welcome to netwrkspider

Tuesday, September 22, 2020

Zero Day Emotet Malware Latest IOCs Details | 22-09-2020

 

About Emotet :

Emotet is a Trojan that is primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet may try to persuade users to click the malicious files by using tempting language about “Your Invoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies.

Emotet has gone through a few iterations. Early versions arrived as a malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers.

Emotet uses a number of tricks to try and prevent detection and analysis. Notably, Emotet knows if it’s running inside a virtual machine (VM) and will lay dormant if it detects a sandbox environment, which is a tool cybersecurity researchers use to observe malware within a safe, controlled space.

Emotet also uses C&C servers to receive updates. This works in the same way as the operating system updates on your PC and can happen seamlessly and without any outward signs. This allows the attackers to install updated versions of the software, install additional malware such as other banking Trojans, or to act as a dumping ground for stolen information such as financial credentials, usernames and passwords, and email addresses.

Emotet botnet noticed that the malware started to push QakBot banking trojan at an unusually high rate, replacing the longtime TrickBot payload.

#IOC Details

 

http://4life.com.vn/wp-admin/Overview/nw36ySeXEj284q7G/
http://ahappydesigner.com/wp-cache/docs/aUeCFuczuwC/
http://asiancrush.me/l2twf1/8NXX306142CU/wZhFuwGTX4/
http://blog.ye0yeg.tk/wp-admin/Scan/CKihdpK85Q/
http://care24hospital.in/css/7BKM3YX1LEXTR/5S7ydcCHd4vg9p/
http://dtyl.shop/wp-content/Reporting/qfBCUpGNwqrbm/
http://hw.lanbaba666.cn/capimyb/eTrac/mHHVS4wzJbHL3QD/
http://infaye.cn/wp-admin/wUUYVI5KeV/
http://onlne.tech/wp-admin/INC/NcVmo2xLi1/
http://qutiche.cn/wp-admin/Pages/R7sfgcoSbK/
http://shuiyin.xuezha.cn/addons/NDPL3WZXLHV5H/8KQMvPECjvqbCxBPIFH/
http://sibcon24.ru/cgi-bin/Pages/YKWoKdAz0S/
http://stomid.cn/wp-admin/EL1LM9MSP/HlZFFs6GisnYKYE9A/
http://wach8.com/wp-admin/LLC/hV1ltKbJHAVEG6GMMbO/
http://www.360wifi.com.cn/wp-admin/JY2xPcdrIlaA7/
http://zok.ink/upmz/eTrac/cuJLUXaIDzohdZ/
http://zsstart.com/mobile/682533981893/MnALqiYy0cpOUUfw/
https://b.fherf.com/s2cxmd/paclm/s0ho77DKJS9xHJ0S/
https://babyhippo.in/e712/INC/uxeHbpppOswKCq5hCjS/
https://blog.classpro.in/nlot/OilU3qpsoUFPS7UY4w/
https://homestay.a2vina.com/wp-content/Pages/3UEAZl5nS359Aax/
https://img.xuezha.cn/ad-amazon/Scan/prLgPBkERo/
https://marquitosgoa.com/wp-includes/esp/UD4aknkRGune/
https://sentir.nl/wp/eTrac/gw5yG8ybVNbP/
https://www.poramorsho.com/__MACOSX/lm/dgzbXDRKKPczFZ71YwA/
https://www.trapezblechverkauf24.de/wp-includes/INC/W5YI2dpuHuzY3Qz/
http://165.22.71.24/sys-cache/Reporting/sv3zv7c4172526640623866438s4hugz5q2v7h60/
http://aeropilates.cl/wp-content/FILE/icitoyqq2/
http://altus.lt/wp-admin/Reporting/
http://aornobblog.xyz/MIFTAHULISLAMFAHIM.INFO/Scan/
http://artemiwp.katedomia.co/wp-admin/08037482/
http://buygrowtogether.com/amfxn/paclm/ajskvqdcgek6/
http://cnaantours.co.il/wp-content/esp/gynzb3n5dyr/
http://dresslikevs.com/wp-admin/sites/zwf739n4e/
http://elementum.edu.pl/wp-admin/invoice/
http://geoplanum.lt/wp-admin/Reporting/
http://hostearla.com/wp-admin/balance/zrtjw4604bp/
http://itrust.com.ro/0gzn01/FILE/a9ztr9aw/
http://jiafunongye.com/application/Scan/3dwq5hz37841052152992qpo5oc06oo82qx1k/
http://kellymorganscience.com/wp-content/gcaaud8d7bg/
http://localesfavoritos.com/wp-admin/parts_service/
http://localesfavoritos.com/wp-admin/Reporting/scqn4xw4l/
http://mijnkippen.nl/wp-includes/VZ4L32C/ec8cp97/
http://movaarquitectos1.000webhostapp.com/wp-admin/Reporting/
http://nahar-infotech.com/wp-admin/nqno4al3gq/
http://nnd2020.com/wp-includes/invoice/
http://pagearrow.com/wordpress/balance/36ebnrug6px/
http://pjgroup.co.nz/wordpress/swift/oahffi7476988931568hjo0psiaihbt4ey90/
http://shreedhiglobal.in/wp-content/uploads/esp/zhm44q/
http://sman1mema.sch.id/cat/swift/hrpjgoy2gws/
http://vietmade.org/wp-admin/parts_service/4drcon0/
http://word.ahavid.com/wp-content/dkh6phc2/976ha616548580202bhggfw777h5ndj88i6l/
http://www.mglgraphics.pt/wp-content/balance/egdfi8cxj1j/
http://www.pailingroup.net/wp-admin/INC/bmtvdb4o/
http://www.showboxchannel.com/smfolder/payment/kuww8879600m0eebe1wrk/
http://xiaoxiangkeji.top/wp-content/167975322228/gpeomul4/7q4162605834017130ia17057x9zztfkz/
http://zabor-pro.store/wp-admin/OCT/
https://akscricket.com.au/wp-admin/invoice/
https://ambulanceservice.nl/export/FILE/meb90305935983qq1qou6so4/
https://backoffice.scml.hypnotic.pt/wp-content/parts_service/szh9z69814084237m8n2tvypgo33tg/
https://blog.socialgest.net/pt/payment/
https://boke.xiaoxiekeji.top/9a654zor/attachments/p2p7mtu1x/t1q0b5758033425853096msni3qa8b5xfjmzmkxl/
https://bumbumemforma.tk/bfa2m/03URLE7N1KV/7nqu4ir3ai/
https://check.nom.hk/application/LLC/qo49b7hvz/vqsr8l249681550919163v7ipufb077u0waf4vo6zry/
https://coltsfan.xyz/wp-admin/swift/0nec3l/
https://construbelcaxias.com.br/wp-admin/ssehhd1w2d1v/lhh062632193ermjfd5xxac3qa19o/
https://dramabeans.me/l2twf1/Overview/kbaqwk3ho2/
https://handfinger.com/wp-includes/INC/k23222240390hcuqx1ka7ss6c4z5/
https://hrtgatlanta.com/a1vsem/A9W7XD/
https://ibjesuseselsenor.com/cwscwi/nqiykv0p91yx/
https://itwasntmyfault.com.au/agsclaimform/payment/
https://kauppa.pe/rmbktfin/browse/0qnihu3mp/
https://kenhonda.cn/wp-admin/ocj28kfwsma/rc183487648385hc7hcbw14gyve16x/
https://medicharge.de/wp-admin/DOC/tkk3jc7g/q2iik0q744412642025bm6m4qgqx6z0lhi0nl/
https://mukah.com.br/anjosdaguarda/wp-includes/balance/
https://mundomedicina.com.br/wp-content/DOC/
https://obeidmachinery.com/wp-content/invoice/
https://ravenssus.xyz/wp-admin/eTrac/04cgabzs2/
https://shibuifolders.com/assets/2pxtijp19551430551578771gqps1eox51t/
https://shop.mtcss.co.uk/wp-admin/paclm/bjj788500527sb8v2qec0guw5jdszgj/
https://shoptkosports.com/profiles/swift/
https://so.xuezha.cn/img/esp/bcteo055uiy/
https://stewardfs.com/img/lm/vmoh226408708710301yoqdu7gm4u/
https://synature.vn/wp-admin/Scan/
https://therafagroup.com/wp-admin/public/6x912wn4/
https://tunicip.com/wp-admin/NLAK7Y/
https://ukinvestorgate.com/wp-admin/parts_service/
https://vonews.net/wp-content/browse/
https://www.hehouzhu.cn/wp-includes/public/91999w/
https://x4fire.com/blogs/esp/vu9r6qq23764271tsp86uzd8492tr0/
https://xkeji.cn/wp-admin/invoice/nfpp7ecl5/
https://zhengxiuyuan.cn/xunth/Reporting/lia1q37h/


SHA256:
0394eebf7602baf22b2e45b390f4aa5854b0179e671b3a2607dbf44a5130870c
408b12e331000ac29de83635501b2c1ad800d8465e28a0a8054f10c4fdcb091c
457b6a08f7e1b6cf8d09929198bf73710085c58f346b256d31d99645df480e67
47fc0c61caa3805d7cb0fcc8a8466dbf5cd3f4df9456bfea6583b9ac2d83c0ae
49a768f22fd648f24523668ac5359d7496d4ec78072f12f3e65138eb3e54f94c
6a0b69f7aa83a9052858c1c98fe25792ae8d393fe5133baefee848ba652038fa
752cfdd4b5bd5525a1b48d12b73710003b76530b232e19a33add7a21712daa98
9d856a82f0899be05fb4c7d81837230640ebef104a02ed0e95bf00f88409ad73
ab528db4cb099ac282d5ed43ee1bb14b101e77e15329937001f25bbf2d460814
afeb53f8204c23e2ff8f5733e97220ecfb71466eb4f3f9ad1aef0807fd216973
cbf5b0482bc2cdc04d1f4ffa6c39d4517ef6793289339305a64f7820553bdeac
dd5ce5ffcf0c62e6fce916b040418dc3bcb7a74ea6b11c3f31123106f04ad6c5
e555220f1fea5978ed71dd48c9b80f989ba259d12fed9b96cb8692e21a706971
f2936defc5fc2976c78eb875870a7e003a079975fdeae34fbc2a652f0b488ba5
http://amvp-py.com/amvp/r/
https://dagranitegiare.com/wp-admin/d/
https://emitt-tech.com/wp-admin/2qG/
http://kvaser-microsite.tagsom.company/wp-includes/a/
https://aravindhherbalstore.com/wp-admin/TPA/
http://leo.jelct.com/wp-content/Hce/
http://domiciliazione.org/wp/UT8/


