Emotet Malware IoCs 2019/02/22

## Emotet Malware Document links/IOCs for 02/22/19 as of 02/22/19 21:30 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 02/22/19 ####
```

http://115.66.127.67/company/accounts/thrust/list/WRajkqLmWY28dZ03pvfwI/
http://12pm.strannayaskazka.ru/company/online_billing/billing/secur/file/xv6ftcEllwPU8CdWl8UHbPRzRAo/
http://13.127.32.1/organization/account/sec/read/eqCq6PE4fr5jD3RNhpOlUj/
http://13.211.153.58/de_DE/IFWXGXOM7140412/Rechnungs-docs/DOC/
http://13.229.153.169/corporation/receipt/QwgQD-dhP_yiifJMvs-LLn/
http://13.229.189.170/de_DE/LJIJIN4305718/GER/DOC/
http://13.231.169.127/REF/info/Receipts/LRDyU-SJ_yuIl-TR/
http://13.231.226.136/Ref_operation/Newreceipt/176661867480/zHCdP-SxUXR_Ww-vXt/
http://13.233.183.227/Refund_Transactions/llc/WumL-KI_NwftQymt-ye/
http://13.57.175.119/Sec_Refund/company/Rcpt/FuxSs-mciz_ca-aq/
http://13.58.169.48/__MACOSX/document/lZHX-71O_DSlA-Mx7/
http://13.59.241.74/Ref_operation/Newreceipt/SDcgq-TG_xIp-1o2/
http://159.65.146.232/DE/DOCPTK8698611/gescanntes-Dokument/Hilfestellung/
http://159.89.167.92/DE_de/CIDDQABDH4591994/Rech/Zahlungserinnerung/
http://162.243.254.239/Addon/company/online/sec/file/lWVGjJAtdPjvEilhv9n7afpbdyE/
http://179.191.88.69/RF/info/Newreceipt/KnyJ-VHWP_J-4m/
http://18.136.103.27/doc/Receipt_Notice/Jrrvg-GSG_YtyMrtrX-BkQ/
http://18.205.117.241/wp-content/uploads/secure/business/open/read/WTFDUY315MuoYA6/
http://3.121.44.244/wp-content/Ref_operation/document/Receipt_Notice/XUeP-bNjY2_LMEpLWi-avj/
http://3.16.25.162/document/receipt/5720759/EUhx-wW_fH-Yz/
http://3.17.29.197/De/XOMMPZ1065479/GER/Rechnungsanschrift/
http://3.87.40.220/DE/CCXVOODB6153566/Rechnung/Rechnungszahlung/
http://35.198.197.47/DE/ESRGRSAF7709844/Scan/FORM/
http://35.200.146.198/Ref_operation/Receipt_Notice/hIdaJ-vV_aWoN-Ln4/
http://35.201.228.154/organization/online_billing/billing/secur/read/2PciH9EccMFLn8PRX1GUtCEAgpF/
http://35.204.88.6/De/PJXSWTABXV5569758/GER/Fakturierung/
http://35.225.141.54/DE_de/BKVBLQ7553155/DE/Zahlungserinnerung/
http://37.139.27.218/Ref_operation/xerox/receipt/fVYNO-aI_aE-iCh/
http://52.205.176.136/Sec_Refund/corporation/Receipt_Notice/438526362/IZEMl-58L_rzDVNB-dIO/
http://66.55.80.140/RF/Receipts/CFjX-btDJJ_vbNy-kct/
http://adenasaman.com/company/business/sec/view/RaFTkC38CQhjKDil/
http://aghigh.yazdvip.ir/secure/account/thrust/list/Vf8CIZ5372MssNTgMY28K78FZY/
http://aghpl.com/secure/account/sec/file/TI39swcDRpraIczehAyJc/
http://alainghazal.com/DE_de/JAIWXFTCV5712097/Rechnung/DETAILS/
http://amazon-kala.com/DE/STTPCIM6977296/Rechnungskorrektur/Zahlungserinnerung/
http://amazonvietnampharma.com.vn/DE/AHXFTKVR9604920/DE_de/RECH/
http://annual.fph.tu.ac.th/wp-content/uploads/De/UWLMRQC3104460/Dokumente/Hilfestellung/
http://apkelectrical.com.au/Copy_receipt/RiEUw-kv65w_eeh-EZ/
http://aqualand-chalets.com/corporation/Rcpt/kryo-rB_JRl-Ia/
http://arcpine.com/NNMLGU6236452/Rechnung/RECHNUNG/
http://banglaixe.vn/DE_de/MAJPJJKCVL0966888/Bestellungen/Fakturierung/
http://barabooseniorhigh.com/REF/Rcpt/47605048/ciWxe-0w_c-2i/
http://bdmcash.tk/Februar2019/GADOHDV9083741/Rechnungs/Zahlung/
http://bigbros.id/DE/MFYGIGUL2331770/Rechnungskorrektur/DOC/
http://bk-brandstory.mdscreative.com/Refund_Transactions/company/Receipt_Notice/2534985619583/kcsn-vbu_MKvkZxSb-M6/
http://blog.aliatakay.com/secure/online/sec/file/9nIbRUx43o7uQz6s6uqw/
http://bolumutluturizm.com/REF/download/Copy_receipt/XGAME-CD_HyojDpco-Uo/
http://bolumutluturizm.com/secure/online/thrust/read/WCXjBTC0O349NomU0bu/
http://book.oop.vn/wp-content/uploads/company/accounts/open/read/BrP5PLO7FSsqN6brudrf0/
http://bookingbus.id/De_de/VLQRNXE6251745/Rechnungs-Details/Rechnungsanschrift/
http://burodetuin.nl/cgi-bin/company/online/thrust/file/fRnLxNiVF7axSphfdtmv/
http://bvxk.vatphamtamlinh.net/Ref_operation/Copy_receipt/20469458/QtmA-PyJDv_wosK-A9/
http://caroulepourtoit.com/De/JYYNZAU9414001/Rechnung/Hilfestellung/
http://cmasempresa.com/company/account/thrust/read/1WF2iJLZNT9KLsNV/
http://cngda.tw/xerox/Newreceipt/aPrUw-aS4Pp_tRRYebQ-BK/
http://collabtocreate.nl/De/ZHSJUUES5689299/gescanntes-Dokument/Zahlung/
http://contabilidadecontacerta.com.br/doc/Rcpt/rmwa-7wt_LTst-DZ/
http://crbsms.org/DE/ISOTLPWC1958605/gescanntes-Dokument/Fakturierung/
http://crestailiaca.com/PHXQOU0845448/de/RECH/
http://crsturkeyf.com/company/account/sec/list/irVFFvmRoN6Lugrx/
http://dafia.org/dafia/wp-content/uploads/Ref_operation/corporation/receipt/fXZs-xw9U1_TcrHjckQ-ydj/
http://datijob.co.il/receipt/legzb-VPM_YzDOQ-XIA/
http://dctrcdd.davaocity.gov.ph/wp-content/de_DE/JOMXMKMT6187940/Rech/Rechnungsanschrift/
http://demeidenchocolaensnoep.nl/Ref_operation/files/28181781733882/wZUr-VK_PlOrxg-v8/
http://digim.asia/secure/account/open/view/fkTfuyupTDJMwpqVecfblxPQTd/
http://dkstudy.com/secure/account/thrust/file/Qe50bWLgyJ2aXzFTJvbm8/
http://dockrover.com/AEOWUX9531912/Scan/Fakturierung/
http://drivespa.ru/RF/document/Newreceipt/xVPs-wVFyw_gAZ-7Bx/
http://duniasex.pukimakkau.me/organization/online_billing/billing/thrust/read/kBfJ7SdoDXKaXS6JeFzEA/
http://dztech.ind.br/wp-content/uploads/secure/business/open/list/BDdfem76rrOZaV1RmeclUm/
http://edubiel.com/Februar2019/FMCXQTFYDW5035534/Dokumente/RECH/
http://ellegantcredit.co.ke/DE_de/LXXAPZ1243161/Rechnungs-Details/Rechnungsanschrift/
http://en.sun-sen.com/wp-content/RF/document/hOGB-lAbn_MRu-WYa/
http://energy63.ru/company/account/open/file/jnpvoliU3GCMMwttLPocikGWpnx/
http://engenbras.com.br/NRDZLCRGF7058124/Dokumente/DETAILS/
http://ewan-eg.com/Sec_Refund/xerox/Rcpt/PlmZ-c6_Ao-Vdo/
http://fashion-world.ga/Refund_Transactions/llc/Copy_receipt/557328819/BkxQ-jJ_SXxrw-ip9/
http://fatinyaroma.com/REF/download/Copy_receipt/74382881/Bufs-mCz8_QSsAPAJ-3Xu/
http://ficfriorp.com.br/company/account/thrust/read/uy255I4lTEIJQl00Uv0nT/
http://flapcon.com/verif.accs.resourses.com/
http://forum.archedegloire.com/LCPSOBADD7560773/de/Zahlungserinnerung/
http://fp.unived.ac.id/wp-content/uploads/organization/business/thrust/view/b2rHQM1yUgR2MV8oU9oFpe1P/
http://frog.cl/organization/accounts/thrust/list/jc481ssWZagkOOaps5cZqptoi67x/
http://gfe.co.th/download/Rcpt/fXWOY-mdfG_xRBYOw-cw8/
http://halal-expo.my/DE/ANQPURPAZF1671052/Rechnungs/Zahlungserinnerung/
http://hashtagvietnam.com/company/business/secur/read/j31fCHVr1Vpvkguy9auB8/
http://hayalbu.com/DE_de/PUZUMI6245609/Rechnungs/DOC/
http://hellojakarta.guide/wp-content/uploads/company/online_billing/billing/open/list/HG9uGBtjgmHwbmzWk14im5/
http://herewegonepal.com/company/accounts/thrust/list/SS9u54tuM8u33r1gC5IFGtj2zI/
http://heroupforchange.com/DE/SLKHASJA3522219/gescanntes-Dokument/Zahlungserinnerung/
http://hillmann.ru/download/Newreceipt/hngi-DIyk_YrgP-AB/
http://hipecard.yazdvip.ir/Ref_operation/6076203058/ReXm-8t_iUFyUQ-XF/
http://hongcheng.org.hk/info/Newreceipt/OZdFm-QYI_APBSN-Ar/
http://huyhoanggia.vn/secure/account/thrust/view/Sgg4Vl3mQAPGLp9RKDu5/
http://itechzone.ml/secure/online/sec/view/dGgzufK1W0jIWlunKqYh4/
http://karditsa.org/De/DVQPXJLIPE4621912/Rechnungs/Zahlungserinnerung/
http://karkw.org/secure/accounts/sec/view/5ddXaQYoqgJ3KlgrSkU/
http://kgwaduprimary.co.za/secure/online/sec/file/oUPtgVmqcgQUfm3zF5Lv/
http://khobep.com/company/accounts/sec/read/E9IStvFItXpJvdZ05WZP/
http://khobep.com/document/KZsma-C5kS_p-G6/
http://kienthuctrimun.com/organization/accounts/sec/read/SL92iANsxS4yRmmsff6caqcfz/
http://kingcoffeetni.com/company/account/secur/view/n8cLmmlNgppoWt3Cg/
http://kubud.pl/company/online/thrust/view/iTNZkr6qVPPTv6S7/
http://kussow.net/secure/account/secur/view/oAOUC4iLx3iRiy8XePcsI1/
http://kymviet.vn/organization/business/open/list/dq7Xy03JgPvSu6MIbF1KWDPOy/
http://labourmonitor.org/wp-content/REF/Rcpt/cgvi-jS_mV-Aj/
http://labuzzance.com/company/accounts/sec/list/N7evqmcSsUFz1fHME8Xm/
