Times UTC


Creation Time	2019-10-10 18:29:00	(URLs - Doc based - Activation Wizard)
SHA256:
51de13d18a23740342f1c681de4cb6c2baf116f2a4df4730c5338439d05823e4
cd50f080071ce929b19dd7b3eecec9733568b07e6957093495e4997d8d7a8b82
f2c0e019820d4117ea66130362fba34a0dfed13ea37af7571de1d6b7c5aa3b26
7bb9b68f8f2c198f14e3d91780d43c593393fe8034f433553c9f06af24c015c7
5765653c411b563e92a30898c514637925c02689f725060dc381b89970c978c4
1a69606cf0840a07b947e7df0ded36fcfc0608705f1ea012b4c4e3120b483587
2b0c664a1359b169fa9571033baf8dee782504bc9622ae222daa16fae90721b2
1805c5e9bf3e64f88da5011beb039fecdfedb527c2626c7e4177d0da307b720a
4a913d6da563604d246a53c01a1652da032d6c6baf9fa1bfccf650635555f97f
eafeedc8839f64e7cc8c2dd9abef1f0934b65aee4a5716e5637acf79f7083f0a
4277656fe048a7d3e97c9fb31fa53433298685052108cf25476b1af499e035ae
47cad341e26f67d00adaf1c4e3d0adf77eafd64d24999e35500e364f046361dd
3703388fa4515756bfa53d35d2647585d591d9d139280626688be604f01c03f0
7f2c7675233854bd89d4c5b6c996c7db8a0cd0b3fc308f2f070582e5fe8f8dab
67b1e99b44fd83aaa03006e5303a3b316a2f160a268ea0f795843ff4539162df
4c8c254a985b48dd350a48233cb4c4b5b0c0348da8bdb14a3c85a6d2fa1ed6cd
d991037ffad59a39f083d639f92cb6118a61e3ba9393518eaefd57ec83639f7c
c7b8721e251c5c28e251eddddfd6610d672414d865b565bac7a4beac5491da20
75eae2ead8febffb89de4e0e64e3d9c9218cdcf88f83c46f3e1324277fc5245d
bc6d39faad64e70a270ea4eb06fbcf05c459349b21ea6420f3a04ca23e3cfa3f
5d4f9d41ecab837351a5bf4d2ac648445b8924dff82ae190d2351a38f8d055f6
5abe8af115d25a49da2b007f9a0220518b72ce4b5ba70f6f243157b240c15182
7a8a800c29c6e9dbf732d98fd5eccb9e78078101fee30d287dc534e83e58a22d
c8fc8eedc4b906accb507c39a0908bcf54bf11faadbbfe538d843f3638ef893d
05d14619cdcd8dae51822a8d3f3a75b32079d847599bd4d1a0094102d4a5bbdb
3bc2657e10bd3903c7b664ff44f62850820078cac38f7754e221b2d8c4bc14a6
28b1c85db8cdb72c74bacdda32cae7875242b6d1edf64f3c1e59a65b7cc9be84
2753a0cd0657c6f27d94db062e5c81bc0c69d3457466988344fc4503e454e989
bcd7e39b95f542b595657d4aa46921abc3810b0ad7643a70c5f9923c3fe9b310
59dc830b757405ad4ef615e6aa82138d705457003e19f7eef93835522be7f6e4
29a7a07432b8d3c57b39baf0a762a029a712261b3758edb97664ed731fba09a6
69b8455c9b970f38183d195610f8e2f4da9ad874ab48c81358f719523648dfad
cc88b6c2e36692379df13967b38df23ea41e6e39403ea6da5bd20097c74d4142
edd0ab17a61f95c20b02d9c7b58ef29911fc287846fdd80d6804d7e325e6b4e5
96d72d099703821a74e753df4760328a454da48615b5ace2be89e19607784a76
c930400ed0dec9e94632ca6948b2d698ce79c6ff3107f847caf9de43c26dd351
33bd1e5d97265753389685d400934b69456479b92137b4b4ff0457e83e7aa8cb
f6611b46795d1ef7c3a0cd4b8825f83d53208e149717b71f974ac677ca60b15d
2cb745a4b6dad2dbf5d1bb957eafc712dcc036d0f08c537d181b9a827fc780bd
6d99e2235ca65c98acb5050d070a950abb75bbdbe9b26f52eb7dbb33eafbd51d
ad9fdc5426cdb06aeac969f131d4eea70affc6b2502de759d49b21abc44266c6
69fa6b2b52312b8aefd0c77695a215245b8eb499b0904bb31e1f9ede0153fe74
803eb60e4df6ced789199f41674ab0e5521dbb469d32ad3a2adfff2a7a2da2d7
b7745f433b2c7192fb3046e409a0980d99285091d2b24d06aca42ce9446f58e6
4b3b82528bb3f6821ce111a4e259e647bfac86d185e47dc0d2f944eeb43fe54f
2edaea083ea39aab08670d19867627d5516f1f78efff05973e3524c3f897a4c9
5869c20a1155e356df2e421fe8cb776cdddcd5569db139b5d3bd22838b4fd03d
f3dba837ce0d38f03c35ec6846ccbdddc138b2c143e4b0432972f19d093f8132
7934a02c57781568f6258b7f4905f3ad42a5b0c6bb5ef0e47a1ea5570abf160e
e20ff09b33d6b5cd78f57c88efc47460a47b6607763a173515832446c9ecc8d8
25390620f0790d79b23f2f13eb4be04d1f9c68b64c682fa7d5d4b15a344de5a6

http://erakonlaw.com/wp-content/QimayJuMY/
http://careerplussatna.com/wp-admin/YnKccnhZK/
http://rameshzawar.com/3ljj6/wQstveMAGm/
http://planetlancer.com/h8rge/kim66_aeqna80-2085/
http://pradopro.ru/wp-content/abpiVEof/

