Emotet Malware IoCs 01/15/2019

## Emotet Malware Document links/IOCs for 01/15/19 as of 01/16/19 00:55 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 01/15/19 ####
```

http://15ih.com/Payment_details/012019/
http://activistdibyajyotisaikia.com/Clients_information/2019-01/
http://adyxw.com/Information/012019/
http://aimypie.com/Messages/012019/
http://airmanship.nl/Payments/01_19/
http://amasa.be/Clients_transactions/01_19/
http://amimakingmoneyonline.com/Clients_information/2019-01/
http://angelayeedesign.strategysketchnotes.com/Clients_Messages/012019/
http://ann141.net/Clients_transactions/012019/
http://aprendercomputacion.com/Clients_Messages/01_19/
http://audrey-benjamin.fr/Clients_Messages/012019/
http://azfilmizle1.azermedia.az/Payment_details/012019/
http://bankingtech.vn/Details/01_19/
http://beardelect.com/Documents/2019-01/
http://business-blueprint.top-startups.com/Information/01_19/
http://cal.com.my/Clients_transactions/2019-01/
http://carbontech.biz/Transactions/2019-01/
http://cardpremium.com.br/Documents/2019-01/
http://chalespaubrasil.com/Clients_Messages/01_19/
http://chepa.nl/Transactions/2019-01/
http://ciblage-spain.es/Transactions/01_19/
http://clubfutbolero.com/Clients_Messages/01_19/
http://conceptrecords.ru/Attachments/01_19/
http://cqibt.com/Clients_information/2019-01/
http://customs1.ru/Transactions/01_19/
http://cvetolenta.ru/Transaction_details/012019/
http://dianaverbeek.com/Details/012019/
http://dijitalbaskicenter.com/Clients_information/012019/
http://dirc-madagascar.ru/Transaction_details/2019-01/
http://domaingiarenhat.com/Information/01_19/
http://dominusrex.fr/Payment_details/01_19/
http://donggiaytheoyeucau.com/Information/01_19/
http://donidonggiay.net/Transaction_details/01_19/
http://dumc.lt/Payment_details/01_19/
http://dyefusion.lesetoilesdelarive.ca/Documents/012019/
http://emmanuelboos.info/Documents/01_19/
http://eriklanger.it/Clients_information/2019-01/
http://etsybizthai.com/Clients_information/2019-01/
http://europel.org/Clients/012019/
http://faszination3d.de/Documents/01_19/
http://firstclassedu.com.ng/Payment_details/2019-01/
http://francoisebon.fr/Clients_information/01_19/
http://geodrilling.cl/docs/cache/Clients_Messages/012019/
http://gisa.company/Information/2019-01/
http://guiavestindoabeca.com.br/Documents/2019-01/
http://hederefloareasoarelui.com/Documents/01_19/
http://helkar.pl/Transaction_details/2019-01/
http://hjsanders.nl/Transactions/2019-01/
http://hotellakeparadise.com.np/Details/012019/
http://imunnologiya.ru/Clients_information/012019/
http://infocentertour.ru/Attachments/2019-01/
http://jeturnbull.com/Clients_Messages/01_19/
http://jourssa.ru/Attachments/012019/
http://ketout.com/Attachments/01_19/
http://kiot.coop/Clients_information/01_19/
http://krysha-max.ru/Information/01_19/
http://landschaftsservice-seibold.de/Transactions/01_19/
http://lanhodiepuytin.com/Information/2019-01/
http://lasikeskuskainuu.fi/Clients_information/01_19/
http://logopediaromaeur.it/Clients/2019-01/
http://lostri-o.com/Information/01_19/
http://mail.mfj222.co.za/Documents/012019/
http://marinacity.com.vn/wp-admin/network/Details/012019/
http://maslianit.ru/Messages/012019/
http://masswheyshop.com/Documents/01_19/
http://mataukitaip.ekovalstybe.lt/Documents/01_19/
http://mdmshipping.org/wp-content/uploads/Clients_transactions/012019/
http://mediconline.md/Clients_information/2019-01/
http://mfj222.co.za/Details/012019/
http://milagro.com.co/Clients_information/2019-01/
http://mingroups.vn/Transactions/012019/
http://mr-digitalmarketing.com/Transactions/2019-01/
http://mtsecret.mtcup.com.vn/wp-admin/Payments/2019-01/
http://nbhgroup.in/Clients_transactions/012019/
http://newwayit.vn/admin/Clients_information/012019/
http://officeslave.ru/Details/012019/
http://palmbeach-hurghada.com/Documents/2019-01/
http://pharmaesourcing.technoexam.com/Transaction_details/2019-01/
http://portal.elsyscakes.com/Transaction_details/012019/
http://prakashdiwan.in/Clients_Messages/01_19/
http://predator-security.ro/Clients_transactions/012019/
http://pro-ind.ru/assets/Transaction_details/01_19/
http://prom-engineering.com/Clients_information/01_19/
http://ragainesvaldos.ekovalstybe.lt/Payments/01_19/
http://rahkarinoo.com/Clients_Messages/012019/
http://ra-services.fr/Messages/012019/
http://rokiatraore.net/Transaction_details/2019-01/
http://scullytrucking.digitalmindtec.com/Attachments/2019-01/
http://sedotwcsejakarta.com/Messages/2019-01/
http://seitenstreifen.ch/Attachments/01_19/
http://sendgrid2.oicgulf.ae/wf/click?upn=AMiKyXv2mtzIwFVrksErJZApnkk6vlvRRpOQI1c51nlrrlY6WJSZS60cFgkcQw6fMr68kZNTD9HiezykenFkJA-3D-3D_nUnntfLuT5qGdCtkT8bDGMjiFtvrH5Kc2vFiJApR5BDi-2Bd4QeTnwJ2JYPTxhq-2BZuGNtYMut-2FQWB8JZuE-2F6jwKZve4HnV6ZKPDcbTkGymR2L5DJb1946NNEAURjwNPmdM1MOehQi5gGyaewIkLHubydrR8nk71gTdMinmrTRKbmErhv2UGbXkG0Hkl-2FSdHL6-2FWk-2FlllXew6ZQWtWWtvmFBQ-3D-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=cd32EPmub8FCGafASmf8Ow1hh1evEaG7UjZ7LfmTySN-2By8MVpoO30locFFTIHFzQ91ztVFP5l5SFYR-2B9yw9b5w-3D-3D_Gj-2Bg1rSC8OckvxTuaO5liXQzc1tFWkKwXtsOcXY3ViKprGPEiZV8C1wrX3bCjePcZCONOge5-2BCj4IZalIkBlajD-2FaTlj5Tu3MktFg6QzqezGuP1HnP-2F2hPqAaOnedxN4o59WdI2yvaSu4jHueEBwg-2BdWPKQqegZUb3eOfNxFvn4cpVrXCU1XQuipYw68v5SPe832cgzzGJZj-2BQCKY0EGxmXtNSxwcBtUp2KTI3jfjZk-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=gbMZY9-2FyUeLO8sbLnThslnXASA3TjEnejnTcT09Z-2B7o05NTEPJoV9NtTHDFGftmLd-2BAauBmfOOR3xzp1QZhCMg-3D-3D_cnBBvye119SQwWyIMEaVVGKjg0JEyqe3O-2Bnt2mI6C2JDoPs1D6jU9jt9p1JlNGEcPxt-2FXcc1H-2BWjC9Sc7qkfurPZaap1HLyNrU4lurmy32TQDCWp1DMKfaV-2FuqDbes05phINZ2U00HVMPyf3H2EaGkoFHzQB-2BGreNmTq6pR0zNXJnlqDMO5AkPKC8OJRaXlpLjYaGyOu41m-2FOCvHiSYMBA-3D-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=PQyP-2FMOSEXgJjvtLHzN126gdRmbeISsKuuD2uuGHnHzV-2FP7w2-2BxNWeL18DgaZVMw9qn9j6rKd-2BbgDLE0Mw-2BiSA-3D-3D_hUdPjQ3E6K6n2DfbXbqz3zFAJxhh-2ForUlIoE1aK6syMEqsuPtlN-2FDsY8fFkp-2FOVtY3Jmdud8nTzyalBT0VyQoGl3tz5yfhJWhGznZw7oUsh-2FmiFpLCtPF7njIXKt-2B1CvqUEojXoWoOpZBZHq4kyMBJp8xTJJ5Ajde37VLpwebYZ9hop9ej6DYKFVFPFOJgFyktGJkwrANkzOux0KjH-2BfRwEY1d4XrKkeWdo4UlOfvu0-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=u59see3MEpnouBz1BstN4oxS3VqOhU3709DvsKGIWLh90j9s6LiR-2BW47eudj0vqhSUqCOp9DUE-2BjLvDU5p6UfQ-3D-3D_GTI9hoVyJLvd8YfTPMmDdbyKGa1TM3sRPj66CRtU-2BEVnRLHzX29pNIuFmer0o9MOJwzZM2nmTCOFS7GfkAXQdLl0-2BA0lBjPNo3W9iBNK9MQfGJp3Hjf2zZRYfh0v25LstEudb6In3S6rh96XxuI0lv-2FSXZcEAbyveFx5AhPNdhJBt-2BiblfVWm2IjFmfkeuqZDizLfKQ1hd9Q-2FvJJdAyDXIIdiIkE35bDMVh-2FKGFipYU-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=VD95ITBgtKnZfMM-2Fzam2bPMP07SpnY-2BCraSx-2Fxsr1uQ8PGWLXxGuyEdk-2FvkeFuGlABvOgLxZpAokfK5-2BwvZSMw-3D-3D_cb3VcAQIyaDU7MBbUgnDp5P-2BfOxQ5q5-2BLi-2BOfkrik5YFwm37YIp6KDwDCikIrdccArWSP8FYr8SwfFxqD4XMJBytwswNfLmwDzLFm7OBwX0r3QlX4SrL9PLyFJ0Jb0QMrUaYpTBIBv3DFHW8MnnoMG-2BM89boSio2w1UniHmhEH-2F3m1XbfJZ-2Fu917bLkaQKoE-2FzWDO4orMaFLB7kWTHaFdxobFhIXtvovw79JrHX8QvA-3D/
http://shopping24horas.com.br/Information/01_19/
http://sibbilet72.myjino.ru/Messages/01_19/
http://silvies.com/Information/01_19/
http://sitesbrgiga.com.br/Attachments/012019/
http://somov-igor.ru/Clients_information/01_19/
http://sophrologie-untempspourmoi.fr/Payment_details/012019/
http://souljournalink.com/Payments/012019/
http://sv-piterstroy.ru/Messages/012019/
http://terstotem.com/31c03/sotpie/Transactions/01_19/
http://thequeencooks.com/Transaction_details/2019-01/
http://toddlerpops.com/Transactions/01_19/
http://towerchina.com.cn/Information/012019/
http://trehoadatoanthan.info/Information/2019-01/
http://ukmc.lt/Attachments/01_19/
http://ulco.tv/Details/2019-01/
http://undlab.com/wp-admin/Transaction_details/01_19/
http://vakilehamrah.ir/Information/012019/
http://valleyciaabogados.cl/Transactions/01_19/
http://weddingstudio.com.my/Messages/2019-01/
http://wp.corelooknung.com/Documents/2019-01/
http://www.atso.kz/Messages/01_19/
http://www.beardelect.com/Documents/2019-01/
http://www.belovedmotherof13.com/Documents/012019/
http://www.carbontech.biz/Transactions/2019-01/
http://www.cqibt.com/Clients_information/2019-01/
http://www.customs1.ru/Transactions/01_19/
http://www.cvetolenta.ru/Transaction_details/012019/
http://www.dsltech.co.uk/Transactions/012019/
http://www.dumc.lt/Payment_details/01_19/
http://www.dveri-imperial.ru/Documents/01_19/
http://www.ema2-medea.com/Documents/01_19/
http://www.ermaproduction.com/wp-content/Clients/01_19/
http://www.es.lv/Documents/012019/
http://www.faszination3d.de/Documents/01_19/
http://www.iain-padangsidimpuan.ac.id/Payment_details/2019-01/
http://www.ibnkhaldun.edu.my/Clients_information/012019/
http://www.imunnologiya.ru/Clients_information/012019/
http://www.infocentertour.ru/Attachments/2019-01/
http://www.jourssa.ru/Attachments/012019/
http://www.krysha-max.ru/Information/01_19/
http://www.lagis.com.tw/ktPF-Fc8Pm_heXXiUK-HWE/Clients_Messages/012019/
http://www.landschaftsservice-seibold.de/Transactions/01_19/
http://www.lasikeskuskainuu.fi/Clients_information/01_19/
http://www.logopediaromaeur.it/Clients/2019-01/
http://www.maslianit.ru/Messages/012019/
http://www.milagro.com.co/Clients_information/2019-01/
http://www.mountainmcc.com/Payments/012019/
http://www.musthavecats.com/Clients/012019/
http://www.officeslave.ru/Details/012019/
http://www.polatlimatbaa.com/Payments/01_19/
http://www.prakashdiwan.in/Clients_Messages/01_19/
http://www.pro-ind.ru/assets/Transaction_details/01_19/
http://www.prom-engineering.com/Clients_information/01_19/
http://www.rokiatraore.net/Transaction_details/2019-01/
http://www.shopping24horas.com.br/Information/01_19/
http://www.silvies.com/Information/01_19/
http://www.standardpen.id/Transaction_details/012019/
http://www.textilessudamericanos.com/Documents/2019-01/
http://www.thepuffingtonhost.com/Clients_information/2019-01/
http://www.thinkcircle.com/Information/012019/
http://www.toddlerpops.com/Transactions/01_19/
http://www.ukmc.lt/Attachments/01_19/
http://www.xn----7sbabof2ac4chjkhgcg5e1i.xn--p1ai/Documents/01_19/
http://www.xn--80aeii0ablmr.xn--p1ai/Payment_details/2019-01/
http://www.yarri-mebel.ru/Information/01_19/
http://www.z-prava.ru/Transaction_details/2019-01/
http://yarri-mebel.ru/Information/01_19/
http://z-prava.ru/Transaction_details/2019-01/
https://linkprotect.cudasvc.com/url?a=http://www.lagis.com.tw/ktPF-Fc8Pm_heXXiUK-HWE/Clients_Messages/012019&c=E1i65uF2KqLJNDm8HAElIklq0Ipvats29X7_ZplT3FTcWT7nmPwLNMyLWknhRH6r2cdw92sRjLZxpygJt37nor2tLVqPfRHWfnnl4fqGtE4RM&typo=1/