http://laining.info/Februar2019/EEVUEBXTPN7058166/Rechnungskorrektur/DETAILS/
http://lanco-flower.ir/secure/business/thrust/file/OXOHs2OrXimddpJCoAeKVEsht/
http://legits.net/DE_de/GIIKIZE3061893/Rechnungskorrektur/RECHNUNG/
http://lehavregenealogie2017.fr/Februar2019/QVIUVO2131825/Dokumente/Zahlungserinnerung/
http://liketop.tk/De_de/FEWQDA7487233/de/Fakturierung/
http://lojamariadenazare.com/DE/UXRDPTF9350535/Dokumente/Fakturierung/
http://lovelylolita.info/Ref_operation/doc/peNL-Zi9_r-jF/
http://luxeradiator.com/transaction/Copy_receipt/KElY-0lOM_tlkDzWVf-Hsb/
http://m.szbabaoli.com/organization/accounts/sec/list/zL3M8LqnhGjUUp13/
http://maitreya.aki9.com/organization/accounts/thrust/file/luzM9Q4RYaZd0nOw/
http://maruf.giti33.xyz/company/business/thrust/read/2RdFR3YJZMa2Z148wiF/
http://miamidadecountyprivateinvestigator.com/Sec_Refund/company/Rcpt/dNCXn-vKuaj_NfWVTeYmK-iPP/
http://mimreklam.site/organization/business/sec/view/kWll3pRDbBvdf4IC1CvV7F5/
http://moving-dubai.com/Ref_operation/scan/Receipt_Notice/OSwc-ECn_OY-2Eh/
http://mrm.lt/organization/account/open/view/tXZ4wRdBRDn7cFYjScnoaDsi34Z1/
http://msc-goehren.de/DE/JZITYM2464319/Rechnung/Hilfestellung/
http://multishop.ga/DE/OJGVAT2102816/Rech/Rechnungszahlung/
http://nashikproperty.tk/secure/online/secur/read/9D5diSgBqUointHD0A6s4BZX/
http://navigatorpojizni.ru/Ref_operation/scan/nfJDX-Ctz_BlLhHOR-vuO/
http://nhadatthienthoi.com/Sec_Refund/info/usBt-Rb_CrIeuvlPW-Nh/
http://norwegiannomad.com/company/account/sec/view/Q2sKPNM4VTfRpv1Y3h/
http://norwegiannomad.com/company/account/sec/view/Q2sKPNM4VTfRpv1Y3h\/
http://oesfomento.com.br/Refund_Transactions/corporation/Receipts/jVHWJ-mTf7_RlnsChwTD-1iY/
http://onisadieta.ru/company/account/secur/view/lSeqiIU8xUbRMp5gCwg0ljx6wq/
http://onisadieta.ru/Sec_Refund/llc/34199190/RVhiR-mOg0d_bhXFdTh-Nb7/
http://otlm.pharmso.ru/de_DE/ZSJZYFE3065782/Rechnung/DOC/
http://partnerlookup.superiorpropane.com/wp-content/uploads/company/online_billing/billing/thrust/list/oXMTcBZFKqF40YoaoLBbUKR/
http://patient7.com/RF/corporation/mreo-4TQ_UNQt-a3/
http://pawel-lipka.com/company/account/secur/read/QZB0FFOKAKSjFF3bgDfTQGZPN8/
http://phamthudesigner.com/Rcpt/NvxOo-fBGO_QmpZn-koy/
http://pisarenko.co.uk/Refund_Transactions/Receipts/BmYS-gdRaR_JgYpGsifx-u9/
http://powervalves.com.ar/DE/TDBUKPA4382389/Rech/RECHNUNG/
http://print.abcreative.com/DE_de/PHSJEQZOCL0899069/Bestellungen/DOC/
http://proffessia.ru/14879501333/ueDR-swa_qnsBmCJfZ-7lH/
http://quizvn.com/Refund_Transactions/Rcpt/edTj-99hg_DQdUcFqhK-Y2/
http://rkfplumbing.co.uk/theme/outlook2018/MS_OFFICE/files/zGqk-VoW6_IU-ace/
http://romantis.penghasilan.website/company/online_billing/billing/open/list/Uddpqqebq7rxlECkfZX9Cnkh/
http://ronkonkomadisccenter.flywheelsites.com/Ref_operation/info/Receipt_Notice/0707960468/qOVQt-OBTB_eqOfdpRk-hO5/
http://rupbasanbandung.com/scan/9960087550/JTDf-Mwk_n-vi/
http://rydla12.com.ve/De_de/HJFXHBOYI5432470/Bestellungen/Fakturierung/
http://saitnews.ru/company/account/secur/view/uFDmFqXB3wxNC3rOu/
http://school6.chernyahovsk.ru/De_de/RFVTKTI2685196/Scan/Zahlung/
http://sealonbd.com/De/XOTJGYZH3053108/Rechnungskorrektur/Zahlungserinnerung/
http://senboutiquespa.com/RF/doc/Receipts/34527917315530/EwVbB-IJqPI_FPXu-jl2/
http://serenitymatagorda.com/REF/company/ltUFg-WvsBx_LBzWEiI-UNg/
http://shovot27-m.uz/Sec_Refund/info/Receipts/55597804464/QMrvH-VaiG_DDcfbaeP-iK/
http://sialkotmart.net/RF/transaction/7725270765945/SZIg-JJHG_ilYkZA-0JC/
http://solarnas.net/@eaDir/scan/Copy_receipt/qqIJ-gLpnh_OvTsAXS-wvs/
http://sourcestack.ir/Refund_Transactions/xerox/Copy_receipt/QxIT-d6_VyQyFdYlT-FfQ/
http://spartak-women-spb.ru/Ref_operation/download/Newreceipt/WuUhb-w0Nh_tDisucJnl-466/
http://specialaccessengineering.com.my/RF/document/aPLy-82_WdLUvT-jX/
http://stemcoderacademy.com/download/Receipt_Notice/YnrkE-k83M3_aMlqPY-08t/
http://stihiproigrushki.ru/DE/KXRJDUJWU8466850/DE_de/Hilfestellung/
http://sts-hk.com/Ref_operation/company/Rcpt/94729675973/mCMCd-fjP_iyUp-ECh/
http://stylishlab.webpixabyte.com/Refund_Transactions/transaction/Newreceipt/myBXB-0Y43_coKyzQt-H8t/
http://sunildhiman.com/files/Newreceipt/0270357/xdCEH-dD_LN-xn9/
http://talk-academy.vn/document/1411743496/CWOQW-Kf_wxBNllaHP-nA/
http://tcl-japan.ru/Sec_Refund/Copy_receipt/yQKB-iu_TKLWrd-Ck5/
http://tetrasoftbd.com/REF/llc/zLZCf-ENfx_ritXqK-WF5/
http://thinhphatstore.com/RF/98295260130302/iAxMi-mUN_JRdfYW-qc/
http://threemenandamovie.com/REF/Receipt_Notice/PbOwM-15_Aejzt-TXW/
http://tise.me/Sec_Refund/Rcpt/280434231078/UHypV-rn_nxdyPdR-Wi/
http://tktool.net/Sec_Refund/download/Receipt_Notice/NHBkH-Uiq5U_NZ-IR/
http://uc-56.ru/REF/Rcpt/aHLnZ-isio_Ksyh-4fF/
http://vcpesaas.com/Copy_receipt/KPPTE-NoYZ_tjl-kWW/
http://view52.com/download/Receipt_Notice/68669216480/yvMeY-zko_Yj-aj1/
http://webnuskin.com/Ref_operation/corporation/WxUC-qkM4w_sIYn-6xu/
http://wompros.com/secure/online/thrust/read/GPfQ0KA0UcZE1NM/
http://wpdemo.wctravel.com.au/organization/account/open/read/BgtYo5Db3ZSKpBY6t8sfADipR/
http://www.51-iblog.com/wp-content/uploads/RF/company/Rcpt/Hvuh-h3m_k-ViF/
http://www.dkstudy.com/secure/account/thrust/file/Qe50bWLgyJ2aXzFTJvbm8/
http://www.instagramboosting.com/Sec_Refund/llc/UUWV-lwgVq_Jwotndp-M2/
http://www.topreach.com.br/DE/JSAIWGAD0408761/Rechnung/DOC/
http://xn----7sbb4abj9beddh.xn--p1ai/de_DE/BHQOGQNGJH9795586/Rechnungs/Zahlungserinnerung/
http://xn--b3cfud2a8bbhes3dcy9ig0ce4k2g.com/REF/files/receipt/BNhbF-nxx_oYvvlfP-l9/
http://yduoclongan.info/Ref_operation/llc/Receipt_Notice/55137535926487/AvBf-1OR_itQNHpA-kG/
http://yduocthanhoa.info/Sec_Refund/xerox/Receipts/PRVO-3wobL_UED-3Kk/
http://yushifandb.co.th/company/online/secur/list/nNystfJhvxR3UElqjMKntE3AYmK/
http://zambiamarket.com/DWVUSXMQRJ6499573/Rechnungs/Rechnungszahlung/
https://crestailiaca.com/PHXQOU0845448/de/RECH/
https://dkstudy.com/secure/account/thrust/file/Qe50bWLgyJ2aXzFTJvbm8/
https://ftp.smartcarpool.co.kr/lf_care/user_picture/Ref_operation/company/0645174121/cMfsv-JSLCQ_hF-mTK/
https://view52.com/download/Receipt_Notice/68669216480/yvMeY-zko_Yj-aj1/
https://www.dkstudy.com/secure/account/thrust/file/Qe50bWLgyJ2aXzFTJvbm8/

```
#### Epoch 2 Document/Downloader links seen for 02/22/19 ####
```

http://103.11.22.51/wp-content/uploads/US/sOfA-QygK_ijheJZDR-7d9/
http://104.199.238.98/Februar2019/SPWLOU3518519/
http://104.223.40.40/wp-admin/Februar2019/DIWDADVXVN0215145/
http://128.199.207.179/RJKVWJPI6474317/
http://13.112.69.225/wp-content/Copy_Invoice/kiUmW-O7_ambwybOW-6G/
http://13.126.28.98/US_us/info/Inv/0364600516/eqot-L9_Fw-WRQ/
http://13.233.173.191/wp-content/En/llc/MdKL-D3HKu_Fta-js/
http://13.54.153.118/wp-content/De_de/YAYYSOFKDP9757158/
http://132.145.153.89/De/BYWZYQ0286108/
http://139.59.64.173/En/corporation/lMUwY-DrBKe_fqAMNo-PG/
http://159.65.65.213/DE/NTGJWR0358110/
http://159.65.83.246/De_de/NSTPPASHUD8902256/
http://167.99.10.129/DE/CKKMRQ0595333/
http://178.62.102.110/En/doc/Ypje-vaN_XysPJ-EB6/
http://178.62.233.192/de_DE/ZYEEJQRWTD1487009/
http://18.136.24.106/wordpress/DE_de/HPAKTAV6459792/
http://195.88.208.202/Invoice_Notice/oEiD-xKQZZ_OQokrU-au/
http://1lorawicz.pl/plan/DE_de/VDAXVAGBKY8750168/
http://1sana1bana.estepeta.com.tr/De_de/IKZIUAQSS1493072/
http://1stgroupco.mn/De_de/EQLHDFO3496533/Rechnung/DOC-Dokument/
http://222.74.214.122/wp-content/WTHEKFBG8220915/
http://34.224.99.185/Februar2019/UHQVKLHAHJ3931598/
http://35.200.238.170/De_de/YTFJYWQNM3325605/
http://35.202.216.83/UOKDDXED0599901/
http://35.231.137.207/DE/ZTFUNJNR6454431/
http://35.244.2.82/document/New_invoice/vTQN-dMT_Rwz-K6/
http://52.66.236.210/Februar2019/DHAFIKX7396556/
http://54.242.75.153/Februar2019/UBVBYCDV8539886/
http://54.252.173.49/Februar2019/LJXTNNWVEO5993970/
http://acmemetal.com.hk/WVWA-ONO34_iJF-Ck/