Creation Time	2019:10:10 17:09:00	(URLs - Doc based - Activation Wizard)
SHA256
96af53941f8fbbbe87f3cd46bf4ad73cb062394a5181d331870175373fced8f7
a44b0402075657c66c8169e23ff457230a6e4aab8aebd87dd532f093e49253c6
f9bec21184263fe51a9fd6c0ad64af952b6bad52064183e4f4750d3b2709f4ee
edfd42ca66e5393b211a778b4bf380afba3e6cd5eaba8cb299e4150c472fdc08
f61b3e7db47761a36ea24ecf8d0213a63cd82d07d84c422f46784f85275e04cd
cc4e1646b1d94db4dae3f14ca2a85a2c46fc3ed193833e0913959b4a07904e64
759b57d56dc9640c7f662d3b1db90f875ef0b792cb5b6cfd6591188b773f5d1b
fbc357aa40ab2562160015ade1c8fae070350e4dbb47ed2027a3746b7f440260
31abbf44ab50fa31999e319d0c37307ba318875680c16f3495c504af367c414c
b42bef60b590a42952b0473bedcadbf27b0aa9cb2c6206d08aa1271579133dd4
8a55de0566e608798651dff59eaf776fc3a270c09091862fe1e0a089a9a68122
1f633b1402f3769a4fda45dc3847edcf788f78c084cf6372e9844dea70d26eff
216648c55add19e80e69f2630f32dfe0472678bfa6b008ebfa57b39cad76c923
88fb982b9c7ad41f2b47c0b922006f7daa76adc2c9b8a6390984b203d0bd039b
705e55a252475b5ae7fa7258eb04be795347a8eeaa929dabe7660e33ed392264
9b3076d6ab321a0bfc1762f3f24fa1896f3bcdfdc9fe22081a37a11a92b4ff74
7657b42d463ea006a8b99406c26750715d40eac0eb459d98cbd0fe00c36c9891
acd5bfd3a6428ab45915fd656e0332bdee3cee2a6b9e9b5feff87219824bcc63
d60b43ba75369b8dddbc1b3f55ae4fda81cfce9f5170136d468d3f6a5f6b7dd8
a7a264ccf0cc26cd634fd36fb69a4c4159fbbaee19e5359b73c42fb24f7465bb

http://erakonlaw.com/wp-content/QimayJuMY/
http://careerplussatna.com/wp-admin/YnKccnhZK/
http://rameshzawar.com/3ljj6/wQstveMAGm/
http://planetlancer.com/h8rge/kim66_aeqna80-2085/
http://pradopro.ru/wp-content/abpiVEof/

Creation Time	2019:10:10 15:19:00	(Attachment only - Doc based - Activation Wizard)
SHA256
c7793eb446a13dc2e3b9c1866cc502f0dcab6cf348aad511b3fdf854223dfb76
ec9b8c4c18d6d7df6aa6454b491115a916ca58bf65cb779cc10fd44dc0bf8fca
5f22097880db3f3d7a6a3adcd34a05649f763657fe60b8284a36fceb1f2c85bd
9f99daf42dd0e33f0833305943b8203fda8dd72695daebc6fae1cf7002229e90

http://www.3uqp.com/digepay/ihm2un_t9pa7lcm-84/
http://sachtrithuc.com/wordpress/38f4u_zfdx63-0930031795/
http://fortwaynehoney.com/otqbk1s/6u4p2_k0pjzk-2/
http://www.bellameshell.com/images/w4img4_5rkj1v7-5589/
https://www.orangeph.com/igvlr/g9ply_d05vm2o1-5015874/


Creation Time	2019:10:10 12:17:00	(URLs - Doc based - Activation Wizard)
SHA256
cc82bc7177f26107263871628ac0c38e385d8f26010182f0f7fd6352221fca33
648044189958f2be69147f756987c4cab3661b21dc6a9ad253999574d771bac0
3942b4de811dca7c8051b90a697b2ab6b02c5343a8371d624e18f7a52d139ebf
a9c3dd24c5d7018ede1f2c2ed330ac15462510f7bffcaaf8badbdb5a4da623ae
60a3ab273bf73aa16177ecd31ee97aefbf7f54132247a8f298a6e0e287846e7a
9d6d3b7ec9ba54131e3b88d4b90b82620e0029aa6b57101121d1e0e9da953663
4bc0df1dcdaf2a6ac0d1d206b3ce9c155bae17e5ed4ea69bc2e398ac1c482747
7e5c45cc547d770601dd7dcc29186fcc8ad1e00dd7d36ac9d58b9dd279998ded
396d30709bc95e4e35aa4f3555c72763de26c34ab5b2eb64b1712d287da7ae9e
306fbe60d6e5c2929185e9fdda314b6ca8197e1ab290de1c141316e71dae6ae0
6be777f2b8c34feaf939fe6e2732936d1b70f7e8a72ef9ad07bb38b42fb68551
6fdaa046ff8def5c39cb32e45cb3755f9997d46fe8db480f1659f6b48f9f9bac
1fe5e2ae5408346d3a58f16f3a7e9244c54fd3c5b05aede2528d9e5ba5a0ab6a
a6e2ec848c64ac67cd536f7a29d8eda5b141bbd186ced563f1db1ea14b083a20
be39e4aa43664168efc1aeb58e4358b2fe134ef11af07a3c6897d5dcaa11e175
aac883d0daeda79034fcbc800a7ca2186dc19476dd16f278e6fcafd3cdcc245b
f75488fdecc020cb293614a8864c2108c3406975002d525853e3e1906cda5125
86b8b4f6962aeb0aa7ec20cb11c345340fcbfa394b651a238e989de896065584
3b9680d5e9f1d2b2799727a9d12e7c1b5f19588cc8ef34f4067265c2a0922ced
0f12f82eece2cd8d1e2c781476c2122fcfd974cbae0cbc80ed542aa4d6904c27
5ce621a996b4fc882f673de2be28788ef305f825480d8c194808d8ef25c8a1fb
b95fe809d7d628b0f222e07defab508432feaf10b7793dbf665671987ddda6e6
5111aee3697b7e6d97f54f97bb11bcbaedda8eb0a8f759e5fb491853b4352c82
bbf26d1a93213cd9c7e208dd249fe3da2c95721effeb02437e299de872e0f199
c1529863d1ecb63d79fdd595b936f198f23867256bfb5f5aeb5276d9851db04a
68bd91736bf28a070e91c41413e0a7d3cb836c4288ef4861515915b1393a3e15
55d8d42e31694227a47b9eb4fe0f9919b95b7d2146a27a2efbb78de8ecfcb656
361b9eb186d6b5b0cb035335a8b2ed19979af4d7f407455891188860f1b82fde
4a1f8d0d29be162a66f63cb5e2cb82ecf4311882dfd59986455d77698a5df9c4
d7ee47ff608a1896f6da45ad06a65900fb1da40eeb5fbf2222618ddd4caa02f5
1858cefd814f58e47b3d7969c4697c68b7c2fe7efc3208aca320e6d760afa03e
21e2b60feab3dc429ddaabb67c358dbc942a5340455e3227f821feba98c0dcb7
49b520fcf1d924d60bad7c7f4c42dcadd50c17b34c0d247625ffbd2dd39ae9a4
d6ba47dba7a4b5d3edbc954990704573281e71239ffd59490f13290d2f19694b
463b181c8a2ab03ea6d9de29ba46f49516d937f5b20c81784bc4baa94efc5fee
481250f01db73b9e422333f1cf2258627660cf77d040de0fed6408cd25592c2a
7bedd3f0270dd2fd84c5ea119ee042136a1d084fbd030b2289eda40162add4db
be07e28685eec8d28601d4230f4af3d6bbcd85304bbe66163b80765314abbb1d
56e4e506e260232a77f20c9ebe49a98d079891e3491dfe60b308f970f4f454ff
c1ebb42a17006413ff3cbb5118d7fd39c2ee4f572bd95be385d0e5e0e6b15c58
0beca4b6b37f8a848da90e0ec25dd4a8fc380409266925ac08c9ae30b5ce2704
5124cd27665210e6f3f8609cd77cc4f7dd875bda403f9bf76d09abd83691d4ad
861d17c81ca38671d9c3e1aca61ac0e839d18c12f206a5c1f414f7f85c310cfe
9721c4330f905e38fab4232eb4971bfea42bf5195b9953e371ca272e5a93f4b8
9cb0f6537585ee20181867bb9ecbf97783f5af0955341cb09288b0f6c9d8401e
4ea830bc524f4854a2dfb9c6065312a1e77da0cfb944d5841916a3be1553a1b0
72ddc680a3b6b2b4e62fe92254d8b5238e6cd7efb9783576d2a113990188fe86
559caa2233ddc0f6cddc50ba23ed9556cda00af17c9154d7222f839f04022bf3
82822a6d9b3d52a07fb3de64bdeefcbe471e2fb5fa06d31452c07a7c0b71c6ad
5baafeb66a574580979000afd32628f25d64063f2d59ed4fb8fe9489a57a9eab