```
#### Epoch 2 Document/Downloader links seen for 01/15/19 ####
```

http://alfa-design.pro/iVMUb-7u2tt_tBrIeWLTi-Dy/ACH/PaymentAdvice/US/Outstanding-Invoices/
http://amerigau.com/wp-content/uploads/Januar2019/RDTHKY2810094/DE_de/RECH/
http://amlgroup.in/VYoh-zRD_IdvTAtLBi-aU/EXT/PaymentStatus/En/Paid-Invoice/
http://arteelectronics.cl/GHeSA-uX_sxXfeeo-Cf/PaymentStatus/US/Important-Please-Read/
http://askhenry.co.uk/blog/upload/fvXS-7iSveW2h7WpT4p_IXPUmtGN-JxC/
http://assicom.org.br/iLFk-ZAB_LCbLfy-NZo/EXT/PaymentStatus/En_us/Service-Invoice/
http://atkcgnew.evgeni7e.beget.tech/PbIZ-L6l_dFqg-wU/Inv/498883721/En_us/Open-Past-Due-Orders/
http://auto-buro.com/OvVJg-o6_RnPlacIbT-D4/Ref/319275518US_us/Outstanding-Invoices/
http://avto4x4.ru/DE/HJSEEJTFA1293851/de/Rechnungszahlung/
http://billfritzjr.com/DwrF-WNx8b_SbJm-ec/US_us/Outstanding-Invoices/
http://biometricsystems.ru/Januar2019/ZVOHZLAOJO4450541/Rechnungs-Details/DOC-Dokument/
http://black-friday.uno/zMoE-Dr_aWjGv-fkG/INV/7473201FORPO/86689225664/US_us/Paid-Invoices/
http://bloggers.swarajyaawards.com/wp-content/UbvEH-ZTbp_EMTwFGs-6Br/ACH/PaymentAdvice/EN_en/Invoice/
http://bomedmobilya.com/UTKPNADYDA3279925/Rechnungs-Details/Hilfestellung/
http://buld.ru/yElYL-uCgY_nUfZeq-8d/848018/SurveyQuestionsUS/Important-Please-Read/
http://cannabisenglish.com/Januar2019/RTWEKQO4171299/Rechnung/Fakturierung/
http://casa7mares.com.br/cNLXJ-X8zS_Lx-kd/VV40/invoicing/En/Open-Past-Due-Orders/
http://cerrajeria-sabbath.holy-animero.com/ZZWKP-NOzN_oe-Xeg/Southwire/HOJ46862317/En/Service-Report-6151/
http://cheapavia.ga/reyOG-iR_XOagihvFT-u3A/ACH/PaymentAdvice/US_us/Invoice-for-you/
http://checkreview.ooo/brHF-RB_pjppWx-jpj/PaymentStatus/EN_en/Outstanding-Invoices/
http://chervinsky.ru/WSIBMHJNF2141241/Scan/Rechnungsanschrift/
http://chriscrail.com/Januar2019/WOBAGMMM6486799/Bestellungen/RECHNUNG/
http://client.ewc.com.ng/rYMib-pEPr_KS-OlR/Invoice/46818008/US/Invoice-Corrections-for-21/67/
http://clinic-1.gov.ua/DE_de/NDEAVSCIE4629249/Rechnungs-Details/Fakturierung/
http://cofrex-eg.com/EJXE-la_CCHl-Sf/Inv/408818461/US_us/Need-to-send-the-attachment/
http://crm.mydealeradvertising.com/nEpu-Az5_SNyKbAyI-s4S/ACH/PaymentAdvice/US_us/Invoice-for-k/u-01/15/2019/
http://crolanbicycle.com/VDfy-Bhbv_OnZWsTVK-D8y/ACH/PaymentInfo/EN_en/Invoices-attached/
http://csrcampaign.com/ZYzfq-qZ3_SlgKaU-uj3/En_us/Question/
http://cultivatoare.com/WWke-6pco0_yQfXrEca-wRD/Invoice/106665194/En_us/Inv-703420-PO-6T490284/
http://decorsfantasmo.com/De_de/WKMAIKT8486999/gescanntes-Dokument/Rechnungszahlung/
http://denleddplighting.com/oHQH-ww_S-utv/ACH/PaymentAdvice/US/New-order/
http://dichvuso.edu.vn/jWAAp-yT_uygp-iFj/ACH/PaymentInfo/EN_en/Overdue-payment/
http://diclassecc.com/KVUWUXZMNC8006582/Rechnungs-Details/Hilfestellung/
http://diffenfabrics.com/SFuhk-J4Z3l_Io-SV/PaymentStatus/En/Past-Due-Invoice/
http://djeffares.com/Januar2019/TIEOBPUVLE8758156/Scan/RECH/
http://drapart.org/hMDfj-LLpLTa5HSTdT0ao_GNyuGUWJk-xx6/
http://drcarrico.com.br/De_de/TBKYRLOL5427013/Rechnungs-Details/RECH/
http://elcodrilling.com/VkRgA-jbtC_KMiKgDHZ-xO/Invoice/1376138/EN_en/Invoices-Overdue/
http://eliteseamless.com/pSRt-k0A_nAGh-zA9/INVOICE/70959/OVERPAYMENT/En_us/Past-Due-Invoices/
http://emiliesaunders.com/gLQtT-eigbc_gdfny-ue/Invoice/4671569/EN_en/Past-Due-Invoices/
http://emsivab.se/JgnPi-2NK_oT-vc/19835/SurveyQuestionsEn/Scan/
http://enekashoush.com/Aplx-GNf_jApmgnNVa-HW6/JI32/invoicing/US/Service-Invoice/
http://erolciftci.com/DE/ODEUBWY5883962/Rechnungs-docs/FORM/
http://estab.org.tr/DE/AZORVICMH7935587/DE/Zahlungserinnerung/
http://etihadinnovationkit.com/Januar2019/OPPZMDQ7295655/Bestellungen/RECHNUNG/
http://everythingfranklin.com/csaoN-un_xrIkgf-EO/invoices/3588/3696/EN_en/New-order/
http://evoqueart.com/De_de/ZCWRRRD4296457/DE_de/Zahlungserinnerung/
http://excellenceconstructiongroup.com/SdGM-lND_ZPcGcOg-QIB/invoices/1521/2376/En_us/Sales-Invoice/
http://favouritefashionhub.com/XbfNp-MMA_vCB-0l/INVOICE/39367/OVERPAYMENT/En/Past-Due-Invoices/
http://freelancecommunication.fr/yzTX-u1BJ_PDK-QFt/Invoice/8988554/US_us/New-order/
http://ganic.be/LLkI-dX6EN_oeSmUxQ-ai/COMET/SIGNS/PAYMENT/NOTIFICATION/01/15/2019/En/Invoices-attached/
http://giaybespoke.com/de_DE/ZJXZKDARPP2446969/DE_de/DETAILS/
http://goodnesspets.com/AADmV-FPGl_z-gs/PaymentStatus/EN_en/Invoice-6824416-January/
http://greenplastic.com/IlKI-qNW_GeAqCj-L7Q/En/Inv-35271-PO-2G659605/
http://gullizaralagoz.com/VAYUZDWP3297930/Rechnungskorrektur/DOC-Dokument/
http://hampaweb.com/WRodk-2m_qgTtrkjUi-u58/ACH/PaymentAdvice/En_us/Invoice/
http://hitechlink.com.vn/tmp/yUdX-ooV1T_REegxoY-vkh/Inv/305874329/En_us/Past-Due-Invoice/
http://hostinggiarenhat.com/rzcZ-L2N_qgahpTzf-UX5/Southwire/XQQ7134989214/En/Past-Due-Invoice/
http://inomoto.vn/PPisD-F3MN_I-8KT/Southwire/QSX6674068692/US_us/Document-needed/
http://insecovietnam.com/UilE-lVBCO_XIZd-cNb/INV/037768FORPO/0253487417/EN_en/Scan/
http://isikbahce.com/sHKfq-PQ_iSVlaWS-b3h/08335/SurveyQuestionsEN_en/Invoice-42509324/
http://izhevsk.planetasvet.ru/XSIh-vR_v-V87/Southwire/YQN4919736236/En_us/Invoices-attached/
http://justfinancial.info/QRhq-OHs_vfSbM-iQ/INVOICE/EN_en/Need-to-send-the-attachment/
http://kadinveyasam.org/aaGf-blvj8_QG-5n/INV/31105FORPO/3639418240/En/Service-Report-5732/
http://kiber-soft.net/FDDYT-jK_iPcQ-5dm/Ref/67158889En/Scan/
http://klobasafest.sk/altXh-JQt_kHAzSp-zhL/InvoiceCodeChanges/En/Question/
http://komsima.org/wp-content/DE/QJXPSRDBND8542414/Rechnungs-Details/FORM/
http://kuhniviva.ru/SDVn-8B_M-Mjo/282349/SurveyQuestionsEN_en/Service-Invoice/
http://lakewoods.net/UlgED-reA3GPGJbsEJpl_anLMvsZyb-WE/
http://lalie-bioty.fr/ofeYD-pR_iJdJpaOvO-pkN/Southwire/RTS227613434/US_us/Invoice-4778255/
http://lassmeder-service.com/BYTVPDJGYA8152756/Bestellungen/RECH/
http://leg4.ru/sRQAC-4Nj_Jzr-6N/ACH/PaymentInfo/EN_en/New-order/
http://lineageforum.ru/DE_de/YCLOXMQYD3571481/Rechnung/FORM/
http://linkingphase.com/xLzlQ-qiaEy_qKimkI-aoc/INV/9260181FORPO/2378484552/En_us/Sales-Invoice/
http://lucleos.com/DE_de/FFBLWCN4296932/de/Rechnungszahlung/
http://mail.stupidhead.tk/ryWl-g1Z_BqOPbk-Eo/Ref/6404039609En_us/Invoices-attached/
http://makeupbyolivia.co.uk/wSgC-LMgP_b-k0n/invoices/04514/99848/EN_en/Open-Past-Due-Orders/
http://maracuja.ru/lsnB-iD7n_Y-HHd/En/Past-Due-Invoices/
http://mauriciogomezjaramillo.com/bnGWE-7URZ7_eRwkBvByF-62/ACH/PaymentInfo/En/New-order/
http://megascule.ro/BwGE-JO_kiM-qq/Invoice/7478991/En/Service-Invoice/
http://megatramtg.com/site/cache/ajax_login_form/Aorax-rB0E_T-yf/EXT/PaymentStatus/US_us/Past-Due-Invoice/
http://miketec.com.hk/de_DE/TFXPBUA0548303/Rechnungs-Details/Rechnungszahlung/
http://mkbayhan.com/Januar2019/DXRMZUP2762371/Rechnungskorrektur/DOC/
http://modern-autoparts.com/Januar2019/MOOOHAI9601427/gescanntes-Dokument/DOC/
http://monrottweiler.fr/hcMwq-8qZzz_MItp-YG/Southwire/UTD940213930/US_us/Outstanding-Invoices/
http://mydrive.theartwall.co.uk/njpNI-tbpFx_yzeHiewbh-3Yf/INVOICE/48481/OVERPAYMENT/EN_en/Open-Past-Due-Orders/
http://mywebnerd.com/de_DE/PXSLQELA4861845/Rechnungs-docs/DOC/
http://newcanadianmedia.ca/templates/beez_20/YZUmV-w88oembtbhdcsu_NRNGArHY-Fl/
http://ng-tech.ru/xVhG-gt7a_LB-E8/Invoice/619377086/US/Question/
http://nhakhoahiromi.com/ooIa-ISD_bchGK-Iu/Southwire/RLC31442725/En/Scan/
http://nuagelab.com/YviK-B0_OHjAguy-8W/PaymentStatus/EN_en/Open-Past-Due-Orders/
http://ontamada.ru/Januar2019/KGFJIA2987254/Dokumente/Rechnungsanschrift/
http://optima.easiere.com/DE_de/FQNITIXHYN9153897/gescanntes-Dokument/DETAILS/
http://ori-motivator.ru/zRxM-ysT2_uDDPAfjn-rb/InvoiceCodeChanges/En_us/Companies-Invoice-34834023/
http://pcengine.ru/zVpXy-rxw_TcJA-1F/Z913/invoicing/US/Invoice/