http://aghigh.yazdvip.ir/document/New_invoice/RgWiD-5aGl_OVImbyQfQ-MhO/
http://alainghazal.com/Februar2019/HNMGGPLNNL8005707/
http://allaboutpoolsnbuilder.com/En/Invoice/287419503779/BopHZ-waQw_QQeguQ-cD/
http://amare-spa.ru/corporation/Ufzb-bTGjV_RgIviKPX-aE/
http://ammedieval.org/wp-includes/DE/EGNYAMZQNI8438785/
http://arcpine.com/En/Copy_Invoice/bAwJS-Wq_goFV-8P/
http://avis2018.cherrydemoserver10.com/Februar2019/AMBXRGE9908906/
http://awcq60100.com/Invoice_Notice/xsBCK-aT_JlUGPfNd-OO/
http://benthanhdorm.com/Amazon/Transactions/DE/ULRAROQL9187424/
http://birminghampcc.com/scan/Invoice/BEaz-hnqXV_wU-9t/
http://bkm-adwokaci.pl/res/Inv/xDPv-TrKM_HlCY-DsB/
http://bksecurity.sk/En_us/download/New_invoice/YbyV-MAim_oNo-bL/
http://blog.piotrszarmach.com/de_DE/QUTJSBDQ0942199/
http://bobvr.com/EN_en/xerox/Invoice_number/QJjVU-c5u_IHHcHU-8h/
http://bondibackpackersnhatrang.com/DE/LIBQXVTJF2686285/
http://byqkdy.com/DE/HIEMUXPFGK4718874/
http://canwonconsulting.com/wp-content/uploads/de_DE/WRDHNAWPAT2004673/
http://captipic.com/Invoice/HKOwp-L0SQ_TFxFaGcmB-7w/
http://captipic.com/Invoice_number/zDyWf-TXK_hMsKz-sd/index.php.suspected/
http://carolechabrand.it/Februar2019/ZFCBBMLYG4718089/
http://ccbaike.cn/US_us/file/biZk-XF5_kQoAcg-shF/
http://cetcf.cn/IGVELZUA2250611/
http://chenhaitian.com/En_us/info/New_invoice/NNcZx-6P91_LgateFVEC-Qb/
http://chiltern.org/EN_en/xerox/Inv/MAqJN-yd1nO_nLJIElUKe-rq/
http://cild.edu.vn/de_DE/DWUXTQZK7725877/
http://clavirox.ro/DE_de/GYDYHR9147375/
http://codedoon.ir/De/DUKXZO8987912/
http://creativedistribuciones.com.co/US/document/Invoice_number/CrwWK-Ut8oG_qE-vs/
http://crmz.su/scan/75246643/tFdB-dOH_lCr-cn6/
http://demo.liuzhixiong.top/corporation/fNdq-axS9S_DcWYd-DC/
http://developerparrot.com/US/Copy_Invoice/TXqG-9OA_VNZ-aZA/
http://dorsapanel.com/US_us/llc/Inv/cosed-CcI_XOwqG-aP/
http://dverliga.ru/download/Invoice/mSjDR-Jl_SbLaLeELy-K4/
http://ecohome.ua/US_us/corporation/Invoice/PFNM-PJc1_UjZAaAhLC-en/
http://eduapps.in/wp-content/uploads/EN_en/Invoice_number/OmbI-HDkbJ_tTQ-bmY/
http://ejder.com.tr/US/xerox/trcrz-VXn_iGWhG-2f/
http://ellsworth.diagency.co.uk/US/KNRx-fAAQj_Dk-5G/
http://ex-bestgroup.com/download/Copy_Invoice/npqH-z6qG_GtpVSp-LqR/
http://facetickle.com/de_DE/XBKNWBBJ3517162/
http://fenichka.ru/file/989285702485709/giYqs-TUAyp_tji-av/
http://ff52.ru/saxiv-K0JTq_ZpOVdte-pf/
http://frog.cl/En_us/AQSyr-pjmB2_hQOrLBif-Qg9/
http://gabama.hu/De/MGJBANCTTS1928375/
http://galeriakolash.com.ve/EN_en/Copy_Invoice/3823962600/yxTb-Klswi_NQuCYHBEV-4a/
http://galinakulesh.ru/EN_en/file/Invoice_number/1516686/Ungd-FKpi_MgV-vom/
http://galinakulesh.ru/file/Invoice_Notice/cysp-zcLtz_ryTFh-8Jj/
http://giancarloraso.com/download/Inv/HbmL-US_RNkD-9A/
http://giave.vn/De/WHJKZOF0284348/
http://greatkenyatours.com/En/download/Copy_Invoice/Lgqb-Gqg_U-Bl7/
http://hangphimtheky21.com/En/company/Invoice/EDbLV-Ad_fbr-vr/
http://hapoo.pet/Februar2019/CGHBPF9650779/
http://hourofcode.cn/En/llc/New_invoice/HrrU-mFwi4_NvKcDU-ru/
http://htmedia.net/En_us/doc/Invoice_number/322374698567650/Uyuif-6iV_cYEx-x7/
http://humanwigshair.net/de_DE/TLODSYLF0662115/
http://huyushop.com/doc/Invoice/ppQlC-1hzuX_OXIpKCI-gJi/
http://huyushop.com/xerox/Invoice_number/4873909681/shyaV-jw_XIkWj-1g6/
http://hyper.gaminggo.website/DE/DE/MGCRMUHE2025190/
http://ibakery.tungwahcsd.org/media/doc/Invoice_Notice/IRza-yOhi_L-0Ng/
http://icspi.ui.ac.id/DE/BZHFIO4860458/
http://idecor.ge/xerox/Mvdos-wM7_SlQUIgMWf-97/
http://ihsan152.ru/doc/Csyz-k7_XfsMbVK-w6/
http://ile-olujiday.com/En_us/Invoice_number/Azpl-1y_HYOjeQhvm-H5v/
http://ingramjapan.com/DE/JDYMCSV7189567/
http://iso-wcert.com/doc/Copy_Invoice/5593042/uWji-T4QB_wisfpWe-abt/
http://jakador.com/US/info/Invoice/uiUZl-YAosI_zbcXOgMHv-B20/
http://justbikebcn.com/US_us/info/Invoice/RRNC-NM_HNc-kts/
http://kebunrayabaturraden.id/En_us/company/New_invoice/QzqIF-Hj_it-jXz/
http://keyhousebuyers.com/US_us/llc/Copy_Invoice/XIWH-IGY_ckwdiJo-gJ/
http://keytosupply.ru/YDLNLHT0064679/
http://khachsananthinhphat.com/EFEAFM2493480/
http://khaivankinhdoanh.com/En/download/GcIqG-Dpqp4_Itt-B6L/
http://kidplearn.co.th/US/scan/qMrqi-Er_VlSOjHyk-XN/
http://kienthuctrimun.com/US/llc/Invoice_Notice/uplqm-U0_vIVHjjh-71Y/
http://kingcoffeetni.com/New_invoice/XpFAz-sL_eea-bE/
http://kndesign.com.br/EN_en/info/Invoice/QiRv-Cn_B-rwx/
http://kostrzewapr.pl/ww4w/file/New_invoice/xlABM-8iP_WgGcAABXA-1E/
http://ktdakhaoyai.com/llc/VqlO-RTai_UHfaP-XK/
http://kursiuklinika.lt/language/En/xerox/Inv/dXBJR-CF_uQwatHm-4HF/
http://kynangbanhang.edu.vn/wp-admin/De/YUNJBZ4605942/
http://lastreview.ooo/US_us/doc/Inv/40698973974/jzDj-P4cPZ_La-YMn/
http://latuagrottaferrata.it/US_us/Invoice/DdaC-RKIeP_FcSCT-ePS/
http://laylalanemusic.com/EN_en/scan/New_invoice/wbNo-TW7P_O-Ko/
http://letrassoltas.pt/Invoice/XHZA-gBUx_JaGJYEsl-JE/
http://lindgerieforyou.nl/89278556094569/lsPAb-8gkW_FsZDD-xq/
http://link-4.eu/De/WSQGHEQEDC1613631/
http://lyo-chuyenhanghanquoc.com/doc/Invoice/Tbtb-25VL5_K-9G/
http://manisatan.com/En/file/Invoice_number/xcVC-0F_I-QW/
http://mantoerika.yazdvip.ir/En_us/Invoice/OrfdW-YAIs_g-Z2/
http://mantoerika.yazdvip.ir/xerox/Copy_Invoice/BLvZd-boDwE_vmYCwE-kP8/
http://marbellaholiday.es/cjsowjhdvn/De_de/WNMFFU3791587/
http://marche.ecocertificazioni.eu/En/Invoice/65003821729386/gFKoj-XspRJ_pBs-lQ/
http://marisel.com.ua/ZyXkK-SXe5_Md-wdC/
http://matongcaocap.vn/Februar2019/VZMIPUBDVU6493426/
http://maxhotelsgroup.com/wp-content/uploads/EN_en/doHd-ghqgD_JrfIW-Ww/
http://meliora.ge/Februar2019/XREWOHYNE9826670/
http://merebleke.com/US/doc/Invoice_Notice/ukZE-usk_N-5Ie/
http://mex-man.com/EN_en/Invoice_number/jYjBA-USul_Qo-m9O/
http://midtjyskbogfoering.dk/Februar2019/IFBFOI8956896/
http://mikrotekkesicitakimlar.com/EN_en/doc/New_invoice/sXBT-w4l_THrjaFBv-9TB/
http://missionautosalesinc.com/EN_en/Invoice_number/ApXnw-vW_suYdct-jX/
http://motor-service.by/En/scan/Copy_Invoice/NUpzw-Hb_l-DY/
http://mrm.lt/En_us/file/Vqfg-I2N_JG-b28/
http://msa.club.kmu.edu.tw/EN_en/download/Curni-dDq_qi-eH/
http://mtrans-rf.net/XPbL-jlz_LzwdIPbbs-Vg/
http://nilisanat.com/Copy_Invoice/IWIg-tytmP_D-ZTq/
http://noithatchungcudep.info/En_us/company/Invoice_number/EqoD-yQW_XfoDZM-Oh/
http://noithatshop.vn/Invoice_number/71550784026926/VCUS-q8_AVrvs-XKg/
http://noscan.us/Invoice/871430326423/vvQp-D8_rndLvX-sW/
http://o-k.by/US/Inv/Bdrr-jv_yZ-Kue/
http://okna-csm.ru/corporation/wBZEO-O5_kYPva-fGY/
http://okna-csm.ru/US_us/scan/Invoice/UCRe-bX_eDIfoJXea-8D/
http://ozon.misatheme.com/doc/Invoice/005060974679/QLeW-mwuf_rmzi-Wv/
http://paksu.my/EN_en/doc/Inv/fqfT-YHp30_RUjRKVXlm-Eg/
http://phamthudesigner.com/US_us/doc/Copy_Invoice/wNHb-YzG_YbSbGu-Zj/
http://pixelfactorysolutions.xyz/En_us/file/lEDKZ-TR3gT_ZXjzK-uKU/
http://play4fitness.co.uk/US_us/corporation/Copy_Invoice/ECCp-M72g_lIUDwz-Y1H/
http://portriverhotel.com/En_us/xerox/Idpt-W99Z_mHARu-xzZ/
http://posicionamientowebcadiz.es/En_us/doc/Copy_Invoice/uwfH-nlg_LKOWHPOiV-H08/
http://print.abcreative.com/DE/NXLOFWIYA7069215/
http://progressivefinance.info/DE_de/De_de/YJZBFQMYL7939382/
http://qnapoker.com/De_de/YUATGGWMQ5766638/
http://quantuminterior.xyz/US/file/Invoice_number/LEGty-sdOJ4_ENS-2T/
http://rejuvuniversity.com/scan/qrqWx-h9kz4_hbJSD-lA/
http://rem-ok.com.ua/En/doc/952988542422/FMyi-rr_OTqTZVN-D7/
http://research.fph.tu.ac.th/wp-content/uploads/De/SNMHXRSNZV8828324/
http://rohrreinigung-wiener-neustadt.at/WPUUPHC8420986/
http://romanvolk.ru/templates/info/jbfK-FcG8k_kTWWY-X8b/
http://sanga.vn/DE/PEQQTVVPU4860066/
http://sanxuathopcod.com/enquiry/De/YZKVTFDE8136228/
http://satellit-group.ru/En/corporation/nidq-qIp_nS-4c7/
http://securoworld.co.za/De_de/ZIMTDWA2450909/
http://shentiya.com/tjp/xerox/1074154/EyOU-ehwUX_p-T9/