https://craftlok.com/wp-mail/pkib8hz_jxklztf-0587300276/
http://upeya.org/wp-includes/uIcbrMKbd/
http://www.ethiofidel.com/cgi-bin/htt6ft2j_eh9u68dup-79/
http://blipbillboard.com/iexolau/qqqPxitN/
http://gullukomurelektronik.com/results1/wqo4dg6_3arh7-1595/

Creation Time	2019:10:10 06:55:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
3f8c4f99b5139296ee691546709765e6d1dc7c4b29e97aa678c38263f8353756
ef49149ca8e82f389d2360e20f3ab0c48a226b05617f14df30631bc10555f581
e8da6b0ad41b3f1a9c42a7835ef08e0c3b1cfb145ae84cb891cbc7404300f268
fffb6f3cd98d776ba23d50c738d58b0dec7cf24786d8a7cc6e5da1d8bad94f7f
e3bb1e323dfbe39df90ea8c4adecadf2e1e8d71350edccd3f922f2feb39c48a2
f2571e6b77607d1fab71f0e9e63173067c7214549892fcf53767def7b47b9c8d
4c3217c9f55f23e9993e9cf2112d282af3b2d08a09771f1e9b9c1def17fe4435

https://tongdogiare.com/ibkslqk1lf/fpmf1_wz3sr-875014067/
https://egyanpulse.com/wp-admin/i1nz_uata0335a-6/
https://space4promotions.com/assets/uploads/ahnxRGry/
http://1000atap.com/wp-content/uploads/0g7c_te6jjbmc-16/
http://academia.sprint7.net/wp-content/OHKdMfYvu/