Creation Time	2020:09:21 19:39:00	(Attachment/URL - Doc based - Transformation Wizard)
SHA256:
0400334c3a2a7e2dbc243a57e54e084c789afd40e5742a3deb2f991d9574ea7a
0ff979ea9674b24eaaf44e80354ff0126f6a59acc790907ccb1fc48c8e1384b8
13d74ade49feace676a6bb678121492f29faad5dfc83d2512b9ce9cf872a375d
187d1420ec5159b3c4d58f576556f67a13facfd7f2518fc574248bb5404cb0ef
29a072fcb55a3231d48a7dcd2c01e5e71d3feafe5481f97c769e8f238dc2afa5
306d1ce13f997f20616bd30e5b182990f8a7d6dea71f6b3df38bc80f7d8b4c73
30ca3b2aed5b521c1a38f66bbaa8d0bcc634cf59c59493b8388dd894d048ef74
3f82fcd3b69f66b0c13d255bd4d7f92c912fcbe022d9b7f8d5f1943a248b60a2
49b275e5af380c6534fa127d28e602929157b7eb19352e9a03fefd4271f678ed
4e8b907a2a9db801e5ac5e63be51c941944aa0432de155955a9b8f7741387890
4ecbd935aed0b9ce03f5fb2539608b31e2b0ecf189a04efb2e17ebcc24cf2772
5d9ea64e57564b3e412eb44aa61235c5b1cb4d677aa5089910f9a5f1c6e6b1bc
6711ae72fcd8ff1f6b41ec56314e0c2133eaa5ece766e6693b8ca88670c8454f
6aaab241dd8288bd9525b1a50b7a9bd3573f1b5574ab80fbac7aeb6813e553eb
868eaaf542a2552458dbab990542114b9eae6c1c9ab0de7dbab93ad7d932cb24
8c3a4338d7f182b5a61fca23d6848bdf9a3bb775d6c5c938b82cfb845aec45a3
92d22198aa452330399eda2a7656453994b1ee2bd263e850b39429aaa34dd9d5
98d06fc771715c436b8ecc3bf03aa2b900ed0bdc897aa050d293666191dd1a78
992275c98caf603507117c6a84326bc0f5820f0f29fcf9e129d19a6e45035265
99282ec71e338ec3ab0f00b7eb394aa1226d4b73d2172301c59b735424100318
9c45d673d87c9821c5a3f9801e5c0db6a1b24d57541186e603a80580f63e4276
9cc2df8a0a216ecc363a023aeddecd9f5c70754d904ecc0f4688fb28a93eac2e
a71eb1fecb04c956e351274028426fcbb1a65045ab70ec3f73350e15fa439bca
a783eae8dc2e2d6cf06971b0229c70d3b8879a725db369f97d35c6c3b48f59f4
a8516766300b452a46b02941f4c26fb6b396ca990d85f6e0b7f660e2c3129e05
b2fdf39787d7404bc206d1a5ed3b41053eaa0c375641af699e74f70281097f29
b6a912df69f9643eb650746c7b191bc2b44d760e2a51bfaf8eca19a74241e06c
b780fd500d7fb2592181acab87281172189878f82ed6ea34f97fad5614203e9e
be5f3f383dff8f273492551b54b9226c2bd6326187ccfb87be8556ac0fb5f5b9
bf472ca39b5a4407fe40c2130b3bb1495772cfe47feb4c79046e811be37e8d95
bf80453caa419886805eb2bdfb4009b0c4689c792d253c215714a0b6f3c93155
bfeee1d13dd72f40ee2b2d19671fac2aa960d12df271864e150f162a6e330704
c0e5018509f8a988f0442d2d6c3a200dc70f4d69bc590c7a7e9720b756267168
c1fbade9d5f7c2b5705288400f77ce167e2f71ae4bda087c52e2983d2dffbdf2
c8c8f98b27aa2efb8abf41694df01c65c3aa294fd3c68b033cbf34f66c1d9afd
c8ec1b5a11693054c13c42e45d83be353dc88a30205b63b6e820c12c9b38a13f
cc422106d6dd2c41a70e946a117c310587b1beb090c9366c0122801bdbf0ab0a
cda5cd21aa538e60c7f5eede88b5ed5787c7515ab5dfc4b756c8547c4c31df89
ce9b37abd7ee0050b9d074b7d04a2b2a3e7c18576c690d5859b8053726e0870a
d15ee7beccb032c7bb054749f3921d769bfed37f38a5a877ff005aff025fe4b9
d55f4a0a5ba6e241b8e8a7e3574474358a990aaafa01443b5ad7a2ded2eef83b
d8b224a047fd3ca45fae0020990a47569ab733c47e03e1fa92628460dbb439da
e1dcf51254998cd51c81bdf72cc0ca5ce3bd5249bad513dd37805bbe67189356
e64bcab1a1f2160f9a78d618a0bea25b228470c38a589b537149a8abbc4401f7
e95337b06963ed71be5d463b3dbfe8b5e6d99e58aaeec4e29a2928336a0c9af4
ebc9dc204d6d52aa17a6209c072481880ef297e8853bc129a18d391446f8eb3d
ed7bc4f1b9ac349628e94398a36080786308437d690b0633909a72a3f2c6bcd9
ee0c171a228697ac111f2fea82463d7b64680e80f9c7ebce77deb08b6aa5bf2e
f0e77efe2ed5bb775bfcefae4448ed8dfc00f824d1e9a9b5f6ea63624ee6a360
f41df92a7bf31e22ac28e3e35cabf45f3be392f06c43b813eea05e2ca08f24bc
f49e5be00aeff785a79ef91f4ddcea3c074c7145f614e63dc439657f8068c49d
f58761d6abe3ad15dbd476209b0096437914904488af5c5be9aeeafa6d598a6b
f6809265a7460ab3d0e927c5fb9399a263172140778b4cc34f6698d9521b3b43
f7f053dd4de2a47cc943feb6ef87471b7d30cc0b7dfc7de91dff8a4c32af9746

https://waytoger.com/wp-admin/w/
https://jaguarssus.xyz/wp-admin/GfU/
https://learnkalmar.com/wp-includes/VSZ/
http://tiendapablus.net/cgi-bin/SIr/
https://prsaze.com/wp-admin/7a/
https://www.campuscamarafp.com/wp-admin/N/
https://infolockerz.com/wp-content/x/