http://shop1.suptgniort.com/US/company/Invoice_number/Yltn-RrDiR_cmg-iG/
http://siamsoil.co.th/En/scan/Invoice/jWZia-PXur7_vmw-6Pe/
http://sinz.ir/En_us/scan/Invoice/ncCGx-5iDS_onHSPWC-hq/
http://smlex.com.my/De/KKFNFUFM1729586/
http://soyuzhandpan.com/US_us/Invoice/UlqfM-xKd_LBlpfb-Ot/
http://spb0969.ru/En_us/Copy_Invoice/CFZI-RSLvA_zHzcfuFNv-s4h/
http://ssstatyba.lt/EN_en/doc/cyXl-j2_q-JVf/
http://stage.abichama.bm.vinil.co/wp-content/uploads/2019/02/viewuserlist/EN_en/download/Invoice_number/tldUb-qlGd_NeDOIo-sF/
http://sukson.xyz/US/Invoice/ChWR-z9m_C-VUs/
http://sweethusky.com/Februar2019/ELUKSM1691772/Rechnungs/DOC-Dokument/
http://tasarlagelsin.net/DE_de/ECBJUGXDF4914787/
http://themichaelresorts.com/gunungsalak/wp-content/plugins/revslider/De_de/DQYEHW4637973/
http://tiaramarket.ir/DE/IXTQPWMLC9359449/Rechnungs-docs/Fakturierung/
http://tiendaflorencia.cl/EN_en/New_invoice/Gnta-57cJg_dQSK-yX/
http://tischer.ro/En/New_invoice/KLrp-pY_GsF-Kt/
http://tmmaf.org/wp-content/En_us/document/9175060/neKL-Ao_UV-uL/
http://tmr.pe/company/Invoice/OYdW-RoqGy_BiFio-mX9/
http://tolstyakitut.ru/En_us/download/tZWf-dMK20_rAz-dB/
http://tony-shoes.com/7JzXexTmCI/De_de/QLQBPFVYE5291988/
http://trandinhtuan.edu.vn/En_us/doc/Inv/820468724023892/hzAlp-74M0B_WHUH-Q7b/
http://trandinhtuan.vn/Copy_Invoice/yNQak-pf1qa_Dye-Ae/
http://tranhoangvn.com/wp-includes/js/tinymce/US_us/download/Inv/IPey-AQTj9_PuzNcqmr-1f/
http://ulco.tv/En_us/xerox/Invoice/1832647384/FsVWR-XV_ytQNsd-x1/
http://vienquanly.edu.vn/En_us/corporation/New_invoice/0307028/HRxvv-P6O_eybpf-lKd/
http://viento.pro/download/Invoice/vMSNo-6JYm_i-RB/
http://volkswagensto.kiev.ua/US/company/09234339011189/SYOJc-aA_Kz-2aZ/
http://weresolve.ca/EN_en/llc/Inv/ZeiYy-WY_Ko-GyU/
http://wpdemo.wctravel.com.au/En/file/wJZbG-k2I_Cw-am/
http://www.birminghampcc.com/scan/Invoice/BEaz-hnqXV_wU-9t/
http://www.coolpedals.co.uk/US_us/scan/90126558649321/lwNHH-J44S_QUp-sD/
http://www.ingrossostock.it/De_de/XXZFUMY6186328/
http://www.mhills.fr/US_us/doc/hanb-nsV8_vzrKb-YA0/
http://www.play4fitness.co.uk/US_us/corporation/Copy_Invoice/ECCp-M72g_lIUDwz-Y1H/
http://www.posicionamientowebcadiz.es/En/download/New_invoice/385278308544/uBoNQ-k387g_V-cp/
http://www.timothymills.org.uk/De/XPCADZUR9908983/
http://www.verykool.net/vk_wp/wp-includes/de_DE/CQPQBPLVMY8380956/
http://www.xn----8sbef8axpew9i.xn--p1ai/En/HAZna-MBGL_kxSHOZ-OQ/
http://xn--116-eddot8cge.xn--p1ai/Invoice_Notice/HTVsa-OSNt_Mx-bZ2/
http://xn--116-eddot8cge.xn--p1ai/Invoice_Notice/YOah-tWq_jHcimfLi-iCK/
http://xn--90achbqoo0ahef9czcb.xn--p1ai/doc/Invoice/34714700878869/FurZe-64r8g_OP-coE/
http://yduoclaocai.info/US_us/info/5310708/dYpmV-Gz_TbOeWCL-EZ/
https://captipic.com/Invoice/HKOwp-L0SQ_TFxFaGcmB-7w/
https://captipic.com/Invoice_number/zDyWf-TXK_hMsKz-sd/index.php.suspected/
https://noithatshop.vn/Invoice_number/71550784026926/VCUS-q8_AVrvs-XKg/
https://tischer.ro/En/New_invoice/KLrp-pY_GsF-Kt/
https://www.verykool.net/vk_wp/wp-includes/de_DE/CQPQBPLVMY8380956/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-22 20:11:00 (Doc Based - ENG - 365 Blue Box)
SHA256:
6b15bbf73ed0e7e9eafb201bb0c011575a01468d9bc79e593ff829ce43d07d04
4ac5eda9e268d3080bb9c0adbdde08bb771ec1c05ff35dfb29d8b16d1b780538
dc051762a9498bfe6a7c8b3a0fdfe40297320d153779f371e49daf5b25ea6b01
5cc01852121c3ec83d7fb48bf22e3685c997f53f33ff1bf29fb2533141cc69ab
0d68de69e94a097e5edbd84f95264cdf235e82fbb3cc27c08d095ca0d4632e10
ad65ca562bf6b19f6e9874bfdd3e4f60a2a67a65aa565393d4d7ca6e30da3f8c
f9a50fd7645aa3d10bbad91c727790bd61ffe25bd08ba16cca3fd9a521c22d58
fc308f26322485c361110bcadf9e3eb54896a1563693a4b8bb3799edcdc9e320
6ca19d8a1147e65b0e8b222215621978905c663ace06195a183e0c2b3a94576f
8d2608fd0eddf328c9509181bfe0560b26ada34bbddc919e8e6d717b5487a220
aee69708fe6713bf1b461cc910ed8297649e578c92213dc10387c90effa7f750
bc42c6d5722725a303e6de809bfb5099d0ea13b18f422f154c5a6713c1ff22c6
e881930c362396744a2338740d28ac26377cf19c33b460cdac987fcb1255f804
9fa9d852c7f7a94a022347e7bf2325d41032163fb7ec61d362bfeb94a0ed9ee8
363371e71bfd3a0f6e8e0ffe1017918d65d5afe7ce1c6d7ea26f5604b26144ce
ba0b908255f68bff48e58cc7d2ac0caa55e369b7a282fce5b9d58ae1df34b681
d523914940ef79338eeba96e8befae59574d1552f13ddff5c41500bf43d9192d
26bda8a7e04a3b4ba47ff57f776cb65b0ed11870bc5fa65b33353c53ab718566
3a162a09d1f8a4ee0248d72a60ff0ddbc2cef8084c3d2aed1cfb73192f628d42
cb83759cf47a4b6e44e5afcf6f85f64b475a6f4bbcd0bff82b31b45f048a64c9
949bd24349829221977de531f8a1dc80d401bf5e0a8fc69a1b386261b474ee43
3d48920206c69924bd3c388e2d7a48845e48ba6a525f06ae466db235deaa6832
6055cf5b67690819f88a3a96685386afd8819377dd31454fab559809fc9ef6eb
db0478556a516ed5d8508f165251efd10fd3e68c84fda7d720730f6409af61b8
415eda47173d571207d420861a66ea7419cea30d59a901f716354c8167c8373b
bd1f913c5ceaf2042070666fba37fa0a8108f1e82ac19e516a7f74e9d5da5ea8

http://lenkinabasta.com/G2ek3iYJ7B/
http://montecarlosalud.com/33x7eCfeBy/
http://nano40.com/bGv61ju/
http://td-electronic.net/MbY14ajM/
http://pi-labs.tech/GOlujDOL6/

Creation Time	2019-02-22 14:42:00	 (Doc Based - ENG - 365 Blue Box)
SHA256:
a63da6fc7ae1cded300cabf23caa61ea1842eb67ffb4067b1e21b258bab220a0
beb0411e0876902fda0b692f6762a060518abdb28e85a0b5a6d6dec6b38b6a84
0a385f2998f80ad17753783a136bbd6af84942635d51b6f02d428fb75fc89559
eff525a92a7e0adf91bea8b6c4d77ce5a4e0f41bdd22395d383bce3aa919b91d
38726dd1965be4c460b2f85d94fed8ab0990da766ee257d591e559a023891374
fc5b2808613e062e69dcb759c97b62ae00da1088e2d530a3d0f36aa0c79e2141
9d24ba1452cf7c3c099c381d32be83c7fa68add51de1dee53159956e0e0637cb
0562de3af793b54da76e76b86f6deaa411a47127fac07a7942b15233096bf19a
7ab0160070db04d98053fb1a7b33114794497679f7511b36a0fa6c8dcf96d37a
17ec95bee7a170f0aa887a896a70291919c654e18a471b24c705b1d233d376bd
7d938cc0739e786acac1200a88ba886e24a5513f051a1c2ea35116ae44e80e2b
2d7e564f8c0904a9a7b4e9459388c447eccde5ce82b59f8c34d67fbba3c041b5
23c1099c724cffa9a4dfee7c4bbdc439a89738b9524c5acbe8e3534b1213e237
04946ffcd40c0aae97afa4abbbd72dad4bb24e5556cbf4a20e512beef3f12aab
4ee69b621d9d156b15f973573af52aecee4f6722964a3e0e83c5f12ab65c3506
2aad2fadcfbc831361808f3d166e24eeba0b57ce9eb2e9b88d604931bfee1607
8b18eb464e938b0e5dccadcc42e2ed20a370b42a1a7d69e2f5d789a830f86789
dcd5bc2bb04ef9afee15588f468778f1eed3ed4323399c083c3803b0a092ab36
90b9006b3beafe089d87e6ab22076f77e7b6056c7991c7580561ec5b9a69ab31
62a5b9859707a127551afc3285badd8d2f1e9e98115ae5bb30add117ce3c0e07
7718350e6b0b63d58a259609e062da6f8fd0c0131d4b24b6698977b4ba771524
b317e3ffb25133f732055103f3c2253515b4c64a63f22dbbfe31fd697186236b
0bb8c7f49057a9df86324c8d72773244d22d4be0608eaab2524f145dc0f6290e
0b8ee3afb4f1cab3de335eef0e4acfd7070a9752623ec02d0d8619a76fb759af
bc7857608fc5e413de7d75e7994474e6680b5057d4209a17a79590bae9f5f652
3b354b725cbaa388f7868639279b83a448fa107a3d54b6b9d7e3c4e8855f97d8
f71b09490cf1085197e830d6ba5eb61019a229d6e5629a7a08d16883f398e42e
117f47cc6372fc2a5c9cb341b37dbc677ee8cf5cb68f782b3619267d8eed580b
97c741d85bc32e626a678142eef9afc36ef16c3bd1bb5df8311750ed6c5cd0f6
d08d1ea41326ed59a111246b637c1cce8193389f40a4d3deb13bcd69d16fa3fe
b73b7bbf69f053106abe436f9f9396202373ce35bccec2f976006abca6952105

http://dataland-network.com/0yhPaoFo/
http://128.199.68.28/NUipKSNdX/
http://mbostagezoeken.nl/lTxOW3ais/
http://199.43.199.16/wp-admin/PMnENN7UR/
http://206.189.45.178/wp-content/uploads/aWk9ELnU/

Creation Time	2019-02-22 10:51:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
ff020ce959d59d8464bb203470babf7b9b201f0287e0a01587a1c766819455cc
e6a8c8d7809cb9220fcb240b3f8b822911132582cdd285705f0ff969872014a2
3d4e35724379eb6f65e1e12baa4262ea0ca687188aeb0c1ae47d4cae01859cc3
c40b54a1f590b57b72b89821ed2836db462d6e9fdaee6d536e08ebe43013003a
6b8852e0ba2744ecf35363afd29da7c293c8e1c9e8a43703fb708b95276c7790
e9a5359b4a892266bc6ffe672c38ff2109adb973a88985606c35579b831660d8
95a2e4f8483d707a8be09b6162d3f45c29803d87c509ed02b16e6bb8f11789fe