Creation Time	2019:10:10 00:27:00	(URLs - Doc based - Activation Wizard)
SHA256
55811da0582ef03451ce64aaefdbde0426a5f135972fa30cdc7a79183b5252da
6d12ec981fc193f0f70e1396c9b5d1c687a0f922e8d3abef29aea87a92c97603
d6fe373d277c5f879898aabf73b8dca3dc628e78cbd2e0ac29d639e1b5d1654b
79fee9b4719d57074517bac0137ba146d97e6f4501546625bf70fa13c75c1a82
25f702601cea983a07def7ac8bd0405139a6b51922b20cbb8b07eb3461492abc
f9c8707b64bdb9718ae60c02a18b99731cac91705c135b05443bf4007abd1a5c
a62b9fe2845005b9d6c3a84b44e7553f810b5ec1080b4598789ce4cfdc314e3c
94817ea9b593f0f5d7d1f926f1ba258f08bcbbde7577646b0cdb0dc1cdb4a810
58eded6711ac307b2b48e309d869ed1c4d88c6a23815973779b6d610704a3f12
1e7150b7020ce101fdbb80a0e13c2d444e77966765369276549ca2300109a15a
9553d10cb9677c2235cdc5cd1902c8c80b74e5ef3cb64026f9cc5c526c71d300
14eadf6f6631d4b2dc28f35fb67d790af9349e4ceba111c20a0ecd2507a1e4d4
5deea2ba20e2f21b2d36d77941ff28c7d613edc3b5f74027f5884b1855d2fdad
3f90a20aa7c21e5d785814d6521649e9b99c8dffe61a910e5ed63f8a70bac08e
4ce3cd5384e274663b11c2b145e0ae0eced9b2061864841ac0adb8f30977ea37
17737112f9f66e51939f77f374b7f8aedccbb8b51685268cccc3d630d18935b2
b9ff09f2a5cc441790c6577f731c756ea95af9961e44cf41af17deaa10e18df5
7344c6d38f46a38419082b72d7ee3d622be05dc86c93e87f55600942b8da470e
0c421092cfe868bfc29d2e6f007bf424f8d02edf05fda335f832f5d67fa57d27
c1e60a9fd532de6bd5fdd04765d497f4c1e9f77421cbd191e0b13ac1615d7ce6
a0995eec6d5e5af14ed30cfcb7d07f4a6aa370d021665b261baab371eb37af13
497751a3841e1fa560f17a424d1c5be7740bc8c9e7579dc625babc5081abbec6
532722acd3db8a8f5b461c0f38c63d37481c026cc5e4428c3d9c7bbfc28957ea
2380bcab47d547103d28169bbf9638b8f418b4455bd2888746fd81cae2bf897e
f2c14f32599039a2b201e1eef7f4715185cf9a60f960cd54834e5bf3d05bf46f
f9cdaed775eb3635df2b10e792da181de1c0fd3e9a5f01f5b7ead25ebfc9bb9e
81df3c431ac69a6e7e3a86c8dadb02988b5babec45dc15e7c7ef71bd566fe262
2c57ea6df2e691b500849b380c31e5ad75728f99f67bc43fd950b6684609b387
96be63dffa9591f36ee20cf8e0556a59d75327cfd175e76e1ba8febe70b45681
cefa16b1812a1d57c887d7febe085519cdefa64233b4df9c7c5b4e8bac7d6477
13deb16765cfd9f4316397848bb834def766955e5c37a1056732e6df278ee646
c0e484299000d1bfa92236a4e9dddbff222c9da2d7176c7714737def791a27f3
a25959f113ee3db1ef53999de65c280bcce6d813e6a079e4b344b7ef0c92809a
2ae4780ab75818d6494b86909259593b7b1d34514827af3916560dd58a9535dd
409fe605f7a490c7e680c335304b04333e0d9d0b54d666b88bee66011b4620a5
44dc2fedc9ebdf6a7f1a64d82fcd41c7d38cb5514667a5a3f401bff441a8015c
931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968
da3298b69575a28bdf0e8f807c3968902b949ab5184d891bd8d30274e79c6157
b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f
d8eea2d3bbcc6e6e992defd69e50cdec689f66a175f05fb05f530d9a17ea3ed3
d48499a6e0a3dbc320fa5c562593789f883dc26c210fb9359bbd21c00d17001a
f0229f9d03be90dd3424637d9832125d43a75e6f65a4aa5ce92fcc192b303111
93d3e110f803099c89c63c9e08bece512f373ea47bb55949e2fc9c3d221c6370
b5b0f6c2bb6cefb46bb387628524cc2cf12842a9caf539e286417ab3fb07aae9
43eadb54571e39ad7b55eac33e7152e282de4cd9343d81a4442f9317e19995a9
1d8be20f0ef5794e5a410dfe51f38d99f7ac42bd3bc5e17706e38988e2635867
39cd1632dcae212d910edfea2eeb2ea7e21b1dd0a2fe1638b1f4d42d335d91f9
6da107e20a4bde15076e46114cd08f53e2a082c6afd30a36b05de9b97fa66474
b4ee275eaa6b6b101da17ee337def0fbd22a821c5559b43f1915fa51d49790fe
c89b38beca8ccb3d0d9cd58fd4f0bfb7cbb2d21a6e4ead3d609b7c5f335b2812

http://www.arquiteturasolucao.com/shells/il9l7_6fbjtt-50317998/
http://www.kokuadiaper.com/wp-content/wp-rocket-config/gPjedSRcK/
https://blog.lasoy.net/wp-admin/vBwxpquhVq/
http://prettywoman-cambodia.com/vqxr/cwbeiqihf_7zv7l5jjx-017/
http://barij-essence.ru/tropcj8kfd/HoBkALzmR/

Creation Time	2019:10:09 23:26:00	(URLs - Doc based - Activation Wizard)
SHA256
b4dd04c27697f3b87422d720c09d3a81af3823ba993e20e05de8a285932f047c
0dd94901b050c55cca88390c712500bc4d7253f781cbe7ddc5cd85f19d88ddc7
c0fbe60051e2c6236a076be28c6ce0348dd495a183f13cd77645a41088102ea4
bed2f129eca372e19fd475fa022f7150b04e92d581677e911da4cd4772063da4
6ea1b1ec86f0ccec8550ec09bb2f0eaf28149df8ebbfcf5e05331f33c27f886e
30d944607245a417a3c503f1214bf06299cdbd43bac3a4f0c02f446a556f64d5
144d03ea075288b15252acf044fc37f946c00e044fe29ede864507d477c3129d
5f986d9031a1e020fc5d57634c74952c0774cd0bc8663c04bb1a8ca0d0c3db05
327ab716cb49c912eea1bd7b2ada30c29d9032fd7c86aeda81654650df3bc37d
4a88e969472b7b72c3b67cc551bd6ba8e406d612de0f9b024f985579872cb560
f6656a930a16a48259f70d4042f09c64afb7d19cc29e17ce719ea4840eb68e6a
16aa536e17f9eae3fabff4fc9a99ee6112aa82c6bdc58dea62d7c0a44f9899fa
1ff45920b3eef0ba9428dcf261538e8f874205f2f7279e881efcbf2c8b7ddf6b
1d29e6801ce94dc34ad5f2b5a41f38be97f7a049f3e9e19df1cb43151e3f544b
9eac41f62d55af75036c89d0ffb6abf724397de9db1601485b3c9fc682da0803
adcf4e809c5eb320eee150c670755b13c7213cd79415d5ea42e2df00019d6f2e
3172a2c9aba211c55835096a66b5e2b51446fe324ab06b9abe3e12ff96c82286
f8a81fcd5e4b1c645941b813c4e7053c4c92cc8b32076e73a5ed2fdb222d02b1
fc13915dcf6948edbe4bb35e72d68abc124fd2703b6d7cb8e54901b490010a75
951b4a236894e17df7860e6dcfdfd2ecb003aea7f811a81c6a114a8021d173d4
88177b5b39ed84cb0d01934549e1af17f39273dc50302d920fee4bb06932ec5a
6cadae1df63f52f3abcb5a95d3d4fe31b90f238da742e61e8edc716373a52375
d83997e478df2c6fb110487f2456e8174b3ed5de8e3d7d09a91cb50f025c9805
4fc7f7b3f725c62a8cbc0ebdb3ce31b92406bd9fd895823d08e478c5440d3e36
cf36aa2fee5351891df1ad0f3a9449c19da65dddfb65a4f6c50f4e9218d84a16
dcda6be47fde8a164ee800f2a44251fb967d389ae1a2b39b371728101e022083
99ab5a5a0ffbdeb15b879e6fe5dfe9aeb45af1929af625435ced25e002a5b5d2
d3127b4036997e3671fef2a90e09c5e340d289dfbdbab44990673500bc56f407
2a52899c65cd366139377fd1a3c1648e9effbae444bab06741f12bd85787676f
7fb16ea476bac40113f29f3a318c305dbe8cb7a61439444b6589d33d69586f60
e333768e423c4aa3e8d064045ab3245ce04700293b0ea520ebf5e5475ebf8da4
ac6fe53c6f11ac695b43b65374774b18557f560c499bd4b9ae2d853ac4b899c6
5bf681e960fa4c9fff5265185a1f295a4d8085d7ef8cf19e4ed352d879f7e430
c05053f986189ad54bcdbe32ec02e82635c63738073bd9377fbdd231277a0320
e341407a68853121b529e2a473e68326263308a874876f41044cf5385c2dd2c7
131d969d83446ad79b80f299db173dbb243158b3df827d2b2bb197f84561b542
d9db4fa770418d6a1f517604a668fa4a9b54ce0e5dd57f2d91d7224763be11c7
c923b3272f267788fd3b9324de97192cac0839d72c742b492a6a5e8240858548
15d5d87f6ba3c6aee2c9a3f3bc9c4f83f6c42ed0ea305eec19c678160d6d15b3
15d5d87f6ba3c6aee2c9a3f3bc9c4f83f6c42ed0ea305eec19c678160d6d15b3
14cc58467a874f57fd4b1b170e7ba3e3aa412e96021b272e9bd7bb6a1f76806a
795a55ce16a6e032f51bfc5db65f4051a3c0df955a50e17a6bde4cf2c907d9e6
8f9307bb59d42b4317ed47e23470dc886580d809a3caa7026614baa348dd50e2
017ac2f1b3f228c520581f72a648f60661e6140b4d176d798fa8bebc04684d47
ba0c2b5c5be8735d4ce6fff7e57396aa848018d8d71ded07134ffb7781f522ea
4f25f7d86cf0f77dc97ebd3184a7e03e8da522ad421766bb559b8f928e53cd45
9a26b75cf3a0d03c97e1ba5e485e32cb77d9833277be6d6f4b8df8834c0ce082
25647f4c672951dfd28b9c9121e8758ee4b45c53b3a462fecf3f70a47aa8a239
c461e4fa357bcf2a2d9638e28711e177143a688675eb23a99295b8868f03e845
9f17b8cd7da66d45d1bbc9c3965591d8571df7f3b052b6f79f10a58e1439d9b9
f93381722b5ba7d4ed93d0c44fe08cd794574547d97eff11ed814b0ec18273eb