Creation Time	2020:09:21 14:08:00	(Attachment/URL - Doc based - Transformation Wizard)
SHA256:
012c334db958a84f1f475fe44c1a86195a783c7701b6aadeec5c06b539158fc8
06ff769ddd838638dd933879a8a930aeacbcae74bf6df79aa7c9899d90222eaa
0a204bf52aa9793a659c1421454ebf60ecabc4b9aac1ddfdc049575288a49e67
0adca8f3f5265407428b7bada83845928992378c6adcfaa2126c4b04f40ea987
0c9f91bec601c2d0bb63e0e9be7387cab8627b055ff37f07367bd481e60fd787
16be9e593507ba2ccca2de91d87b8784818450844e2dd0df7a54f2cd24f3b683
17fd5dd4d03d97fe15026bbb396bd51a6338d5b5c5284d1f962c3da4e2ec69d9
19605eea16ef9fa725b26956ec089105384106b08ea365b2df496f9559fe2b9e
1bbe375d43a1851674a41be075244edd766ebcb1e62ca831450f11202cac82d1
1c1d6a7d2690d01c33afbde392a68bb12a53fd56aeaef85282b81661b0b06ed8
1c207d713f338bdd9388fcbf5a62faf0bf73c0b4a555c1734b63d521952fcef6
1df07b51bae05c06a37810d29ec72043b2d9f3e93c01e3dc13cb5ae1a03558d5
22288c34f43e04e40516c1928c92199cfa707badc18b23cdadb87511a06dd140
22a29b66bba17966a31c3cd3286dc31fa1c99e45ab2fa9bd84eeee1bd847f58e
25a45e935d58087ef1e9dbc5ccddfcf223d44a45aec64f99670a5ba62cf8ec73
2cdb7d27ab35b454598dba77166abe2004e91987f96261f66d9a995419936668
2f702f1a2ba900b1f907315425309f855fc57073c9c5afea7bcd30e69ada2ed7
356b82eeebe4eebc57579bc3932589783542b3b169a2f2c85dfa0c78fddb7ac1
35cde8868a2076e10e0dfddb3ec487a74ca52b6643cef4d514deb69d11e9edd5
37e160826469f43f38690f2a097190027c40e8d072c192c2dc36ac96a3855ca8
395bb9568da78936c13a412ac5052ef6a015bc0134fcceeddfef1f47fd692b6b
3ac8d5f57b90676d6506f3aa2c3231b1c7e4a6ce0b485bb71d52450bd14326e6
3bd8620bf36ba8d7e4bfa1477aa62faf1a980ca50783b571fbd71b9e00d36a52
3d53561b3bf1124d38edeb67519a5abdf7951c6ff3abe5918b8458b5e9f94453
3fec38315e25ce05e197bc39a6136959cf4cdf2b9fa9229fc188a71d464a5846
400ce9c0043e68540e0e6d31efc1165cd0e4d696ccefb033d77e6f9fe45e0f5d
436ac89a546b507039fc09df81c3e57eb3fdc5de7781422bc6ffa441a6f3a504
474af9dc6229c515f3c206208e9a7bca0eb884b0c6a647428054d521427deade
4b6f866b4d3e232b0bcb99a08d5ec72e495a8a4eba816436ac390f80fb01288e
4df26ed4305253b0d9ba185bf4b58d769301b0afb4cb6f2d72f7c31d217bfcf0
4f19dbdbc84cf5630856fba58a6b8ec24352becc031bb4d4f4e1fbbc344f83aa
5355e3bb4ea6fe8292b67d63ba8940c95a24c30770deb892aa675333886b69b8
54a883fc74bc50947d3f0887b9d6dc12b7d8cbe38a8b26391351c60986e73714
5532e7441feb84ff86270beee49a0add1600e5a88a0edab8e37ad5e9db16c29d
55b83e0145826b5f2be4fc231a15ebfea175ce87689594c884ac7a7e4a8a308f
569910897c96b5385d7869be7cf95e003220e6e7319f785d1e8748d46fc7c1d8
56cccdfa916393c8d85145450efab9f5862bfe379c2c38951956c6fd9592f53c
5af3bb808915a87c9e3b47110e4e4d712ee7fb6a463edfcfe48d0962917425a2
5bbc50e7511d96f3499f30c3000fa522641f4988ac06bab6016fe595a5f31ef7
5dcad75a1fc393de310584cc9ac10268998af6af9845e5767b26bb144dfb9bf3
60bc408adade60cc996c821f2be6c592a364ff84df237ebdcd9fac551cceb84a
61eb0d422b0465e3df0a4d5167d820688c9b0435aa4d28b8a09cf216487399af
622102e5267a380d026748ec3e0790747cf94774b47588e8474d1ea5c8b86d16
62ca9ca194ddf304dd0b2d91eeabd65a25ed7b1da54eb8d555834bf3ced8dd4c
6351168d14cfa0372803482062882590c98d717dc4f4eb2541fe3a154e8dc40f
65836f35189720691f30ed8f88638a91183cfbf994e08500b8ec1e1c39d54f00
66cb8b7e3c4085898b6efb2c9b2d39cb3bd28f6fab85e83e70b4e9a3f441a22f
68c41cf3b9ad038c684a928847be39b790d0de074101c554c7b7ff2cd32bbedd
6c3815585bd2e5df3eb70a52a2037e856543ad93056799773d3fab15caca316f
70703c85120edbeef8ad0813b2ed9ba2fac6b856aee1eaa112ffb12f4cad9f41
70dbc4cb021488253faec5d8447c680d8bf7285fe74e0728c0c8051719877104
70e273a60af8784db64021a4c41e0f4963ee67a02c0c3c1deb8aacbf74149a39
716299f97023ee3e7f0a20ad1843ee7284684da8a503b9031fdaf0aac7e81671
742b4bd6750f9aff1859bbed2516e32b77d17214a1c9d4294141b0255eba5314
750865a6dbf1e7023ebb0566e7e33b13eef7526cc01cfe5ea550226f7f029219
77c88c85cace420b9b8fe01b1306ee27674e3ec8a457d99302c980ef2e271a3d
783364f07072f525abca2b24cbe07e68ddcdc443a2e5b882c9d8d03929a23035
80a8b5600bf204df850aadf7d4e7833263ef3c4771208d62fcb53e662007b5d3
817dfa0131f4686e1849deaf26ff7ffe1f5b2eb30526bc09a6753ce13185f502
82fd021a09f56eb6c9c4129caab80c81c416871df51ed92e6649100c7373ff85
8444b33aede1c4250ebffcce3e2abc7f96072003c7a5981b85a10bad9536ecae
871e9f95f83bdec95cd1146efadfca928251886fbcba5671e65906f40d73842f
8b60b261b7d64f0e7ff4d7a76fee3efc31a5caba0d764122e5bbb6dee3684b4f
8ca7ddee7d095c888f41356838aace04486d06a5b20a15fa6105416f3c73c9f1
93a1db3e72d3c223e9f8dc52f78fb1e81ad6d1663885915fe1e55447ff99b6bc
9c52aa87b478480188f49240e7286d869dc06ab37388e6821f088b5eab8bdaf7
a437e2c0bdceb42fa9b6d14a398043dcb832abaed3357f649ae4bd1756802dd0
a86172b1a905a60ca23551b80ad4a8a7bbaefbf4565e9b5b660a8bfef4b9ade6
afd45922c3589ecc0dd6a70924ddb82a913798343dd9d425a83b655e94517da7
ba8f9cfdbfa74ffbfceeab42358902638da12396802bd63597b7677f66485494
bbfbfa4b74ecbd22841d49fe5721601886838b5365ca2da11e07e046670cbf3b
c526bd9559b3c86c8d12821c511d2b8d82545dab3d76087773427d8b98129d5e
c569edbab23423ba1e8b07d887e2f627f83169707deb8987fd9a8466b998723f
c60660ab0787ad07d92caba8f19ce8fd7de59a44856d3c442a770672842f3ad4
ca9bcee491d6c3d28b4dd44993516cdedf46cb56d650e41e6d2f7ab8c0e4505b
cb488450f7c6cb90bdc78dc2e6febe6e9eb0f44713212f6737a5d686a5c682ce
ce17c43a0cf8dbf2a3db7e70dff4273c7330dd42cf83c3145453eb94bb51974b
d09bf180c62ff076b690cc1ba7f1848bbcd7aca274fd1350df751593c3d06cfe
d295a4bc76b3fcc18074cea9d67ed8b169bfa0d2c88f51d09bdc56d1db74de58
d3ff202740cdff416eec962da85987a787df2ae2fc8e6fdf4b010035594c9960
d497bbf903f9694b94bb89691f77296e779b76aa135b390d97a3e51502c52bf9
d4e93a23c63fefe0b002ea4ba7f32118bff1da967b6be99a62e3386fd0617b10
d54c82bc2188424a79d137dc8dc9cd7764a0e62e8af9ba7a37fec7058efc20ea
d6b49fd8cd1ae8ef8187df86ab91bb6b2b0c19b4025834915102eb597a04e0c8
d8e606128ea6abf4af62e98e8f0de8e37080dc6aec867ab0a5d2d4a8ad68ebb5
dca654f7419186826dd804c032f8e751321489bd9949c76f41b996cd587ae19f
e269566d0ec9e6b79d184105ad80a51ff32b0894f2d07d60a2080c0267924f90
e4b33e50d1a6bacb09905990c0ebcd3b96f714979d41c85a842a0c615490da60
ec6306040730f010ec7bcab442c87da9436370a6f1d6294572705570644ece4a
eec5de4b7b0f1cc511f1bd917e05c187785ea211748aba8d6dc3ca62007dc905
efbeef5b97080c254b5674ee470a114119acdb49a6704a6629ac542173ffd001
f2047aa88b10b376fa4c25df0838bdd2e523b1e7593ef46bd6b460604d5c9505
f2e681ee5b79805f8cf54b83b821ad59c1c4b7daa53deeac54ac5ac3ee7a6421
f7e288414ab9e74bc1a11ae2adad7f9308badadd13b048f166a403029ce4c272
f822bd6f9426cfa72121ca946e9dd04ff3bd8832db4564ecd2ca11dd2f187a67
f843c6d86e65d7abf6658590e9c681aa01ccbf1e9938afccbf4e911e98dec3ac
f85e575ddd651c3d60580fc1e2a4c74eb93f0097b1141daaab16fcc6ec843279
fada4708605505ec08d2045110877e6a7cd8fb2037b0d9bc3c32c5607a23c21a
fb5916b49a668daaac999ec4edfa053a580598228838e24dea97f07289f6a2f8
fccf528f0152705715608cfaccb8952b64971c5f5c8a3479f035b979b8e51631

http://minershallmuseum.com/documents/D/
http://injazjordan.com/moodle/Vh/
https://site1.xyz/wp-admin/Y/
http://2bstone.com/vr7tf0c/ZD/
http://biology-360.com/wp-admin/hv/
http://tez-tour.site/wp-content/9sB/
http://iooe.cn/wp-content/hdO/