http://pcokey.ru/dENF-GJa_lELyOD-ope/ACH/PaymentInfo/EN_en/Invoice-4287713/
http://phelieuasia.com/iUWD-AY_EIfZ-afg/Inv/35896259620/US_us/Invoice-Number-448033/
http://pivmag02.ru/PDLQi-9H7za_LGB-oc/Ref/59544797US_us/Need-to-send-the-attachment/
http://pmracing.it/WfDLx-jIDc_IIkMrXkHy-kW/878963/SurveyQuestionsEn_us/Need-to-send-the-attachment/
http://ppengenharia.com.br/WNaIC-DLd2YkhMYHql50v_qNAZxoME-gh/
http://privatetoursriodejaneiro.com/rIZMn-hhvu_x-z7/PaymentStatus/US_us/Open-invoices/
http://productvideohut.com/Januar2019/GJEGGQZ5087232/de/Hilfestellung/
http://provillus.biz/beta/De_de/FWYWXO4725041/Rechnung/RECH/
http://purifiq.co.za/tSOD-ta1W_cTJN-9aH/INVOICE/US_us/Invoice-0326887/
http://rashil.com/de_DE/YMDQJBNVB6027729/Bestellungen/DETAILS/
http://rccgregion15juniorchurch.org/de_DE/ALSVBSF3947732/GER/RECHNUNG/
http://refineryproductions.com/aJqX-HgD5DzF30jLlZK_UMlXHcsA-Qea/
http://reparaties-ipad.nl/PJmI-oEdsDWe5yNF8fa7_qbcGesGSO-BWj/
http://resbrokers.com/DE/CTHAAUHNH6233541/Rechnungs/FORM/
http://restoran-maligan.com/De/HERLEBSRO9612047/Rechnungs/DETAILS/
http://rossiodontologia.com.br/fJaR-zFFpoSItWDqtueL_DUQUyDEv-sF1/
http://santehstil.com/MAKKIMD6703918/Rechnungs-docs/Zahlungserinnerung/
http://seaportmovingandstorage.com/YXyBX-RW_cMJRRYZI-kQo/ACH/PaymentInfo/EN_en/Document-needed/
http://sevensites.es/YuuQ-bhLv2OSWXUc9Sl_urcTiang-ixB/
http://slcip.org/MnBrK-8Ae_j-tc/INVOICE/En/Need-to-send-the-attachment/
http://soloftp.com/HDIFV-71Q_qV-YR/I352/invoicing/US_us/Service-Invoice/
http://solverpropaganda.com.br/de_DE/FYOICVFXR4196590/GER/Rechnungszahlung/
http://sosh47.citycheb.ru/Januar2019/RUADGSHZP1644912/Dokumente/Fakturierung/
http://squawkcoffeehouse.com/Ecdn-0duqc_hkW-ZK3/EXT/PaymentStatus/En_us/Paid-Invoices/
http://sskymedia.com/MARI-OD9S_O-Xx/Y055/invoicing/EN_en/Invoices-Overdue/
http://stacknheap.com/De/ARBAMVDKL5913152/Rechnung/RECHNUNG/
http://standart-uk.ru/rRNb-SmEXz_c-b0F/40041/SurveyQuestionsUS_us/Scan/
http://stats.emalaya.org/KDPfP-vYc_VbAktoyl-2e/476308/SurveyQuestionsUS_us/Open-invoices/
http://storylife4you.com/AUQfG-1J_nI-pG/INV/191542FORPO/159688852097/US_us/Past-Due-Invoices/
http://stoutarc.com/DMUHGXKWZ8963686/Rech/DETAILS/
http://studypalette.com/Armt-ULAhI_SEVQ-Xg/INV/0337474FORPO/21645673519/EN_en/Past-Due-Invoice/
http://swanpark.dothidongsaigon.com/kJcGo-4x_YOOprAfa-Oo/ACH/PaymentAdvice/US/Outstanding-Invoices/
http://symbisystems.com/DE/RNEITWJ3387844/Rechnungs-Details/FORM/
http://tajiner.com/jwaQA-IX_mpPY-n2/PaymentStatus/En_us/Invoices-attached/
http://take-one2.com/De_de/RNARFD2289771/Rechnungskorrektur/Zahlung/
http://t-casamos.com/FOZRKEXB3623604/Rechnungs-docs/FORM/
http://tc-jaureguiberry.fr/hJYqJ-xUD4g_ylVrS-SH1/EXT/PaymentStatus/En/Important-Please-Read/
http://teacherinnovator.com/wp-includes/hRTCH-0R_jlZQcD-mQ8/O788/invoicing/En/Paid-Invoice/
http://tecneworleans.com/uESey-Ug_MrfbrMs-W9/P526/invoicing/EN_en/Paid-Invoice-Credit-Card-Receipt/
http://thamtuquocte.com.vn/De/MWTDJB6346155/gescanntes-Dokument/Rechnungsanschrift/
http://thelivingstonfamily.net/de_DE/ZHUNEOZCWQ5729993/Rechnungs-docs/DETAILS/
http://therealdrbill.com/GNbg-Tk_ZR-JF/COMET/SIGNS/PAYMENT/NOTIFICATION/01/15/2019/US_us/Invoice-Correct/
http://therxreview.com/MHDT-ctWB8useQaLBgY_Jujiputr-5D5/
http://timestampaholic.iniqua.com/KNoV-6T6Pf_OUJ-Ov/150506/SurveyQuestionsEn_us/Paid-Invoice-Credit-Card-Receipt/
http://trakyatarhana.com.tr/De_de/NNLHOLTLJP2165818/GER/Zahlung/
http://treasure-wall.com/Januar2019/BIZRUQVZO9225456/Rechnungs-Details/Rechnungszahlung/
http://tutoproduction.com/DE_de/ELZVIVALKF2064744/Rechnungs/Rechnungszahlung/
http://ukmc.lt/TcoSf-he9Pp_DpTzC-Ivu/Inv/7785759609/US_us/Paid-Invoices/
http://ulvsunda.net/DE/OFAPVQZXB0990899/Rechnungs-Details/Rechnungsanschrift/
http://universobolao.com.br/HpZjv-4CQ_LXBEP-SmH/8246620/SurveyQuestionsEn_us/Invoice/
http://urbanaturefilmes.com/Hxee-xi7U_JtCz-X2/invoices/95240/15265/US/Invoice-for-i/g-01/16/2019/
http://web.pa-cirebon.go.id/mBAh-LmFuJXk2QFZdFSb_DGboxvqg-JMq/
http://web63.s150.goserver.host/IuYWK-GT_y-jL7/EXT/PaymentStatus/US/Companies-Invoice-1236003/
http://weresolve.ca/gQce-5d_fcmkOlhM-IJw/U970/invoicing/US/Need-to-send-the-attachment/
http://www.1348photo.com/LERESUZ7074814/Dokumente/Hilfestellung/
http://www.3dyazicimarket.com.tr/mJAog-5QA5_bMeo-wDQ/PaymentStatus/En_us/Companies-Invoice-3933304/
http://www.antique-carpets.com/De/LDKQDUHSA3654559/Rech/Zahlungserinnerung/
http://www.avto4x4.ru/DE/HJSEEJTFA1293851/de/Rechnungszahlung/
http://www.balancedmindus.org/FCLvq-kk_ybcgT-yl/En/Service-Report-76163/
http://www.bauburo.ru/uKtbg-qjP_nEtjfC-BGk/En/Service-Report-90017/
http://www.biometricsystems.ru/Januar2019/ZVOHZLAOJO4450541/Rechnungs-Details/DOC-Dokument/
http://www.bomedmobilya.com/UTKPNADYDA3279925/Rechnungs-Details/Hilfestellung/
http://www.buld.ru/yElYL-uCgY_nUfZeq-8d/848018/SurveyQuestionsUS/Important-Please-Read/
http://www.bureaudebiteurenbeheer.nl/De/WVMKOETL6246843/Rechnung/Rechnungsanschrift/
http://www.chervinsky.ru/WSIBMHJNF2141241/Scan/Rechnungsanschrift/
http://www.chriscrail.com/De_de/YPMQBQN2741835/Rechnungs/Rechnungszahlung/
http://www.citygroupkw.net/Januar2019/INFPPXH9980256/gescanntes-Dokument/Zahlungserinnerung/
http://www.clinic-1.gov.ua/DE_de/NDEAVSCIE4629249/Rechnungs-Details/Fakturierung/
http://www.cobec.cl/PVMFESEOGC3686161/DE/Hilfestellung/
http://www.cofrex-eg.com/EJXE-la_CCHl-Sf/Inv/408818461/US_us/Need-to-send-the-attachment/
http://www.cognitiontraining.com/NCwUm-Mc_JxlgmtFSf-FK/INVOICE/US_us/Sales-Invoice/
http://www.condicioner-ufa.ru/DE/AUJSLFXO1452575/Bestellungen/FORM/
http://www.creationmakessense.com/DE/JWZWILOARB4701143/Rechnungs/Zahlungserinnerung/
http://www.crossboexim.com/DE_de/WTVYIL4033832/GER/DOC-Dokument/
http://www.dashkevichseo.ru/NVXi-Xl_MfLXrYRmX-CI/INVOICE/En/Outstanding-Invoices/
http://www.digicamblog.info/Cwyi-Jv_qcMZ-WW/ACH/PaymentInfo/US/Question/
http://www.digivoter.com/UUSS-IG_yiJ-DNc/US_us/Paid-Invoice-Credit-Card-Receipt/
http://www.diplomprogress.ru/De/URZNKT4941271/Bestellungen/Hilfestellung/
http://www.domaingiarenhat.com/De/CWDCGO7645780/Rechnungs-docs/RECHNUNG/
http://www.eclecticelectronics.net/de_DE/VTQJZEKWT6556816/Scan/Zahlungserinnerung/
http://www.estab.org.tr/DE/AZORVICMH7935587/DE/Zahlungserinnerung/
http://www.etsybizthai.com/jdiZz-L86x_mPzcmNAF-TNJ/ACH/PaymentAdvice/US_us/Inv-12441-PO-8C586861/
http://www.euk.lt/DE/STYSLFYQKG0437773/de/DOC/
http://www.fissionmailed.com/ogbpT-G5RN_FSWV-upg/ACH/PaymentInfo/US_us/Need-to-send-the-attachment/
http://www.freedom-financialllc.com/de_DE/HQPFAJKK6489287/Rechnungs/DETAILS/
http://www.ghmhotels.com/PiJvz-AWvO_rIPiWDDvb-9k/PaymentStatus/En_us/Outstanding-Invoices/
http://www.glazastiks.ru/BAMXJ-YK_aGuzKvH-8XR/En_us/Companies-Invoice-7729809/
http://www.gogorise.com/Januar2019/XTXAMOLSPH8193682/DE/Rechnungsanschrift/
http://www.gonulyayincilik.com/AXEpi-T2s1_FYIx-vv/INV/401997FORPO/5187711320/EN_en/Paid-Invoice/
http://www.hjsanders.nl/FuXs-mD_bEJ-tK/InvoiceCodeChanges/En/Companies-Invoice-96944979/
http://www.i-deti.ru/zVkVS-mOO_NGlD-qK/EXT/PaymentStatus/En_us/Overdue-payment/
http://www.ip-tes.com/Dmyh-mMBJE_NVtzfbHtL-7N/455929/SurveyQuestionsUS/Invoice/
http://www.jenfu.net/de_DE/PHPVQLJJ5927086/Rechnungs-Details/Hilfestellung/
http://www.kamprotect.ru/LADYAAXA7639399/Dokumente/Rechnungsanschrift/
http://www.kannurrealtors.com/wp-content/DE/GZHOOIMGP6070497/Rech/Hilfestellung/
http://www.klpervezimas.lt/hnxjO-0rfc4_YID-Neh/COMET/SIGNS/PAYMENT/NOTIFICATION/01/15/2019/En/Question/
http://www.klussen-gids.nl/DE/USZVONP9929126/Scan/Hilfestellung/
http://www.lassmeder-service.com/BYTVPDJGYA8152756/Bestellungen/RECH/