https://www.mmtt.co.nz/genimage/ClUXVYfQ/
https://wkoreaw.com/wordpress/FxiXOLHy/
http://gennowpac.org/wp-content/DJRMUdiP/
http://cjextm.ro/wp-snapshots/oDjcwvxm/
http://www.antonieta.es/caeeq/dtWZYxVo/

SHA256s for Epoch 2 Payload EXEs

4dc93b3587ef77f8ad79d70d5b62e6af508bb0dae578f8d691b10cee1c9c6b98
93af2091e89c55ff7358968dc363e0c4db34d770d07a375c00c436dbcb8fe911
c16b037770de8e203fd61532daf379889933d310d45d9502675c6faa3ac6ad70
079abae48ab8953e193dfc9164a5e445631fa480fb7d5c7065dea99049e3d51d
51737bdc870897dabde0fc132e4393c125bc7ebb8f72f4efd1b3530fa3d95d23
7921e0e1f73e08021aa0648c408f236cdc483fb187d19e7a5651c08f05d9dd3b
d17998dfa4f23b11b50c0b84dcebae08c912bc5d00079ce83d2f54114a734cea
d0ce7284573bd0b16c06d34bdfcd6c1960738c0e8e39a6327c178523ce412f44
9ebb7f528634bc0e26806b9558c0f2958f118f14eea21a2e1148f943508d1446
d144da1fd4cfce2614d6ff1ce04a235f3399b315a9138d33b2f72ce7f254d315
0ceb1ab2bc03b840c03b5fcaba8397ee8d0f3877b73fff22e7bc50ab5c596821
205e75b54f67ac0d99445adde7a91e94c56cfb5c4995878327027159f5562027

Epoch 3 Payloads by Document SHA256 - All Times UTC

Creation Time	2019:10:10 19:21:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
22ba77a12f0f65c75dc2d2ae854fed023fdb346a6d607cb69ddde541a5a4d4d4
9e2352af82aee15c522d96d2778deecd3ca88a6b056e148f5c9addada9a0579d,
361713eec6b15bd4a1735d9ad16e38e26451e21e6523305247ce80ed3f0dc8a7
8f25337151ae59e36bcf06de3c247096b22ee929da3bf0f6d9cc4449fba4369c

http://techassist24.com/wp-admin/15b3319-lnxdvfv-65167154/
http://hussein.shop/wp-content/TFMopVce/
http://kk1793.com/wordpress/ipUuEtsZl/
http://www.hardwoodcolor.com/74u4/se9faht-34r-25352853/
http://extremebdsmtube.net/wp-admin/mfq2v4-fvei51-93166/


Creation Time	2019:10:10 12:54:00	(Attachment Only - Doc based - Product Notice)
SHA256
2ede73fd78c58d3923438e67d728d7d12025a5d628e79fa665cbc19d5387f6c0
63dac4cb9e90bdc91c2dee55134a623554ac799f99c3b3f3c4d55c5b0e3e74a7
48395e9339bc6c27a9888b3f54c213327d62219de867fd225c90418822902f99
723eac17f39a1df8fd2cb7d736de3325043c230b810425da2e50b2a717ecc3e9
a7534af6f4633007f368be6ccf540017d8e077ab439e38e77d05ab83639b31f8
a58d1ea022ebed01d3de57c373ded469c78b9f0dc9c52b89cde51fd3ca12375d
c3c19dcc422abaea657a86886146fb9c557b2f7c40ce9ea298b445397b0acef8
7c42090aceb10e0c69d9bf870a95c18bfacc34abf6833e3f40e03927503a8154
629b48da3452dba8e8afdf57c70fadc46fdfcfa30357e80bf6a38741a982f527
9a3a3f8006639a4c99987e49903af4bb234fd9519fcc0aa26669e771b9be68a0
0ff86c18a2a69208611f31b79e1839cb790e01e1fbd57d459c396170a23ac7f4
bb65f90d32591d777919a7380e70deca98e8c4949f773f380ae6c61983f472ba
191cfc9ab8a6b76704d6750ab189efb7628232b76eca67086734df6bb255c2b6
ca435bc58a3429ce50d1f5b4a04dac967f98a02d9429b996ef870b94170d8969
9adf6953f0cbd8d9d62818d3bb9065de847b37bc44f38afe714a0266aa5c7e97
e8a1fcc32f2318baf22ca92ae9be592b1525b68c1b96fc51fc01e0e7db3245c6

http://wire.goldseek.com/wp/wp-content/uploads/AYhnVwo/
http://charitylov.com/5v9gm2/6phanpt0-yjqcx5spzu-47012/
https://www.plowsharesproject.org/wSa9K99/AfzYAtMFM/
http://www.projectolynx.com/p/vtzBprBv/
http://thefortunatenutrition.com/wp-includes/tql88-k5nvg4-224339/