Creation Time	2020:09:21 07:35:00	(Attachment/URL - Doc based - Transformation Wizard)
SHA256:
006eb3de7c7d6ef36973d365810c036529acdcfeb2f53c7b8d9d3f36231d584e
02836be5c9124bd4ba54a0f55a760d8b275599f13e41dd2adb1a1c55a690c80f
067eb151263b210a180acec91b442c110a21200820760e17f408b1fbbfe4f67a
074042495b97a2e7cd7a37b3146f0447d96c51519caa6130928924bd4a141c10
0b8beb84b2712c9627f2eff3aa31e2d64307a0dd3d5d535d01af5842da422a0b
13e462d6dc61d17b76d36ac1d5c4f9a990923084f48ef4eabbdb660847f54e87
14d45f947ad30ce515c35815942b9f76eb1b8feb7828112e41de5bbfe9818047
155fc45f0849e7a83587aedc0cb028a587bf371a518ceeebbd95492f5ee666dd
164898a09b7b291c8898d773c7d1bbf378552734b76b9ee7ce6f8ec296cca217
197e6b7ab5d8d561afd038bad52a5be5c5f9134eb8c8d04ba5f64124c211baad
1f612f1b213f34bdf096d391df58a72549173acac407c554bcda4d9498c42932
249cf1424893feb2001cad2ac3619c3715d1d5c8c40587bddc6b5b3e29eb2f8d
249d6573f4f79e8743e529bdb81be6c11f86e83a53873ab864ed86b5cf603c92
2b2348aa673f017c233082d9588e34d488754ac4e2aa9b3209d2079d29c7ccea
300f362cebd97d34728046140eaaf4dacec90c06dbd2b6f81188e7bf7a7ceed8
3065b2d463101dd67b069c1926597f2bd2cb3ac50881206cfb87357465796e75
306d435e7144e90ac64d022d1aba40808a9b00583cb0c1f22750a430fc9b8ba3
374523e9d054ba30d59eaaa8686fe97fc74a10882a0b467d52b21de5efddc31a
3a05776c14b74dde1308f9a7a7098c4c6fbc065004db3227330937bc0a1eeaa1
3a3066eb5fc603c6bd26e82784e4692ad45e2ceb005e34ef397224cb38b9800f
3af20e9e67353d36d683c97554fc2e0a1ecb6659ae0c4ee670cf6d4a54d68b8b
3e852ee596953598ade5ec15aca21d6360f378edb62269d0b2d2c9ae5c8d3bc7
3f0d53be0681ca0b025e12e57da569607681b4b3f06849aa66b7ca1d4b1f47a0
407095bee0e129a8413839d5557e63d69291c118951788e95424b02e24c66552
4116135982a432153ece02e8a233691a48b59bae55a23615a717a18844e36ae7
479a5b1aac423a54a966aae4c4c0f4c48b789e3fba3575d352217f34b5c3f536
47f9aff19305430cc60a0fbcd715d54e493866e989c73d4e3afff622239ab909
4df45ae673f6459bc067d282655f48f6a72b149d9c514c8038ce6d50bfb4efe0
52b7c476c5d75923ba3ca1632709771dd89481a427bb0da2fdb37798c1cca27e
531018489ced30197ebf01928009eccc4fc77b24113032057cc5d8e6399d9aa8
53820e879e1209577c7c62bae23dfe9e6f81d2d8c18b8a9b7773eb497c5ad107
54651970b301a8c0908daf207240c4ae755ed59d22d7de3f00b69993838688c6
58c4c0e1ff4d0fd3f3fc617e1219a8ccaa5780b8efd90db53cdf44b35ac2fa8c
5b553de983ac2fa97b6d41a6bc545e330a7e725deb81c7d4ebb0e795becacd4e
5d4548534f15df03e54ccccf8eaa3a7cd08ac7482dfe65414a7758507e96d7f3
603a954c14863f0d507744dc12a79e66e12df3a802cfb33e3cf52e5d4965c68b
61aa35d9ad81f1503b69543877dedc53019cbd8cb4dc039e50269e2aa3499d24
6251fe34a473b9a4b4e6c0b0ef652f0a69353b1917bc54295b2d9f8d8cdd53a9
64956b41e8db0a035288a8e710b6dc83ec80a02c9b3bc752237f405f42860fdc
6a0d97aaeb19130893ef6d26d7322911d12491373836f4158973305a62ee263a
6a31245fbfca703f971222d092fec0fc06776ebe8e2f8f154976b6fbdcf72de6
6ae3a03a68a4a6ce72eddae2943476e1e43938758ab1123168e76dff0aebcb31
6cd088d70602d9032920e91bec900e3f28ba0a38eca2b98bd6139e6e882bed64
712fb1d60ad43d0063de94b64d1db09629a00d5803efef4ce9a6055f82b26ff1
7252c4f020cd8fe64a34b006074dec33be448f6e8af40d6c2ac0b89c74bc429b
7324fb63ab2862f03f39836b95eac796f953ca27fe0fd545bb8b8fb8c99e3a36
77b767b8c013f9955505e5c6cc426678500419b6c046a0ab44258977f798cac6
78087064fd94215cc6a0700120c55c2ec63db11fd810dd5e175bca51ab8975b0
7a54b9e5d5090d615e8e104632ff7c966103ba016bdb7722525a3eb1aed17c13
7fde47e9c85a90a0e3a59665575b70542f5e4c5df27a2ae9819d09a59d4cdf24
8107e9bdb5b253a1ba409281b6c4196958c41efad1ed86ba7a7ab2e2d58520b0
868ba9aad8eb6aafcd6a7f0478da47b3053f110fa35aa2e1e49d9bc8c0888b1a
88f27d4beb9a97b1f8fe1095cb44670077433e0e98ee762d7e74613878998265
8b160c5e14e6cdc95718a1db66d62bdfe791723e5f08bfeaaf2937f7ba9e74c1
8efec761be2ad1d9d1759aaa87162aaafe6d8abf893d3ca22b1530ef6a561f3e
8f2b2239ce860bf63ed7aeff29df138123938f4982bf37087e37cda996776367
907c8db3d28d5cfa2c716572ec91a289936bc7c70d615e2afdb5d7b5d34a8381
9475e60869aab3e8d45e76c6b7d705be58862a2b374b27e783db46923b8f17eb
9626311ceb26e4ae1ef6fa70e40bf593f7a2be83d865b6ad393440a049de26e0
962a1909befb23ee9d065755ae3fb2fd3ea9e31cf4b6c41fdd36adeb9501c5f3
9de3bc7c39ba2edd50b190c48781010f46b42995ca0c5ae7be8b8c0fbb181ec4
9e786d5fa88f060de3c17627c28c9a844f4e85036c0e90f0a4c5ac75e9b88fee
a0953aa999c3d722ffa876f5dd3371023be5aa513d6ec18052edfcb2b7feb185
a10f1ea6897101bf35f7b40239a4614cbebf414ff33b4634f8c5c2fa0ff972a0
a3019d963b212893540926b54307b6f2af7f7a30749c0afe950b18ae5ca323e2
a4fd75e0a63c4135f57de1a879916e56af1ee7c85e08702120b56407cac21b54
a9d9d201ed6f1157fac2cbfa378e11edafcee4cdd6bc0e7a1a71033bfc50f432
ad9b0de3b8e65ebb7aa8a660931bc871df4691d16fa3a4074a528ec879dbdf29
b16ecce47c281646295a38b45f138c8d0fedc872f816e7467e881dbf00fabc45
b3a71b67034edf8c96abf45f5afae740d73f431a5dda97c500fe3a62159b7986
b556e5b6ae3087d8ffa1327e4115618e43c66602e8a877abf50d008861d7b740
bbd5fa6f8a7f89155f18a2ce58a3c8c5ec96ad3452ac15957567098125fce163
bdd1ed31fe9d127bd2506d586edabd88cd3cef87f0e4188112f8ac0aaa692612
bff303d63d09eee584444fd3345b76aa4ea7ea7aa7c569711fd5c0a07ba1ead5
c00090beb2d80d6e3b59ffd4c07c6577a6afc9dfdd74f749db99092a10f559b7
c011f657db09823eeda192e8f301d95cd0abb5aa4fac1ef4d53c5169e951bbf0
c1ebb641f36328616711fb377d95f38319840fe6a0ace1c0858b64d7b75f96b5
c4804cb73a7c243615e1d5d617435971b6f45e0dfc7d0dd83d9df841ee1e58f5
c5cf5d5d6629f30577d484019efc27d16e13d2c833b58c71bbd163cea36a163a
cacf05026e9ff252718354854402d119747a0a0ff3390f908044e7ee222b1f83
cccd2885744265bec6edeec18806f01f46f127609f06804bdc0e3f8f9f4b638f
cd31cca5a87d7da0dfeb7b2d75aa559b4c8086a0b3eabefe3e3f8856aab715d6
cff41d54e136cb2a317e1cfd7f31bc5c566c1b8c77a26e62dea291c98b8fd586
d379185bddb04372ebaa73fb3d3d84f999a3ef2f1cbe9c61e39a5ad938fdbab5
d4159a0f2d98c970d14d5dbbe6cb100bbd38d0d34134ee2f73ac7d3c5ecaf048
d514c46c30e752ee22291f4cfce174467d0b7c6ee1506f12d854a4090fb65ef0
d5d9155e8c1764e303d8511ecd388073baf67b5609e969619966c91aaddfc885
d6da450c0e2352f78f148911995e293f0b91a02208e48078f57993b68d9a3fda
d8fa1fd9d6875f094c2397135903ec7e871ca63b06a471a6052b8cda6d7b208e
d928555a251bfefd48543b81b1d8c5cc4b1773e7b4d44e4c2244fc72921ff8b2
da3050b0d91467358dae813cc2436cdf839c08206d0651e0703b74a81caf1ebd
dc22d99fa3a69c87670c71cbc507b1653370e7aaf7a476244463a2ce20770f05
e31852589616b85edbf925aabe05c088a34bf27428fb8b11d1908d227b8bcb37
e4623f09e9fde14e0a87982493d6f2bc7f37d592e16bda57e69eb65541c7e2b4
e678951168cbafe831fa542da45cb0c6fa43a16d1069e96fbb60fd690f11b5db
e9a7fcb8a2078b43fbb63793dcd3b7b49b37491a46724a3f347ef058280ae18a
f35e1ab3d24d0a44181d02a8d852f4154e79bc30e5d22f88074816007713b62b
f7702d1f529ffaf4f63ff3e1f187bf299215f423fc8fdba43e49f337ce1025f1
f973c445aa69501b46214e3a65d8bd66dfa1abdf5010716989778d844ef32de6

http://dongyabingfu.com/wp-includes/w/
http://givingthanksdaily.com/Q/
http://uniteddatabase.net/wp-admin/dhJ/
http://www.gozowindmill.com/meteo/nmy/
http://kcdryervents.com/ca/D/
http://www.greaudstudio.com/docs/kGQ/
https://mrveggy.com/erros/3Ss/