http://www.leg4.ru/sRQAC-4Nj_Jzr-6N/ACH/PaymentInfo/EN_en/New-order/
http://www.life-and-spice.com/UQVVCLISH1323826/Rechnungs-docs/FORM/
http://www.lifestyleassociates.com/De/QCIDKGTTWS3129914/Scan/DOC-Dokument/
http://www.lineageforum.ru/DE_de/YCLOXMQYD3571481/Rechnung/FORM/
http://www.maracuja.ru/lsnB-iD7n_Y-HHd/En/Past-Due-Invoices/
http://www.matreshki.su/DE/FTXZVGR5997107/Rechnung/DOC/
http://www.modelgenesis.com/De/MLAXWYUOMW8123967/de/FORM/
http://www.modern-autoparts.com/Januar2019/MOOOHAI9601427/gescanntes-Dokument/DOC/
http://www.mother-earth.net/SlHp-fmGN_mRr-xC/INV/084073FORPO/57754571425/US/Document-needed/
http://www.myukraina.org.ua/wp-content/uploads/DE/LNOPDEHUYF1272947/DE_de/Rechnungszahlung/
http://www.niman.ru/earD-Ncxsu_AzUmQINO-nSN/ACH/PaymentAdvice/En/Past-Due-Invoices/
http://www.odesagroup.com/de_DE/KQSYUV9675540/Rechnungs/FORM/
http://www.ontamada.ru/Januar2019/KGFJIA2987254/Dokumente/Rechnungsanschrift/
http://www.ori-motivator.ru/zRxM-ysT2_uDDPAfjn-rb/InvoiceCodeChanges/En_us/Companies-Invoice-34834023/
http://www.pcengine.ru/zVpXy-rxw_TcJA-1F/Z913/invoicing/US/Invoice/
http://www.pcokey.ru/dENF-GJa_lELyOD-ope/ACH/PaymentInfo/EN_en/Invoice-4287713/
http://www.picfactory.ro/Januar2019/QOEGQOUT6449129/Rech/FORM/
http://www.pivmag02.ru/PDLQi-9H7za_LGB-oc/Ref/59544797US_us/Need-to-send-the-attachment/
http://www.ploeger.ru/De/UEEBMZZSZL5955043/de/DETAILS/
http://www.pojbez31.ru/De_de/HLZWYP1604214/de/RECHNUNG/
http://www.prirodnadzor-kuban.ru/DE/SZGHGQNJAD5093844/Rechnungs-Details/Hilfestellung/
http://www.productvideohut.com/Januar2019/GJEGGQZ5087232/de/Hilfestellung/
http://www.profconveer.ru/de_DE/YRKRMCETYC7380553/Scan/DOC/
http://www.ptks.gr/DE_de/CCQWLYGQ2403490/Rech/FORM/
http://www.pwpami.pl/myUlP-pr_SxfpDKR-zL/Southwire/QBX924743500/US_us/Paid-Invoices/
http://www.restoran-maligan.com/De/HERLEBSRO9612047/Rechnungs/DETAILS/
http://www.rome-apartments-it.com/JFyM-8G_q-Rg/PaymentStatus/US/Open-Past-Due-Orders/
http://www.rosimpex.net/OQURYVU5178922/Rechnungs/Fakturierung/
http://www.seslibiri.com/ujTD-spb15_yKXq-tc/INVOICE/6943/OVERPAYMENT/En/Invoice-79269863-January/
http://www.shot-life.ru/DE/LGVGPU5328119/Rechnungs-Details/Hilfestellung/
http://www.siapalagi.com/TQar-LN_XxwSDZ-944/INVOICE/En/Invoice-Corrections-for-27/69/
http://www.soloftp.com/HDIFV-71Q_qV-YR/I352/invoicing/US_us/Service-Invoice/
http://www.solusiobatherbal.com/De/LTCYKBNJE5969176/Rechnungs-Details/Rechnungsanschrift/
http://www.somerset.com.ar/wp-content/uploads/rwfHa-qjoL_jiYLYXfo-Pv/INV/3765841FORPO/8505566790/EN_en/Invoice/
http://www.stal48.ru/DE_de/IMFCLKMPFT0728555/Dokumente/Zahlungserinnerung/
http://www.standart-uk.ru/rRNb-SmEXz_c-b0F/40041/SurveyQuestionsUS_us/Scan/
http://www.stasisfx.com/de_DE/NOQPXE8009655/de/Rechnungszahlung/
http://www.studypalette.com/Armt-ULAhI_SEVQ-Xg/INV/0337474FORPO/21645673519/EN_en/Past-Due-Invoice/
http://www.taizer.ru/mVfO-vOZQ_xWzJEbZ-rr/ACH/PaymentAdvice/US/Paid-Invoice-Credit-Card-Receipt/
http://www.tecneworleans.com/uESey-Ug_MrfbrMs-W9/P526/invoicing/EN_en/Paid-Invoice-Credit-Card-Receipt/
http://www.torfsgebroeders.eu/jxvcW-5j7_FfHbDoyE-Zb/INVOICE/En/Document-needed/
http://www.trakyatarhana.com.tr/De_de/NNLHOLTLJP2165818/GER/Zahlung/
http://www.translampung.com/Januar2019/KEBIGTLVY6527523/DE/Zahlung/
http://www.tutoproduction.com/DE_de/ELZVIVALKF2064744/Rechnungs/Rechnungszahlung/
http://www.zasadulin.ru/De_de/LLUYMBGNKZ2723237/de/Rechnungszahlung/
http://www.zigoro.ru/OMJGVMBP9253958/Scan/RECHNUNG/
http://zasadulin.ru/De_de/LLUYMBGNKZ2723237/de/Rechnungszahlung/
http://zentera93.de/QpYt-oOUNAPoyGvAv3M_bqIIVlhN-xTC/
http://zoox.com.br/AoKP-6URi_mQF-WN/INVOICE/En/Outstanding-Invoices/
https://lapsoinmobiliaria.com/mQRFa-LKCJC_sl-tGj/US/753-43-672323-659-753-43-672323-244/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-01-15 21:45:00		(ENG - Orange/White)
SHA256:
2f74b83257ce3c713014a8b0e3d7dac661007237c02350d968bdf0b01299cbfd
3c85d0c92c86fd083232291af98557a3bd811e5454dbd28f6259e935c776f849
e424f136c6214969f0b43512b61557f68885fb2f32e333a722b690149922d8ac
7acd6c28ab69e2266a7dd86ff153f74204f0a76dcaac47f8a6ce26528b931d1f
7a9781aa5b00f1eeffceb26a584573e6a9b0f3a659254d424eb1b6e0c96913f0
7b8a37fe981f65c846a575e64e770bfe3f32a0b19f2bac129501c9442bbba884
3d4986b995e5fe4d1b9d5440ca8a1592cfdd6f5c751e5f09bfd81b8fb3368cf1
c109d3c4e28ff454f699952760d5388253dae0aa648ae4b3eff9bc485d37642f
76da13ee8cee96abc0a956014dc5b95d7d7cb24e43a7c6949116e32816c0f026
26997f953dcfedaff8954a8d45b3712e09e8b8ddcdeffda5c190cab075dc82e7
785881763255cf55e6769eb0dd4024f50ce09b9e6734444cc836f6501b89f6c3
572fceab9490d2455243a170f4eddf89282b71a3b0938ded332256b914d0ef15
e64bb24fd65c491e36b8d85c6491c724b329ad4a3771efe21ccad28411be5abc
24c89e3e8457f265c62b30c1b4674fb036e86f1d2be96f510e6af2bd9dc0d8b2
a0bca1bd2f69df26423b6a82f64030866558d7b6b87c5893d13ae43b55dd84de
e028da98726d90389828d6509bd5b6170957eca4b434d82a729fdb320c5ce858
e315f17dc7c7607f3348b6815d99e1bf24196368caac8469558a0c4efd9fb8d8
17140cc39de7818884c54821add39defb1e8130589430dd637abaf00e27dce7f
f550c8a6436cc551fbb7af96cd828f57d2d0dd9b3b4b44bd656bd3b46d7b39b7
6096c1a77c7be003cbdec427e74c59b4d7670b6f0e766d7651fe5c335155b6dd
fe7d9cabbc9a0e8405420dcaa94fab2f69524b7cf93b04c455c7c2aade461193
be417e4a40e5590aa1173f506c595c6bc528d2e443e855c8bde642dd39ba5ec8
ae69854c877338ccb35bf1d272f0b93f66657e2d722edcda7edcece25cb396d9
fd456a86043c25634f431e85566fa93a360c2a70a8b375582443b2ed567e7d70
5fb50152198395069e3f62f7f8b9d7afccfd710e23596ddc1eebb2bb7b0d596c
92bfb1ddc764f1e3d3dc5ef3208e27c2f8c7f69c28c8a00e762255931fb39769
5c9283eec7b8fd2320671da85cfb56f0f8e66c76ab377d3d75cb7f856dcde1b6
92f82e65cf7687e36dab1b5ba2ac3141d2618d8af114009092af9d044818ea44
acb59cfe52d0fbd5a55e4a109ecf4ffb9abe4826759a1eb85997d1724abfbe55
175c4eed9606f98de1311173b4f87e8dc6294c27b2a9a5fb5efc18c86a0398bb
e527ebcabd8e3cd026fb69b02cd2cd0ff8b480a5cce835eaea120f01db2bd527
c827ba44a0fa545a17580e006f41f02287d33863ac2ddb198d016acd57f77767
adcf907d6469f25eab6da2aa03f3f04dd8b81daec6ac7eaef5996d216469fd5d
208e7277486ca18541ed21593963869516f3c7fce5ae0b8b034ac7adaa9bc33f
364186c825db05a46fd2d1ac54e54d827b5bfadb0998fbb3d7fc81dc0cfef055
2577108d9cd57fe4b2a494a6e19bc9db18c860091e9f54ea22943f9fab7fe6a7
9b20724ee187fd68e94cb02c5ea249c6d4e7780e687492d644efbaa2ed0bb02a
9b2cf8b3a7ab720c2fd938f2a5b631f3b5ce9c9145136f45b38bd4b499cedfd3

http://radintrader.com/NAOvd1X/
http://mypuppysitter.com/WcUDi4YdbH/
http://demos.technoexam.com/ehRw1bmlo/
http://timgiamgia.site/P7p4eo54QB/
http://garopin-r-01.com/aUUf1TKh/

Creation Time	2019-01-15 20:41:00		(ENG - Orange/White)
SHA256:
aed8f06f825c3495ec63de5bb5c6bfcb8cec479dd6cc3634f3e64ed14bf08a40
d6908adb730464ef4c824d248a4c588f131e06d2600cfe690aaba741ffa234e5
8528a84bf4b839044b43d7e7996bc0ca8c4f34c4477e0edc2f4a29f5587acb97
052a5bcfb141b79eb90177f5a1859d6757a4c6575eb503bb2171855083a3d795
271f10e5dcbce05d23509a73a9551ed140c441daa155c1614bf9599cbc41178b
250d95a77e5e76c68b35e3326a1f8310939f818d59baed4b924df043915f44f0
bc92ee07dab6492a264abf58f11fe42284cb9270767df9762270f21cfe19b48a
78f3db2a79c46815c7a1380f0ebdbdb94ae4ff07932a9466b3a881945350ef91

http://ewencegroup.com/ntquuDI1/
http://alovakiil.com/itFA9Spcpk/
http://onesixcraft.ltd/xdbiq1VBR/
http://www.ori35.ru/F5XU7EuPe/
http://ivydental.vn/X8JpGXMSn/

Creation Time	2019-01-15 17:20:00		(ENG - Orange/White)
SHA256:
d97c0f944c0b99eaeb6d63dcc6d98937021e1b74c3b61b37561a9c2d0c98bc79
92e58db5813067368ad4ad997711f1529212456b41f0b599afb6fd24e948d720
8505d4f3a8f93f191d75abbe285dd7e50d5def9293059b1e912e27f57634ce4f
0730c4cd81e879d97b39a70ea31b9543ea4ff5c9c94d06a79483d9855dfe2b7d
abd3942b115eef97d1dca7bbc05022689ee78090b02fb930d202148b9218323c