Creation Time	2019:10:10 07:05:00	(Attachment Only - Doc based - Activation Wizard)
SHA256
93cd0aed11c8c78fdc61b74d4b36a4e00ced96554a4bbc1be09926ab7cc7647d
d90840bafbbce388a8c4874f6d6d28e26d890a9f9d17b164b0a4daa2ff71e1d4
d55a645b01d983b7b7f697b72934f0374edd2608ea026e9dfa069b4c2f13eed6
b334e3bf3f4e99105aa0d20715d716687baa9358068881d1b7bb4af1a7863a2c
c0b46278ce20d505fcbf97ac91d14fb8c45c2ac35bce6c17f4f27854bf9abcef
ba83b756c981b48bef1f152db4c6891b53c61208c9822229347fbb4d719909ba
f39fdf7069c19832eddd45e51a32271af2e363da5834b646177ac70971f4cc98
3e644bda54200a4497a5f67a81f15bd0efdbeae48cbeb58383914a2c7676f974
67a46ec4b958b717aed6bed60555320f38e381342ec8b2cd72f450077f0faa46
4fcb79b95a3fe5d380c012978fa805b291a95bea8264d96300ea24a3d07576f3
bc21556f526b7233e45ad5ba3c74a20455ff5759a464a78e15958238f3115cca

https://sarapatka.cz/wp-admin/VEgDVvi/
http://www.bilisimnokta.com/cgi-bin/XNQfSeH/
http://www.mutasinsaat.com/eski/cBndMGO/
https://potentagents.com/wp-includes/FuecVMOrV/
http://www.z360marketing.com/showaboutus/864-kc0-8854398393/

SHA256s for Epoch 3 Payload EXEs

42f06af39572f6f887195c8d3651df17295d81f8b9894f3ce29638ec35f1f520
32b5e610ee28f9409049624c8cad63a5fff8c0af455329659068d07595dda99d
acd97ceca0dc6f8765a2e71590a91d06e807a551ec0cb73278edc6a19d067130
d9b696a62237802b6b7c2507be5c897a4578413ed298f2597330cb7c982b26b4
e4f54f9ca9b6df51f6a426bdac1f0cc0db4aef9e50fc03d3832c9160522b25db
c2220428b8e5c9a855c77a667e2cfd56e2f000109abd08cebb62601619fffbfb
c5a6f09e237e3e92147f2a5ee87e4b446b38f97e3930b7fd49603ac3740949ac
f8842162354595fcf7d7b14c9aa9b7422dd432c166fe4b82c1eba6bbc69ea078
5b3bd23e42579e4c74adb320ee1adcd9d658cf08c9885f2eb2cccced13d33e3f
5c337f8f46e5fdad2ab0e4999cff0c47665baa67c097b9adf3f42184ba430063
d1b2855bba105a08d0debd5c9e21ee29d07d04e90f09adca230da7f83f701867
ddecacbbb1f58ccee7d1590fe0bf717c847fb75bd8ddf606927cfb2ea418dcd4

C2’s Per Epoch

Epoch 1 C2s

103.31.232.93:443
109.104.79.48:8080
109.169.86.13:8080
114.79.134.129:443
119.159.150.176:443
119.59.124.163:8080
119.92.51.40:8080
123.168.4.66:22
125.99.61.162:7080
138.68.106.4:7080
139.5.237.27:443
142.93.82.57:8080
149.62.173.247:8080
151.80.142.33:80
159.203.204.126:8080
170.84.133.72:7080
170.84.133.72:8443
178.249.187.151:8080
178.79.163.131:8080
181.188.149.134:80
181.29.101.13:8080
181.36.42.205:443
182.188.39.68:80
183.82.97.25:80
184.69.214.94:20
185.187.198.10:8080
185.86.148.222:8080
186.0.95.172:80
186.1.41.111:443
186.83.133.253:8080
187.188.166.192:80
189.160.49.234:8443
189.166.68.89:443
190.1.37.125:443
190.10.194.42:8080
190.104.253.234:990
190.158.19.141:80
190.221.50.210:8080
190.230.60.129:80
190.230.60.129:8080
190.38.14.52:80
190.85.152.186:8080
200.51.94.251:143
200.57.102.71:8443
200.58.171.51:80
201.163.74.202:443
201.183.247.58:443
201.199.93.30:443
203.25.159.3:8080
212.71.237.140:8080
216.98.148.181:8080
217.199.160.224:8080
46.101.212.195:8080
46.163.144.228:80
46.28.111.142:7080
46.29.183.211:8080
46.41.151.103:8080
5.1.86.195:8080
5.196.35.138:7080
5.77.13.70:80
50.28.51.143:8080
51.15.8.192:8080
62.75.143.100:7080
62.75.160.178:8080
68.183.170.114:8080
68.183.190.199:8080
71.244.60.230:7080
71.244.60.231:7080
76.69.29.42:80
77.245.101.134:8080
77.55.211.77:8080
78.189.76.2:50000
79.129.0.173:8080
79.143.182.254:8080
80.85.87.122:8080
81.169.140.14:443
81.213.215.216:50000
82.196.15.205:8080
86.42.166.147:80
87.106.77.40:7080
88.250.223.190:8080
89.188.124.145:443
91.205.215.57:7080
91.83.93.105:8080
91.83.93.124:7080
94.183.71.206:7080

Epoch 1 - Spam C2s

37.187.5.82:8080
45.55.82.2:8080
185.94.252.27:8080

Epoch 1 - Stealer C2s

75.127.72.18:8080
190.115.18.139:8080
66.228.32.31:443

Current Epoch 1 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOzoTryw1r9RxRJPFKalO4+q7JaDZWSB
KZlEc22H6ITuE06tvJspue42TF1yk8xN+1bqW++QeV6Clm1uRswA/qoao/6p4eN0
h4zIO8PEaJ0C/9EO4cx9yfRLlVpjdEkP0QIDAQAB

Epoch 2 C2s

101.187.237.217:20
103.255.150.84:80
104.131.11.150:8080
104.236.246.93:8080
115.78.95.230:443
124.240.198.66:80
133.167.80.63:7080
136.243.177.26:8080
138.201.140.110:8080
144.139.247.220:80
149.202.153.252:8080
152.89.236.214:8080
159.65.25.128:8080
169.239.182.217:8080
173.212.203.26:8080
178.254.6.27:7080
178.79.161.166:443
179.32.19.219:22
181.143.194.138:443
181.143.53.227:21
181.31.213.158:8080
182.176.106.43:995
182.176.132.213:8090
182.76.6.2:8080
185.94.252.13:443
186.4.172.5:20
186.4.172.5:443
186.4.172.5:8080
186.75.241.230:80
188.166.253.46:8080
189.209.217.49:80
190.106.97.230:443
190.108.228.48:990
190.145.67.134:8090
190.18.146.70:80
190.186.203.55:80
190.211.207.11:443
190.226.44.20:21
190.228.72.244:53
190.53.135.159:21
192.254.173.31:8080
192.81.213.192:8080
198.199.114.69:8080
199.19.237.192:80
200.71.148.138:8080
201.184.105.242:443
201.251.43.69:8080
206.189.98.125:8080
211.63.71.72:8080
212.71.234.16:8080
217.160.182.191:8080
222.214.218.192:8080
24.45.195.162:7080
24.45.195.162:8443
24.51.106.145:21
27.147.163.188:8080
27.4.80.183:443
31.12.67.62:7080
31.172.240.91:8080
37.157.194.134:443
41.220.119.246:80
45.123.3.54:443
45.33.49.124:443
46.105.131.87:80
47.41.213.2:22
5.196.74.210:8080
59.103.164.174:80
62.75.187.192:8080
67.225.229.55:8080
78.24.219.147:8080
80.11.163.139:21
80.11.163.139:443
80.79.23.144:443
83.136.245.190:8080
85.104.59.244:20
85.106.1.166:50000
85.54.169.141:8080
86.98.25.30:53
87.106.136.232:8080
87.106.139.101:8080
87.230.19.21:8080
91.205.215.66:8080
92.222.216.44:8080
92.233.128.13:143
94.192.225.46:80
94.205.247.10:80
95.128.43.213:8080

Epoch 2 - Spam C2s

23.253.207.142:8080
185.187.198.4:8080
46.228.205.245:4143

Epoch 2 - Stealer C2s

173.214.174.107:443
104.131.58.132:8080
176.31.200.130:8080
46.105.131.69:443
24.45.195.162:7080
24.45.195.162:8443
80.11.163.139:443
94.192.225.46:80
209.141.41.136:8080
46.29.183.210:8080
198.58.112.7:443
185.42.221.78:443

Current Epoch 2 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhALk+KlHgOKXm9eDkWu2yN9lanjwOm6W2
PV0tgr4msNVby2pOJ6S1MZQnQwxl7y6WWzT4kveAQhLmW8JB2M2PDOxZOgVMJH2C
AtkVW1p/P9jNJWVvjK9SmrbLdIeiKNtRfQIDAQAB

Epoch 3 C2s

110.36.234.146:80
113.52.135.33:7080
125.99.61.162:7080
138.197.140.163:8080
143.95.101.72:8080
144.76.62.10:8080
157.7.164.178:8081
173.249.157.58:8080
176.58.93.123:80
178.249.187.150:7080
181.113.229.139:990
181.47.235.26:993
181.97.70.132:8080
186.10.16.244:53
189.253.27.123:465
190.13.146.47:443
192.241.220.183:8080
201.196.15.79:990
203.99.182.135:443
203.99.188.203:990
212.112.113.235:80
213.138.100.98:8080
216.70.88.55:8080
216.75.37.196:8080
5.189.148.98:8080
51.38.134.203:8080
70.32.94.58:8080
70.45.30.28:80
78.109.34.178:443
80.227.67.18:20
83.169.33.157:8080
91.109.5.28:8080
93.78.205.196:443
94.177.253.126:80
95.216.207.86:7080

Epoch 3 - Spam C2s

185.187.198.5:8080
41.185.29.128:8080

Epoch 3 - Stealer C2s

178.32.255.133:443
198.46.150.196:7080

Current Epoch 3 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM426uN11n2LZDk/JiS93WIWG7fGCQmP
4h5yIJUxJwrjwtGVexCelD2WKrDw9sa/xKwmQKk3b2fUhwnHXjoSpR7pLaDo7pEc
iJB5y6hjbPyrSfL3Fxu74M2SAS0Arj3uAQIDAQAB

Credits and Notes Section


WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch 
because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, 
this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen
 
NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

What is Epoch 1, Epoch 2 and Epoch 3?


(09/17/19)
With the find of Epoch 3 that split from Epoch 1, this section will be rewritten to reflect these changes in time.

Community Lists/Samples





(sorry if we miss anybody, make sure to send it to @cryptolaemus1 in your tweet and we will try to include it!)

Credits

Combination work of the Cryptolaemus Team - https://paste.cryptolaemus.com/about/ and/or specifically the following:

Doc DL URLs - @devnullnoop, @p5yb34m, @malware_traffic, @dms1899, @Paladin3161

C2 info/RSA Keys - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @VK_Intel, @Paladin3161

Payloads - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @TheHack3r4chan, @p5yb34m, @malware_traffic, @Paladin3161, @ps66uk, Anonymous :)

Spam Templates - @devnullnoop

Special thanks to @lazyactivist192, @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and 
helping out with this!

Very special thanks to @Binary_Defense, @lazyactivist192, @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project
https://github.com/decalage2/ViperMonkey, @digitalocean, @mploessel, @anyrun_app, @unixronin, @hurricanelabs, @MalwareTechBlog, @KryptosLogic,
@0xtadavie, @MsftSecIntel, @abuse_ch/urlhaus.abuse.ch, @urlscanio, @BlackLotusLabs, @TrendMicro and @Virustotal for providing services/software
at no charge to this cause!