Creation Time	2020:09:21 04:09:00	(Attachment/URL - Doc based - IOS Enable Editing)
SHA256:
00687a63a22520f84098439a4a3e060d8b6c848935fa9433d57528fc5dede962
0b5af6a8e912d72d3665ed4c1df992874d91b4194a4084ada1ba6d52abb23a5e
0e6942c9e4f43ed3e5a26b01be4b0681b16fb28878cf568973993517ae63bcea
11e29b1764f9cb02263e24c2ffbd2c7d1992552cfb4bd6bf7f19695b8e28bd16
19f032cd8a2f4e54a759740a457eda11b94fae08920917346e2094949d218546
1a941bee924f00bbbdcbf3f2aca0c8ab959531b2a52443afd658ac34f8432e2e
206dc1c940e5109e2e121fc275c21edbf294ddc5c4d14fbda80d08b35dce5053
22a8c7163e3a7d8a6f56f36d0f4906da36bdf4deb9a329feeb9df07343e68026
253db82da18296982ad9d56ba6e27224e101862a5c56dbe06f8d6a1d2ae2b1ba
25f21a7da17df26edc8e1d8fd48561fbf9c67d27f64a5e6e4c056176b146972a
28defa65b9b480c24af5a357e4fb05c04a1e3009a834e6586b85b37a55d9615d
2eaf60c37676f989570e93644edc4ce31bbb83ab5f01754816b402b4ced13ceb
32c8bf0109a19d4da65f6d1359f29e7910642033600654e238da763125a76294
3c77e9b86f43927559bb92012199d94db254d6764781f37a90d30ae0361d032d
3f65c040548e19efe04dd82604458f807e138d5d1e406ac4082ae890c5ed2b85
414edf5c1a9e8de40c1ac18c36577dbda66520cd3c54ef83c5d1b08a92258773
42bd5694c817a1711d186dcf4dbb1b59c343ad3edf28117ce218fa55fec28bf6
4338aff79668b2bc8e15dae944bfcadbf29e8dbf8db916be2aee1102360853ad
4b746e2205023e92aea5a9da75668ac79eb78599d6577a3dfedcfcf76998acd3
4c72fccaeba45c7dcedd299cf87acf3b213ce6ddfb77dbe84283323b9d5762c2
4f816b7cb08a9d0ad326f96a2fae50989ac6ca0624658ae223bbec57a61c2618
5f3c1e7b9132454c6b7fc3fba24103ca801e724541fdfabdf9003ff50f696888
5fe24f9e46087777c1109a653e421a0540d844586bdb6163c038a1ccddbeec3f
602c4385ebce5d23b29a194ada7d2e3067e9f78cc7f9326034d38a3b9a391f53
63ce48280e06d9496857bce6b6c4ffc8e9267f43c50bd4c044af776bfac5d97d
63f39b5d4c7df1d496184b11a68d27be3dcc0e058d457d8d68fdfc3025c46a6e
643d6086cc7145187bc48f08e906244f750cf3830ae09a58630b8074cdb916b4
6e6a29654cce97b2b58217bfd322d3b4584836ee97eb69aad35ab51db10ab9e8
6fbce443adf1a89b6e8448b10a0266a20613275cfae9d9091cb216d9b4409954
7120acfc03f3cc507395b88aaaf139aae70f50dfacd096c1a8c1685e4d08bdbd
72b8d072d56649395e4d9e5078857a3085e7e358d26dd47ac710dd325686e530
731c89aa40184be3b2dd8e387a94c11b9253280743ae489902230bc34d092eae
7725ef079e325e61a0940298fd108d997eef7bb18ac14f9767296b65de04ebae
7a6237a15ed035ded9629b186174ccc77d71deb434d6197cde841db86ada8ef7
7ad1f56b965db53f8daf7a7f74b2af41dc9fa69d8026905dd5c8630577126afe
81ab49b690e1bbdc91e690b222a2c7d3bb5edacc027d2db853fc4bff6e68fc2e
81f0729553a13e04abed70af62c346ff7ded2c139cde0117e08528b7ed8ac673
89e4d437e3cf1e57516045ca9d76e1689a142a80dbd09f49d53ddc9c7914a013
8d0ca0956814c9f00a306a1931ff8018a56a1c57de581adea31861fe2f0f92f9
8def4d691fff019108c8e68ae99fb81cc8e3712c727908390779a4bb72be4ef9
99f502fc10ff5779702662895b84ba935eab5bae399ed624c8ea94bf862e10ef
9a5698d2c986d77c5dbaaf0edcb2201704ff642834a4f5cb1f7c93500215136e
9a9fe6ec920f4d8548ed30762fb4046f2b361b06a376859eb680bf6dabc17842
9bf877eb844f3e50fe550eafd1395780a7677d2fcf23d33a4b20c07b7d11828a
9e60f97fdb83d6fc547468ea049ab8b76dae4a45e2172c084e5f317e9bbef727
b0d6eaf6602f12c512beaa090013dd28146b98efb36258c0285c5d0fabeac6c1
b56cc21acb9e995c4324a37f655f08d6708e933ec91e3760bbc396ad581c8384
ba99cf0c435b3ccf8d9fb12cf7086c1286bbc395cfb5ea6edca02b7558d2a99b
bb2d6edf40b2fa6403c315b6e7dc4175057cb230539c4338960ae569c96985b1
c166cf314cb66a1945dca4dfed75512f30709c4d0d8f0782f1e3519d868b9153
c2536df89f0bbaafd863cfb89bb96f6231873c62a8f4e6e6e7c788e6694b65fa
c71b92dd35f3bca17c7b086b10b5ba3344868cd7d4175586795074f97f3c2cad
ca8ae8202db2b8b97471641166ca3abebc755d1a589acef1016aeb38186fb40b
cc9a3a0706e1f3fc56d3b902645d20c088df0220855b841797ccd584ad69b307
ce2af02602df968e4869ae769e3d2e775f571235ff838aec4389076c76439bde
d0307f98fdd02f005a07503d6bc5e75595567f555a600a5e084bdcf6fa486ba1
d7eba393957320094938db5221da24c71a0f9d6d29d6e05ec1d2015a6d824a95
d99a2641a73f595365d6be91a603347e5d88d0dbd15e94bae11f54920418031b
dd846aec23ba119033f73252a5b536497be457303e4f3a7c208f686d4fbaa944
ee8644488dec3eafbaa5a339eee98a5328cf6d6358efddb7bc890ef3430e83d8
ef31160c3261b9de2dbeb27bfbff7cb5e3ccdbc20b70acdd95aa7426aa9aec5b
f7fc22c02d259e3ad271db0a561d310288cbd879a75e9b75c5c7b3dad2d5a2a1
ffa3068edcfee0635dd376feb0f487484e4babb30737b5159d835b1e39001d01

http://wynn838.com/wp-content/B/
https://menuazores.com/root/4eq/
https://www.lunalysis.com/images/P/
https://fedo.xyz/wp-admin/AaD/
http://themsc.net/cctqv/M/
http://earthinnovation.org/pcimonitor/d/
http://pastaciyiz.biz/wp-includes/1/

Epoch 2 Payloads by Document SHA256 - All Times UTC

Creation Time	2020:09:21 23:04:00	(Attachment Only - Doc based - Transformation Wizard)
SHA256:

http://thejoyflower.com/wp-admin/f5/
https://jatoapp.com/wordpress/I/
http://amessageforinnergame.com/newworld/oXJM3jA/
https://carolinaskylights.com/wp-content/7/
https://ragantechnical.com/wp-includes/1Q3XRzX/
http://nescoat.com/wp-includes/kMSx7EE/
https://seeitbeitbulgaria.com/syslog/ZV/


Creation Time	2020:09:21 20:39:00	(Attachment/URL - Doc based - Transformation Wizard)
SHA256:
025f8afc4fe9c491ab36c4b78e7f60620250a2bf76c231186993727526ffd6ca
04b6915557c386d4219e56049dca6eeef6f30b41f45fb525d36977e248fbf4ec
05d8b6ee1e6ee87acce063fdbd25c9973252d1cddf3f0a393f1a4eac6ab49793
0b406d237fa37888f1acd0ffc4b59577ffd5e45b792a835c2141483e2206ce9c
0ecb8f0ac3c2c27f213dff3752b70d6832343dd6e1ef7e95e066e0446ef384f8
1c32c9f78e41111a64f8b70991f12d32e3baaf7def1f2ec157245644d8e4ddf3
1d5883296700a539b700172abed3dd4d1f4e171189c3536c80a81d5fb2f943a1
1ee23bc9e2a3807499d0fd736a4503235cc2d46e14429f19ff423fb2095bc38b
250c90b6b133e2ca3a8acd3ce9891d956b41e53837ea9d9aec4b1477b10dc49f
292a48621b6f7863d1a7d04f25cd2c6ddbcbf5abac1282941d3ba20ae076b776
2d560e72a8bbfa60a7f05d58048f8174de084d6ff4a53531d9582e251fc067c5
3366930cc13338eb0661795bbde1d36e686105df071793c4080d1483b27d2d84
35f4f4709b6981bc96ad057a270f1bda933dd3b0579302a2e32079863ebc923a
38429e629d4112efe0a0932335bbe5288c920cc21fb98fe8b687c50083b0dbaa
39de97c9d5604bd29ee471559a22ce1c35ad2157fb4d71802c96e7621cde7fe2
453c3ac3a5da64e336f00f48a7e77a64a0d1a69b2bb227fe318abd0e873501ab
469d40c989ee52a990ee653b38417a1fcd785b0a2179e5d997fc82843e0b47fd
4b79ba0096d15d6a7c759fdf3e094194707f88072e8aeb0d53979a88db734ae2
539412deaa4405005d8f402fe43a5cffb4c1163e751e9cea52651a6a0f924086
5bb3e05266ae1854d7bd5732eface0a2f45a896e99c1d0ae15f6e70423b2a2d1
5ec6bed566afb4a94fb1fa92fbc8b964ed670f2627e8de8df3eaef0dee7e7f50
5f48ec62b70130e2ebbdf504c0de8057499f87bcf6bda3462f498f3d2e08c22b
602746041c972299de2505980a9346450f01f8a0818a85acc682f66491a1d8a0
61ba6999ffd23a0f22f6827b577e773e9d6a79ef366b3260a6b55a792c98d519
62f036b925c8b4c5c90b88eaf15e774481a952ac6e1c7596916e10054b82dace
6aaa5d1200a0ddb1900acfe0f5b79eac2ce5b928d30db37c4f21e43cea55d69e
74c1fc2f43a4a426a9f4ffbc4738e6107d95009d67a202f0c8a2a1b80ef60937
75aacb9b9e0f3b4113358caf49078bb79286fb9637c523807a8f533d0df7c834
75f1d2e9cd7d7f7f877e0758fec979992b23073f7c56ff8b3fbe8fc5c89d0adb
778a7dec2a3a0d2021406e3186ff559dea78e4a07678dbf5619e3cd6d7d8217d
86a8ee1c5f1f5ce84a8f3b31c04f51e324a47d2de0936339357ee0e9a139e0c6
92ee99cdff841cd67c677d847968d3a0eaed00d1fbb107b8da485b9a6ba4c608
9959447fc9c87f2838c48ceecfcb5cb1eb094702dcdb553d798bfd513207e3ae
9e23f757e5e389aaaedeada32671c3f7a5620ec100069483a67b7305697a88c9
9f3a5491d61d0e1c05f436639b20d24b38465f96aecdda836f9fe292d1af0b34
a09dd0e095d93b68eb0713e31e92eb9caee82983e99ddccdb71177216cc52f30
a8f76389eb48147fbdfcf5e3037911b1d933d7e0a1da38d58125ee2b9084b561
a90a365b3c7a945f46b9fdd9cefcaf5c9d8bf91969bd48b47d8454bee53e1425
b0c1e64b3b04df99668587d56d89c513ced13de50d8596e1d49a2eac66c96049
c19dd05cf11f244d0b2189ff9b5075a190c1a64d8c65dd5f47a65e3bb8c2b869
caefda78ff290b2ad9de3f8ee864f985144a3caeb6e307e034427b5f621184da
ce745f41bc3c216b25b5d553cff68854d633377995317973429dc64180aa89ef
e1e28e6b69d9f4ccb1171262803787c1c468b9b27924012d88df127d9aa1b480
e5ef583d80780947a6660111040fef17af94bb4a2b32611f0ad9605d8815e17e
eed638e68fb63c08e3dbe230dc2a66544170ba12c92aacb9571a99fe355f0878
f032da6342ee3da2b15c96ea27035574335bf6c5133bc03871bba1958206d66b