0eb29597bd2a76b3d7d1a5b5100e1d59f4e1e6e62cf4fad1de9ffb990f54855d
c194f46bc3d735c019c43833b4b05e849e1a28e4db1e92593f9a5608675637c8
683d9ef0ddb8bbadb97997710065c01b886454e49fc9f77b4e9399ae9ed2b358
d4065e35dce526fa42c7c0bb1013dc436db9a63c7fd572c22d239132fa951743
385b37e37bb2471ed86876e9a2beb290f078d2a5757e74e413cf0df3b44dfd56
c0108d5ff6ba2321ca2189831085765e663bbbd5a6b3cf047ad7ec71d326e9b2
cb6a5f58c5ab3dbeba0fc5aac4373ef5e7da4a8c860ec3800cd2bbcb4161ab90
5b26da941e2d695af13fe6ba787a97ef0bfe8aa7aa1c477c02851fd9cd63d7d0
a7b6f9710d4b55bfa0c79d5fdbae9d4c0e2bc6d63ef7039b467185b04e8f9833
cc94c3b982f3a5bd605b2e837f9b3e1339e9f1f5e2f5155b68351b4a095427fd
9f0770440dd293f04562528d0d3d9280b0681b471b4ae3d15aa81d28eb307a4f
4f6874f822619ae2b4b36d07fdafe23c08640eb0504229d780a8e58d3e5aeafd
44776e744c0196fb4e12a697b378dc69704e1a25b29eb2e2a4b74a85b637ea56

http://eurobandusedtires.com/8CkavCZyr/
http://guidojoeris.com/0Jq9Kb2Uwa/
http://guanabarahandball.com.br/wp-content/uploads/YgQFFRe/
http://www.ccbaike.cn/5KabHk6/
http://139.59.182.250/rLUeg6v/

Creation Time	2019-02-22 07:17:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
6de999d0280a8d4aaa022289c71504b283e599f6e97e3863e7080b314007fb8a
3335a117ab3942e92e1027dfd1b50d5b3b56c6aee23f3a97dfc615d8c0354fdd
9ba11246258f8de67a2af0246e22d6716b0be542ab1c7a3b3b0e7969d0b549d8
77acfcff5a71b198b7bcc4d5b458482bfcf13cdd1a6b3b37eb2517ea7fb8c35a
19d4954c0926ffdacc90987d2b9ea1a1f5fa894fb3dc718cd41fcec8751e2e79
b5fe6d1fa62a3978471199da6c051c0bc9b84963478923377caf2e13feb22c39
e7ba84c834fcf0d21ec94380a972965cd9b5c50ff984d393149076d3c44397b1
e7ba84c834fcf0d21ec94380a972965cd9b5c50ff984d393149076d3c44397b1
a59ab969c68131c7b5eafdafc793b9e20b70fb401bf35c328f6c1639576a54b7
708e9a33c866dc9d60b151b4c35637b012a611ecc0d0547f1556957edc62d95f
4e10635154e02b5555a60da9172c56d6ad1bbd54fac5bfd7eb37f71be845657a
ce4f66b3c0e0e5cf74a8d0de9bd06074a2a03410eb2c35e0bcd98de5ea78a07f
fe3006dbb7d4cc41cd99aa00e0b5ede5fd8688af6270a4458f9a0099127c8cd9
b7b90606200693cf7f05f79153460731e376fe30aadcf389ad496609de80ee10
94ab5cc18d0df73345d045826fa9e4027f1311d105d20b125eee71bbb0002917
68fc4630bd05c3731a25019a915232e22789c120fc023c615779a94fbcfe59cf
323dcae8f0d9d0a3d5bd883f86c7c748156643f4c75bc7bf0026a4bf71aefdb8
09511026645995125e09057562271afa23dbead6e8c9489241f8e58f4d9538b7
b41328249c4496d74f8aa66a4ee736033b3e7af9db9babf866703e8f4fa7d108
28905718bd028d99da8d0cf89db77294397e02f6d742fe0214ea11ffc9353e4a
fa3e30c8519017bf50afb2a9a2a0f6bc5c2367927d921e23c94e2d116a6e2837
cb166bf8f89c65478277be66510fa5e3527a958c791052d0c2bd27d80dc9a199
6407bb361e5611a475ca4266d416ee57c73a98b024713bfde516165e1c13faec
3b43cb817d5ecdf81d574722499b300464518c65d13ebaa50c7b87869250ee1e

http://140.227.27.252/wp-content/eirJDz6P4X/
http://80.48.126.3/wp/wp-content/uploads/HfTT9hn/
http://kgr.kirov.spb.ru/LUGataK/
http://tekirmak.com.tr/6nseJMHZgy/
http://mediarox.com/6wcdQDCe/

Creation Time	2019-02-21 19:28:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
046f87c718018b50c7c6f539d11492b8fa6e4325e3da77a64f6a702287e5c824
4b75a9159e22f9e5ae12ab9c732b7075e1965c92be52b859eca1b03eb86ac805
ee60f9e2d38218109aff1d443750aeec436be61873d04466a24c2178928ada5c
a7e75c95eb4d7dbd3236888c12dd4ba59ae69500620a07521120637a6f8abd23
b8644d9f61436749be8678f246cdcc25ef58eef190f10a6ce079fb689caf3ef5
1186b28adceb8145a036958af9b666a86f94350606c58559013fd7e0bf5b2d10
2f5f36a66a982a2f0457a6d1b04c50f2da186c5b97464b3be5a7eac114ed467f
7c8c775210220e5ceee72c0c7459877dbcb72068aa6011fa6a29f5e3fda1b5f8
84c269a26193867fcf59b3ef37fbb87619721f18163f233f1e7612a423617050
ef843662c0f3ee87c56de95a49c430e90696798956eb5ce980f08b85f4dcb05a
763e1568e57bc1bc0eea550a996790ae3a08f66eb9a1164257f2ef35875745cc
32b93c3a0e095ddba394079ec1d18f3a2707172ae7780b213a6973b2d87e565d
d87ab889091040521fc76bda0abdab6bc37bd3afbcb3d4421b3b0c8c2808e15e
e5d8ca1e7faa58e8016549b308650709b9609ed2f655abb165826ebda065a256
753e6d5f8b2922939f905cc0f324c06acd0d6a3a033691e256ebfd37779583e1
1e979dd7f93ebf27f9559e151d508110058bc0ae24e7443bda6d206e8040db26
a421681d1d6a43b2ca18bb57d596a9002e3a0442fa5cdee0e2b30098aadcbf47
cd63352e1eae206ee6d7b9646fa765a6638d7a6c093a6f035d04a798300f2672
0e31b64c56b8b6fb914bc519d0564490c31ddbe81da51a56d1f71ea15635bbb1
f980dc8dc9418b78ad40625e3e2490083d2b1f3a8d0bbd7ee6ad02d6043e218f
0a0d6e36083123462b0362f0909ceee2eeb962e4fe2bdc3428c452184e701d94
4c1c586ea91084e4ab171a2a1faec85244e823f4ac0e282faab996a6b33f0700
df4a92dacf24f62e230b0656dabe555c231d1c42c7bd3d1f6128c528458fd3c2
4ff00fef96a8b96ba389bee1744b3e33a5143b64c6402fdd4bf0d8db8be6ccb2
99cfc1d7303f75ab1a8ba4ab3f60a7ae67c36eed36aa2098858b9607e2c462bd
2836974c689831bb98cbfe91a85f59c42a50b1888c82db496d53e1132886f7a3
155d10bea9e7018e6b20ee840db81ab1938d69531697c41a6896bf1a5b7b6517
857473dbe88b80da3e1580876384cec6a84cdc85b2a0274a81d5437ae361cf4a
90ebcdca1a7f6f2ad9a52d8edf26a7e75d4741625d08616c1f6631b4b7f3b426
20c303567a05318e7ef208304abb8fcaa52329bd26e4584db4db399949fc3241
9f192124b2235421f53196db5c9e1d538be1d30b5580a3b284bbc953440f9f06
4950451b96939bc5e872b286398930509981767a8a840e80306f35d1c5d3c173
50b8e39e1cd2c2886542d0a3c9bcea3e91298fca4af62b23e6a46994335cda19
b408dda7bc388d61fc3032a57d1680f68e81f90b698deff1897a01899cf554d0
269d5a38bc77f5228031fa16b3b19dea79b6f4095331dc4e6e8edabbd35df36e
2c5985fb3d6419f4a0e8861860b9aa6f5eefec3f55d41a163e25aef684e597b2
3ada6e8496565c7288c045e0dcd7d4d019ca3aaca855d2d25d4c83ac7945e9c4
5a928ccfdda8165fffe7c25fd7dca4270f64f25f6efbb401ae0859058bbe1e7f
e8a539d214ec2ed141d9619bbc2bc1d6b9d73541eca7a0fde94139d7b108774a
4701102fd7b71169276d8dae3065e6c15fd4667d6fda5375b90e0458a4a5c257
5f528344740d8555e9a2eef46a7cfb33391ad44274c8e7f303e8bb14cdcebe03
0b4a62a24b9990ff092bb55fa4375f6e47ab0f423f7e8a9f59ddbfe315626d7a
ed707d534ff4671e1db0ef802074f9b146f7ca4d0c7d4ee7f42e29fe84a3cca2
eaf3d751be767274ae82b72a2d5946ff06ba2e2c8969a8c17f4705e4a0dceb98
8cdc3a56ab924c1b4ef340ef6fc7246e7c433e2ef7ad6102685faad5f0b40798

http://uat-essence.oablab.com/cEP88qz/
http://34.207.179.222/GPc2ykD/
http://204.236.197.55/ZmkN6EP/
http://107.23.200.84/EmllsJND2W/
http://radioviverbem.com.br/SZYTAZDa/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 02/22/19 ####
```

70fe811e7c16fc8f42d80d704349819eb9044af3e858ce1c6e8875563a6f0817
2ea8991e1aefaf9cb61db388a3336667a5b8164e23ebd28ed3b28c7d19729a10
eb2c11e411a4bd4e122273d8e08d7f20b956e7cee160be4cf95dd45195ffe3ee
bb014f3cd443b9bafa48df7d06121b47057ff8dbeee6479b6b2c8dc2dbb4df7d
07885a0e79c13b7743ba872a119a76d643b98b1d4f1fb094dde6efdac03f7be1
f3760cbecb581435b181defed3dba88bde2841ce982be61a5ff98ee88fc72767
6724f015f93622f173d3d07ecd51702e5add69a510b7f03f9535c97fe0c15d5c
4b6847cb1d8a71acd66ee7672a1737f13b085a550882244580a25eb9f60e3d9f
0febea4f91628e5e0011e56456508962ac3885c3ce7c74d825c2f22a7b554669
a517edbaecd8f5ec99554aab2e29dde0d4f32316757bc69b0e0f0063f57d4019
54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232
3f7a24172cb893d6e6e11cd4b9fd1d80bd9d921306920ac9313b1c5682839179
e10412b3f56f15cc3363b39f3f1f03cd4a127943e6f03a0654494ecf843b19f6
0e985416ce1f0eab95b774d1e1608d2895e955f871997a2892f57a28448c0b1a
0d5f45befe5686a6b48f56b76d4aec96fe297cbb81aefccdd667d1fe0a3f7ac1
0283eb958383ad555d213e6ec90295eb70e1c87694ffd47f11c6639b1f4c173d
e29ba4e2d1b805061e2a1b08e2e246dcfacfa11ff007f7251bbce63727d9cc24
87d882779340aecdda529abc74dbe37c5c0c4e80c5f4b1fb7c5de20f0a8b00d1
331c9274fa6c42c30642e3adca515f62978fbfeea6c960b84533e034eca781ed



```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-22 18:16:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
961a57f6c6607b7d1c5273d3e8515f5f9f1cc8506f419de5a9031c0ba5745b49
1ca43cc4e8e5befc913f2a3adc89dc1c2fcd9c16764ccef10866b0e59ec61e6f
fc4f525f44d7f3512af531aadb22374120304fb4bac24e1fa5067d5916506cd3
fa49901bc067792d069f9264b7459459cc702f7b8111819d93bc562be9ee87d1