Daily Log 10/10/19


@ps66uk and @jroosen here:
E2 has really been working overtime lately. I was very surprised to see the 2019:10:10 00:27:00 release this morning. Also E2
seems to really be switching back and forth from Attachments to Links to PDFs quite often. I only received one generic malspam 
today but it seemed like @ps66uk received more attachment spam after hours than normal.

General News


@daevlin tweeted a couple of oneliners to unpack Emotet:
https://twitter.com/daevlin/status/1182197076458971137
https://twitter.com/daevlin/status/1182200515960156160?s=20

Drops Report


Brad @malware_traffic released some data on Emotet E2 with a Trickbot gtag: mor19 infection:
https://twitter.com/malware_traffic/status/1182410833801945089?s=20
https://app.any.run/tasks/271ba6f9-c0b2-4942-9869-6fe69693707f/ - again with the non-english characters and this time KR.

Email Template Report

It seems like malspam is ariving in Japanese as of late also. I have been seeing more twitter traffic regarding this lately.
Here are some of the tweets threads seen:
https://twitter.com/58_158_177_102/status/1182149387989860352?s=20
https://twitter.com/bomccss/status/1182449422447169536?s=20

So now we can add Japanese once again to active targets as well as English, French, German, Italian, Polish, Spanish. This 
level of activity reminds me of the heavy spamming earlier this year.

Today we saw 5 different quintet releases on E2 and 6 different docs which is above average. I don't understand why the last
one was the same quintet of URLs either on seemingly the same template. A normal 4 quintets on E1 and normal for E3 3 quintets.

E1
E2 ModifyDate:	2019:10:10 00:27:00	CreateDate:	2019:10:10 00:27:00 www.arquiteturasolucao.com
E3

E1 ModifyDate:	2019:10:10 06:27:00	CreateDate:	2019:10:10 06:27:00 yukosalon.com
E2 ModifyDate:	2019:10:10 06:55:00	CreateDate:	2019:10:10 06:55:00 tongdogiare.com
E3 ModifyDate:	2019:10:10 07:05:00	CreateDate:	2019:10:10 07:05:00 sarapatka.cz

E1 ModifyDate:	2019:10:10 12:22:00	CreateDate:	2019:10:10 12:22:00 shejipxw.com
E2 ModifyDate:	2019:10:10 12:17:00	CreateDate:	2019:10:10 12:17:00 craftlok.com
E3 ModifyDate:	2019:10:10 12:54:00	CreateDate:	2019:10:10 12:54:00 wire.goldseek.com

E1
E2 ModifyDate:	2019:10:10 15:19:00	CreateDate:	2019:10:10 15:19:00 www.3uqp.com
E3

E1 ModifyDate:	2019:10:10 17:16:00	CreateDate:	2019:10:10 17:16:00 icfdelhincrchapter.com
E2 ModifyDate:	2019:10:10 17:09:00	CreateDate:	2019:10:10 17:09:00 erakonlaw.com
E3 ModifyDate:	2019:10:10 19:21:00	CreateDate:	2019:10:10 19:21:00 techassist24.com

E1 ModifyDate	2019:10:10 21:35:00 CreateDate	2019:10:10 21:35:00 mayurpai.com
E2 ModifyDate	2019:10:10 18:29:00	CreateDate	2019:10:10 18:29:00	erakonlaw.com
E3

(These are experimental, use at your own risk.)
Looks like only E2 is doing links now and it seems to be some of the old Regex. Here is what works 
so far for the list of 330 above:

https?:\/\/.+?\/([A-Za-z0-9]{8,30})_([a-z0-9]{5,10})-([0-9]{8,15})\/ - 182 links or approximately half of total links.
https?:\/\/.+?\/(Document|DOC|FILE|INC|LLC|Scan)\/([a-zA-Z0-9]{4,30})\/ - 40 links
https?:\/\/.+?\/(administrator|academy|alphabet|assets|blogs|cache|cgi-bin|css|DANE|Dane|demo|discuss_lib|direc|Document|DOC|Dok|DOK|esp|FILE|function.cheese|homepage|images|INC|Inf|INF|js|LLC|lm|paclm|Pages|parts_service|phpmyadmin|Plik|popup_index|public|Scan|sites|sitemap|sox62c|test|trademark|themes|uploads|wc-logs|webalizer|wordpress|WP2|wp-admin|wp-content|wp-includes)\/([A-Za-z0-9]{7,32})\/(\"|\n) - 115 links

18 of via this new experiment:
https?:\/\/.+?\/([0-9a-z\-]{3,11})\/([A-Z0-9]{7,32})\/([A-Za-z]{9,32})\/(\"|\n)

Also keep in mind, your filter needs to look inside PDF files to find the URI to test against these above. Otherwise
this does not help.

Payloads Report


A stinker was released across all botnets(distro and C2) around 2030UTC that was small around 120KB and seemed to hang
executing. This hang fire file may have been a crypting/packing error and it was missing the key payload in the loader.

The rate of hash busting has slowed and we are now down to 12 a day or about 1 every 2 hours.
Totals seen on C2 and Distro: 
E1 - 12 between 00:40 and 22:20
E2 - 12 between 00:35 and 22:20
E3 - 12 between 00:40 and 23:15

C2 Report


Roman over @abuse_ch was talking about some of the long standing Emotet C2 servers this morning and ironically
I was actually looking at the same thing recently. I have noticed over time some C2s seem to never go away or were
very old and come back in the botnet. These hosts either are never fully cleaned up or are bots behind a NAT point
in a network that is prone to infection. You can see the thread here:
https://twitter.com/abuse_ch/status/1182249560367874048?s=20

E1 86 +1
E2 87
E3 35

Closing


E2 is really active and Ivan must really have a lot of customers now that he and the Emo team are back on the stage.
I am not sure what the purpose of the E3 botnet is still. E1 seems to concentrate on EU targets also which is interesting.
I am still waiting for E4 to appear and I am not really sure why it hasn't. Sometimes I think E2 is really just development
but with this level of spamming and URL consumption that is a lot of sites to burn for testing. Time will tell I suppose
what the real purpose of these epochs/botnets are I hope.

TT

Sandbox 10/10/19


E1 
https://capesandbox.com/analysis/2811/


E2
https://capesandbox.com/analysis/2800/


E3
https://capesandbox.com/analysis/2808/