http://fulfillmententertainment.com/cgi-bin/jO/
http://meadtimes.com/wp-content/VZrDrTw/
http://pinturasydecoracionluis.com/wp-admin/fK3/
http://oconsign.com/cgi-bin/koLViD/
http://umapreowned.com/wp-admin/XF7RBbs/
http://kitecorp.ca/wp-includes/kEI98N/
http://moneyii.com/website/ddeoUDo/


Creation Time	2020:09:21 15:38:00	(Attachment Only - Doc based - Transformation Wizard)
SHA256:

http://haymetetrading.com/wp-includes/yGELKj4/
http://simofferbd24.com/wp-includes/fsiQc/
http://401kplansinfo.com/cgi-bin/KtFRk/
http://fidelityguide.com/cgi-bin/VA/
https://sirnakmidyeci.com/wp-includes/qk9wW2/
https://subitocarne.com/wp-content/ByeOAt9/
https://eliesalibaarchitect.com/wordpress/T/


Creation Time	2020:09:21 13:01:00	(Attachment/URL - Doc based - Transformation Wizard)
SHA256:
04136b8270e1d84f73c175123aa7f38165f56bd7641fb172dca3caa593f6546d
099dd1b4e232dd633b835e76786449c0c57439d1584aea04315e86b231201984
0f3dcf665c7ea9ad31fbcaa324e8f714b5611ca2d55c539279fe724acbf61cfd
2cf740fe002fcb52b76e9121ef2b1c0efad8f7829310489bf59e7a045742deb8
42f29aa41b1f7d9de698db6b2a4512a76e4c54af72ab7ce26542fc3666438084
4dd537ac46ab8a39db41647d215caf9b042be8faf2ef929cbf48b5582a02e85a
5a4026c992939e304da0cb25bcf181141d3875dec80db0003434902ca37ec64e
8624b86a85ad6c756c26034225f489ef15aa8cfcfdf0dafb529ab9a1718e075b
9e41dcaac0305908786dd0bfc9200f13a1d7d5f40431c0fb9070f950f0db142b
be9ecab012cc1458f1122eb7bea407629129263e22b0606c4c68046b82f55ede
c38007baa464dfca54ee9305c00ba166951dc23b5b4acf9fd9d28ae1ca04ca8d
c3f490b02f7c353e9e3482fe9ab964aaade540105541a0bad12f0451c25d4866
d47b287ef4b8d45599f5a80f2fcee0858d175bf98714aac0f0373baee18c74fd
d8ecaa9d0463137fbd29b7b0e44ec8225fd3fbc3d41a2734fce53ee0f7ae69e4
dd82c62bce75cfe9cc3d63c50d2108210a4a7307bb05d0155ce6690d326df384
e61511eb24b3cf59eacc8ee628d014e14b62fa3e2b8e041dc9a6a342db373472
f515aa20198574ad28264b78c6e2e4387697c8d8854080321942c2036133eb53
fa3defffe8884b1d46798751f4c734b1fe25494e2e56e709f0aab500fe309981

http://swadgaar.com/wp-admin/f3qB/
http://oxeir.com/wp-admin/T/
http://prosperahertz.com/wp-admin/AnnaV/
http://banglashikhon.com/wp-content/XxI3wH/
http://iamcyteese.com/wordpress/twv0L/
http://homehm.xyz/wp-admin/hchhm/
http://dev.internal.dextrousinfosolutions.com/niamh-quirke-solicitors/g/


Creation Time	2020:09:21 12:09:00	(Attachment/URL - Doc based - Transformation Wizard)
SHA256:
02fb0cdf26f5c95bfa798f3bf039f07b98991046866d7b282fbc2e5df3304305
0375b4835fb4def35254dd37af3b71c8c92dbafb8af44ccf8f7ff85e3751ffb7
0472d0d1c3efda63a79c6b219c98867b775c5748918411529c4f957acd47256d
05e685c37f06a9161494c990d94eb18745d2a78d4afe5a916c425f3bc30cc6aa
0ac10cb1898d5d75cafc730cec147129f9b64dd7e063ffa833b1c9ba93c50691
0bd3309804cee24640d2874c2d9d3e72629aef9dd6011438404c8c2cacd941e7
0c946b095469a7be23241476b4d069804e1643c6313e14914854f24b7dfd3600
0e035ec654420f302e735b6b6f18580b07146b5ffb121bca2f3979a89e9ba4d7
12055ad316953428f253335e313855ab7200e9b3bf0a03d8fda95dca58b0bc94
183248bc6ec8eb848acd91bc0c7db5d4593df72fd325cf55a9c184ee9f2eafee
189331cae8227ddf053297e8aa4b27752da6c493cfd3049cf1945d52af979219
1e0ad6475aad3deb28ea9202c57b64589fd3638b15484a6f614fb7ae4879f071
20c91a51721e21851a9378758513e3d0ec631985cab6f862b783627792f1f127
217964d82326beadbb7b8928ecd9d4badb90db271cf1345f197c995e260ffebf
229688b1f7ac90b600e364e4f882c86c76937fa1bad916b4ba9cf48ea1a0ba68
230f8ab12618e81bd64e2a7e18a63b323aea440bb8bd112553541c0a83b98d81
2399ac63e3280313a12469e86cd594da3fdece95ec09663dd10823aeb1958130
23d5d8e9c92d53d3ee2027f177ca8a6a51be1fd82c937219ed25eb2c0720a377
257be5a7bd65816161022b44a843518eb7bb4a3faff62c17a075e29199e2aa6d
2a0b99a87a5ff51d2773c29e11bdec1e660fbe8ca4da68e1e55e553ca359859a
2c13e193f719d9760c5efcdfc996df6b9ac513022ead472d1e901ea4c3aba62f
2d6a5431e61158153fef1258729585f1e960289a985c131147dee0f8918b40f0
2fb1aaab163c5d674f32a4afd442561b6333e3fe377c272f69c96090d934ac93
31674a6f9a3af9c35d63550ad3d2bb37c910304d96d7ed56a1d5c418b0936009
31d332a6df71206a7b046b795112668bab055ad8f97ff657bb0fa72736c77cc4
3783d48d6d44d88d9bf4bbb9eaa9b4f10b258447d45b5d8c2e49c5132cdc9284
3ab0702a3d820e15619e9125350d5275da998abed6d3231e31428a8443a2b604
3d156c7d13dd664f1a681a8127ef4187afa3f0106d214d52b3e250ed42acd488
440034152cddc398fca416b327b6ae5ec04f6bcf5838e8ad698b247faf5d0c1a
440c241e8dfd087944e10b8d9018d49df75698168d5257a2c7a756a7672dd0fc
4a302af09a3467c26893b329b0646fc758032a20e47f1c6a9209d0fdc55d05ed
4a56cc36977e419b49db6fa5eb0d8b67e62501dbb620c4f9abb24d6debf03ac1
4f2d668a9f829aad2f91c6bca116c63f722f8df5925f994ce30ac6e2b2c5b4af
4f4c232ea2c69924fb6e25c1be805252f13fca60a413529e16b89d759c4bf0b5
521bf0da13001abe96bb049cc75c8a958f5a36ff2265f135fe0ccc502d3e3354
523df645555c6aa6bac44a44298fc5049aea8ba9d530b69a6d6756a1960ddf74
5af136d60a366d4fa170883a816b530f4ef2828bfd11eafe0204c4f202deb748
5bcff88fb7e7145c160caf05dd1eeaf462a13bcad2f037b87204026d0146a668
5e01bb6710a1372cf87030aa295b607e7aee0c3a57f0c3d8730981cb599dfae7
5fd62f3d6ab1378720249e92793bebd06ebae2390df2fa262b03c78749f9f52b
60833f92788bce0102cebdc74767af989fe0c12a33cbe80e885f5a7216af9fba
695508f2675521f0d2405a900032570a8ff7a70d25e37cc380b049dcf7819c6f
6ca00f6d839ec9a1a0d786abef71fce3d2d88018968bbd427a8e2d25f6099c57
70b42e83e192d86e68eabe93e5cc5d9728abad43936da81cdbba878ce966f984
718a6bd57357ae4a5846096e897df2f41aaef2979454ab14492cc7c19d40760d
74af058b98e05d54a1ab61e1d4984d0b2a984fa4aa258db638b2606b4762e453
7d39e7284cb1db0c2b9ac91aa89a0134d88e4b7f5e9676567aa9881f2b15cf43
7e1c13afc19456158e3d46e68d27b8ff4570bfa508761457629447c36682dd5f
81a52f4c31d61b87a6a239b511311ffcdb552feb821cc3c3c53642d4fa53eb57
82db633a79ef7fe836d666e7da62a23e424e40387e257c949fdad5990b6d9e04
8a2225745a60d3f57b0113823c265ff4a6a2e79bf932b455c218733c211ac495
8fc45d3494dba0ee846327dbd78eac86c7dca836bcb256a3b429bfb2a42e8c27
90c61d8f9b124033fe802a105413590c8ee328d83b16c0795329362fca16d985
92794087ed97cd0a206dcba03947ef93fe440ed8d69ab98a233a006728ae6795
9374412b70d8641b0ef446f11e4396fd07b9bf8084fd3edc2c9d6a38ac1b8a82
94585591fbfcbadd59403e40c14894c349a00bc36a4f8efb93432e07e901c354
9604c505b9032d8523f6c638bad33e1e0a864f8550fcdd12eab4c966ba0262fd
975dc69d842139da08be3809afd9ac58e5602992470fa173c085c3a6f8fac214
9ab90c1d6e1536e7095428f0775e5f86f67f20ed84d0b5046a00327db43115be
9ac42de81707bd470c8974966355b1c4ab5b4be1ff55ffc4b0e38a197d1561c9
9e0a38788ab4b2558df29f74a693d30ff8b7a00424386fd3d0386b1a45a11d36
9f20d4c02cc0a17cab07b9dd439952f5b036ebe4e1b1adf6bfd639386ce05eae
a26de4ba071b2f3d5f5fe238c0fcaa9d641019a4593ede7bf28e04a62f26c2dc
a3a2d36e8beed929a36f043c083de3b21457b08ae846a6a60d394964380f646d
a882c643a51b44bd6eb5199d8d15d92ae08869c5e6a7f868de5bc23275a83de2
a8c861e70b70f3ec09e75901bc0b04a5023a54cf7e33eaa618a99450d15820ac
b28378e6974a53507bdc9ccccae320e4998c79966ec3a03aa0fbbdd5465df93b
b3305ed54c6ea3bbf7fdafda47380b3081cf5e0f7ee4dae58ce09d2f7f73a45c
b446e1f7810a4bbd7e7b28125c2226d9998a12086945c37647e3a43db0a5ca65
b9ef00798eaf9c2a2e2be81e90e730ff315dc3d4c4d007050b24c2c5a86ce97f
c21d1380aca8b0bf6a959ecef76f038219bb549814f2e6c92c6fc2ec2316632e
c391d84187ae6c4dae5f1931da4abe216e34a219b7e2ee95e68bf25b5aded93d
cabe0605dd6140798ca1573bc18bbc38043b41d7e8bc202fb6ce104462a88595
ccd9919fb704aaa053d6c613e2fbac521a6abf5a75ef4e9a3aaf324f68c52c97
ceacb71b802701140f4c5432823b479d42c5d3a712c0972d8316b7d145b3b366
d8abf84298ab1a8eb2758c92dc9a1f498b76299bfa39ea678b6b310675668df3
dd8dba51621cf349aa102562f01a6209911ee8d9ae534436dbddd573653159ad
de262e7ac841a01fc0811e18b43ea7d4cdbd32e7c32e7c9e797ff0da640ba21d
de5a99df71dcf0a0f4f26778402621776b679e781c84b9da01211d651d7693ab
e04805dbc00956b3ba5cca341501b0653edea4c069a82449ed35ea1de79182db
e4bf7ba6d49953f6d305ed245b9ef7be426ea9b211bbd8aee04948809159fda8
e60647cfe1adde616c890f3e26971215036da239a61dc90bf5ef9fbaaba6dd65
e6573ea6cfe0bdb4f9b3d43b7b68207d18fb492c9ed35aaf6bee52d0d681a9dd
ea13635d8fae6f813f3021e4d264e12f874aba0cadf496e53a82fdd80faf37e5
ef8a188ef5589dc2f34db1b19956c9989c1b99d57ce3c61e7cb8d422c1b01e37
f004c200aee13a599b9132f323cf3c1752babe33e106d55ef045391c394211a8
f226616dcab5868dd11313462d57834a7dd683641fc4f599f6cd0a6c3718266e
f30920a67ce7cfe9432e60806e950e924a34e48196513336ca8700021da86303
f7e55aaf5dd70ff14ae9e8362f8653b9dacdc6d9ae6854f9d402f1910409394d
f87c10d05f454254da53ad0717ce0f42871dd7293e1b24157355fc0544ac8926