2a274753602d0b9cba527e667b7247a4e19416d35648a57c724d08f9215b0e34
84fbe1a7d9f1a39bfa812609b0e932249f86332da4cd585c6d016cc9dcd608da
39e18585fbe82eeeb53e027599e24654d32c49971ab868b3dc739b8212d147d9
a7f3f7a257255e22c696a5714592fc0c62fdf0c712729805823a8084fb055c0a
f624c4e1c49239d7c25a68a7c30d7c45d6b8b694111eea307125fd842e5da904
a96407c639147915da83038a86a2c8927a377895315281fabd69fe8d0a45bf0f
0aa4239396404481d6ce4d38eb9140e2d52f49408c9755f03204bafb80358cfa
65c4648e28e6f6f8945a67375afccf39779cff0cefd98bf19c5fb3adf83c9d5e
7c03dd7a53bdad863c4ef4da12cf19b724686a8972f03acd0f12f5faa28be4c2
71fad1f80e57bfce9da1e2bbdd836443cf1fe3d5c4f264beffa9d4db675db786
252d38958c5789e408309bb562a4a5d1f3d24955b516a20f9ebdf75762583430
fc7252d2bb725774ff9195db5af8f9602a48ab2c4e30eb6d12ecc87c922ea674
9f51918746416b2d8b1d6062030afc723ea45f65a97b29737aeb7fa0004ebb2a
9e2e215c94dc7e99812a49d6e3d796d9f02798c951d6cd2024d93678fd01874e
59803960ce9fdd1ecc84a5f7b8e6f6a91c572eba2d15b101d085b8db93cb5167
a8f7ae828fcbc601a599402abb2c78064dae3578a267bae90bf66d2d4a571af5
529b560f34084634da442f563e691db180a983ca078cb0dcee4fa89584bada49
ca8fd0389d1e3a73d9e0fa2bfcbc32783b6e7ed0bdff849f0d705c566092bfe6
0fc795c44a906742f311322849e106fb2246c42734af49084f49a4d94fdc88cc
ebe1df97727fdbe018a30e13b5ebde08f7df414445de7dec0bc54df3daa6f6a3
eb9f1022837061b1218358200de0512aa78bf0326c7255578a5d32e4724c9722
e9a16026adca83dad0ef0c573fabd247143237eb6a4c7c8dbd0754ba3f2c2081
22a7cd8b9e0580efe178640286fad199fbe9798b256b2b87a08b21fa3acb9e0f
53ac9b24e07df504d0b6ed665676d7e5cecd0b4841051c89ac1a9525667d5e38
bca3d9df8c5f8dd577f12c3224ad5247dbe795087b435f83a36be63950f54272
0eccd2439b22ae9540d1f3ee3d0470753019720c2b6fa678f279300140940deb
224e4bc620496c5c3e0dae296cdce431641b90af7ca60e20ddf313ccabdeac3e
a8e24d396c0bb7881333c925622430496fd35bdd069cfef8966bc18b1243ba84
a960d2da5178d922c57cc537ba3d002f4f4e3d28968b5a732acfd114000f1263
00b220013b17a76962bb3c09dc09d3e60c12e427455e560749b14ab9d8723d4d
bd9ed74e0cf0b14305163a615a37475f52969c85f4d30588bc59d83e1b4831a4
47c72e73c619cbbf6a1d3425f93afc69f20a0a11a7e7366b368bde07d76743f6
3189aa09594a1b6101d3c6619baa7dba16d61d080a83d6975a6e9e8772979803
1b65dab3bfa87b87a2a8f8e44258a060d958b536dda9103f09f2ba87160c0005
19f120b5a6caefbe4cbc01f3d1d1c6fbcdc8074ff213bc9584c07e877e56bf34
afa5500064c46c66c19f57e22b3c7f40b3ec861ee6d92b434c026976001866e4
c66d95c1f481b05fb6c7cfe306a1e29cd39dfb5f4099ffb301742ed41cff3359
2e48e189062fbd6467ec7a62ca0e514fe23b629f8bbe041ddc9d614f151f2e3e
a8960bed362edcdbafd39629c6821927073d18f1bc311d7eedcf55fab90e9176
5a180c8554b8c8d2bdf3eb2374a5dbf5751ad6c61eac88d62d0d9a0df989b01d
6fdf13fa81007704468b0cbb9f5051fb3bdd9983fe6150b6e86f9e8e985981fa

http://pandeglangkec.pandeglangkab.go.id/VRiVl1jL4rZ9x/
http://primevise.lt/JVC887tTeJsTm_Q2/
http://206.189.154.46/hymd818Vvm86LW_ee/
http://35.247.37.148/UpY2rFZj3YVu7K_bJFfhx9Ep/
http://107.23.200.84/UMTFOfAh4hptNvMK_GGNPnbI9/

Creation Time	2019-02-22 14:29:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
fb8214e8438e5a3b192dfffb47c0fe669b98a4adabbbe3d027b1853a34d0fa90
7959240e195ddeb4c73c6c41128887530c08344676fc832ebc5cbe492a38f6a1
cd10e074276be9990ab5a8e85a0ebeb383f855a6cbb598919521b2d022010668
f5c59c6b68d73566793e6fdfccdf2cecc94c9f1b7315487e4467f6acb4c69eec
b29fe3fb2b9909a94ea8f079abc7ea994cb8d225a327222bee2c85a5480bb32c
8a1c8041ecff89c73c83df41ed70b24468f109a87766ab182f5a415599872059
6c9167142597152c09a19b9dad7e4643f007fc83b8598ab21520667ce7dbb213
134c3c9300fb1117e3765baa1f92f2a91d7535afec5a0282ad4143f13977597e
3126083bae39ce34a8688ad8c68e9ce313b4968c487a8407b33451039bf33e2f
e98fc6c0deda7cc83ca0fec2a8800bb08987db4fba4729ed4f7187f042ae7df7
b24abbb4b18b3c6a08a7c77497dbe0d068f39ed8319d98a4b4e0dc7f97d8380f
edcc03a53acffd37dc274e1a707adb3c95145f053eedbf3415008cae94bca950
aadd77eb71a287bf7add8c94aeeafaa3939bdc8295cbb68260475c55a992dbce
23db4387b50f01b6aba78b378cc208f1e4c0839e262e929d53af010b23db7736
8241e3ef37307e3412a8d93414cba2849a6292b09da5f7766fff9dba56ec9bc2
c05c2f2011e67479a3b138140a348647dc2f81828dbebe91d58c29c34fb191e2
8d633c3b35480167e18bbc12e517facece157d1f8e3d00ebb893b2dac8d7777c
b4ca77f65fe917854bec3b3dda5afbeabc2cf2a57cd43a6f330a38acadc59155
9100f09501b34e5999ff36f74f5197ca5b26b05f296be85e5531d6a8e52e639e
9efebc889e55c3d4e58bd2003530b093abbfc5d6776d2209be3b2d32bffab067
f746c0e7c20d9bf520b9bb5f877cab019ae1ff91ad3e8adf667f82fa05bd5016
a20e8ead25e235b8f7a3e14a40c15aaee6a4fcdf9d5f04fd4a3936a5a33f68c9
f3347032633b4461190ae33a2db84cec5ef09f208d8b7a5a1861d38a208cf5d8
6be0a6bbe53fc12c181591966c5ec2a31d5ed04f3d6d5d9884199b89c1c28681
3138b5bcb246b464a3bcfd9de407d63654fa38db0c34344c9834626cfe9ad754
bba7c7bbcee32adfb481c2e2a7f88d9fa197f53c28267413dec22d2a973d33b0
d546695b2dcabcd462189cf554709e65de2c718861b5fed38077e8c77deca375
f6c7c2fcefd6daa20f4ca328d7e92d16313b01f20644eff473af1f6bde98c0bb

http://suamaygiatduchung.com/wp-admin/js/bkgiovu2mxS/
http://tjrtrainings.com/bhVVXzfNXCxrj3_dV/
http://song.lpbes.org/oKDGT3HnwA_9u/
http://ditib.center/2OTZiNbRxnb2/
http://www.gelectronics.in/wordpress/wp-content/ETGjNx1_g/


Creation Time	2019-02-22 13:45:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
8960b0f0a90a9e2e509c8cded688fd2a744973b4de7dd45cd1eb9ff221220f58
d4aa6aefb1d37234a4e549827bfe07b56307f6d5d8338b7e9db82f960cb7e1d2
bd63961a0b576c07e38660603acfc388e38d3d369c81bb1663775ea2d871d1db
4c73c3031a9ab2678ec5011247672d19c962c934fdbc165fa549cf78cdca5c52
5e42876035b214c50307301131b5faf305d9c3310b391b313de5f2d050667d75

http://suamaygiatduchung.com/wp-admin/js/bkgiovu2mxS/
http://tjrtrainings.com/bhVVXzfNXCxrj3_dV/
http://song.lpbes.org/oKDGT3HnwA_9u/
http://ditib.center/2OTZiNbRxnb2/
http://www.gelectronics.in/wordpress/wp-content/ETGjNx1_g/

Creation Time	2019-02-22 08:22:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
7313d002582722f2552a82f91ce1a013ec79424d9a57915d16e3693fd44ce269
a5ec36f262af3ff218bdaec36cc7a8c90befce2f623b1f2c71f8256ff81bd573
bdd6b6fbe8a17b80347e02c15c57de0264a8e48d9980839b5c6041dcbb1e7e89
7a1fe6a2231a39109f82f38ea46b204dbe49e7a41bc03d010917cec16c035427
28f765d66743f41ff590cd24859c0d428517930696761f11594609e979a5fbf1
e9912e1077bda9f94ecfbbc184e654dae92f680485efd93443df48ed9243317d
7c3d9c011b94b7de6416e8ead6451d071bb209bb493e834ab74c8671f0a2129d
c96521108acf5fd1800fa4b302f09009ea3dd36973fa3cd4b673186ffd703a28
1bf74c1e82d63589d9703907e6eb5878f4f5d0238c47c364ddb65dfd71aee84b
a05d193a03741e2c2c9de7236e56669288a08cd03706fe4c933fa9ce64ad56cb
224f8fd4b25520adcc22c49b86a7f52dffba6428dccc81abeefce29383c354f1
c5fc3f6ca41ef3a9b55f342e78bdea209317a186393fe7de25ed9db51162d633
8c0a03eda0f34f7e87a36b697b113da7aa50b961d3af1a5056dd33ffa1f1707e
e2520b9b484f7ccf2f9c3b1cc2cc8ddb7c37c5eff20d709e585189ad55095161
13df66005aa50f3f0a9213b5c7f1d889fd72a202811c6794e467d9df1f760b7a
4b25363b28873c1add7b13b046befe675108fb36ab874dd9c8c1ab9140a26aae
93f590739491d3814a4820aa7e69ef8a6c875aec2eb450280bdfb7fecea00edc
b9568f524c5e5a52877c5e8ad28438472d3d2dd7b4099cdbc5be299f27320817
cb101e5de7d8ab909e3ff3cb9b60da24feaadb6ca684f099d8690bdea9eff435
62a1307176dcfc48a20d31f5f76b7c8d2a25e861f57533d23ac272815f7ce460
f756f1e3c6445d187b15c78bc4fb449ab633bcd09042fd962eff8ae9f63b4594
1b689be6dc9754f4a81303d0b661ffdceb86c990c45ac1dfc4367beffecd0e43
c0ab099ead88ff3de60362651144a2edc78bd944cd11ec0caac89fea221e1ada
482371cfd57977e11bd837b54a7d4759fe8fb85352ea15fbb846c7658f70f836
245079c4fb127b0b60febe3e89af54a44866c67ea1b623336daf68b2a9a060ad
d271484f11fc77b057940ebf43c1bd15547c3d2bc64b87d48e08e5c45bb8e735
2418ed2015fae480691f3239ce2002de93dacb93b9ded1c9a1fe4d0d03832f6c
12b4add00b024cd51120ca220f2c6eddbc7de7a2b9b42877f0d779e474b1ebce
367cbab1dc1ddb5eb5cc94d2f613ffd0b91be1fc2b574de07b58bfe301c4fc5a
f1647858533b4749354ff19ab0928e1559255a2b0335dc6cb560135fddf42cbf
37f99bb2121239ff814753f565c43a876f4b63c5098cd83ff191c5f667c51dab
d5d6aae3d940aaf613cc733705769e7d91222549be3e668f59e6341cc2366fce
b164ca4da4bb9d5fc5e4f8fa162bb4eb93a8464914c850b042ac0ee4c69ea795
362beb3a4a19e7a0fbbc119eb4b8d0730228bd644594fd211aa719f584086d97
f8570802bf76063969c8a167544fd283bba43cfd7ce0a1d2f405b098fbfe3f73

http://destino.coaching.interactivaclic.com/tjEwdljrg44_lZhOyC/
http://galiamuebles.es/wit1OfboK8eA/
http://thinhlv.vn/73CtMXMgqwq/
http://palmer-llc.kz/TxIvOOt9Uw/
http://www.armand-productions.com/B1kK33Yc9ULW_wb1/

Creation Time	2019-02-22 06:57:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
ce06e7d309f3c2ee9ada6ef07f14b734b1229ab672f14f646b35e689158e3a8a
6d06956632e3853c1896f7a32f227e6a3bd36cb4d20cf0b945e687c6a13cc995
b498d256fecf401dbafa33019919b5f41bdf912aaad458cdd0c3d948471356b1
0fa13885a21266d0fdae33ca6cebbe7e496a961bc8f6f15c8acdcaff2ece9534
18d32c5f7388bf283b376d4ec1646fe70c03400f218f86afbe8d03b029dc2c88
49ae81b34e03962430086000a093b41db32898539b909f0a9de25aca0a4df646
5dc5c97f22c78e2eef957dc9412644ce71c597b62584ddc0eea25bc352412bd2
c0e4f2434d9aa1ae110127f100ee7469dda1387cc899aed670b0ed1f94b17b65
da1c259d333f72f05be637093cd9a53d69b9650e369956701567c747ebbad495

http://healthytick.com/wp-content/uploads/ustpcF6FMZpDg_9RwPnGG/
http://ftpcm.com/BZCEsFUe653snDRB/
http://protecaoportal.com.br/BdSyFxrniPRjsN_K/
http://palmer-llc.kz/TxIvOOt9Uw/
http://www.armand-productions.com/B1kK33Yc9ULW_wb1/

Creation Time	2019-02-21 21:58:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
98c0ce92e61c133b514b58093e17ffa6df186e40ae7244c9cd6290ec7578b49f
695947db8e78b9520041c1b25b9de373eb1bf0c6aa184a4330d24cc086cd5623
3e8f09a00da64f471232c26c327cca6e04e939c6c11b34f451a0ed73b9e649fe
3a814aba071c0bb25158f9632f177d4f0bb79ebeb6c4184e750c9f1f5be7556f
6f00cb06559ee611ad863f052d203d645455ee83556361d9f3db0c68f6c944b0
cf2d7e0c2bc39625f2aeebb6b8c0950963a8e51b1568c9fb5b4a2dc67e8b3cb1
50c5559035123f045c5ea46d600cf9135707a76519122d18c86b12a0f61e8470
00cd3678ea574e1f132cfa48aedd0fdf7b16879d7a5caa697980a9febec8c49b
96e2cc08140b91a7ea123eae11cd24977a0938193a727a73038ee9a28bedddf2
8f518f6ec04b7ac2c4b43176f0349ba3ced69453359e09948b007324e5af3a07
4b83a7cfd2fc2ef08fff2d87ff6afbcd42ee1d78d8375824fd16601f74bd322e
5fa2a97cd7e989eac9fc9a1ce98af71cc3b77078e8653c7ba9027bf9711ac59c
d095edb1ebe403e34bb7e556d4d572f8adf4cf0a928f1bf78e9dbb2a09cb87a4
89e716291e1bdce7071afb523cef3c1d788bcc7ac5be5252fa4eae61864b1cc9
7e4a41ff4ebe8750f84a1eb1acab55c0e326246d045054888b6acb022d38578e
94243eac3290f53bd56478e0bef9e523060a9398d9f4f66953ea7749491f8cbe
f2ae4e6272a6c254d9685c8b95cf28131e59555be218209c029f99fe05f6542f
d1534d44023fc954eab8281a858ae7ac67ddaae7e369458c63764476a3fcca47
72e48be9ae480b705c2a9e4f6f41c4b18e159504d57a75409c7e4bc937c09384
59933f2acdec3c573634e29f631526a3feddc7899b68724b515a3259f9460b0e
1aa6fcee174dad4fc57da2996ce4881217dc26b34a8fd43f1934ba04a2e94cad
cd168b2a2559b63a988969f95a897fec4cae3583b0867a82a79b8b0f4239e9a1
09885cd35d4a8ce2d2f14197a892dcea9b9164da1ba693bc83c874d2cb169874
1efc84de08d3b53a897fb9eba6e105bc3d0c4d21ed26e16d48d696f1210252b8
0d6804c5eb316f83de77541e46be0fe34438917cdf3e60e7f6980adc2346b07b
0d6a2fb81dadc4ee1338e648a92c62c8ec1520eab9e09d8b508c38e2047e4687
aca925c5e72482417254a5f75b06221aeef8628b2097fd7ab3642fe65125fedb
a448e1c4821fa9c9f41791a8c9d461e09f3d1a00f7ab29ca024175df9204653b
94d1ce79356e2213336f8cf874bc64b8be9303a07caa242dcc6707a49c2296ca
dba985d5697186de88463d3058fec1067d53b31c4f72bde225800c178a70114d
53a3dae9cbee00d4a21c0b5406415757581ebd5fc8ee33602a52a2b5037006b8
c69ffb0d1f57218768ebd8b691576d302580a7cb4a302adfb0718fdeef233b79

http://222.74.214.122/wp-content/9kj6qOXTF_aR9C/
http://79.137.86.189/produits/poissons/zgLvIOdR2vvZj8_KnYC7/
http://dmcgroup.com.vn/k0jINCbJj2n8TL9/
http://english-run.com/yojDPG1mo5rmPXV_sxKAoEp/
http://elk-joy.com/G4AFioRkP1t_oJSEWMw/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 02/22/19 ####
```

f10ed0e6c4cd34c806732ce081faa8323077965d1ba8784b3a3560a85d3d3034
17fb1eb88d9380f20d73a6c975d22fbd46c4bdfffacade1a1cbd6be3081716c2
999b2c8b665a4b8e3327811ddd0bd9585ba6fcc2142251d3d1821571ca0ca690
eacabe53b4053af858e7706a09fcbec1b95c1dbfbaf6ac076e14b23285112875
f13bf7cbff0a2cae50e74832dba7e31f032cea8da295f21fd8685f4081f95ff5
b488002d3b8f8fba6e039587a47cecbc8e40eb13a386d2c5c9cc8948a65280af
cac79530710a405ca4daa54af4ddfcd2c04006b5ff5ccf4528e4647d16d94d75
3406b39d07f45487ad81ab122fc4b92c2e4c340a08c299f34d5985b7489fc26a
3c68f963b0f3903c1c19c64e66f71d30d6b97d4dc5d6f9eb08902d9fa65e6e95
ae82d4db7ee2d8861b79a1c579484756a0b6d7536a4b31464f528d53c17141d5
c2a6497f80a1de6cbdc0fc533f8a2908c654018f3c4b3e5f671e6b8d7a13b9e0
595048c9ed480824162e754dd79e78712c3e6b54821afe85646173752af29d77
fb8c433ec526913a4d8c45a6192f7cb1b63c97f1a49bca4afbbf349a0582c628
f5925fde287847ffe4e87795a2bedbd388659b332b99e53cce6f597a1c240976
e2eb34ac3356653da56876b68d5afafccd5d72bf63c425f4aa84a901dde9834e
b60f3140e2f6a7cdb592b7b6d6e816bf87bb337f66d8c60abd86db8a20f8ca0e
327f0a543778e5493a9765af07f551c4190414e19ab6ecb18bfa934311f538d4
3b483810130ab7c6bfa6625f45cafb070e793128a723c62d77c5598d2009a7e4
1bba2e80cf271c5d36f1800d29d0da0da2507fbe2c99901171b6c4a4fbf68d67
c2ca10c379eddebab5ea428e6b6a79203c2614068b8f68783ea61cc7aeb99f22
5a276f6be10c865870b8530bfe23d89d7d8849bccbe07a6552b95f3b888291b9
0c891ff7c73ef05e6dcbea2df183cf791fb0a77070c9038a1c0832436829077d
e2046b994e406af83fce87fda1874d6faf4f3a638b92bd87f5f39eebc78b6d23
4e6fa2c1152c9d931de0f841206484085914c312607a35e8c1098a6bf5909841
74b6cd0c43f504e87c99a9878a5ad76a1ce013a962db2c10f925d47d77d5b5d6
ffe9637744f90a5ae50a76bb5636a6887a754d19c6a49000bc0ce0c3bad2091b
27a04c08aabcc724cc54e3f6b621a96c925ac17d091f159da6801c90593bc6f8

```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
123.168.4.66:465
136.49.87.106:80
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
168.226.35.218:80
173.94.53.3:8080
181.168.123.241:443
181.29.214.233:8080
181.56.165.97:53
184.15.10.139:53
185.86.148.222:8080
186.68.100.2:20
189.173.176.115:443
190.117.226.104:8080
190.191.218.44:80
192.155.90.90:7080
192.163.199.254:8080
194.154.80.106:443
201.122.94.84:8080
201.204.44.101:8080
201.212.113.14:50000
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
212.83.51.248:8080
219.94.254.93:8080
23.233.240.77:8443
23.254.203.51:8080
5.9.128.163:8080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.114.194.228:80
70.177.115.200:20
71.40.213.82:8080
72.47.248.48:8080
73.115.132.124:80
74.45.170.110:80
74.62.89.170:8080
90.63.245.70:8080
92.48.118.27:8080


```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
187.134.63.166:8080
189.180.186.235:8080
189.244.82.217:143
212.112.113.235:80
24.191.37.42:443
50.116.63.9:7080
73.185.42.52:8080
75.166.252.40:80

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

107.10.49.252:80
133.242.164.31:7080
138.201.140.110:8080
153.121.36.202:7080
172.248.21.6:8080
172.98.243.40:80
173.21.116.239:80
173.255.196.209:8080
173.255.250.241:443
173.63.66.10:20
178.62.37.188:443
181.119.30.28:80
181.119.30.36:80
187.198.33.171:7080
189.150.140.28:8080
191.92.83.137:990
208.78.100.202:8080
211.115.111.19:443
217.13.106.160:7080
24.151.31.150:465
24.153.169.62:443
24.185.185.187:443
24.243.160.247:80
45.123.3.54:443
45.63.17.206:8080
5.230.147.179:8080
50.31.0.160:8080
62.75.187.192:8080
62.75.191.231:8080
63.116.14.206:7080
64.19.74.49:8080
64.228.72.40:7080
66.193.130.13:80
67.205.149.117:443
68.195.129.139:7080
69.198.17.7:8080
70.115.70.154:80
70.116.68.186:80
70.123.237.77:8080
71.41.68.158:8080
73.186.92.178:22
73.194.61.246:20
75.99.7.18:8443
83.222.124.62:8080
87.106.210.123:80
94.76.200.114:8080
96.20.172.107:8443
99.139.140.129:80

```
#### Epoch 2 - Spam/Stealer C2s ####
```

198.58.114.91:4143
213.136.86.219:7080
24.164.79.147:80
47.50.128.85:443
58.108.251.65:443
66.38.64.143:80
71.95.197.230:143
71.95.197.230:993
96.42.13.162:80

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 01/29/2019)It has been awhile since I refreshed this section so I wanted to update it and bring it up to date.

I have been tracking Epoch 1 and Epoch 2 since May of 2018. Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for
communications. Epoch 2 is currently the larger of the two botnets and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing
version of Emotet at one point in May/June of 2018. Now Epoch 1 seems to be the smaller of the two since this time period. Despite having unique unshared
C2 infrastructures, these two botnets have been seen to move bots from one to the other and show similar behavoirs seemingly controlled by a single
entity/group. Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an Epoch 2
document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those being delivered
in maldocs on Epoch 2 at any time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and Epoch 2 may
have a document hosted on host.tld/B.
- The RSA keys will change every month or so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours to stay ahead
of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from is to find the payload and then check the C2s/RSA Key.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://twitter.com/ps66uk/status/1099059333604753414 - @ps66uk
https://pastebin.com/XphvkZDD - @pollo290987
https://otx.alienvault.com/pulse/5c705f9e1a83e475aeb19b09/ - @SecSome


```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial
@shotgunner101, @HerbieZimmerman, @Outkast_TI

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial,
@OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Today was light and only saw 14 malspams. Almost all of them were link type with the same templates of late.
Spamming stopped at about 19:30EST for both botnets again.

Today I saw a new tactic of offering a Transaction Refund which has not been seen that I can remember. The really odd thing about it was it was dated
as of 2007 for some of them so maybe someone forgot to change the time in the template. Others were current time so I am  not sure what happened.
(Picture attached in Report)
The HTML templates look like this:
________________

From: Full Spoofed Name <Comrpomisedsender@domain.tld>
To: victim@yourdomain.tld
Subject: Transaction Refund for $1150.00
Subject: Transaction Refund

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body>
<title></title>

<table width="100%" cellpadding="5" cellspacing="0" style="font-size:12px;color:#000000;font-family:arial, sans-serif;">
<tbody><tr>
<td valign="top" align="left">
<table width="550" cellpadding="5" cellspacing="0">
<tbody><tr>
<td valign="top" align="left" style="font-size:12px;color:#000000;font-family:arial, sans-serif;">


<p>
</p><div style="font-size:16px;font-weight:bold;">REFUND CONFIRMATION</div>

<table cellspacing="0" cellpadding="2" bgcolor="#a0a0a0" width="100%">
<tbody><tr><td><span style="color:#ffffff;font-size:12px;">
Invoice Information
</span></td></tr>
</tbody></table>

<table cellspacing="0" cellpadding="2" width="100%">

<tbody><tr><td width="90" valign="top"><span style="font-size:12px;margin-top:12px">Description:</span></td><td valign="top"><span style="font-size:12px;margin-top:12px">Online Payment</span></td></tr>

</tbody></table>
<table cellspacing="0" cellpadding="0" width="100%">
<tbody><tr><td width="250" align="top">
<table cellspacing="0" cellpadding="2">

<tbody><tr><td width="90" valign="top"><span style="font-size:12px;">Invoice Number&nbsp;</span></td><td valign="top"><span style="font-size:12px;">2921794</span></td></tr>

<tr><td width="130" valign="top"><span style="font-size:12px;">Customer ID&nbsp;<br></span></td><td valign="top"><span style="font-size:12px;">AY7786</span></td></tr>
<tr><td><br></td></tr>

</tbody></table>
</td>
<td valign="top">
<table cellspacing="0" cellpadding="2">
</table>
</td></tr>
</tbody>
</table>
<hr>
<table cellspacing="0" cellpadding="0" width="100%">
<tbody><tr><td>
<table cellspacing="0" cellpadding="2" align="left">


<tbody><tr>

<td valign="top" align="left"><span style="font-size:14px;font-weight:bold;">
<a href="http://serenitymatagorda.com/REF/company/ltUFg-WvsBx_LBzWEiI-UNg">Get REF-receipt</a></span>
<br>
</span>
</tbody></table>


<table cellspacing="0" cellpadding="2" align="right">
<td valign="top" align="right"><span style="font-size:14px;font-weight:bold;">Total:</span></td>
<td valign="top" align="right"><span style="font-size:14px;"></span></td>
<td valign="top" align="right"><span style="font-size:14px;font-weight:bold;">$1150.00  </span></td>
</tr>

</tbody></table>
</td></tr>
</tbody></table>
<br>
<table cellspacing="0" cellpadding="2" bgcolor="#a0a0a0" width="100%">
<tbody><tr><td><span style="color:#ffffff;font-size:12px;">
Payment Information
</span></td></tr>
</tbody></table>
<table cellspacing="0" cellpadding="0" width="100%">
<tbody><tr>
<td valign="bottom">
<table cellspacing="0" cellpadding="2">
<tbody><tr><td width="130" valign="top"><span style="font-size:12px;">Date:</span></td><td valign="top"><span style="font-size:12px;">02/06/2019</span></td></tr>

<tr><td width="130" valign="top"><span style="font-size:12px;">Transaction ID:</span></td><td valign="top"><span style="font-size:12px;">89123494617</span></td></tr>

<tr><td width="130" valign="top"><span style="font-size:12px;">Payment Method:</span></td><td valign="top"><span style="font-size:12px;">Card ''''''7410</span></td></tr>

<tr><td width="130" valign="top"><span style="font-size:12px;">Transaction Type:</span></td><td valign="top"><span style="font-size:12px;">Refund</span></td></tr>

<tr><td width="130" valign="top"><span style="font-size:12px;">Auth Code:</span></td><td valign="top"><span style="font-size:12px;"></span></td></tr>







</tbody></table>
</td>
<td valign="bottom" align="right">
<table>

</table>
</td>
</tr>
</tbody></table>
<br>


<table cellspacing="0" cellpadding="2" bgcolor="#a0a0a0" width="100%">
<tbody><tr><td><span style="color:#ffffff;font-size:12px;">
Merchant Contact Information
</span></td></tr>
</tbody></table>
<div style="top:0; width:98%; font-size:12px; text-align:left;">Full Spoofed Name</div>
<a href="mailto:Spoofed email">Spoofed email</a></div>


</td>
</tr>
</tbody></table>
</td>
</tr>
</tbody></table>


</div></blockquote></body></html>
________________


Beyond this I saw a few of the typical things like 2 German based Invoice malspams this morning and some ACH Forms/Payment/Receipt Bills in the
afternoon with a few Freshbooks messages thrown in for good measure.

Unfortunately it looks like CAPE extraction is broken for C2s now. I have switched back to using Any.Run. The keys have not changed either.

E1 C2s changed and combos decreased to 44 from 48 yesterday. - Recorded above.
E2 C2s changed and combos decreased to 48 from 51 yesterday. - Recorded above.

The keys have not changed.

Notice: the @cryptolaemus1 posts may be a little chatty this week with C2s both saying they are from E1 when they are really are either E1 or E2
in disguise. The bot thinks everything is E1 right now but the posts are accurate and complete. For confirmation check these daily posts.

Have a great weekend everyone!

```
#### Sandbox 02/22/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run on 2019-02-23 at 01:00 UTC - https://cape.contextis.com/analysis/39527/
Epoch 1 C2 run on 2019-02-23 at 01:15 UTC - https://app.any.run/tasks/9272df7d-49b5-4f71-b402-6c4deab670ad

```

```

Epoch 2 C2 run on 2019-02-23 at 01:00 UTC - https://cape.contextis.com/analysis/39528/
Epoch 2 C2 run on 2019-02-23 at 01:15 UTC - https://app.any.run/tasks/dda5b389-4b96-4f00-bf34-6d4e4d8b86ee

```