d1c556cea58eba409760be05fd393a8397dc55c791843069b26e40a4b6495908
af4dc0bbcf2ac053d7a82d1f63f17835e5120a592d2fa55df6d207c22e4b53a7
7d7b9968aa342471b44b6164823b9e8c6434944573a327e7fb74345d04b24cdd
121f3ff8c9e2444d3405daec1ec20c395268e48de94e074ea8ac21169cf890f2
c721c7c94e96cecaeeff2609c066b36f42328151492ac2a280b1a5a2c117d819
fad94058760ba2d7ec6932b7ea362321bfbe199e4c4305afcefa1e6dc7d12efa
d3be1dcfd3bcb34f8664f7ea97e9235122849c32d2e6de811c4bb2bd09d556b7
ff5aaf0eb6cdc67abb4c946edd762435186711b610eeed4713f2cd4962fdfc23
f3adab5a5e44b7476d2dd29a5dbab3345af00d75538d42ed8251224755a6a477
1dc9a9b7ceba8dd5628ebe9d66a9afc64dc83a5d929ad8d690284333cf55872f
0e091b51736de9cabc2cb17996f8c23e45e22158f0551d60ffa40861dfc8ad2f
796ecc8ea9087516f9dabbc4ee94915df690721b98ae8c358c4b9aed47ae1666
567325db84cdbaf5698fdb54b0f61ea97bfdc4a7566ac53ce1f36e9494f8a3d3
1b136448ce249f32b83d5ccbee64e92823b68da34e0c505c5c954cc7c5292d49
e22b5243e3effa0cf86332a9f5946d7c39e9f08ba1f0e4eda5c0976ee2a3f726
2b8c45af81889ce22ffaf3a78d79a307ce3ab4ebeabbd00bc5982d60a89a2c87

http://www.al-bay.com/JbDEG76/
http://starbilisim.net/umEgLOOKUD/
http://www.mosgasclub.ru/sGojJEiH/
http://www.veenhuis.ru/X4h2lgtb6t/
http://www.aseman-co.com/4imBAvzS/

Creation Time	2019-01-15 12:09:00		(ENG - Orange/White)
SHA256:
442f8849750286ca1f0d5387fdeadc97b02d87cf54e063a10953ef6b76c47499
3ceae789c2fcd82f06fc7bb91775852b8cf05e87c2f2abdff740156b684d3667
406157a8abd3b06089c0c3f453eea25b93c5b3589850455be7138403a4af0281
fc03e1f920d4d45b7a8b7151aab189fa6abec650cfdd34687a488414e27fac7d
b1df9ce328eecb4679587233ff7b5ed57bc5dd73b627f6fbad12288107c31f37
9cd9434806bee401ba9be1ecfe483cbfdf183a76923f3b7c5784dad1ae06c600
868e0361f4bda3e45114649e3d115459a8cb83fb54af9b7f32525db67786e009
f18a62f51000138e22450671b684ab8c8580f78a56b285d78d9cb3e491e17978
d2d7103e2f2a02d68ce749ffd85754052ec707e4286ca3e810ceb7911437a89a
a9035096f78dd5ca23dfbdef486af89cc486070fec5bab82cafaac9a44d1a582
3abfde0fc0d50aa7ca761b3d86c4969a653defbbc464cd2dba410edb9c90b2a6
487cca419860cde2556df02ce7cfca4a50ab3c5be67312aaefd9b5cb7574308a
cd4ae834983ff4189d1d0fd22e71a8b81476fe5e380faa14d106c906f34dbbb7
ab37d198e0a1aa5ea37a6a4ebfccf8f6f175f3e97f77261b9a4813a4c7e2c1c4
4ac63e20f525191858f1909dd0f20fc28aafe1b109ae931208cb96c90bd041d5
7de270f806accb0bef00c9ac16b450beed97756597d9d49a2827a317dbd245eb
b0e3b1986a427ae9e34efdae39ef5539c2c36d10edc622c026a8af848dcfff92
eec04217df2f1a3a768c665ec9c381940c4dcfeab22cd03841dc44c44b1cfa0f
0d8a36c8eaa49c9a3752c5275bc8996d63dabfa52622615e2a193929718f0c1e
e7c43da5ea01e4cc7c16c3aa3b7629b772098f6442ee46201d1529f42ceaa383
60175535fd06a2e5e54202679b63036774cf6e63bc02f00d6f4e3ea520ec3bf4
ef26174a6446cd611b444a09ca56e4b941962ce6181831346b75282e8138521f
aa89a59bbf3e7220219afe25dc40fd7201b003ecf7beac22ddb3c62c9cfc1f83
429202d67c94a1d320747c2e4a9219e2333b9c7def123a0f07a7a0b6302ebbd2
edfe911e07b77c94696bc18e2c3082230b4788af8c49555df089e336b5f08a1a
0942cdaf70b272625208480c5d3dce99c2ef592550fd67b7308f6cf12915c742
231e98fbe926616f0fe8d40a5f03c7b95f229b7ea83336815a22b29784c02454
e24f06bcac764fb61a053f6a0cab53609a1b4c66b3d1156f6ac58f3ade53f0da
bb19f4f45fe565ce466b2d6947113dd9a1b83e825bbd8807e7d86c9da8b41af9

http://www.niteshagrico.com/z7ISltpB/
http://www.tenmiengiarenhat.com/bIfcRi8Kc/
http://www.hopeintlschool.org/ebIV1do/
http://www.dnenes.com.mx/Wmv9Lwru/
http://kynangtuhoc.com/h6pTDOH/

Creation Time	2019-01-15 06:22:00		(ENG - Orange/White)
SHA256:
c9a19739818aadf72ee68c36dccfad65e531f0515bd78d98f2be56eafb43e7fc
ab9cdff2238d9efea3ae19b0e7abd38ca15811883b0b26ce02afd35e9775535c
a36a9287fa254c6200b21165590cecca9ce2ca2594776731aca3c234faad2fe3
98eff236b82350abbe27fa0d876e97183068adf22ea28288dee45824b717da5b
c463cdbcab4d343470a26b6a18457ddcdc5289e7f2a168b1dba473d489d43598
c5b08ae5f4184e0500177b3da3d40e6cb2efc474dc89c8858cf2af6d2a3a9dfb
c7599d0b8ea804e8592f7ee6ed37236aeaf2f11ce62cd5692d07af6388f926ce
72e5dfa4a6ebd887ab5aea1743cb00dfadd657327db9bfa5f0c6c23b68f7acaf
41f99e0025a860f90cc8b76b770fefe7b8682bf08f69291ccf3191443e9adc77
1e3ad24d6e2fc6a7a960ec960ea61c0fd485d0f842fac1699e531e8d594de942
299a96af854096c57a55235a1bfc477f9d8ffd72f1d669580eeb82f9fbfe0c6a
1305f82e47d4982e7cf9f1511941417c0e8ebe3e6b1943447e0920e60447031a
7b4f7d3668857e09280ca1311c3c91ad00fb4d84498b4adcea56d5a604e38133
e7496dd2f0cc52c6dcb9b04197dce72a75cbc3b07dbbea6e04558b6941bffc17
d2fc6466f69848a21043833db92130a068621b11710b3afa1c2764e11f5103fe
4abcd798f836f3684fd9b8be3de155785e68d7dcf3f60512116667592c1d69ed
d75d24ab1db32c97edebd6902b54e0da0946a650ed7f502597891d7b20251ce2
64382c252fbeaafa3b56b4205389c5f30066d0ba41d748cf87bf1b59a8997913
ab9a9c384d1380f757a195959c42e856fc093acc3eb0fc7dacd5b8b89697d723
fb64dc194f8137383b0513e77bb27c67d2b758bcc6258291df88c5f946102cb0
e61363683a660437180573d3b64c4932a0e6968d7ba56ec041abc9ac71bbf669
20a880f06ddc1b419e940504fb6cb5a7f3ca8933603995667917d84958799961
32f22b05607450dc635cbbe6929f6c3b37c809ca2ad7d200566ea541a221c4af
74ede20497ab90d4564274ca4cdbbba8f4796db42021461ce9b8be3bf0c8b2cb
edfdfc97f0f54f42524a5963215a93f4607b62c66e89035fd5b4b2aa807eb7c9
0a1b52af0087ef5c93cd2bcf57a68c40aaaeb49ccad789320198aa497446c538
778150a4abbc9a6a95c2fb5e227e67a044e2c5ce5995fea17b9baf74b6a0d410
cf98887783b4bc7a288736f400a5da009ebed7cfcb8b8026c14f8123be6f2da4
f4f086ec38cdf6d0080e77889e344dbc7ebcf7dc62e1014c4b0ba7d3a0d1262e
15f275351998a20d402467849e7fb620264d0a6da589997f588c9b2552efcab8
ffa36f7412bcba7c12a6eeabb7b140dadde1f670125865db452323f324a4e0d5
4982bdff13d138de937a4067c0dfd8a2000b86afda50588e998a62b74233122c
c86954692f9e83792474c1cbc22188f5a8e7bdc4d92542f47f1a992c340c0e80
f22d89f36d0f57f27bc67019f8ce8aef3a7701150a6d3a68b640ac2b8aa33eef
08fe41469f30fda853fd5fa9c059d1573bf382fea20575b1f10311484f1d9458
3ee86f515939e4c4b172793412ade50ed19b46ddec405e706c11944c62a8e1ec
92c4fa02723ab0f3466908a508eb96884c915f7d57e545db720922f7d025bbe7

http://fungryfood.com/KplV5zq4/
http://www.mixturro.com/Vp1BgRVz9V/
http://www.coeurofafrica.com/ZOMYq5itS/
http://kleveremart.com/wrsYMb8r/
http://sakivatansever.com/1e0T7Gvc1/

Creation Time	2019-01-14 22:59:00		(ENG - Light Blue White)
SHA256:
403908765d4f679aea711b8f332b85a41fe2b417ae59631eb26076a0f849a5b9
78e22bea0e1eae24d25c613a048addc6bf04f2f6c10703dae9c2b63bbc017c9b
43d4b8e8c6d2836b4160b62bdc51f39f952075496ee87977178b4b04b4077b26
c57cbc05385003faea236971e9617c3e81d70b6079347e833dd0c3c0f635151f
998197ad51c5859a2caaa5e058f0b6e02ad34039ecdfc013e71cce6e4681e03f
770855aa41de4582fb4c683fdccffabe507108aefa06a4bedc578a02b8a3045a
8f59424f3de635efc2caafd5787ffc63b1ddc2aa5d45ab6949c47ace67b2a7d4
5a2e46067d3710ece2abdb092e7a3e49075ca19d0849e6499fb7953c28a9ec8e
d7e114011982bf58dbd1752874d27895b1716fc1a0a02f8515a3384c9dde7a97
016449ce658b591c81a660cdf3aa38bfff92a5f107ba172c31e127954b36e344
3356b99748cd869b64a8be09de12dc8af1f417acd040e6ca4d80344ad58eb62c
38e53d78bb20c1475bb99e81348df948a7a2a7c54e553f7a07297e53de59ea15
33bc3b2d5e4464eb9a12fcbdd7a4dc0a6e7c02f3e2149325f473e1d59c019022
b5d324893085f52a6b7d750b41d3039462d0e66e2e07f36d7aa07ab53f694790
28cf4ee192bfbf24ef0bc9a8eff889501ddaf08031c4c369035ddeec949e2879
ce9398e95ba8d9f99bfbab5e1a817b44462c49beb863a991123a7b6bfae65630
388fe279f421985cb9e147aaf8231a98c832874952c396a13df08894c3a9714d
8c2bd29b1fc6bb1e3187ba8cf8329847e419fe62b6ed3f2e054991dcade63dda
aa800f12bc65cd7580d5f75a3b19de5333ccba6b81a4d7df58556c7878a4d82a
13b940875b40ce85284e6bd50ebe307a08e074fabfb5045280270f1a109db37e
581e775919ebf602a88369287a40c6b746ebf0a6e4f631c627091527690ab6c3
c7cb43c0854e5691b41f80496be003f9c1741e2921e5ee039645e220190162a2

http://www.dawsonvillepropertymanagement.com/Q1YYA7U/
http://www.rjsen.com/ZQp4CXn07z/
http://wp2.shopcoach.net/HqNiHSbZcx/
http://motorworldwest.com/CLatMZDCz/
http://www.gerasimiordan.com/XvL4wMk0U/



```
#### SHA256s for Epoch 1 Payload EXEs seen on 01/15/19 ####
```

32f425cfbcc7ca76057c6ccc0ea5e0f27a59f7d276213036e72f8b614b360027
ccab5e7a7cf692e97bf081dc779f8f6b3ec2d3cc150c7f63ed66802e1dbe2fb0
3c4df18e8fc2a72547419ed33d0fffa2a15b62e8cd122359f4390762080b6417
ee53c488af14b863e65ab3599f3dc2fc0f05c757979a4c8dc5a0a7184c501902
a2d4ccd13954f43ab541b10f879f0d8b5fcf4fa24fffa1b08444bd2313242a78
0753b4ea09e7c562abacd4d3fbb6ceb8065075fa7e9ac3d53a7d7b9464111d97
6293513b08a4d34e6be79228aec54ac858b5dc6263e92eb8972c454db42cbee3
e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd
84dd5f53bf0d6a29e39786d62b5d97fb9d513bc58ca8fd42caff9307a8bbd9d2
a80b0974d9b0ae7358dec39a3b6caa8c2e4bd0c0280fd1539ec5d2d581d80adf
4cb1c0ce3de256e671b096729ae35b65b5f4ac67fe0ca9bbdc27e84aaf25a4d3
4ff4eea5c9e86839465dc7ba8a0e06c8db04c847e65cae7a015a7e0cc6ae499e
c8f9f18d95c4a59183a05bba7c38b586ceeb456701d15dc535f83bd869188435
b3adf3830653c6bceaa5e797dbd7ea2725881de5097fc2c7703ae511ee96d3b2
ce86415a3b941257107ac663aa2c0aabe82875de3806008db9cd586b49149867
7a22727630e9bb2c2d4b92f2fddc7f7c7446cc3db781debc3bec872e63fdd3f7
350f42856e87c939fbc0a994c5ee8df09e056c449931320e7a2ed633b62e7f2e
f9ad5dc15d26c73b6c1d26be6de8f7b72db28ac0759f515cdd0d2b9ee0391512
f1d74e49e8aaf3421e9da21b46f96948fc11b76e04a578fb6c0794272f4ae387
0353c9149b5f88a330904bb62b32224f04ba58f03d68dd0792757ad775308b55
b92f35f14649f546fefb90b30af2669e386668b11e759229304f471642c62e91
1fb31fd9d68cdf3e7003c8312920f47279c35d5e6a57072274c347abfa72546f
df554526ce5b1c40406c0e2ae5ce0e92c2b80bc46c6dc1ae2f3a6c8b67e22f03
d3775c520dab6ba548f5bd9262a24a76d8c8d87bbec52ef62fee0b173c539a6a
2522495bf58a6e4f01cb5fe37065083df648b0fd3d8c911edbb7f2349c467606
e467a0d11161ed0af27a2d2806d410bff5b619693ff5acf77c5b0c5158eef76c
72e47058660aa3e11c363a1aa3135b1b6de5eb007042f009720636e1d1c4e3da
14d7f3d917d695ca32aef0a87a7fcbf92ea8ac397fc933e354a92095ca321beb
04c3f1590c9e9389582e21d7711379cab42d460433a2918bb888ce941bcfeedd
d865026c3f3f82fbe2ad2e68f36a143ebdfee8d1a924829a4503511b536539ba
b423a36a84e0be94184b595bc947399a3c49be5dc3eb5b3b41563734dbaa7a1c
9673c59fef5ba5dde9081803805f813235c1da389a2c72d2ed1c823dd0908f5a
7da518307963fd1acf140735617e14a046113df1a0181085034e3a0aaffb9d5f
2af1a4553d45e06cf3bea89ec94b8e98ff2d0ab3b4d058c17b4b0a2c68789160
32a25295271b2091b10533f3beb8f9b032ef32668f3081c9f1c44e8e6017f325
566cec738a2f5f103f52657b2d590800adff49707a34c6b5adf0986629d94799
6959458d9a5e319beb5d7b7a55ef5b5eef9bdddb0f490534ec576615a9c158f1
04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037
9f29b0a25f561d88ef445d6443b057888bc0d57f3a19ef634bbb9439d15ed16c

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-01-15 18:14:00		(ENG - Orange/White)
SHA256:
c62f02ac392d005e396bf0bdf4d7eed9c2ce49183d1fe4c694c13cbe7201eaa0
c7a47f70ab25e7230fc67c23c8c6c7c1fb1d48fe82566709b60723fb55b7f8b8
a94114b72f6a0810444bf597d8f9cf02048b395be3255a2cb5370fd0376c16fd
86ce9f043dc105b24bd5f89bbdf867449fe1991b7b16fab3a156444c0a9b0fbe
5586eb3632edd9c5a2976cd1d8266caa3d4279235d8e1381f1d3e3c6bf0ec725
7a78ce7c03365d06f718e2a2b52080d2d996412d6ea16b9f6ccf66e85677a23d
23298fc98b790d4b24444d2edbf0233c16d56b7d9519bcf9f9e320c798292673
fa12e8e59f2152cb3435882d7b039e961fd54789603b0cb47e1d5f5131f4ab3a
21333317d7f05db126188b4ca3be0973f19b3db1dfbe5ae03e6ea858f9b14e54
9e2df12a882dec091626f97192f98f27e565b2ea141d9245f1991edb881b6c45
4a4f4e41bd279f91c55e3656b73065b93cfb48cda18309782731d942ef299f17
d0b5126b634f66c07b00a44ce7c0ea06e342e5354b275ed247aee67836b4b36c
a9dbb143b522baa5ec096605f6a83287a8e83c74a81c86e80b28b6fea72f32d3
b04cc6ff3c8cd2f5cbc1fb7c11a92ab0fd6d2a1e5ce3a3af751b41ab98f2ef40
1abdb7044de2d11edf413a4e3a8b661d4fccabefd7b6e82334b6be08686a59b0
a38828d94c38717c5b6c9c0ab04d792a7770e3737a1a8951259844e0d50990aa
d10be6e5a5cd1b04b0e1faae92ba4e29f6aae6c55877a8ca9c21a52bb24b653e
a9960b744b8f8a9c986d0394fa8c45af582c56dad78476cd88b9ff02ea6dd0a9
449e1c3c24a918b1b1ece85fe541330bc522b91d13b73280bc4774367f7c1895
dadfe9c8cf19b0f55b98147b72ba7e0849bae74e74cf4445830636027819729c
c4e9a55d7216e9cc61f60eb936609b2bdcfa62cea320f9577008ab3c43f126b5
e23f4d9bccca4aeeba5d0fe21ecdbfe35c733e182e93bd5d19a83f50d8d1d364
f9da355e1b1d67d942ca779d8dea13f69aef6d24b53bdc59df1985ddb5006d77
c6bb5b80feae0cb8669f710efb1799e37fc24bcf6fac4c98735f1062cd32cab8
784f5ff294989088c4d13237fb0f14cdcfb3394387250d645e40ec57af05be31
71916eb78ce88fc298f25df2ebd8bdc253af4188e7f38e69d1b419f79102151b
18919d6d26913abe27d00c1e64b701c2ead8cf34855863910389828388ae23d9
c84d790a70c401e4495ba92b136d9eba9245387b71f96c43242d74c30226ecdf
98081b4049e02b007390f7f3d833d1ba526812f966828d0972dfb8e1faeeaf6c

http://www.forma-31.ru/x9w0Q_aJ9eUDi_0/
http://codienlanhnme.vn/wmfuxxu_bf8c_ccJhM/
http://www.viajesdelbosque.com/oJmICLR_SF1qjTc9v/
http://www.kiber-soft.ru/Heq3CDGN_tvvO3Ae1q/
http://www.yogaspaceme.com/QCPdiT_LN2iP6fHd/


Creation Time	2019-01-15 15:39:00		(ENG - Orange/White)
SHA256:
45731bfd7a8aa8a0e042aa513315ba0d9142d4e8f2b07e1b0e2858549d196e41
a8c8e126000bf6c7761b0784528b7ea4f93f3d967fc5e5e8f4644afc2d4fc8fd
3167e21837d0a08b94460340a97c2f26883fb122d6284c2a1645ca8f0d8f5aef
e18ac5345546b11319dde33e33421c03eddfeb44bc0d366114a452b6bc6aad6b
a016a676a1623fe33c04d041ddbffd963a2db3e560442c0e8245455f624b40a5
261e09d049e9361cf9229130dcf41d429f5805a9495bc1dd41203251a46c9122
54a10493652ed3ec5948775d594e34bc5b30412fbc030fe7b663a5f4a6c6ceaa
106cf7ada1f5b7a586d3f26c562afc7c0295548fda86f68c76ec4bdaa1031061
f14055daae4f5a0ebffa07aa7c73d881291e32174b175e919a8c80382e88a5be
02399c48e148b053be872b0b2109ee53ab9aca9f59a030f77de00a8d9fe86239
b0d858c9dc5f9159c61d8ff59f1aa0d974083be435c1a9b420cf5939e14c0cb1
981db5daa08ed93a9edba672c6246fb4559f285e230c84762719532bd0ef2968
b8d7643d4bf9c7feb6cc2508eae6b1947b220064f8877ef53b7bb89f3a6d0639
bf01dd394ce25fa3895ddaf8af2a8730d18b2c788ffc2a111140605d141a0363

http://www.werbetafel.net/vtgcl5_6OcN/
http://www.kiber-soft.ru/Heq3CDGN_tvvO3Ae1q/
http://www.enfoquecom.com.br/GSA_lW1O4/
http://www.cvetochniy-buket.ru/4T8_o2CO12Y_r/
http://www.kolejskilmentari.edu.my/layouts/f9SK5Jy_QfbwM/

Creation Time	2019-01-15 15:08:00		(ENG - Orange/White)
SHA256:
17b5e7612847bb2c36c8997d5f70d560635771e9fd376b74dd866dc317ccbc1d
d1a8020bbc1e0ee0a51f48e4ecdff9e7e3a8630f593c5f43377f7971e41d35d8
dffcb4c8ef14abdd7f10c15831d05d69124c466d9c9c0561e8848fe19769158b

http://www.werbetafel.net/vtgcl5_6OcN/
http://www.kiber-soft.ru/Heq3CDGN_tvvO3Ae1q/
http://www.enfoquecom.com.br/GSA_lW1O4/
http://www.cvetochniy-buket.ru/4T8_o2CO12Y_r/
http://www.kolejskilmentari.edu.my/layouts/f9SK5Jy_QfbwM/

Creation Time	2019-01-15 12:26:00		(ENG - Orange/White)
SHA256:
36850dbe3c26f69a78ed92d9248b12a0d9c4377c9df320aeb0a442cade11dbaa
f29c223ae46ab265ece7b1522518a96833f94b45cdb31683b7a18b2aa5038a33
119545a364e6db2b30cbf99fdf510aad717cb31f4d26d309735640cded017618
84e1ec8bcde10b012eeb74dcdd14529c05a80e948ea3ef26a980d67a7fc24a47
1b193c9e375fde2c7d4e8bfcd09a7d60919bad252946219009b8cfa6a820bfff
5b1c5214098aa9bb07ddc10866b568cbbdaa34460e16a3f9102c2fe141fe2907
129e1c6d214bd17b8f19b27e2135217c78c4158d012b9b0281fed792d7e771c2
bbe22a7fe98ee053c7e56a29a315529302e499efd1f884f72bd53eafce11ff24
5b04cb7af57d190dde60a2a340337509744e54045081484c41ffac3820f200bb
8a82572416da119fc0a3995eb20a2250b1a9c83f6ae490ff3aa437244855f520
7bbcf2576a8308492711259461ea83b43579f2783f650a8cc53e058d767c0963
7bafc608fb484289406a5b2c890dace41e2be0f9f136f58f7281dad55486ef44
5b86f9abc92ce2fb20a23e4b3357e467c16302eef8c175f3d370792ad47488ef
1aa782f15ab8588b726a67018060f02a66223d1859a8b19a12a7f07f5675de7d

http://www.unitepro.mx/PyZTGc_yPRX0x_ik0aFT/
http://www.nkalitin.ru/3ghp_FE5B5_77azu/
http://www.jessie-equitation.fr/H4Nn9_X736_ajROTy/
http://www.lidstroy.ru/adfdl_tnvFDCC/
http://www.kartonaza-hudetz.hr/LERDIp_zNxmr_9A26/

Creation Time	2019-01-15 06:50:00		(ENG - Orange/White)
SHA256:
d75be3c827f21a9964aa08b108abe78417f7e9aa7af84a038dca8e1a1d20a1fb
21518eb93ec9f16b7498564bd3fd9f5d163c8b2feadaddeabc2081f2d4cd64b7
ae2bb270345f6ec29446ca612548eea1f643b3fb7f6dfea2ad86117aabc87322
c6f2e0c69b6f829eeadfd63de936c7c30f475ec45032a08f77c520408b34d819
02e0fa895fde82b75c29ceefa3b75daa3e4eb7d865541b3047ca917b68249ec8
26d6b1ebfb422cbef18284061630e75e29656ea4ed53798fca0afbe587e9c03c
7807066ebf2f7a33fc04885dd65bf1615e767a304b5240967d61c2b125b754f5
2b56f932288efde09cfb8a05e283deeb33ddf5945fef16513b6b3ecd15815c92
5b7f47384299342c27944642462d567e2bceb720c31a4279fdf1d01b9e05d5ee
f0dcb8e9fa3f437ddccddd8459b71ae9e414fc8c636a49ef6a098d9295cfed64
31f48c97afa2b36e53a3f31697e202e950f3168d167ac8d4063d5b58230a17ea
31b37025cc97d3a070ac3eae6d4ec2c7bc93a852ae07d4a12aed1214df7514c3
9c311226fc58b6eb4a7262e68571df40cb232b2cc53e8b32e4ecf15e2a127624
eb3c22b7caa66bc529028bade71f0c0ca7190d8b2fd376579137d626500f7800
3cb6fcfe19e3416a24697cc2a79f90d508866c7c635712340a78e8e6c7f0469e
80ed4cd74cae23fcf10ff03e45a219dad7ec2bddd6d421f6e2aeae4e8ca304b7
d7ee14acee78a642db07f9c09c7232f258845a2140e5b7fc4023847e4c3e9152
4d861e32218ec25148501ab1a41ed06c8608a5107bed3ffa1ba21b99126244a5
c83e2477a2c5ce14657f6161bd92b6ac7af220289a11e8d0fdbe707f4746f383
b7994c7365aeab1624afd52c3eb8a277a4664542b403e3aa1507477bd73e6b3b
528e12a14b74831cea2e11f659f005b2f07e2edaa2bcbac2e12adc24f6b8c6e3
6f0fa4e5a76c740bf8de6390d7d46e7dab0f0b59f24fa4f8e0c4973cb40e823f
35563b393ebc24b2421c0352dacbbbe741d1f4bc7af76a2129d83e9f806ff8ba
e0699e650f67fbc338cbde5c175fa504ca365595e70c91febfd05ebb7199dd3b
a3307c2405768e40c8bc53298b7f36bcde3db8d4f08796dd6c5b4d1f68fc132e
069d145208388a54e9211aced7864cd1a78f0735e8f997c32fdcdfdbf6d837fe
6aaa9001869b8ff7eec87d550c2f5318a73691f284b97de018c723388ac4b3b4

http://kemitraanmakaroni.com/wp-admin/user/gZrNf_Ya89/
http://www.salonbellasa.sk/ASM_i9N5BKZ/
http://istanbulklinik.com/vzsYTia_5W7H/
http://robledodetorio.com/HbS_Gn0bm_1/
http://www.eurolinecars.ru/6KBh_zpKc/

Creation Time	2019-01-14 23:10:00		(ENG - Orange/White)
SHA256:
15026ab099b9eb293bb8a9a5e417fda813c56cba92b02056d322ad4220d6db04
7694cbca5f23fa657735f072c1cbbc087a3b3e8f90f023b3465720a7f9d903bb
31f2fa247154dff65f49f8d67e1cfea51800d08ff0ff37f416891dfa07967872
07d23501a997fe2be3aa8005f55ebc1414d6d7bdcdb20abedbc4ab95a8ee32b0
806c6cbb989f9783d78b47e992ff9ecea883acc76a3bb576dc04eb12d48b754c
51f42cb867be5a30f194b00de73104ea358b661e29151c73c5f20e64ae5f4051
8dd068cd49244a820b24ca7a58b7f1ec9b27a9ab94ab76aaa7869a6bc3db7ff4
78c5eb184bb6b75d4752c15a981899590b2b868e92b5df9bba39411a5320b812
b7a2ceceaddfcedb3ce8ac47087cf264d3115c9dace513585cbb66c18e0af0f3
cac8574acecf7df7fad93aa8c0c519b342ec7a8f52dc82f09707d39d7d603b36
2f67bb818c4988160720df3b06e8c753ae0210529f4d9b7ef1ce90725a036d63
d6fa1ba1e8a3c4eba8cbdcc7d070e2596cce442bd8f3737d5c4a65f5219c09a1
0489a71e9249d7515f26b883fdb7b64ff41e98b73c1908eeeb764cf079d13e6b
c4d754f8c98a03c57f08242cfd7d75c26be9782c659520cb8b25186a02634197
dd6769c2c63989b71cfa0e099b5ccfdccbab37d84531a8902bd7b08dd738732a
e5f5c8a76de14d99db419de92b5bc74e3a65d9c2b22f7e5b5bd7568c67adcc60
b83d932975b348fe17d21697fe2552f8ecaf4c94be78299f20d736727f887f76
794ae642a0a3cb291b6bc43ca1b9b69f69ff9add4befbf913a7c22d262ae2fd7
c494f6b22ab709985d185de9e349ddfe8d9411e5e51aaef3edf7f8b0ae06291b
6883ee85522c09576e85a9df443385cf9bd9ded5794bd0133136ba316e50d980
0f1f2793efb4d8a4bc07bd66cc608d0982e2025affaf0c1c0d67432f1b75a57c
1e7818f7fd879c98a93a934c2ca289f29121371015430dc8921fea589c6a5a81
4280bf2624544e303275ec94ec300eff710ef1ce58f95fe8ee702b63cfe3a331
61c2950fdf075bcdc03c90c8c66932ec05d50a6471924256aafcd5270e9c8919
68539aea0795d265502368da42783aa4df61a5cbb7d84163decc7dc16dbf3e7b
53e52264d5d0e4da081924fd59ff9aa7fc1888a9ae276f22f453eefdfe3c9fd7
22aec89603d396d3566a5f3d5f355f9efc1791ba67f26b85f2aed141aa0c6aaf
49325d71592d97899ebfd9639b3d3cc2e4ba6acc722bb5dfddbd22924452eda8
dc61b424999a87aea86422576c7dbfd9658b9ddbcdc1cab5424eaf3df2d1cb46
2daecb43f8f2c05545b6974ba9e4173b6708fb89141e1cac5ddd60847f46ec7f
decbc82d7c01ca9d07ddff78ac92f1cb461f46db4d170cb8459d159f8e79f100
4a5f793c1e2f5b8d8f040cbdc357b2e06b59a844ea7b5620440697fbfedc10b0
bb0713133afac2d28bf39ab96b3fac5225a8d167f043b21d0ac5716c2462a3fc
600285418c76a3b461a43e84cfde59054dae21f119cddd37cdca85a069b6e320
841622c88881bad69ba65df05aa44c90edbed7dffe9734998ff76d9399786de4
bb5e5db8160a056dfca4c383ed751946dacb53267dec9234be0c1354709fbe9b
d42a8f19235f0281bed1e194034c7e08fb60e0b497c222f9fb3272a790b4a28b
7c026a7ba7e7fa9623bdcb2d3c61493480e62e307c19c8ba99410f5c709ebe1f
19ee948b96af076865e64e4ca70ad97dee5be700a2dcdec84b70c387c740d515
47071c78d7840a1237c9acf13773c986f8a6d88a60d2b21da490cf6e323c4b72

http://www.araucarya.com/2Oc8ggZ_5h26fUU_fPrgc/
http://www.nigellane.net/uM3LyT_PCU9x_07nEz9/
http://www.mir-krovli62.ru/uGqCE_F8jceGFz/
http://www.clubdirectors.tv/zp7mEqv_zaz3h/
http://shantiniketangranthalay.com/eUOLBN_ukCfdG3Ux_q010wOU2/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 01/15/19 ####
```

46caa7981fe209cec319f5e3ea240e3d494fe4489edc66dce8eceb0a4cd340cb
a01fdfba8e0efff6b1252470be99ae38db4689f50372f738c2e53babaf3c1963
f25cc6bc359a6771b7d0d29744aeeb3a60c7d3f19d59e338519e63732a4538bb
0c99f700981182ea8d51eb61b5cabb4e9133679102e3c271fc7ec4fa6d29e5b5
1ac9012ab61aeeb5573237828decbb57b742baeac7e870b9e78be324b1973f52
0e0838d60693a9fe803d104f97b1513781460a3e0eeedc0add12d9cab9d57b89
1ad2e0fe5a5f6622f48af7ef0034f4eb9926bba7c3d3a2d35e6c50e27f6f7c7a
fa38baeea0e3c71a9a51cb822f5c871215487fe7379ce7592ede4915d7d3a295
ca075def2e529a8b5b4864ea09491812a54f3fa3d8f0d838aa24e0c5660e179c
3759184ad0939d60725e52abf38493808986f7ebcf81b8037beceb4a50539602
33906f0abea0b36325a9fae790527fd5317485426c70801600e129795af7f0f9
fd093eb9dad00d0932db5dfcd92d686d649cc26706cd32a75097dfb9d702672f
e982858739cffc10670983818c9ed1bcf7170ff1409304373d010621cea8e3e7
6c2890c61e73feb0227c4d8951b7dcc6b8b0fea0e0c6e9a2bd65019163045cdb
f312b432af5ad61e5d44b12c9cc65372be4a91f459e0ecb28242a4c9e68266c5
07a40319b4eab80ad4bc5ddd1d326b380fbd84cb5695436ad973026f10b2ffcf
6ef905013244e7ac8af70931d4dff5fac28b98558978ef8916f4ecc4dfb8eb0e
7b086adf025db7dc0f09cec1934b94597094be77b8115dd9ed08c58d886ea32b
d4a61c5c3ecad1bb92f2d7b6c8f4e220c527dd1e34d24f471d790293df24a649
5cb4b26afd50801d147f53bb708482bda88b4e194e9b0eab97df36e4b65cbd9a
5daa4002a8aa2a68d8b953eacc3ad29835fd347743c36350f073ad72fb82c7a8
6e72d96d8689f33fa110c3f75b51a03c9f04951b7435c18049f8372f981d7fda
450aa64e81195966925a140cb8950516b4e12cbbfaa72c027eb9829078fa8cc5
a53b47796f3ad49dd0b126d86ec68d4d4c7d37037da1572999a21da1f17c0887
4c35f4b1fdcd8011e51dc6c81ec24920dc257a5ef2a98e282bc75e0cc074c884
3ab78388338a4de158a445d338389abf70268cfee474ba06a64d15ba21b783d6
0d964a43daeda1575da176c5eaeb56c1360e059bba7ac400b8c3804079820cba
80719d43798a4ca942f156a74ebe5bbdc969a5b9e2522d95f31493a6b614d68f
aabd206ea5f0fd70989b09269df40d25644d6b0172c285329beaa5acc162f725
7d5284539dea3386f4918b1345fcaa54362d748de3e330b4d16b364bed7534f6
e587109a9ad3e4d1f6011a968137f1ea09a5455d08530cb29767d7e68480fa27
9ea80fc0f2bc1e32328b48f642c30a04b7f2d8c53a08af0a48167908ea5d7630
8ff1c044ffc6b034e6af2ecf3ed5274298ae329b9b9bf0e9056a909305db4f90
a965d24ca02d61c6696bc0c99ec57061af62cf8be6d8a69365d23526bc75fdf3
6b03b5bdfbd82da8e9a8fa364129a7dcca93eed9ee3e8534361ea7464d70621d
c477fcc258c4b5217b5a7c826366de5e6af9e1c8e90bb912ab6e3665e52e7ab8
09de6c2ed62ccd8612bd14c27cb99f93060c5e3d2d264d48fe176ec68df21263
4a936f552009683b4dcf10284dc01c1a2c576a47c165c07c3eefdd747d891ee4
397bae15519a2cf9e0b8364e1c15db08c1a3adee36c17ebf96bc91c46a61c5ca
c1a8a919dc02df2cd5841166b8d3ece3df11877e239e79184951a6d63bc12898
19b0b0087b81e9c2c6b5c94a7830fcb2674318a32eb7b7f22beac0c21f7afe6e
401b401b4bb88543a160657b8c9f54c85588792ac3ed089743f01a4b2e6730e7

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

105.184.106.99:22
105.184.237.83
115.71.233.127:443
120.63.148.9:443
151.237.16.5:7080
173.255.196.209:8080
178.209.71.63:53
178.209.71.63:8080
178.254.31.162:8080
178.62.37.188:443
178.92.73.34
179.41.14.199:990
187.163.91.104
187.207.58.148:20
190.10.159.242:22
190.17.173.58:443
190.52.161.1
190.6.24.248:50000
190.60.225.114:990
198.74.58.47:443
200.93.90.133
201.111.29.109:20
201.143.82.199:995
201.230.255.100:22
201.235.65.61
201.245.184.16:8090
211.115.111.19:443
217.13.106.160:7080
24.232.79.140
27.109.116.48
45.123.3.54:443
45.167.12.22:8090
5.230.147.179:8080
62.75.191.231:8080
67.205.149.117:443
69.195.223.154:7080
69.198.17.7:8080
75.99.13.124:7080
80.44.121.62
83.222.124.62:8080
86.43.125.152:20
88.249.181.174:20
93.88.93.100:53
95.141.175.240:443
98.142.208.27:443

```
#### Spam/Stealer C2s ####
```

181.167.49.76
187.147.153.225:990
187.163.213.124:443
45.70.90.134:8443
50.116.63.9:7080
69.163.33.82:8080
79.66.242.43:8080

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

105.184.106.99:22
105.184.237.83
115.71.233.127:443
120.63.148.9:443
151.237.16.5:7080
173.255.196.209:8080
178.209.71.63:53
178.209.71.63:8080
178.254.31.162:8080
178.62.37.188:443
178.92.73.34
179.41.14.199:990
187.163.91.104
187.207.58.148:20
190.10.159.242:22
190.17.173.58:443
190.52.161.1
190.6.24.248:50000
190.60.225.114:990
198.74.58.47:443
200.93.90.133
201.111.29.109:20
201.143.82.199:995
201.230.255.100:22
201.235.65.61
201.245.184.16:8090
211.115.111.19:443
217.13.106.160:7080
24.232.79.140
27.109.116.48
45.123.3.54:443
45.167.12.22:8090
5.230.147.179:8080
62.75.191.231:8080
67.205.149.117:443
69.195.223.154:7080
69.198.17.7:8080
75.99.13.124:7080
80.44.121.62
83.222.124.62:8080
86.43.125.152:20
88.249.181.174:20
93.88.93.100:53
95.141.175.240:443
98.142.208.27:443

```
#### Epoch 2 - Spam/Stealer C2s ####
```

187.178.233.96:8443
190.112.228.47:443
216.154.222.52:7080
95.78.115.115:50000

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now.
Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version
of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change
payloads every 3-6 hours now and payload hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100%
sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the
other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the
other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch
as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/Hms7iKyT - @pollo290987
https://pastebin.com/5QuSPQbz - @James_inthe_box
https://pastebin.com/1Cvpai0G - @executemalware

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @JayTHL, @pollo290987, @malware_traffic, @0xtadavie, @devnullnoop, @gorimpthon,
@Racco42
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @JayTHL,
@Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @digitalocean, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal for providing services with at no charge to this cause!

```
#### Daily Log ####
```

This morning started out slow but we managed to get close to yesterday's total. However out of the 470 some that I received, about 100 had no doc attached or links. The template was in French and and seemed to just cut off. This is what it looked like:

--------------
------=_Part_38979_319289697.39795404072975805326
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

=0DSalut,

=0DVotre rapport Facture compl=C3=A8te 7503749 - de gener 15 2019 est joint=
--------------


Joint, indeed. That was the end of the message.

I also noticed that there was some generic banking invoice ruses that were targeting TD Bank that were sent out around the same time. This is the first time I have seen them target TD Bank. At the same time the template was used to spoof WellsFargo in a separate email. These seemed to be coming from E2.

Had a late run of spam and it is still trickling in.

By 2130 it finally stopped.


```
#### Sandbox 01/15/2019 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run at 23:00 https://app.any.run/tasks/0f570694-dc76-4a09-9435-4a78376e204c
```

```
Epoch 2 C2 run at 23:15 https://app.any.run/tasks/d79b3afd-0bc8-4915-8553-500a0a9c8576
```