https://www.1plus-agency.com/tmp/nlr08Z0/
http://winadev.com/uglot/iiClU/
https://enews.enkj.com/wordpress/h62/
https://apicosto.misco-furniture.com/dvzmj/0xm3yS/
http://drbeatrice.com/wp-content/HSz/
https://ienerpro.com/cgi-bin/VVwhOR/
https://premierbarsamui.com/Irc/O/


Creation Time	2020:09:21 06:43:00	(Attachment Only - Doc based - Transformation Wizard)
SHA256:

http://ora-ks.com/system/cache/MF1h/
http://megasolucoesti.com/R9KDq0O8w/s3/
http://buyparrotsaustralia.com/4318z/q/
https://dubai-homes.ae/wp-admin/4v/
http://adventureitdate.com/wp-admin/7/
http://blog.zunapro.com/wp-admin/GoSV/
https://fepami.com/wp-includes/h/

Epoch 3 Payloads by Document SHA256 - All Times UTC

Creation Time	2020:09:21 22:26:00	(Attachment Only - Doc based - Transformation Wizard)
SHA256:

https://kodiakheating.com/ldnha/9sj213x/
https://luxxisinn.com/wp-includes/AHEEAtpTd/
http://asikbelajar.com/wp-includes/RAI/
http://shahqutubuddin.org/m51X/
https://rahbartimes.com/wp-content/zkLijQfFB/
http://adinkraworld.com/wp-admin/PSfq/
http://mmosite.com/wp-includes/bOE/


Creation Time	2020:09:21 16:59:00	(Attachment Only - Doc based - Transformation Wizard)
SHA256:

https://exploreproperti.com/wp-admin/E4PhyIw0y/
http://newsalertafrica.com/wp-admin/J/
http://yuhelou.xyz/wp-admin/cQTaMcfWH/
http://naturemais.life/wp-content/8Irf/
http://bevelplexus.com/wp-content/ceAleXY/
https://fpricecapital.com/wp-content/hov2uS/
http://ibn-alhaytham-academy.com/wp-content/X/


Creation Time	2020:09:21 12:13:00	(Attachment Only - Doc based - Transformation Wizard)
SHA256:

https://girl18us.xyz/wp-admin_new/LySd/
https://www.actacomunicacao.com.br/provisorio/7TXfhq24lO/
https://ceramicaburguina.com.br/Backup_Sistemas/7Dy/
https://pwk.ft.uns.ac.id/wp-content/gallery/yZNrFFa/
https://dubailuxuryproperties.ae/sun03/WcHp6tk6/
https://moraniz.co.il/wp-content/879lgVo/
https://selu.com.br/B2W/6WX/


Creation Time	2020:09:21 06:53:00	(Attachment Only - Doc based - Transformation Wizard)
SHA256:

https://alameenmission.net/alameen/control/action/m/
http://hottco.com/stats/iBnP/
https://fuguluggage.com/wp-content/6zWZ7y8/
http://movewithketty.com/cgi-bin/m/
http://f1.dodve.com/wp-admin/EksL3KtiHZ/
http://guarany.net/zefiro/2D2qJIZs/
http://markantes.com/jason/BK9vrxXcA/


Creation Time	2020:09:20 23:21:00	(Attachment Only - Doc based - IOS Enable Editing)
SHA256:

http://marmolhi.com/_vti_bin/0nNKKlWZ4/
https://comerciopuravida.com/wp-admin/qqUV32Q/
http://www.closmaq.com.br/wp-admin/nc/
http://pulseti.com/isla/61D/
https://hotelunique.com/teste/oxda9J0BvF/
http://greensync.com.br/aspnet_clientOld/Xyicd/
http://muabannodanluat.com/wp-admin/css/colors/kIxtL8/

C2’s Per Epoch

Epoch 1 C2s

76.168.54.203:80
51.38.124.206:80
38.88.126.202:8080
54.37.42.48:8080
5.196.35.138:7080
177.129.17.170:443
87.106.46.107:8080
68.183.190.199:8080
185.183.16.47:80
186.103.141.250:443
64.201.88.132:80
70.32.84.74:8080
68.69.155.181:80
82.76.111.249:443
111.67.12.221:8080
60.93.23.51:80
104.131.41.185:8080
92.24.50.153:80
191.182.6.118:80
61.197.92.216:80
213.197.182.158:8080
137.74.106.111:7080
138.97.60.141:7080
187.162.248.237:80
110.142.219.51:80
51.159.23.217:443
192.241.143.52:8080
190.24.243.186:80
51.255.165.160:8080
212.71.237.140:8080
190.115.18.139:8080
174.113.69.136:80
178.250.54.208:8080
190.2.31.172:80
45.16.226.117:443
50.121.220.50:80
217.13.106.14:8080
217.199.160.224:7080
80.11.164.185:80
172.104.169.32:8080
77.90.136.129:8080
123.51.47.18:80
82.230.1.24:80
74.58.215.226:80
185.94.252.27:443
181.30.61.163:443
111.67.77.202:8080
96.227.52.8:443
2.36.95.106:80
78.249.119.122:80
209.236.123.42:8080
185.215.227.107:443
188.135.15.49:80
83.169.21.32:7080
96.245.123.149:80
216.47.196.104:80
50.28.51.143:8080
5.189.178.202:8080
74.136.144.133:80
72.47.248.48:7080
190.190.148.27:8080
189.2.177.210:443
98.13.75.196:80
185.178.10.77:80
181.129.96.162:8080
67.247.242.247:80
170.81.48.2:80
199.203.62.165:80
204.225.249.100:7080
77.106.157.34:8080
68.183.170.114:8080
45.46.37.97:80
70.32.115.157:8080
190.163.31.26:80
94.176.234.118:443
95.9.180.128:80
104.131.103.37:8080
35.143.99.174:80
91.105.94.200:80
190.6.193.152:8080
155.186.0.121:80
219.92.13.25:80
12.162.84.2:8080
220.109.145.69:80
177.74.228.34:80
77.238.212.227:80
61.92.159.208:8080
186.70.127.199:8090
45.33.77.42:8080
152.169.22.67:80
192.241.146.84:8080
185.94.252.12:80
177.73.0.98:443
65.36.62.20:80

Epoch 1 - Spam C2s

93.115.23.115:8080
80.86.81.31:4143
103.80.51.122:8080
54.38.143.246:7080
104.236.168.190:7080
145.239.64.167:8081

Epoch 1 - Stealer C2s

62.210.90.75:443
81.4.105.175:8080
67.225.201.19:8080
88.217.172.165:8080
45.55.82.2:8080

Current Epoch 1 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB

Epoch 2 C2s

24.43.32.186:80
38.111.46.46:8080
134.209.36.254:8080
162.241.242.173:8080
74.120.55.163:80
61.92.17.12:80
219.74.18.66:443
156.155.166.221:80
104.131.44.150:8080
37.139.21.175:8080
94.1.108.190:443
169.239.182.217:8080
220.245.198.194:80
139.99.158.11:443
91.211.88.52:7080
62.75.141.82:80
174.45.13.118:80
137.119.36.33:80
188.219.31.12:80
103.86.49.11:8080
104.131.11.150:443
124.41.215.226:80
78.187.156.31:80
104.32.141.43:80
47.144.21.12:443
93.147.212.206:80
200.123.150.89:443
121.7.127.163:80
200.114.213.233:8080
94.200.114.161:80
24.179.13.119:80
84.39.182.7:80
97.82.79.83:80
87.106.136.232:8080
5.196.74.210:8080
24.43.99.75:80
213.196.135.145:80
94.23.237.171:443
74.134.41.124:80
96.249.236.156:443
95.213.236.64:8080
137.59.187.107:8080
75.139.38.211:80
82.225.49.121:80
123.176.25.234:80
194.187.133.160:443
62.30.7.67:443
109.74.5.95:8080
176.111.60.55:8080
24.137.76.62:80
37.187.72.193:8080
110.145.77.103:80
153.137.36.142:80
1.221.254.82:80
195.7.12.8:80
110.5.16.198:80
185.94.252.104:443
104.236.246.93:8080
78.24.219.147:8080
85.152.162.105:80
85.105.205.77:8080
139.59.60.244:8080
79.137.83.50:443
50.91.114.38:80
172.91.208.86:80
74.219.172.26:80
83.169.36.251:8080
153.232.188.106:80
209.141.54.221:8080
168.235.67.138:7080
139.130.242.43:80
121.124.124.40:7080
89.216.122.92:80
203.153.216.189:7080
187.161.206.24:80
157.245.99.39:8080
195.251.213.56:80
71.72.196.159:80
174.102.48.180:443
181.169.34.190:80
140.186.212.146:80
201.173.217.124:443
42.200.107.142:80
79.98.24.39:8080
5.39.91.110:7080
139.162.108.71:8080
74.208.45.104:8080
61.19.246.238:443
50.35.17.13:80
95.179.229.244:8080
216.139.123.119:80
120.150.60.189:80
219.75.128.166:80
68.188.112.97:80
107.5.122.110:80
87.106.139.101:8080
46.105.131.79:8080
82.80.155.43:80

Epoch 2 - Spam C2s

144.91.127.82:8080
167.114.122.37:80
219.94.242.134:8080
51.38.237.230:8080
217.160.19.232:8080
89.248.250.44:8080
95.215.46.191:8080

Epoch 2 - Stealer C2s

51.255.40.241:443
78.47.87.196:8080
51.89.139.219:8081
159.65.222.75:8080
195.14.0.12:8080
23.111.136.190:8080
87.106.225.180:8080
198.144.158.120:443
151.236.60.57:8080

Current Epoch 2 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB

Epoch 3 C2s

190.191.171.72:80
5.189.168.53:8080
162.241.41.111:7080
190.85.46.52:7080
37.205.9.252:7080
172.96.190.154:8080
120.51.34.254:80
181.95.133.104:80
139.59.61.215:443
157.7.164.178:8081
113.193.239.51:443
67.121.104.51:20
41.185.29.128:8080
86.57.216.23:80
185.80.172.199:80
54.38.143.245:8080
41.212.89.128:80
223.17.215.76:80
37.187.100.220:7080
167.71.227.113:8080
8.4.9.137:8080
113.160.248.110:80
220.147.247.145:80
60.125.114.64:443
182.227.240.189:443
45.177.120.37:8080
103.229.73.17:8080
117.247.235.44:80
115.78.11.155:80
79.133.6.236:8080
139.59.12.63:8080
91.83.93.103:443
186.20.52.237:80
185.208.226.142:8080
115.79.195.246:80
116.202.10.123:8080
162.144.42.60:8080
185.142.236.163:443
172.105.78.244:8080
37.46.129.215:8080
157.245.138.101:7080
182.253.83.234:7080
143.95.101.72:8080
187.189.66.200:8080
103.48.68.173:80
200.116.93.61:80
223.135.30.189:80
36.91.44.183:80
198.57.203.63:8080
203.153.216.178:7080
46.32.229.152:8080
51.38.201.19:7080
103.93.220.182:80
103.133.66.57:443
202.166.170.43:80
95.216.205.155:8080
77.74.78.80:443
78.114.175.216:80
189.150.209.206:80
113.156.82.32:80
58.27.215.3:8080
192.241.220.183:8080
185.86.148.68:443
74.208.173.91:8080
126.126.139.26:443
88.247.58.26:80
49.243.9.118:80
2.144.244.204:80
138.201.45.2:8080
91.75.75.46:80
119.92.77.17:80
202.153.220.157:80
46.105.131.68:8080
178.33.167.120:8080
190.192.39.136:80
115.176.16.221:80
179.5.118.12:80
190.190.15.20:80
113.161.148.81:80
14.241.182.160:80
192.163.221.191:8080
128.106.187.110:80
190.194.12.132:80
75.127.14.170:8080
195.201.56.70:8080
118.243.83.70:80
50.116.78.109:8080
5.79.70.250:8080
80.200.62.81:20
192.210.217.94:8080
103.80.51.61:8080

Epoch 3 - Spam C2s

162.214.68.171:8080
159.65.140.182:80
118.163.97.19:8080
37.48.84.223:8080
82.118.225.196:7080

Epoch 3 - Stealer C2s

45.230.228.26:443
82.145.43.153:8080
195.159.28.229:7080
104.236.52.89:8080

Current Epoch 3 RSA Public Key

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB

Credits and Notes Section

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch 
because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, 
this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen
 
NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

What is Epoch 1, Epoch 2 and Epoch 3?

(Updated 08/19/20)

We get a lot of questions about Epoch 1-3 and what they really mean. These are different botnets of Emotet with different 
infrastructure supporting them. I called them Epochs because they seemed to follow a different timeline and timescale of releases
for updates. They do not share C2 infrastructure and they can behave independently.  In general these are 
the rules governing to Emotet's Botnets/Epochs:

1. All C2 combos are hard coded in a list of up to 127 C2 combos in a given Epoch's loader. These Tier 1 C2s are never shared
between Epochs. E1-E2-E3 will all have a unique list of IPs/Ports(Combos) per Epoch. (Usually updated once per day)

2. Module C2s are also unique per Epoch and usually are former C2 Combos that were published in the loader but now are used for 
the special purpose of the module for that Epoch. (Usually updated once per week)

3. All Epochs have a unique RSA Public key that is used to communicate and decode messages from the C2 infrastructure. These are 
listed in the daily reports. Using CAPE's excellent Emotet Extraction module you can easily find what Epoch a sample is from.

4. All Epochs will use a unique location for distribution downloads. You will never see the same directory on the same compromised
distro tier 1 host used for a different botnet. e.g. host A may be used for distributing Emotet E1 loaders in directory /wp-fail/X/
and you may also see E2 documents hosted out of /wp-sucks/Y/. You will never see E1-E3 use the root of X or Y again for another
distro job to host loaders or docs for another botnet. (Note: a given distro directory will usually become abandoned and stop 
hashbusting after 48-72 hours from inception.)

5. Spam from each Epoch will be used to add new bots to that Epoch. While there have been very rare exceptions or maybe even mistakes 
on the distro side, Epoch 1 spam will be used to create more Epoch 1 bots, Epoch 2 spam will be used to create more Epoch 2 bots and Epoch
3 spam will be used to create more Epoch 3 bots.

6. Macro Documents from a given Epoch will always contain 5 URLs(Quintet)as of 08/19/20 now Sextet or Septet! that download the loader for 
that same Epoch.(There have been very rare exceptions to this rule but in general this is the TTP.)

7. Macro Documents from a given Epoch will have the same Creation Time for a given Quintet of URLs. This allows for quick identification
of the origin of the document per Epoch. When the Creation Time metadata changes for a document, there is almost always a new quintet 
of loader URLs.

8. Malspam Templates are usually unique to a given Botnet/Epoch. They may later be shared to the other Botnet/Epoch but at the time of
the run, they are usually run on a single botnet. Example would be the Ransomware one from Friday 1/17/20 that was only on E3.

9. Bot can be transferred from Epoch to Epoch and we have seen this over time. Normally it is done by dropping an EXE from another 
Epoch deliberately for the C2 update.

10. Macro Document Creation times usually change on Epoch 2 first and then shortly there after change on E1 and E3. We believe E2 is 
really the primary botnet for Ivan/Emotet and they put changes on this botnet first.

Community Lists/Samples


https://pastebin.com/PkYQ85US - @pollo29087
https://pastebin.com/XHyFj2Nr - @Paladin3161
https://pastebin.com/TWFTqv8c - @Paladin3161
https://pastebin.com/i2Lstq9w - @Paladin3161
https://pastebin.com/EJZqP6NR - @Paladin3161
https://pastebin.com/jmbnZ6g7 - @executemalware

No comments: