Emotet Malware IoCs 2019/02/05

## Emotet Malware Document links/IOCs for 02/05/19 as of 02/05/19 23:59 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 02/05/19 ####
```

http://139.199.131.146/MrMIK_JZ-OWJxFYG/dcU/Information/2019-02/
http://184.72.117.84/wordpress/AHJkC_2zwG-LPgiUSq/W4/Messages/02_19/
http://1lorawicz.pl/plan/scripts/piJZF_3Wn4e-IcgUm/Rz/Information/022019/
http://217.107.219.34/lAGay_kS-OymiTSy/nsu/Clients_Messages/02_19/
http://7w.kiev.ua/ptfW_uwwC-pHa/IH/Clients/022019/
http://abconsulting-dz.com/LTAb_4O9H-cXSO/zmM/Payments/022019/
http://acbay.com/OIsGi_KInNm-fOZrWx/S6B/Transactions_details/022019/
http://admins.lt/Kvta_le6y4-IqmHTUeg/3FF/Details/022019/
http://airbnb.shr.re/EefUT_YTo-jhdXIq/ThK/Details/02_19/
http://aisis.co.uk/BZnni_HBNkU-a/AC/Clients_information/2019-02/
http://alexovicsattila.com/pVtWF_PDM-wlLz/vnp/Details/2019-02/
http://alexwacker.com/fWBpp_iV9R-xGgQwT/pC/Payment_details/02_19/
http://allopizzanuit.fr/mpIX_Ve8-SRMkLP/9z/Details/022019/
http://alooshop.ir/UZFN_xGFU-yyDGSDy/l5J/Clients_transactions/022019/
http://alvadonna.info/NDyx_sM-jRNn/rE/Clients/2019-02/
http://amaprogolf.co.za/hBCe_7F1Ja-AKMBi/kuJ/Attachments/02_19/
http://amavents.progtech.co.zm/harqH_87a-M/px/Clients_Messages/02_19/
http://ameen-brothers.com/rMzL_jAs-xHC/8b/Clients_information/022019/
http://am-test.krasnorechie.info/Yweu_Bv-dohxFV/Yp/Messages/022019/
http://angholding.it/qHpLo_nmEq-bYyXWhj/L9/Clients_Messages/2019-02/
http://antikafikirler.com/ZrEDw_EUHik-CWIiDP/py/Documents/02_19/
http://aoamiliciadebravos.com.br/rJIGy_zbk52-Paq/d7O/Clients/2019-02/
http://armourplumbing.com/iNTw_mA-dr/WV/Clients_information/2019-02/
http://arnela.nl/dOxw_buOH-PZ/rs/Payments/02_19/
http://aroa-design.com/OVMG_NCDGe-ubsV/uT/Clients_information/02_19/
http://artesianwater-540.com.ua/jdBd_qGW-HKMeCg/kj/Transaction_details/02_19/
http://artgadgets.it/kCda_72K-sEQvx/xJ/Transactions/02_19/
http://ashrafabdelaziiz.tk/uSzDv_zE-BlV/Fk/Clients/022019/
http://astabud.com.ua/LanL_mUbp-UO/GJT/Clients_transactions/022019/
http://at7b.com/pRnM_Y7-tctAUKow/4xF/Payment_details/022019/
http://aussiebizgroup.com/RMocJ_aF0zd-kYCgJsG/cQj/Payments/02_19/
http://aviduz.com/jxwWO_TqdZ-OqilgiM/Vy/Details/02_19/
http://banja.com.br/uycJ_NTm6-S/vR/Payments/022019/
http://barilsiciliano.it/jAktO_R1SM-AKzfRvG/lg/Documents/02_19/
http://baselicastudiolegale.it/CSBNm_XqfM-ZLXGILt/wu5/Clients/022019/
http://baum.be/wgWp_Nwy-ONYHZ/pJE/Transaction_details/022019/
http://bendershub.com/FbJnK_MAIjE-UTu/mNo/Attachments/022019/
http://berowraflowers.sydney/KWOVl_P6tV-J/JT/Clients_Messages/022019/
http://besef.nu/FfdsF_c3-bgNNFLi/yKF/Documents/022019/
http://bey12.com/THxcF_pe3-W/l8v/Clients_transactions/022019/
http://bezplatnebadania.martinschulz.sldc.pl/LXgS_828N-xNCkIj/DV/Payment_details/02_19/
http://bikinbukubandung.com/lhjSr_z8Kj-jZcQiVVu/4ZB/Payments/02_19/
http://bjzfmft.com/nFVN_UOaic-FYX/ou/Transaction_details/2019-02/
http://bletsko.by/ZMCb_PQsX-NaS/bw/Details/02_19/
http://bobvr.com/suex_XUG-vb/7HI/Clients_Messages/2019-02/
http://braveworks.de/SdDv_mm0-yi/wz/Clients_Messages/022019/
http://buitenhuisfiets.nl/IkMZt_FE6KX-LgxM/cU/Transactions_details/022019/
http://buonbantenmien.com/vACY_YTA-rjWqoCak/QEF/Messages/022019/
http://burodetuin.nl/sxdG_dIRdU-CmNTQwXq/OaC/Attachments/2019-02/
http://buttonmonkey.com/rgYB_lIrs-cxEY/Pjp/Documents/2019-02/
http://buzzplayz.info/WTAAz_uYteS-EKE/1A/Clients_transactions/022019/
http://bynana.nl/fOmof_BJOa-cNOLiN/nIh/Messages/2019-02/
http://candyflossadvisor.com/eArP_jFX-JMXIRXSH/aPc/Information/2019-02/
http://canhogiaresaigon.net/sBUDN_NL1-zCtkG/9R/Payment_details/2019-02/
http://carbotech-tr.com/mFuKF_aV-QCzX/iE/Transactions_details/022019/
http://car-rental-bytes.link/jKbq_cJH-PXSwwKkc/dtd/Payment_details/022019/
http://casinobonusgratis.net/ublwT_boC0x-RSXtBQ/AS/Payments/022019/
http://cattuongled.com.vn/vhXE_Il-SEFVj/xrZ/Clients_Messages/02_19/
http://cdrconsultora.com.ar/iMYQs_f2-QxpDDEPo/JJ/Payment_details/02_19/
http://cedraflon.es/YQiB_sxGBH-FsMDrUtL/F6/Transactions_details/02_19/
http://centerprintexpress.com.br/vayw_ro-qPuo/0B/Details/02_19/
http://cetakstickerlabel.rajaojek.com/gSgY_aNx-h/Oa/Transactions_details/022019/
http://chevroletcantho.vn/tnbe_ie-S/xn/Messages/02_19/
http://chicagofrozenfreight.com/cAZx_LwFs-mIjbCnsg/VQ8/Transaction_details/022019/
http://chrysaliseffect.co.nz/eyqav_cXqW-ZMMNZgf/S9V/Attachments/2019-02/
http://chuyensisll.vn/gjhwk_vzv6-zjfytkzS/AAW/Payments/2019-02/
http://cild.edu.vn/Tifgo_Xa-JW/GI/Payments/2019-02/
http://cityofpossibilities.org/rjje_ih-HFdS/ex9/Documents/022019/
http://clashofclansgems.nl/InGs_DH-yGcaFf/Eb/Messages/2019-02/
http://colbydix.com/PmiF_XsPvH-BVH/LGA/Clients_Messages/02_19/
http://confidentlearners.co.nz/EAKL_bzLb-CzGjmLQ/3Z/Payments/022019/
http://consultingro.com/VYAE_aK-ImKg/toB/Information/022019/
http://contestvotesdirect.weareskytek.com/CZmI_47v-Wmwj/III/Transactions_details/2019-02/
http://corkspeechtherapy.ie/QwDOG_iHzp-xeQ/fFZ/Transaction_details/02_19/
http://curso.ssthno.webdesignssw.cl/ZjCGP_M4Hrd-xiRAQZ/KL0/Transaction_details/2019-02/
http://cybernicity.com/YWbA_oFUb-Bcuv/7xK/Information/02_19/
http://daneshjoocenter.ir/QYGSB_UZ-i/X8/Clients_transactions/022019/
http://darktowergaming.com/zadh_4w-QiOkV/mC/Transactions_details/02_19/
http://dcfloraldecor.lt/jgHV_kLoOx-WnjwFQKlB/DUx/Clients/022019/
http://debesteautoverzekeringenvergelijken.nl/YVbyO_hhYbA-wGs/MxE/Transaction_details/02_19/
http://debestedagdeals.nl/BpvQ_kBb-R/G5Z/Messages/2019-02/
http://debestehypothekenvergelijken.nl/mjbd_oy7-M/8I/Clients_Messages/022019/
http://debestemodedeals.nl/TYtN_5kI-PacXzBHhw/xWW/Payments/022019/
http://debesteusadeals.nl/lZnlQ_ywJJH-zZ/KeZ/Information/2019-02/
http://debestewoonhuisdeals.nl/UEYL_Ur1A-P/UKX/Transaction_details/02_19/
http://decowelder.by/qtWne_X9KS5-mliNGZq/Oor/Documents/022019/
http://decriptomonedas.xyz/rtbfD_ATTv-GEO/ex/Transaction_details/022019/
http://deepindex.com/jAxN_H2Xwx-pfQsyDkb/Vu/Clients_Messages/02_19/
http://demo.lmirai.com/JMou_X1-uRyuy/5K/Clients/022019/
http://dentalradiografias.com/gMRyQ_cEW9-Gbkfsy/u9/Clients_Messages/2019-02/
http://designartin.com/QUKL_kq4-QaOlw/ITt/Details/022019/
http://designbyzee.com.au/MvjF_zNdz-SCOzKDqzp/Hh/Attachments/022019/
http://details-eg.co/cLiGy_QrU-DXQRGiPXT/Oz/Transaction_details/2019-02/
http://diamondcomtwo.com/PyKMy_UD-UMIETpXX/rmJ/Details/02_19/
http://dichvuvesinhquocte.com/MeDV_hP-NRIH/5hd/Payments/2019-02/
http://distinctiveblog.ir/GSfa_uds-Jofbovhjq/tT/Payments/02_19/
http://document.magixcreative.io/NDOc_xGcl7-Yj/4A/Details/2019-02/
http://dolfin.ir/OyaqZ_M7v-LGqv/sY/Transaction_details/2019-02/
http://doordroppers.co.uk/nxSJH_rn-zkDAc/md/Payment_details/02_19/
http://dream-sequence.cc/GmSTZ_W4w3-m/em/Information/2019-02/
http://drezina.hu/YMaFx_16m47-bOzO/RL2/Information/022019/
http://ecolinesrace.ru/KjSR_aLxg-gogrKzUCW/dO5/Transaction_details/02_19/
http://elektro-muckel.de/Turvl_DxQ-MAVuS/NE/Information/022019/
http://engba.bru.ac.th/images/kYod_m0-DyBuTHgp/18/Clients_Messages/022019/
http://e-pr.ir/wbik_T6S3X-bRXqbPxYk/gQi/Messages/02_19/
http://eskmenfocsanak.hu/AHsB_aXKr-YFXqWic/oAT/Attachments/2019-02/
http://everett-white.com/VfXSI_420-xkDA/Wp/Transaction_details/02_19/
http://femconsult.ru/SMxM_MHh8Q-MJPBBWVWT/acX/Documents/2019-02/
http://ferafera.com/fdhX_Lp-TtP/S4I/Transactions_details/2019-02/
http://fergusons.dk/jmOh_fEccl-xnSAj/0T/Clients/022019/
http://fitchburgchamber.com/xeHj_XYrF-ofeY/NY4/Payments/2019-02/
http://fomh.net/rTuh_GSY-ED/eP/Details/022019/
http://frameaccess.com/DqoYU_z4-vFraiSXs/7Ky/Clients_transactions/02_19/
http://freelancephil.co.uk/FeTQ_z1QE3-E/YEs/Information/2019-02/
http://gamarepro.com/qdjP_g699-gIEmpn/qtr/Messages/2019-02/
http://gemasr.com/ZBNl_X4k-HuyV/IXM/Clients_transactions/2019-02/
http://giaim.org/Bacgw_rffE-kBVGtIY/0wQ/Documents/2019-02/
http://giaim.org/Bacgw_rffE-kBVGtIY/0wQ/Documents/2019-02/index.php.suspected/
http://giancarloraso.com/qnXi_6jz-Orm/xCC/Clients_transactions/02_19/
http://goldencommunitycareafh.org/zNIaR_8OM-ZKWeYse/bh/Clients_information/022019/
http://hamsarane.org/bWqcQ_kIrEo-ByIIxOaJS/iX/Payment_details/022019/
http://horse-moskva.ru/iPlU_M7SQ-kEnddrQ/XW/Information/022019/
http://hourofcode.cn/IsdoA_SOqk-VdXfgtYhJ/GM/Attachments/2019-02/
http://igsm.co/hICy_7mqZW-kescUSL/DO/Information/02_19/
http://jianfasp.com/gHkK_m1F-kDEyXtM/W1b/Clients_information/02_19/
http://kadinveyasam.org/YOSO_XSb-ruQI/Qg4/Clients_transactions/2019-02/
http://kiandoors.com/suuWf_35Mwc-iA/NP6/Clients_transactions/022019/
http://kisfino.sedarosa.com/KILsH_pf-mCEOFA/WU/Clients_Messages/022019/
http://kostanay-invest2018.kz/gaaMQ_y4-YzC/XE/Clients_transactions/02_19/
http://kymviet.vn/eoAo_yH-jAQvXPD/gH5/Clients_information/022019/
http://lacledudestin.fr/kwtI_H47m-HjEAIMZ/xxB/Transactions/02_19/
http://lanco-flower.ir/RUnKt_UVx-Nn/Bg/Transactions_details/022019/
http://laprima.se/wp-includes/RRaDs_RXqr-CkKM/55/Details/02_19/
http://loja.newconcept.pub/FfXLo_OIfG1-aLBpea/A62/Transactions/2019-02/
http://lustgirls.nl/CJiT_PI-OzVaqdmx/Ow/Messages/2019-02/
http://mail.slike.com.br/uUzcb_vj-bIT/7u/Messages/022019/
http://marcin-wojtynek.pl/JjUL_jM-VqhEXx/mt/Transactions/022019/
http://martellcampbell.com/wp-content/upgrade/jDFQj_BCk-CR/ly/Documents/2019-02/
http://msgestaopublica.com.br/suyfh_ogx-FhwagJ/Yyh/Transactions_details/022019/
http://myfrigate.ru/WqlX_7z-UbjHuiG/hn/Payment_details/2019-02/
http://myvidio.site/RPuyy_eRuDh-SGrxc/LP/Clients_transactions/02_19/
http://nationalpackagingindustry.com/izHr_id8Rn-jpGY/H1/Messages/2019-02/
http://noithatshop.vn/bllLp_24X0-FW/1i/Clients_information/02_19/
http://nt-kmv.ru/saPuC_kigk-aDoOnOd/SW/Clients_transactions/2019-02/
http://oceangate.parkhomes.vn/AKGX_a1dYE-kfKoWVOw/ZfH/Clients_Messages/2019-02/
http://phaplysaigonland.com/TYhaR_cb-EKyVGA/gF/Clients_transactions/2019-02/
http://pharmacie-joffre-toulon.fr/wHJqq_rz-tOSshvR/qX/Clients/022019/
http://phatgiaovn.net/mLvz_cJexF-uUAmJOEM/A0k/Details/022019/
http://print.abcreative.com/qQOHm_Q2OY-uaLMW/REx/Attachments/02_19/
http://project1.belyaevo-room-nail.ru/VsbL_3ROYT-xhZjV/XlC/Transaction_details/2019-02/
http://prueba.medysalud.com/JavYa_L7O-DFbSHmt/dew/Clients_information/02_19/
http://rapidroofrepair.co.uk/vsYz_wzb-eNqAFeJ/Psh/Information/02_19/
http://remavto66.ru/suar_rh-Aw/kC8/Clients/2019-02/
http://sarbackerwrestlingacademy.com/wp-content/zleV_aT-GcRSQvWNN/DVS/Attachments/2019-02/
http://seksmag.nl/PtOwh_s41-Shv/sDO/Clients_information/022019/
http://smemy.com/kwzu_AV-TQzfEsL/m9/Clients_Messages/022019/
http://studiafoto.kiev.ua/JliIp_Ca-qkyXn/Uyq/Clients_information/022019/
http://sxyige.com/Vmolq_qiP-R/q6/Transactions_details/2019-02/
http://tapchisuckhoecongdong.com/Ejlzw_PI-FYCNrqcb/Rx/Details/2019-02/
http://tasalee.com/aKBio_Ps-nSTiVJkq/33w/Messages/2019-02/
http://thingsofmyinterest.com/wp-content/upgrade/gLJPY_ul-VPsBg/zx/Transaction_details/022019/
http://thptngochoi.edu.vn/ZyrOs_Dr-OBHEQh/uo/Payment_details/022019/
http://tisoft.vn/RmOxK_Fo-FmidOoDq/mK/Transaction_details/02_19/
http://trehoadatoanthan.net/EEGG_Y7Dw-owUL/sh/Transactions/02_19/
http://udicwestlake-udic.com.vn/AIcC_S9g-x/sM/Clients_Messages/02_19/
http://up2m.politanisamarinda.ac.id/wp-content/MIaR_Y9nW-iysbBBHXe/E40/Details/022019/
http://valkarm.ru/scripts_index/qEoD_HmUAD-GHAlmhlU/SQ/Information/02_19/
http://vincewoud.nl/UPjaF_yWN-r/VN/Payments/2019-02/
http://virotex.uz/gTqP_7rv-WVOx/lQM/Payment_details/02_19/
http://wavetattoo.net/WgEAg_RAZKO-lAVH/6o/Payments/2019-02/
http://webcamvriendinnen.nl/uuDp_e1uw-VH/0pG/Transaction_details/022019/
http://wiebe-sanitaer.de/SVPMD_RswvB-riIo/qhc/Payments/02_19/
http://wieczniezywechoinki.pl/GZkNd_RNW-OaCWHpqE/DC/Information/02_19/
http://winkpayment.com.ng/WRqtH_4e-LoAGRD/Uo/Clients_information/02_19/
http://www.arnela.nl/dOxw_buOH-PZ/rs/Payments/02_19/
http://www.carellaugustus.com/MbvKW_bqm-IG/L9Z/Clients_Messages/02_19/
http://www.dkstudy.com/hvnVE_gMH7-BA/GOO/Documents/2019-02/
http://www.forodigitalpyme.es/JLTMJ_UX-oZgCk/REg/Clients_information/2019-02/
http://www.panafspace.com/XpyZ_EI-drgtmr/1Sa/Transactions/2019-02/
http://www.rekonstrukciedso.sk/nYSY_sj-OGtagPTh/FoH/Clients_Messages/02_19/
http://www.seksmag.nl/PtOwh_s41-Shv/sDO/Clients_information/022019/
http://www.traktorski-deli.si/ALTTs_UU-mau/HSB/Documents/2019-02/
http://www.vario-reducer.com/tobJW_WG2PW-IZ/CB/Attachments/022019/
http://www.vob-middengroningen.nl/BfJNr_VI-t/n0M/Clients_Messages/2019-02/
http://www.xn-----7kcbkneb4bbrmjadmiak7alk6i.xn--p1ai/gyBUH_eZu-oiCAospPU/ANP/Transactions/022019/
http://xn-----clcb5aki4ab6afi7g.xn--p1ai/ZRpkJ_83KS-AlHC/jG/Messages/2019-02/
http://xn--sanitrnotdienst-24-ptb.ch/gtMJ_bfXKk-oTnJmVsP/Z5/Transaction_details/022019/
http://xn--zlbhdoihrubehkj3aq0g.gr/SKPx_4oS-QoJlUN/E0r/Clients_transactions/02_19/
http://yogora.com/CNrd_x8QyO-UtIwwWHdv/LR/Attachments/022019/
http://yourmusicscore.melodiaecifras.com.br/DPAu_iO4M-wld/UKd/Clients_information/02_19/
https://ftp.smartcarpool.co.kr/lf_care/user_picture/bntWJ_Hane-Ixoxoj/e3/Clients_transactions/02_19/
https://myfrigate.ru/WqlX_7z-UbjHuiG/hn/Payment_details/2019-02/
https://noithatshop.vn/bllLp_24X0-FW/1i/Clients_information/02_19/
https://tischer.ro/XuFHe_C0Q-WIkbUR/4Q/Details/2019-02/
https://www.dkstudy.com/hvnVE_gMH7-BA/GOO/Documents/2019-02/

```
#### Epoch 2 Document/Downloader links seen for 02/05/19 ####
```

http://10xtask.com/US/file/MgfNk-jKGGg_CCqUQ-lY/
http://2625886-0.web-hosting.es/company/Invoice/8550366/eKaVP-kky_EL-zzu/
http://365ia.cf/ipass/scan/Invoice/fUUF-WrLe_LEW-gWR/
http://4dcorps.com/En_us/document/aEQT-2nG_AhhhKY-Cu/
http://55tupro.com/US/Inv/bqIkl-eY5e_kSbuWOh-ag/
http://6306481-0.alojamiento-web.es/En_us/document/QXjx-BWS_b-vM/
http://72.52.243.16/llc/iyGl-Kfz_utOrWkfg-aOs/
http://9600848340.myjino.ru/info/EZnd-uy_x-k5X/
http://a2neventos2.sigelcorp.com.br/En/download/906432301922406/gpkTQ-tPgTu_fJSGrz-5P/
http://abbateylamantia.it/EN_en/company/Inv/HWRCy-GR_fGxNZOvjv-vJA/
http://accutask.net/Invoice_number/rmhto-Ce_XokdRFVQ-Kxn/
http://actron.com.my/En_us/document/663948092204832/hVJo-l73hQ_ZxAX-Te/
http://ada-media.com/En_us/New_invoice/nCVR-kzz_rTp-ZRD/
http://addittech.nl/document/New_invoice/KbCl-AYuZ_zGgKq-UP/
http://adwitiyagroup.com/wp-admin/meta/US_us/download/ZPETs-DT3e9_TWIUwMSyO-IS/
http://afrodigits.com/En_us/New_invoice/zOGzQ-AB_f-Z8/
http://agenciacoruja.com/xerox/Copy_Invoice/vyWK-yCWya_reA-fbf/
http://agtrade.hu/doc/Copy_Invoice/lpxAZ-NonD_enVSuz-4Sr/
http://aisi2000.com.ua/En_us/New_invoice/GYVS-oG_P-qY/
http://ajosdiegopozo.com/New_invoice/5928154634200/tBWL-d75_WvvX-Nz/
http://aktemuryonetim.com/doc/762748842534/EYgs-cKK_DtAsTVnQY-kRN/
http://alainghazal.com/US_us/Inv/Kwap-1o5_Pz-Ct./
http://alainghazal.com/US_us/Inv/Kwap-1o5_Pz-Ct/
http://algomaispresentes.projetoscantec.com/xerox/New_invoice/AfgrG-hvD_evXT-NTC/
http://allens.youcheckit.ca/perform/JkRW-i6_gbulBU-Myk/
http://allianti.nl/Invoice_Notice/5733559/Xlyd-p8hJP_c-3P/
http://allsortschildcare.co.uk/Invoice/PwHr-0Ka_iB-sFK/
http://aloket.com/En_us/company/Invoice_Notice/Bqqd-rl_nGsJ-Wf/
http://aloravan.com/En_us/document/New_invoice/ABnL-zRQsT_Y-Jc/
http://alpha.elementortemplate.it/US_us/document/72262910428792/IysF-VJXIC_fBlZ-SO/
http://al-visa.anyangislamiccenter.com/corporation/Copy_Invoice/qwTm-L70wY_PCVVB-SrJ/
http://amnsw.com.au/file/Invoice_number/jPLod-sKp_R-I4/
http://anhsangtuthien.com/En/doc/Invoice_Notice/iVYT-t8UNP_Oy-rR/
http://anja.nu/llc/Inv/ehUD-HlD_GQ-4QD/
http://antifurtiivrea.it/En/Invoice/773297821202/elDoz-DuG2H_JxV-pFn/
http://ard-drive.co.uk/EN_en/company/Invoice/FKOh-I7j_DKPwkQnHP-4rQ/
http://arextom.pl/US_us/file/7686116068043/pQnL-44QqS_Ozoz-0bY/
http://askibinyuk.myjino.ru/EN_en/xerox/XlSG-FEJ6_AUFP-Cd/
http://aspireqa.com/EN_en/corporation/Invoice_number/13719056/IxVH-uyj_mmuS-Gyc/
http://atema.cc/En_us/iBrsy-fVk7O_sjRc-X8Q/
http://athemmktg.com/En_us/doc/Inv/oJnt-8qSy_U-SM/
http://attarizandvakili.ir/US_us/llc/Copy_Invoice/TNJL-gg_FBuoFwTSn-tY/
http://aurdent.u0453635.cp.regruhosting.ru/7716053/YWidc-cyM4K_TRlAqe-Zc/
http://austreeservices.prospareparts.com.au/download/qgmW-H5BR_jNNtXo-f0e/
http://autopal.co.za/wp-admin/Invoice/LIxv-pT_qo-y1i/
http://avakin.tk/corporation/Invoice_Notice/XOzf-Qu7A_LMgmpI-IqK/
http://avresume.com/Inv/XEPRb-y2Bk_pDUqx-gcc/
http://azfilmizle1.com/document/Invoice/JSTjk-U84b_gvsrTGmOY-ls/
http://aziendaagricolamazzola.it/US/WnKmL-iHWnz_Z-aL/
http://azs-service.victoria-makeup.kz/En_us/doc/Inv/axiuo-nlO6g_WsQLMDvJ-j2/
http://bachhoatructuyen.com.vn/EN_en/Invoice/yVeRe-SIBW_Ml-ck/
http://baljee.nl/En_us/company/WdFnt-to_WqQAA-1Hy/
http://balloonabovethedesert.com/download/Copy_Invoice/Cfhp-Fmz_jrLxzM-ekB/
http://batdongsanphonoi.vn/En/download/Copy_Invoice/IiYHd-Ajg_DqBmKato-Doj/
http://bbcatania.my-lp.it/info/Invoice_number/hoVl-GvD_iPMvkVqAN-ck/
http://beaskyshanoi.com/En/corporation/New_invoice/2514840610930/DkOF-ZDs_BCHgpBU-6o/
http://beaulieu-iran.ir/US_us/Inv/92529604/agQR-cOkh_ssL-JA/
http://beelievethemes.com/company/30575907/kKCoV-RW_Rbi-ZVU/
http://bellnattura.com.mx/EN_en/New_invoice/GuVKL-4E_zBGxd-N6q/
http://benjaminmay.co.uk/EN_en/info/New_invoice/94686056820378/wrFt-Kf_htuyU-ZVX/
http://benjaminmay.co.uk/EN_en/info/New_invoice/94686056820378/wrFt-Kf_htuyU-ZVX/index.php.suspected/
http://bernardlawgroup.com/scan/New_invoice/ofwh-ZAO_J-XSj/
http://besenschek.de/doc/Copy_Invoice/357251146388/auzjG-Bbyn5_pcZomX-iSs/
http://bezplatnebadania.com.pl/En/doc/Invoice_Notice/708710479746/vScI-jOrE_NDHEfNT-QA/
http://bgbg.us/En_us/llc/oljbq-RRDG_XL-Maj/
http://bijjurien.nl/corporation/dRCT-maKO_xoEbTt-op/
http://bitbonsai.com/US/xerox/uRGc-c3_hopJoBxz-ht/
http://bizinmontana.com/US_us/Copy_Invoice/24391795533556/aZHx-ozGId_QNa-e8/
http://blondenerd.com/download/Invoice_Notice/599910057375/SoYZu-yQV_cYso-mNk/
http://bluetheme.ir/file/Copy_Invoice/42301076/qLbS-rgGF_mcLPXZ-cEZ/
http://bobin-head.com/US_us/gFgnx-0ws8_qtsu-Dm/
http://bobors.se/US_us/company/Copy_Invoice/pieMT-PoRQD_CKmBrZd-DMb/
http://borealisproductions.com/EN_en/xerox/Invoice_number/bbkB-fnU_YBROSm-8bY/
http://bosungtw.co.kr/En/Inv/jIPdq-xpGq_GKrIeH-o1k/
http://bpaper.ir/New_invoice/05313761/jPRN-68Lg_pg-lPI/
http://brightnessglass.com.au/doc/bIbx-0Fgb9_rawi-Nyh/
http://brizboy.com/US/corporation/GnyV-4zV_o-YG/
http://bsps.com.au/EN_en/Inv/eCFET-T7lCu_OlgFklV-KD/
http://burlingtonadvertising.com/Invoice_Notice/SSGDh-BW_IdCzmSmS-05/
http://burstliquids.com.au/US_us/download/Invoice/jVzG-DJ8_K-fHR/
http://butyn.ru/EN_en/llc/Inv/MOJi-NJJ_XmYCF-OBB/
http://buybywe.com/corporation/New_invoice/qLqdU-OB_BahkszfL-WED/
http://calavi.net/US/company/New_invoice/gxKUu-hAP_DIx-Sfk/
http://cam2come.nl/llc/Inv/CPAD-VT_sE-Sf8/
http://camsexlivechat.nl/EN_en/scan/Invoice/slwF-N5_pLIaThLhS-F50/
http://carolechabrand.it/US_us/scan/Copy_Invoice/46958479072852/HDGdS-yX_XfMB-2X6/
http://cassie.magixcreative.io/En/Inv/HBwR-Boe45_ciLLIBQC-eD/
http://catgarm7.beget.tech/US_us/llc/New_invoice/MSGw-w9_TvPJvKRs-NCv/
http://caveaulechapeau.ch/US_us/corporation/Invoice/YPcd-4Xca8_sPqaa-N7/
http://cdsanit.fr/En/info/Inv/934672737272566/VQSD-1ovkQ_YE-4L/
http://chateaufr.co/En/download/Copy_Invoice/FExpI-5g9uz_lJyfrzh-djl/
http://chems-chaos.de/doc/Copy_Invoice/VlLxp-xTja_nchXtQ-qY/
http://chrysaliseffect.confidentlearners.co.nz/US/document/Copy_Invoice/5615384/oDyej-4hpoS_dLfn-j0/
http://cine80.co.kr/wvw/US_us/doc/aVbaL-ZCEfM_cRpA-Iwu/
http://cityandsuburbanwaste.co.uk/Invoice_Notice/cadHB-2wUk_nD-AQ/
http://clinicalosvalles.cl/US_us/ACAp-k5tTR_WqpfMrXdu-JK/
http://clipingpathassociatebd.com/Copy_Invoice/QOyng-Nd3_Fptra-5KN/
http://colocol.vn/wp-content/uploads/EN_en/llc/New_invoice/lzse-cDe_vAkD-qFh/
http://cometa.by/US/scan/Invoice/55433119463/zmvNy-05O_vjgt-SQQ/
http://conservsystems.co.uk/download/Invoice/Arnvu-WZ_FtvTFxO-3fs/
http://construccionesrm.com.ar/doc/pLaDH-D5kPs_hD-gE/
http://constructiontools.online/download/Invoice_number/NxUMe-7BB_qzZJ-Di/
http://convert.gr/EN_en/info/eunjI-Pi3_zER-Wb/
http://cordesafc.com/EN_en/company/VUFU-VIYUH_TcvoV-ex7/
http://cosmoprof.com.gt/US_us/doc/Lrsg-F5K_rbNBsn-jv/
http://creativeworld.in/EN_en/corporation/VxzKA-5I3v_HyzVjpf-zV/
http://cybersama.rajaojek.com/En_us/doc/qqcT-0P_wyDeEls-PZT/
http://cycomhardware.rajaojek.com/xerox/Invoice/RExV-RLN5_VjJjFl-Ld/
http://dadagencyinc.com/En/file/Invoice_number/20175602063/fRuEv-qkjA_sSDqV-Hox/
http://daotaokynang.org/En_us/corporation/AVPLf-TQ8P_Y-DKs/
http://datvangthainguyen.com/EN_en/company/137722188703398/ZrFN-YM_IYZVY-gd/
http://dcmax.com.br/EN_en/xerox/9558962232308/fJoJ-8bTwS_YQ-nf/
http://debestekofferdeals.nl/EN_en/llc/Copy_Invoice/dCfK-HlgT_TbTdz-Gql/
http://debestetassendeals.nl/US_us/scan/New_invoice/AIhUH-Ig_PtaV-SM/
http://debestewoonhuisverzekeringvergelijken.nl/company/Invoice_number/vxGSS-zU_PGhe-xXX/
http://debestezorgverzekeringvergelijken.nl/info/Inv/sxGi-Od_cGSkyxNWP-GCR/
http://delosvacations.com/En/Invoice_Notice/178612284/GJMB-d4_JWg-OzJ/
http://deltaviptemizlik.com/US/company/Invoice/oGQJ-L2rF_NGrm-EVH/
http://demo.pifasoft.cn/En/llc/Inv/348017348119901/nnwHt-6Z_Vka-bX/
http://devicesherpa.com/En_us/581429047995091/LQgjs-Gqxg_i-cC/
http://dierenkliniek-othene.nl/Invoice_number/ywNSo-rO_mdmfsFy-tv/
http://dijitalkalkinma.org/info/943777013765/KIipo-3Wl6_I-Y6d/
http://dijitalthink.com/Invoice_number/ldfF-YC_SlOdtgok-RAn/
http://dimeco.com.mx/file/Invoice_number/SvMHt-263w_kAG-x9/
http://dizinler.site/wp-admin/US_us/Fprp-AjE_ooNzxW-3HF/
http://docs.web-x.com.my/En_us/xerox/Dwpe-uE_fehkgHH-kRI/
http://drszamitogep.hu/New_invoice/tubu-1m7j_jV-THw/
http://eclosion.jp/file/7240082706/RTPQH-c2X_HwNiW-Ds/
http://ediziondigital.com/llc/Copy_Invoice/AlcG-dEO_Guj-NWO/
http://evolvecaribbean.org/corporation/Inv/qoJJ-LCuYU_ffWcCC-J5/
http://expertductcleaning.com/En/QMbjf-IKl3R_VcWRzYUAl-bk/
http://expresstaxiufa.ru/NvgD-uVr_UWnrdQR-8dy/
http://facetickle.com/En_us/Invoice_Notice/rxYDm-IM_apAi-Xps/
http://faratabliq.com/EN_en/doc/Invoice_number/iKBo-T9CDE_kGylpvFjL-LU/
http://farlinger.com/Invoice_Notice/eoso-zYU_qfS-RQp/
http://figuig.net/company/Copy_Invoice/nOqER-LiEun_FqR-tM6/
http://finet.net/US/file/zcRX-pgV_JLUYJdGdH-hFF/
http://flarevm.com/En_us/scan/xCCH-PcQ_WbOQSCA-xH/
http://fondtomafound.org/wvvw/EXuXU-DAvo2_iy-ZP/
http://freediving.jworks.io/wordpress/Invoice_number/298979907420/hkjf-F2_RVwbZPo-7lC/
http://freelancer.rs/xerox/Invoice_number/zvKkP-xoJIk_pUcMR-HJ/
http://frispa.usm.md/wp-content/uploads/EN_en/info/Copy_Invoice/53570607847/SiXHK-tgd_eWVt-Ev/
http://frog.cl/EN_en/download/uDUSK-nz6Yd_qNhS-1S/
http://fullwiz.com.br/company/Invoice/OgdZ-SL5_CJusoEP-gl/
http://further.tv/EN_en/xotK-eo_HSUbH-wG/
http://gamzenindukkani.com/scan/Maueh-dD7D5_TNfNIE-XA/
http://gjsdiscos.org.uk/US_us/file/Inv/BCpn-C55_KlFZSjP-6g/
http://globalvisas.ie/llc/Inv/ihRzf-ml_pGzKqvwmV-E88/
http://guidex.eu/En/document/RXvh-2ie_IbB-XD/
http://hamehpasand.ir/doc/New_invoice/VCsFx-JtSx_CfTmUA-yqJ/
http://hocviensangtaotomoe.edu.vn/US_us/company/Inv/NvNA-qjk_X-OO/
http://holydayandstyle.eu/Invoice_Notice/051919264/DIvXb-Ggs_iPd-w9R/
http://iranfanavar.com/Copy_Invoice/zHkL-zO4_FLnSagoRP-Ke/
http://isoblogs.ir/document/Copy_Invoice/HKSCj-xhwux_DHncDHCV-qwH/
http://itservicesphuket.com/En/info/Invoice_Notice/QoHjv-I1ROC_OIQbRGGx-AD/
http://iventurecard.co.uk/EN_en/download/zwND-vy4_vKzgMpQa-C8/
http://ivigilante.live/En_us/xerox/33438049/ZjMa-PjKE_Z-fa/
http://jsksolutions.co.za/llc/New_invoice/lKPFt-E4d_oxcrPiiwp-y5/
http://khaledlakmes.com/US_us/file/Invoice_number/piIM-aak_saZuCbvrN-ENB/
http://kidsaid.ru/US/Inv/5619021222659/XfDKd-BpO_T-3a/
http://kidsters.ru/Copy_Invoice/Jygm-NPXX_nVwEzaxQ-xZx/
http://kinesiocoach.ae/US/doc/Inv/rYBS-lm_YJrd-2Lk/
http://klassik.com.br/En_us/file/nPJGz-RmY9l_R-Q0G/
http://kmi-sistem.com/info/Invoice_Notice/MnASV-VpMD_PZW-lKr/
http://kolejmontlari.com/scan/Invoice_Notice/McDHi-hGx_bfuga-Osn/
http://kreditorrf.ru/EN_en/xerox/Invoice_number/JjmX-8fc_ftIgnLr-9CK/
http://kshitijinfra.com/company/New_invoice/sDEDw-Fhev_jKwrhkd-1CV/
http://latoyadixonbranding.com/En/BMdyd-BZdW_ISdLczb-H7/
http://lesprivatzenith.com/En/llc/Dbkoz-BeFga_IyNQUIYbu-eut/
http://logowework.com.br/EN_en/llc/Inv/1598179903/oPzmz-nQ0Xt_wVyT-LVK/
http://maatwerkers.nl/US/info/DEtY-3i0SD_Vida-Ho/
http://maria-tours.com/US/document/Invoice_Notice/9356611364/GRZZ-PGm_pteE-vF/
http://maria-tours.com/US/document/Invoice_Notice/9356611364/GRZZ-PGm_pteE-vF/index.php.suspected/
http://mask.studio/US/document/New_invoice/yeJWL-ky_rSPzZRKj-yN/
http://matongcaocap.vn/En_us/Copy_Invoice/gWlX-Jwnp_Mk-R1i/
http://mdrealtor.in/En_us/xerox/Invoice_number/Yxjxp-QGp_rZ-gi/
http://meitu.sobooo.com/US_us/info/IcOr-AI_kPl-1J/
http://mnsdev.net/US_us/download/Inv/Zdet-Xd_WOMbLMsFs-cm/
http://molly.thememove.com/xerox/Copy_Invoice/skRng-RjFu4_tCpuj-YbX/
http://mustafakamal.net/info/Copy_Invoice/pIUr-n7K_foMXjiBf-Pu/
http://newfetterplace.co.uk/doc/3715488811/skiN-Ylo_Hlbsdxo-uov/
http://nrnreklam.com/PCzo-LZZ_DfC-8N/
http://okna-pvh-deshevo.ru/EN_en/Invoice_number/pgWWq-9SMSC_PpDCegcE-St/
http://ontstoppings-team24.be/doc/Invoice_Notice/975671530699/CAXP-MdSS_GanrGqSt-xU1/
http://pandoraooty.com/US/scan/New_invoice/Ikvy-vt_LUTkAM-zH/
http://polsterreinigung-24.at/EN_en/document/Invoice_Notice/nkDc-8zd_iH-utl/
http://portriverhotel.com/US_us/document/Wzvi-nflt_mbWJh-2y/
http://pratiwisky.com/US/Invoice_number/nYYG-thJHB_EzJroY-mrc/
http://prisma.fp.ub.ac.id/wp-content/US_us/info/Copy_Invoice/wZdDW-n2xu_NGxM-z41/
http://profenusa.com/US_us/file/Inv/Kgfyu-u3h7_GGaHPTT-qb/
http://puntosilueta.com/US_us/Invoice_Notice/333861226/fUUaX-hQH_HUuMe-Sb/
http://purphost.com/US_us/corporation/New_invoice/yvqc-Zz1U4_MXgIf-vAg/
http://rakitan.online/EN_en/info/Copy_Invoice/010217015/kKpnH-0QCqL_FrnJ-Wb/
http://redic.co.uk/En_us/llc/Invoice/XBNMo-dm8bp_mI-Kpd/
http://rehau48.ru/En/document/Invoice/WMuzP-7k_N-dsZ/
http://restaurant.thememove.com/info/Invoice_Notice/qiGh-3jRr_QidrZ-D8/
http://rift.mx/US_us/xerox/New_invoice/5562896744/tyibT-uqZ3i_JkKuG-mM/
http://rohrreinigung-wiener-neustadt.at/US/scan/OZdN-VklOQ_g-Cr/
http://royal-granito.com/EN_en/xerox/Invoice/ljzih-mtH_NFZHxtx-DOu/
http://sieure.asia/En_us/company/New_invoice/ermi-ib_BWiCYuP-pg/
http://sscgroupvietnam.com/En/info/cOiH-ABy_RgT-ZvD/
http://staging.fanthefirecreative.com/mobileforming/public/uploads/En_us/Invoice_Notice/15467877164/MUcS-ln4qy_BVR-HM/
http://sugarconcentrates.com/En_us/company/Copy_Invoice/8256871/xlpxb-emIkq_sTKd-QEH/
http://sydneymarketers.com/file/yhrZ-cVKc0_rLPJ-Y6m/
http://symbisystems.com/EN_en/file/fleDU-2i4Eg_wQLhC-cU/
http://temptest123.reveance.nl/company/Invoice_Notice/sELl-USXX3_zCLPeiaF-d9b/
http://testcrowd.nl/2378397861574/OtnW-x16kU_I-C60/
http://toldoslorena.com.ar/US/doc/yvsUH-Th_cIhh-CXD/
http://tour.antaycasinohotel.cl/En/Invoice/98299184205/rpIP-YWmn_BRCea-I6/
http://tourinn.ru/document/5031973/UpoF-Sv_qh-qU/
http://tsn-shato.ru/llc/Invoice_number/jKuYl-K1_W-W6P/
http://update.rehangarbage.com/doc/Invoice_number/sYBo-WLO_PvsdMNLtM-KBd/
http://update-chase.justmoveup.com/US_us/scan/New_invoice/7088155/eNTl-QWizG_rBm-LX/
http://vieclam.f5mobile.vn/En/Inv/HOfl-yB50_BnRs-KD/
http://viralhunt.in/US/New_invoice/5461746497/ZbBG-xeHb_GjL-7v/
http://viticomvietnam.com/company/Inv/HbJUr-Df1yi_MQspP-4t/
http://weresolve.ca/scan/New_invoice/mFZfS-B5RRY_hGc-qj/
http://www.lesprivatzenith.com/EN_en/Invoice_Notice/206427596260567/OJPVt-kfA_XDjL-uWZ/
http://www.mulkiyeisinsanlari.org/Copy_Invoice/Zcno-x4tH_o-aK/
http://www.qeba.win/corporation/Invoice_number/032181221635422/ieINk-eaafG_DoOpeja-WO/
http://www.rijschool-marketing.nl/En_us/scan/Invoice_number/Ibfy-Hk_dJ-YY/
http://xethugomrac.com.vn/download/Invoice/WSez-d3fY_pEJ-udj/
http://xn--80adjbxxcoffm.xn--p1ai/En_us/Invoice_number/exmx-Lbd_bHBBvoAJ-206/
http://zolotoykluch69.ru/company/Copy_Invoice/xWUHe-R8_zojLPTtfX-ZZJ/
https://abbateylamantia.it/EN_en/company/Inv/HWRCy-GR_fGxNZOvjv-vJA/
https://dasco.kz/company/TObn-XZ_EtqyO-Vo/
https://profenusa.com/US_us/file/Inv/Kgfyu-u3h7_GGaHPTT-qb/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-05 21:18:00 (ENG - Zoomed Indigo/White)
SHA256:
2d2ab0e9d76ead0b0075b2b657d9694148270082e979e5e9f9653fd1ad06bcfc
1ea6955552017fafb11399f3165afb22ea03fec3d6a8d621d0adc92574939c6f
12f418655135e9dc58276da02a60a79da006dd12920d4dfb8a2ec27a39737258
2d3387aa9321c8b746260e9b923c7bdf4201bc63fc1b75c17eb5fd36310b9290
eeb56c818bd856cf3fbaec6661226a75f656e0988efac634173b664683b0bb74
e2195d4a2a44c7043c3ab218e01128147361b5b848aa113c558c47d310d38177
2ad266a067ea36f9fb0e5a7f1a45782a8eb81b7ea73b30fb2c8d8ca38b1ec5e6
4f84eabd05a2b971ddc5eda38beb82238a95f0d8bfb22e8c83748532f3456699
d90ae3ef98e3b7182cc449dc481242a4a15bd07f536ffcc93b59cec15a3179af
14006259ec87c0c525948e0f8a25033c7a4c41f931034116852419b9bb36a935
3cc9c1bcf44aa314645dfe156863781956fd37b0aac471123b8866427e5358ad
2985e6b3df1efe64c1c581b53ef4e2d0183dcb6a685f4464b10b79178f36c895
e23bb8eb13c86c546a9749528a653381ed0d1e2d2facc92802c460f0def873f4
de8ed6e4f1cafd5fbe0dc529a0fcddec17ddbc4f61598672d1c304f0bc19fe88
81a55cd6c04ba67da325e78c70fa85b390e967fcaf16394a3661a94eb378aea8
e4d224c235d50df0999db39e875147af9a15d44987b765c0361733a41758f69f
3e55511853b7d5cdee99880a8aeb517b2f49c887b3771348b71ee7c33a409fe9
157a544c2bc4ebce2537a8d66f1dc25f6c8a3915c1fae76f991748f2eade8960
598e60462bc61a1f64990cf2639860e85781b0a56f3d1badf9e85c9e4ca7d669
80d3869f6ea0359e3a9d0b9102e7ff287000449349f2b11ccd215c75ed1f9aca
4c0a652f2abfa9b8ad4ef88903e96d1743c55ecc935e715a9e9778c169fe535a
e04136afbb4c013d217ee19cc96512c381faaf067e40e9e1f297fa3f1393b3d8
b1e05cc9e4784c7cfda338496816486cb35d79624843e0eaf01c78965a2e96a3
8f314b59098bd8cfbf4f6ceda569a6472e38b16c23fe4eca6548b19800424ace
b78e2b2b6f8bd56963644e85251052d443ba51d32eb298df84a29a9acccf91c7
8b41368a8548700d117eed3cbc2ff2ea19bfbb156813f9cb64490c425e273d77
8f5912d7f605b62e96114e8f8c37df85930a8c85087cf54c6afe7e8cecdb71cc
611c8f95358a60d965403583c35fd83a89e138ff94c56017bc51b01be33ea009
02ef9ba79a3664ccc1180177f24660c4dd6742afa69a4dcf88f46110af47120c
d0e9b53fd5fd1a00b19121d3ad7f39d79071a9fa4d24f0980f83a10c46087830
c665af120a4cba4e05e8c7fa16334af92f507a5b68153236e76b9a3b47fe193d
01803dffa47e587fe0d89f98b9ddf4363438df48838a7e4664777147cb3dd9e6
b7fc95a2bc7a30daf68c9809cba01c8617e876c753bd0261beda9f4eaddac0df
0abbc41f1cedc2e9202f66d9121d46f008542cddb90c306d4285f83db662783b
f64a382ff99c23250e86c20edf6ea1052ba983df9cbf13d3905353bc80f1a167
f534dfd35d9a361f68be09b596dd207675b1e93b8f0049201cd8c6047e727a23

http://conhantaolico.com/34hxFYGbRM/
http://dep123.com/kctF66Z4Ns/
http://debestetelecomdeals.nl/fSERpV1oMK/
http://deleukstesexspeeltjes.nl/mDXN5EUS8/
http://www.tubeian.com/TQjVVcg/

Creation Time	2019-02-05 17:19:00 (ENG - Zoomed Indigo/White)
SHA256:
b714c8ad4458f42fa3c5de2b3bb5b39842913a04337c253b3ca46f41428f1aa2
1e7e27b5c0881030fdd0152bdb1bfdfc523122b7f8067690654f4e14d1d73197
fabe6396d0f66857df66a99e1d28cb788d48a6d02014c878fc9edc11806f6cb8
d7c2b0c52f64d2e49ca3f65c9a60155560469101b60d30d8b20810b21158a338
9f3915047ed36dcf60b18281f7d02c402950df2b14461376231cf07363f89173
1ea6b245a123c2f4f46405c5b1bfbd7abd05f1b27807ed5895f10984a35cd0a4
938b3988817839d9fa3268d3ca6dc995ba1fb1535a8fdcdc5f36e833a9bee3be
aeacda11a9f779d621e1a9f65baa846f2ed61ffa5eff8f4f9ab80a8a3139efec
0137074968867ba6a6021d2007682b1653bdc5a2c9227a11940ac54a58fd186c
c780cc92f746fb404fd8849398586384194ad9508e36186728341307c4d9b5a1
d6edf75ad4d7d9dcc43670fe4a16860a25efe44da423e9dea150cfc8857cc25a
32c6451042f5c9211ccb518418217af48d195e2caebd6d592a420445021ff6c8
6ed710ce395754bdd4ff37d4356530147396b0c0f90d90f62ac6d4446727f50d
6e39b734c36a2d9df8783fcbcb19d71cb8707b3569ca0a39e8f3901c92b288ee
633c73a8301bf31c433c17d794c766820d6deff07423fe123f13945ca3f9f2e1
be60689245c7789f95a92a467d9d9fd1e44d8e1a783cc89e324592a600e51676
91a147199eaa1d9d1ac8c3efcd03e08d7448773b0c585588b58909c1732c0e35
c1b123194f78bed573729c7470584288c07919700fc74f0884abb97e1e91ea38
73f777fab6966d2ae2642bc57d2ef9020eb93f3585c952abf1fd37181b38ba36
cb5f6dfeac0562b0fd9a787f3f0db62aa4850c8fd1c546df8c003562e724434a

http://thanhlapdoanhnghiephnh.com/ltUBTjrSCC/
http://mayphatrasua.com/1WHoKoZ8LH/
http://wikki.dreamhosters.com/911ujSteJo/
http://baza-dekora.ru/6ZwZza1/
http://3.dohodtut.ru/EJgf0bU/

Creation Time	2019-02-05 12:06:00 (ENG - Zoomed Indigo/White)
SHA256:
c4471c5aee72af274d0435297a545b2456d7330cfaa59fae186b7fd21d1d35ac
9b9bb9b2f03a3e267a0d5e5783a83fa7cb67559a6232c02aaf9989df6703871d
c6449171b29a631014a8001ce785c45b707fe962b8ccea2c89f99d005447b4a0
2acc440ae5ff8ca3b15e94c47c9f402e013176d26130a301a7ea99fe2f5adc7d
142844df564b5cd64800184b33465387913f0ddab03ff4b86d9fdcaa53608abe
df1f04c271e5f1dcd9a71a56710deb71ebb1c99009ad7190bf5de0c810060948
2b27694fd33e7908b56aaba418c3b01a5bce0a19701ec33aac61d020fa51e8ef
f600a3cc9dee0bf638d2994525450b5b532a5db3494748f65b357c2446cdd96e
a32cdc0afc841615f0b0a32e9b0f6d3c7d4cc81f590db8ac67ae295bdecb57e7
d116ff5c899fc8e7ee7f2b2ed2854c63ffaabd47529a9e9c18d1b5650b60717e
c67ecba78851cc8a39ec8a809bf29072e1be600571ed5e2e029dba7c0aab2396
51dbe11b3f1a1399be0962ec3c80a8bc16f311b42afa589aa43a926b96bb0965
a1ee7311778d706b77ca23d4964e620c33f5a795f6d42be51476a6debb5827c9
fc09808f8f3eba7c785acb5098a9a9e39ca7107f5165e2288450744604d7a3a1
4fda79bbeff18d5db5872b95ade684338f91b4f0e23503dc633621c448abd7b2
5c0b3b5512a686090d692db193341818c00c10295fcfc19e5a4225873adf863c
23ef734de02240d11a2383a595234c59ef3c49e40f4b3b845ebef593be6944e8
8d99186bfbf62eeb11b269d0dd4e1089137ad1a33dc136585e832c243eeb8186
3adcc0255f1bf651c0c060237b2784e33c47e3a4839f6d194f0ee5f35396816e
fe86cbdc327a82e49e4556e66bd85b26627f57e0fbf8c03c1df29b03eb621686
231da1a201d2f2458a49d38586e446e27f9ad090b77e3f9e3555cf9010bc5489
0cd9ee913848f2596690c63d15d03e0eced9c94e4166e0377159017758a2defa
a74f522a017cd1dbacc98cb823e303c04cdd1ae9bf75a26d7d429573524d56b4
ab0a56c57bb81d36a84304ecd21d3983616d94aa39e49075b926958be5a8e2d3
b4ea14b7e1dbe4585ceaccfada0047b02b7bb893f98c684ee49c94df219e256b
1637bd41d48d4a751f779e6586d2068b19ec05baaf0f9484585159aba24064c3
699170c85f76b70cf3c0ab84dd356be61903894ddc80f25de1959a00276bcd84
c9d839e7d59cdc4adefa73a88d0027267c9d1ca5b41e156cc64e5115be7cf8c7

http://mimiabner.com/bqJkeK7/
http://assinospalacehotel.com/a0NHaFNAa/
http://jaspinformatica.com/tlkZbfDBR/
http://ulco.tv/z5GQzVhSqH/
http://billfritzjr.com/uOIIIykS/

Creation Time	2019-02-04 20:20:00 (ENG - Zoomed Indigo/White)
SHA256:
ac0a34d2af305422ad9b289b8a6abf8784c08cea9e65f45fd792e757096f3fe2
264a81f472f541f3ebae87d7a3a52b91e60c831323b116f2394bc4bea8358413
06f0586b8db4edd9be2c11efc822304b3efcdd1f8c981ac0cc3ac77c8c106c65
fb393938798933fa5f116328a6893847a1fdf2ee2a65186a3e3d0d6f9afe10ae
4343048cecaa28ab7f751c14a2027a69689bb20c7482a4691509c4e327f4a6bf
c1daaa453a5439958aa8712621d6427953cd29c3baa7e196da67d37a37491c86
7fdec4ca78da464cb3b712ab2d14f59a2ce863bc40a220e8b6ce6532b063aa18
83db4028ac0820fa973ceaa097cbac455f8d36f0f2467741639aa1ba554512fe
566f829ec8f4a3610c4ecc6ea4e66ebc3210b0f116d3fc419830c7973a5eda70
a4c26bd972947e206f35769c8dba19f04dbf47aea73c6f72c51119882898fae5
1bbf0680caac91f327a6ecc2de07bd7be082d5cf740ccb85a0d1e35ff9c96bb7
c6a1dac07720bc968c66ea1179d536b5bc6254fba6a37085397144ef069f7338
2cda7bacb73fa3c77ac8790d7f8875898af9bef91dc229d9ee938f8a56323ce9
fd5ccda51bc888962774599c166be3a5ffe979f25c1f9d87293da74f45b71f6b
68af9f525e5fee9dd406af7998dc8fff6ae0dbf4c0dbee9a5068c55543429ee1
51bc4c45a2ca6a5c5e2715d1e333c343c03c373e329f6925d74beaf0ecd7c083
d1276370eeec2a24832aa6d1d7d533794c58dd2e2690f28bd8c4ca37fac02ec1
8a85f4b744ce295f7af99445f2ba5e7202a02d89d05f216e540efd169dd5dafe
577fa3c6ec7ced27a49e54767382377bb010ea6a0a3ded9972f20003f456e6b4
e1bc305c777e5ef377a74ea6f0a0ec6ffb3e34e2fb4fc45062cab7fb0d1eb2c5
d129f5ae78e14502820e1f535797d3c545c7aab75f73feccc171e6642fc4b49f
049142ba8271a632e8caadf8e672b9e3535fd831d1864cde3810bebdc18aa7dc
6aebcbe7d5639e7fbb9d971a07f3cf78dd1ea5f6491ff2a1f25a0dd91435fe81
9cbebc574f3710499c8e199131b11a1d7f1071fbe96b2053193d55f184e996d1
756be3fc1a6e535b168adbc789f8ddbae3787cc98c39aba382710bd79beacf49
0c72a78c485ae8acf3456378e068cc301cc81db73c27e2375398cc19de3df9a3
2e76712669301aee0c9ddafde3390f2da76fa277f2c9d4c48fee5e9013f5540f
e0cb9a416eb2610e375f50833ae201ecab65e4a5339a24167a1f8dff6eedd137
a428751d209c0cd15e519f795012f60b367521f747259aabee05f16e59144a8f
46a38598e50942790a6ca7590520c17398d37eade03d7d6b3b6e7cd399584112
034929f2b3969f52227e9649dce7f98625b961f421485d7b67dc68d6449835d6
0b27f5ea2da29755b94186eea09a92d1ed4219e777d121cffdb0e3c8333719dd
e4c2ab241bc850254fb64b0bd852b0ad52675264d64ffa619dfb61997744b604
48d9dbdd5b51dbb131dc272c508d5d660c3177404481e25a0f867249e6d01714
beaac1fe590b3a1e7fbb07142f92f054a66c5bcab9f9a35216a99b926d346144
3ad69e68dae0d8697146b7e274c8417f99d25bb77fccffbb8fae155c81db5f03
c9b1c659afc7c76c2bd04bc6a0a3bf97acfa3ad197f155a42d262e321367a66e
8aada932487959a9cbcdf09733e54d137e19c822701f2d2f252cedc6fd011364
996a040f7bfd786a63dc1fb2e4e66ab88b7cf1ba9c23bd1fcf16f21218e54774
2341088a8d82d321d0dec58fe75838cdb1afc8a773d46e91342c58ff8bd21b64
bf4cfc58ad314637f90a7dcbb4021a96f5b876ad6109dfd4f342593dbb01efc6
3d7f7a9dcb1a8024ff18cf32a2455beb45c9a7f69ed70e499e7490360c10265f
3cde9894427401ee43959b12f88592d1d1dccf9e232ef3c360d4bddbf29dd3df
29614dd8d5c72d7b99184c9ba4f351648d1d403a02b918edbbeec89e2323d97b
c3642197bdc6a5ce0d10fa71152331ce2923c01bccad03f2211e88c50c3e2e95
cd071d3a984fa4aed0655149edb1df5d95b1505f401cf21bd9665aa6c5eec667
6c04488ad135b02d868fa1758b466a46e6f815fe4fd259230e34bfd71acda5f1
3e55318acacb37c7f438dc1b90b7f7a3ce055840a281d7d3b0ec9965b023addb
9454c58d3dc94db662e3613c2137747e229364a7e3b55614d084dcb46d12e30a
2d5bad034a5f08f6ef58eaf2b543fbd88913f1322984704f55c56fe860fb4ff0
bfdad0431cba17b4824bccc65aac1bda67bf413326081b6cbb80835eda18d1c4

http://hoatuoifly.com/x4KlFN7m3X/
http://choobika.com/AzIHTA6I8/
http://debesteuitvaartkostenvergelijken.nl/Cbz03rYf/
http://keylord.com.hk/byFJORP/
http://host1724967.hostland.pro/P1KDmtw/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 02/05/19 ####
```

5f01bf35cfd72c6e7c28a4240b2584ea82cfaf25eca4ce1086b4c7f6c9d39bfa
86f19c059916762909405405629245620caa00426cd5f588ce65031adf17895f
3d08ac9cd968a11b8d59d07cf56a70e0e765c62218c20431463eb6d87be99038
7edfcc22c6f223b9f5f608987ed15d2d6ee94e399bcde2088e38c613864ad183
7cc7db8f0c0777fe8af2e55cbab8e65b7791f7defd994d1372f31aa5e283b38f
50d336af71e434ac5e15c578a0cc0321c5438b47ad5262d04da0d128ca3a710d
644965d971da898492740bcf2c749f803a4ede04eb220c026c2fb62332c81ef0
7a5c9a9a1bfe1708550715a4a884fd5f75ebd282de44b5b58d962e2ea7ef226e
5963cdecba4ebf5381a10ba51295df01a2e4363efad3a86f781286e2113f559a
5cdf14a58222fdbf9b20394e91e0e11f48aeee7446da52155ce3b8f067ea53d1
cf75e210beea6a3053f6161f8df8d08ba544c576d9c4de671cf2241b77665791
dbb4dc13a5d904acf839d2f7ef539fec6637cb7d976212f0aa52c6d75d70593e
e516617922f1112e124fcfb57c5248d0960b8ac23bde8f0e89bc01a480a84d64
c1cd7aa30146738321427445f9cc1836021bd8dc61d43853130be31c253396c5
df50848331312380412757fc8d57a5567c49f79981d3dbb425fc6e96cb72fe01
c4eeddf306530a4f71ea0bd10e8d8f4a27173e8e580f24c628ab22880547b30c
c358111d66a1f74e79ef9250e063a5b563c61d52b4ce561d7204a1b9a6cad020
018a42937e564578e29778f80c9094c5d92519d04fbdfe5bd8cbf23edd59b1d0
e2993aabd02248867318ba554550e738d71abfce71c20bc84612dcb126d81211
2beca4453bd3682b9b1918a3fdeb4fd54cd893024f7eee5dee5a3dbf60a112f4
8b60ab10ad8b3421dd1f0e10168721930fb7831bc711adbb4df9353b7299b4e7
773d057c97db86a5306a39dcaea89fbb826bf4f59cf9e33d8783fb4e16b75892
e1382bec1ada92c4d671fee978a2d2f772ab5444d0c6f94b22f369d611b9482b
33a52c3856cd2944d5f1f3b29cf341d7de2833d2f4cfef462145989adbec35f9
5e06103a82482235d05a368351fbea32ccd435e8c6a34e539f3e352510255f49
4d5a70a2cc7466f127a2fb4774436595d1410bf5cdeccb9efaa05ebb54931c0b
6f16c270ddec43d245b5d45b5cd48c54e8bfe01e54b0b415b8cd7b6d1c785c9d
58f862b2ac7b5dbd78ac09a696f0be3bc9b281fd282e4cfd3ac6bd35a7ca5e1e
c6ce0760430a71c207c43c281fb626a3451628d359c479b64412217c2f1575f6
5f4a0e6beaebd7457b11a3d4d364780adfb37c41e5f3c5bcbb96de15a670e6e7
c49e9ecc19a77cdb16697faf96363f1006d9f0c7cc3cafc897b4fa029e14dbac
c39d06ca864231ba73fa4a460dfffa47b76fe4fc33ab2b4d2fd6c6ec40f36048
8e97b82698ed8e361a93107023279ae4ae3bda236126506551a233bb2c556ab3
b9c3e02ffe79517c63ea4cf72aa575fc5d228bbcde73bb71b559e68b6c639e37
b5ba8e000952bcd4c2b0ec0506e4d77abe13e9729f30e4005f842eae47003ae5
de5cdd53113ffdd0b5864a51329e5bb8f4b7f2343c851540b1c00d48e85e1959
0e7684f9bdba13815e37b26e8f84089390fbadd90d5f31b43c84a833c65dedc5
ee336755a22c0bb4a25a54b9c61546f73c9f2a9ea5cd3333db76df78258bb6b9

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-05 21:06:00	(ENG - Zoomed Indigo/White)
SHA256:
0935fcf67e175bee0dcacdcefd79e11fef9fa10c57d86d66c4926db09f76ea8c
da84a09501afc8ec9ac188ce76cf96ba8bfba3cbb2009d45b2112a955565be41
5d7cbd551a19a90037178f812ea91aaa2ab12a0f11206c95370ea0f3177dddbf
1a740d8d4a9d05cba539c8a0332507db76cdc91cb9fb8421496301e8cb418c34
b1b32249508512e83533105fb2bdbb2e7f4c55288a1ff0c045417a6761295184
d47aa2a2bb8787dd6ca241d5328d1dfb0642187b4f12c83c416cfa0a6bc3a538
266da6aeaa68e4552d0ada92075c106fb12feb0c3c775b24b4eaa2055be2dbb6
911ede8cdc7c1359107e97b535bfa1fbfa3a23c4e320e2ca5e82f19b6a7ee981
04e4aaa9250ccdff004b0f5f44faaf6461c6bb6e35cde394ef797f48d27cf5fa
ffeb18dea86de1a445b54681c47ea3eb08b9eddcc1989d808202f8497a518435
131785037035a5f67e721623a77378e92664e51c5b587b492b30c31c04bb2a89
9465ffc9ab048a1da8a4e28d06d0cfbc206f1063b85ae1aca6855a08b5cf9beb
e47b52622cee32242b7cb0ba73f2e6945527208eab888607f87c16627cdaabf1
141cf249c587ef27abc645fca581d40e992226dc4f448da5d0a995b8080d5ef3
eb1e57bdbd9ccb30a4758d95749b88bea9ab4460da7649d947e1ed761dad2f87
60963cae8372f5e5bb2316c7dc8b2e45faf1421e6951f8be04a1f7f1357291af
70bd496aae815468e2354b6ee66fe606626f5072f42e05651059f60028dc978f
207b41a5fbd49849f9f422b2227e32914acce3fd7cfdf243eb6acea23468c399
20c4b74d691e7216888545d3393eca6661998c455b340fcb3a89d045ff2193a4
de4896c8f98a9541773dd85d65df6463d811cddfd597d10e2ffb6b9e467bb87b
df6ce82149a3735023a6d8191f3455fac5af81703623be6136d1ceb89f93d91d
c896ccfa49c88045f45726362e12d0a8ae4ebe467c8a29a693390baaabc96e45
6038c03c5a2f937de49b0e78c86dd25cc0c2b9677c8b824fa0a71d66b700b881
08d3af547ffd6450a226906d145a7d2ebefb6980bdba0e1485c7d606225ed852

http://doostankhodro.com/fK6qaMppa/
http://dev.worldsofttech.com/TGToBTgXMgJxTL/
http://disticaretpro.tinmedya.com/acmethemes/ifWwmIYow9hVD/
http://debestevakantiedeals.nl/smVjfzShY/
http://tcaircargo.com/fb_personalize/S8cVB2O0FQJxa_IYFMQ5lE/


Creation Time	2019-02-05 17:26:00
SHA256:
dd1a0e90d5325ab61aa89aa2ac9c3feede1528e85e992f948e29f79432870995
ff692bd89f3c7abd82ec69e961279fdbee61eb27dc38e051aba4a954b2c4b7ed
e9faeceefafb32b8007846ee30f22099f0f36d5fbc7acdce317e7e908b03fb9d
855024670ca8894112fb52817619db212d446289be702e51067be47eba78e180
2a9aa05cab46bea2ed58bf2245aea67e2fbed3387420ba721832ed14cf0b24b2
bdf4b90264c6ff900a6f804366b18cde44c1d1c2e8804041ca521e8aa0ced8fa
a8a722c778588daddd98bd78d80d51d202edececf861e3f870d2ebdc390d4420
a85f8012806bfd30394033f35ab8a90ac7b7f7bb849ff980e3071b3d0776d5a3
87f437287c0f836aa59060e5358cc96dae07a7d686a1445331b9758e8aba8ae0
6f8f5e692ebb1adb807d803ab61b7b1fa8c7a007b08b987fda45114ff8ab7418
c15aa70ecc20003575642f2e5035ed3d20dfaa1f342358fae6ccedaf6fb19d00
0ef8d94003057cbf14c7bb940deafa7e6b03eb7d63d8a9f4532d6b410915d19c
93bc7898b4b0f4f898d862233fe93e43e0cb9863f98ec80fe4717041c69f6669
b653a24ef4f03cad2f7a39ec72b1951ca54245b175264b441d76a770eb67be42
66e5a01798f5801f4f334dac6071a45e92c2b68a13c1b0f472c4d67445feefb3
1ab4f94b67e41213ec4f6eb830cd31eaf1107f19d8555b5ae3bdf46587f72f5d
7e48b47dcf3ab0727fb2e373e1b72f5e048a8eae619aa5a4e60450044d4adae3
20c66cc5ac140824db813d19fcad52fa10b05aa17d5a635ff83a11ff3f10cb66
de0006c4dbe0eb02335963613ce90d9ca0ddbb3644af041cde6f5bdddef46d1f
e115c52732e35db6dbd6685fb7ffda4811b226e355a0ab4d3347b01f8bb981ac
dff9a62bf98f34d8cea8c5414e4c5f76466df7aac3114d6c620d0ce9d7124d45

http://maheshlunchhomeratnagiri.com/H6NW1MVHjhy1lhTXP/
http://jornalirece.com.br/JvPlToR8s4jFukCW1/
http://ortotomsk.ru/O1v4nfV216KwNX/
http://acm.kbtu.kz/p1bgBMnqGoNkh/
http://acenationalevent.ft.unand.ac.id/KSArVphFPBTi17xl/

Creation Time	2019-02-05 15:03:00
SHA25:
ce156b7c2aa6d96ec7210c15222d8ac24ceee6e030adfba9cb5f82e72c174540
ca14b800a89b39db35c3f72113e2877d988591993f6a85d8c4a6632405c4fbc3
f6bc67058a7b073fee11d917d0aa3f49754f9b3610a92d1b21108e687ed029a9
459d36d11e00f48dc9e9307e0b864aac16fec980f14e637ad83932fec3105b34
0921d6a580c598b75a6cd23e8ff5a2085119f554a3fddfc5d7a65aa18a4208ee
50382f362cec475def8dd5f4f93b5dc34b8ae41d05d615b77e817a38333f60ce
46b32f9f738df444e699a46ecf8c31e895cccb972523d2e90561b0a8220d2b26
3829de47a3163d60e4eb946255640002c85a90181eda54d970fdb01bec1d5236
27798a2ce37dffd3c7cecf7056010b3be3dfd0174b4a630ccc71d38670f337ee
474bf861a612ce7566af1010fd6e7965bb45fe33064d88814d7892a38adf0a49
85de57e345c3fc329c6c5ba6c6d8f3f895db269361e9501f3dd5c90e7e02e6cf
96230bfaf02fad44de0a2b2861b8076637592013ca2755f882a8e5b4f6a88011
5f7baf556a32ede483471fa9e4334fdda7d996fd7555089e33addd7987e7f1e3

http://alphastarktest.com/m5kvxnU3gljN/
http://nairianthemes.com/xaS3TLPVBURpB/
http://puertascuesta.com/nN5xhDQABfx/
http://spb0969.ru/JGXqQwLErqw/
http://somamradiator.com/DwyBr05HfEJ/

Creation Time	2019-02-05 12:39:00
SHA256:
2f4b9244630aa363eea4a617f227ad3358cb699e13feb11977c3ad4cfae46204
dc74f0f4bc52f96f59387b2951bdc3fd1a23c60078275bec80ec47f6bfcdee10
8841f226dd4c167a603fb928d92fab79ec38e5e1c3fa43b215a7c3331dbe5a96
04c0728abfab49dca780c1165d7c99912dcc2c1284a43a67abef9114bfc9accd
c078e33702587bfb07f9cdb2cdb603c7486f14f79cea4d229a198682d287c94c
f1f69bd4e9e9af66d59dcc54d01794ab68b494ed61b25548168ea7a30b28d384
056df11a523c76928305e4f778ba3bb45937aef5f70e4d480fa6e157a55269c4
e3e12763fc4e211fc1f50ba29a27189f365f79b3696533e73f58e1c8ea44f74b
17126e4a1bcf3fe084bd079aa416bd8d9b4d09c4cbda488e60fa21a7462f7623
77ae62fe8eea41cfd33a6b211ff1eada6c23ff37313a6712c6ea9917487780e9
0143a4839a0193274ac5f60d421bd536210093f7ae7ec6a26531d93dfef1ed12
39320fa990c0f894d9bc984429f4ce79c87c381b4c996fd25eea8dbb7fdf3a7b
27abba1b5af11014f83b7f507dc58df97bc4c270e04eee1168a2a485f17b6ba9

http://mipec-city-view.com/q0Y2VCo4S8_8cQR8/
http://badkamer-sanitair.nl/OFwzfFgQr7yKGYd/
http://shlifovka.by/Iw2Rqxw58ji/
http://nightonline.ru/images/D1aSg48AcN/
http://bestservis161.ru/wp-snapshots/XDFTbeO6ID9N_BNKk/

Creation Time	2019-02-04 22:59:00 (ENG - Zoomed Indigo/White)
SHA256:
e8e7df3ab22e1d35b08087d4e6cbb5954c232af7a1f2a4421f1897e1962a1533
d3b5017a69865a689b147bc77a1470f9b6f1559c213b6975fcaa6cfd01c54367
bd5d634b27215cd63189c033a3f48d7305b57d3173679f717d798af4bba4bcdc
e070d8949989d91fbbfd01af408de80c5cb8ab2c5460b978b7f412ab33fed1d3
560aa0f7f559a91223221cea91813d035e130bc0cec1257a40233767d13cfc52
c7419b55c82da03c01787082e1984544d0a64a0777065ae78cf5c54e1531af4b
ad73ee063f6019b2740918eba9ce5bdc52bcb3c622e5bc4f06bdc02dd9a1aa60
80e360339566ba0010d1c72364cf3692311a35258a98e10dba11ea9cd5f3f48b
373786fcc9563cb8727210e48488f11ab4fab81cc571f29434546809cb663216
b557c7e1d652e663ee95c73e58c7101fedcbed6cf64b933465ba93fe9aad1d4e
b4675add70597b59df397b6593c9e20cc85830b17ef330c74e7a7f23e399ca24
8e3e4a594f4dacf16227560d89573f658141dca45258d026e17fb2fedc9e2739
a3f482c3e455a3692b92ff8d495b198181b6a2a33f6f87a540b25043733dc712
ee27fc90d767b5d1b588e8fdc29d33f47c6342f5f3a4df31e98687ee26f613bb
f8e53f66b8dbf7cba0ef7515bf2f484f8e6c5180d9f89e410e89542a72237985
e9870bd8b785b148937d6134829dd3ac36b820a35817a87b6563834e5b4c5ca7
2299ccc632fbe498ed306680fa7326a9f0a1107f28af162ed1a2392a3a657d24
c96e098e941bcc741bdeaec9fb24eefcd4eec5e6bb321fcbcd5578b7f561cb95
1c02164001fbcdf5d639502dda9b34c5fa26166f94e8214811756c7b4936a625
9c6b880aca2aaf8bb86bf91f789010293a3d7b9a3c4c7b43c8920b223fae1d8f
7cb15f1a04d72b3d096caa708f995cd55de6a6a962a1a0d9815cf546d536bb5e
4c344a99101f839faed14966f2c7a6a529be9fff781aefbe6f7255f39417800e
48243ef9448365a816adebcf3ad50cf9f1b39fb2c61e7901189d4bd78f3303ba
27bc67eb95980779f9b535153ce753499b967d041c91d6042a9449b14d481765
a2425891bb49cbf2aefb78902de3013631f977c27f2f6514d333e27d79669fdc
e956bb8cf1ec69f9260d6b10be5a675544e74f4f8645559dfc32c2cfd617e563
9f327758879c8075075c3f880227479e069d93c4c68d3e1fc89306123d3fc316
d56497920d3084b577f88d2bb2a85b22b25305f4daccfdbd35d4db6df76df8a8
977ef9e1d49d57ea568cafbda36ed6179f42682a1f6cc8d5d32e72591f98694f
430971edbccb2723b9bd47e9dbc1a96e78dd7ed2ddeb093753d6256453395394
753f4c76d82e9adc78dfd3efa61e24fa80cf518e8d6762dc2fbb0a0ae18f1cea
26aadbdf2d22b706956ae09878961de487a28165dc982a075a431f644e3f19c8
bcc6cc5bb459d3ad027df948e059cc816e142d7fc5c3529dea4435ab22ebf0e8
e35dc234eb4c16eef2e950b81836de66f40f3b623a574ecd9e2e7364b589e212
47fc1ca8c16f981878e8232703120686c3acc5f7777f0cb49b4b81fb3920226a
4be024438ea4d5adb52262dbc1785329fa833b4c59336a48776a5e6847a3da3f
04c0721b2e4588cfcbbe8d27ddf479ed3c3eeb537335a96a259711fa927a7278
61c150d934ed88e1f57fa2781e364a048b0f961a49e86324d63a3c56fd74bcce
bf3df7f1285db00dc06ebc445ca8a6082743c52d90128e0baa62303e93de53bf
c79a5a3ec642749d957c8c7d441804e1f76c1b6ea423b9b5f2883563a6bf8ea4
663016be2ea8c9ec5163fb62cfdf54efd3f32f8316bff934013bc18bb5963f62
3a27dd6eb0ed7c67186415affb43249b4f48ef8f5ee638cfd42b555155ef8ee3
d2166966a26e1cbc3822994ab53818b6f3d03a96034558bf5c14b74668156909
893e44bea682c835a4300544355ac3447d852cad0d340613cbf12ffa2d70f5f9
0288beaa74e308699834e2a021f34acfca233514ee8632bfad67f6df01e2d045
74d4e0ac2e426cffae5b17518f096c095b1ab77a9842407e4aabcc3362d1676d
fed25e795987f62d3e62863546009b7050c665812ff7944c5e176dc4d6c8b314
77c052c6bc4c77539ee04f95e02783da63d10cd2b1251a6040aad52c0c39dc3f
9f2765fa07e16837e175c99cef74602fff7440ca6e50583c5b5cc5621e1f3f7c
bac7158999450add9fcc0cb158615509e1d32fd1d2769f97cce5d0b7fcec93af
a83c2794ed4d87f21ba9f28afdd7e64b8fe6ea9f57cb44ace084fecb5ed445fc
185f910f143cfda2916872428073ad2a9932eecaa991239bdd8099d438caeb4f

http://abcsunbeam.com/HSWuy4MbbeUZGgs_Am9agZ95/
http://doski.by/Dm117lRykpFP/
http://analisiclinichecatania.it/XE5htUzKMsxodV/
http://4kwoz.pl/33BRr6OxxXHUbS/
http://debesteenergiedeals.nl/dDnEcmaVNBSsu/


```
#### SHA256s for Epoch 2 Payload EXEs seen on 02/05/19 ####
```

a287063a8003de15abb565614bdacf9caa629d160cfe5ec7ca1964f0c68ee0cf
0b7a4816aae619aa5c0e04a93505f2b1b6d354308ccaf8b4c53a5b03fadf0ebc
7ecb275d7bdda39c719d5b721749c4ec6d96669bf3d977914fa4f108e530ae07
1eb4fc2a04de65d1fb77e0ea61c60e1779aea6aebaea1d463823c1ff554b63be
8f5bb5166e4c4240a09dbd239141ead162d276a7ffd82c8d839b77bca90a259d
a1d3d7b70a8044e19e3fffd88ec285ff04809875f5a2a9fa747b38035cfe9e73
a30036417442f55ad323778b4f42196043cc3398acac26b4d0575a8a3f74b442
d946d8a92dfb16ee7b81af3dbc9555ddebf6fa718ea5e4550a7882b959a3aec4
32af9592767d5c76f87bfde4474659234bd883d368abc65d45f25ddb9d815e08
a569c3d9a76df64d10fa3a64bd3cd295d23a9dda6fc9ea31443f71c82c28f120
47ee868aecfccf24d5008d9bbd046d1a66c6a52a228a7ce55cd0766fe622dfaf
c5189767824dd189bf18d18de2681d7898810ec8da166be37d0fec62eee954e1
46264c55a018db1a58839edc6dea26093c825084df11f555cf79ff6e18e0e524
1d82468a72fa8b17e2b20f0766c507b1b5ca5522ffb350d4af149359830df5a9
b7bac9d82a9c15707d23d37798c8957f47bf1d05ef5e92800795d7ecf6ee89e1
d6cbdafc1b42169f01874d24a4e626d515ab876f0107ae731659c74db44f599b
e9be074dcb19c1421e9370db8dee82a0290ba7495ce18a4ba26743a0e3c4045e
0151854c4ccd1ed49a5a9701b21c7b3c878528b2f046a51dcb55e2aafda1d8ae
f7270c450f6fc019c5111c1a539c71a91408e52cef9745ed4bce7688e2feb30c
d0b3317ebe1711f6fa1b5a95b753e80208af2d98d940c12db006a135119968e7
82bf7043addac1ecaa6592ef6c9e74f6dc999fb16a1a2b34848c32ab29258148
570c145d39b6d074bf36c80c1f3da01fec0df4da1af3f030295c39470703c038
a63812715fa308febcdcb43068f00a808f2f38f5847e338312419309cb1655ae
5575a0157d07d441be2d832d7134ea3b6a9d803b03b595bf7f81844cb7261076
cc94a24bc6333dc777c1956d0976c4bf1da2ecec5473df4ff1de297761a3a524
14c7f306b1ab64ec69592a55d929a3c2ebdfec39786bff068bebd785884a1722
b35857276b802ea70b18f9f4cd474be0b0453dce45f4f3f7e701661bb06dd973
11b28767fcfaf712c6a03d19d89d762f41551b5b76d41d6ab3304d82960d888b
8a3d45287a20af267d64a0f4571a4301790f9411688a44eaca398abf10b1ae94
3b113249a97b7136177996bf27a310e7a6439ecc122e1054d3e996154413e959
409bda60dd3dbefcd5d916f39fc23bbc194ac441f1a474cb41874e953f5b94aa
e507cc96e5117f024c40b4b8c06bd670f3386591fe628d9cc7fffc67bd7be61d
e1ddf0f1ae608d04ca9ffc25d611bb084bf2aee3422241c30b8ef438adb84a5c
21c98ec242d970726ba611f17c1510d604341fe944aa18f94ebaedc2c9fc99e8
a12e6a57bafb85c0d8eeb15d71697b09be4a0222ed897fc05b573d57a2593ac2


```
#### Epoch 1 C2s ####
```

103.8.112.222:8443
103.9.226.57:20
109.104.79.48:8080
133.242.208.183:8080
138.68.139.199:443
144.76.117.247:8080
158.255.189.202:8090
159.65.76.245:443
165.227.213.173:8080
174.84.250.37:443
179.62.226.22:21
181.164.188.27:8080
185.86.148.222:8080
186.176.26.59:8080
187.131.137.216:50000
187.137.46.18:20
187.153.108.92:20
187.167.66.31:990
187.178.89.60:443
187.207.105.37:465
187.243.193.143:20
189.205.249.209:20
189.249.2.181:995
190.171.206.194:443
190.188.114.60:993
190.34.215.74:21
190.55.118.192:80
192.155.90.90:7080
192.163.199.254:8080
200.105.111.130:22
200.110.85.138:20
200.110.85.138:990
201.184.41.232:443
210.2.86.72:8080
219.94.254.93:8080
23.254.203.51:8080
47.44.193.210:8080
5.9.128.163:8080
51.77.109.38:50000
64.32.70.194:20
65.34.46.157:80
66.76.135.158:22
66.91.156.90:53
68.188.125.106:8443
69.163.33.82:8080
71.174.233.71:20
71.83.83.190:20
72.181.91.254:21
72.203.200.234:995
72.47.248.48:8080
75.139.212.94:990
78.186.71.119:8443
78.187.255.242:8090
79.98.31.206:443
92.48.118.27:8080


```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
187.162.64.241
189.210.118.95:443

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

107.15.91.221:8080
108.189.196.29:22
108.189.196.29:443
108.189.196.29:7080
115.71.233.127:443
133.242.164.31:7080
140.186.244.9:993
153.121.36.202:7080
173.255.196.209:8080
173.90.152.220:80
174.55.243.128:21
178.254.31.162:8080
178.62.37.188:443
181.119.30.35:80
189.166.121.19:993
189.236.80.172:20
190.47.64.245:465
192.186.96.124:8080
198.74.58.47:443
208.78.100.202:8080
209.169.223.42:22
211.115.111.19:443
216.119.181.170:995
217.13.106.160:7080
24.146.44.8:8080
24.189.222.181:995
24.232.118.175:80
24.47.179.42:8090
45.123.3.54:443
45.50.177.164:22
45.63.17.206:8080
47.145.149.235:80
47.50.17.78:8090
5.230.147.179:8080
50.122.201.159:8080
50.31.0.160:8080
51.75.168.89:443
62.75.187.192:8080
62.75.191.231:8080
66.115.89.239:7080
66.115.89.239:995
66.57.47.2:443
67.205.149.117:443
67.238.131.194:8080
67.80.241.206:50000
68.171.118.218:443
69.195.223.154:7080
69.198.17.7:8080
70.118.9.166:8080
70.168.116.204:22
71.175.108.209:8080
71.78.24.146:80
72.132.106.183:443
72.132.106.183:80
73.185.67.141:8080
74.196.254.48:53
75.99.13.124:7080
76.73.184.103:80
83.222.124.62:8080
88.249.85.118:50000
94.76.200.114:8080
96.56.206.155:50000
96.64.59.185:20
98.142.208.27:443



```
#### Epoch 2 - Spam/Stealer C2s ####
```

189.210.118.95:443
198.58.114.91:4143
201.171.48.28:443

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB
```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 01/29/2019)It has been awhile since I refreshed this section so I wanted to update it and bring it up to date.

I have been tracking Epoch 1 and Epoch 2 since May of 2018. Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for
communications. Epoch 2 is currently the larger of the two botnets and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing
version of Emotet at one point in May/June of 2018. Now Epoch 1 seems to be the smaller of the two since this time period. Despite having unique unshared
C2 infrastructures, these two botnets have been seen to move bots from one to the other and show similar behavoirs seemingly controlled by a single
entity/group. Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an Epoch 2
document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those being delivered
in maldocs on Epoch 2 at any time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and Epoch 2 may
have a document hosted on host.tld/B.
- The RSA keys will change every month or so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours to stay ahead
of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from is to find the payload and then check the C2s/RSA Key.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://pastebin.com/qAyfNFV5 - @pollo290987
https://otx.alienvault.com/pulse/5c59e6affe052d0cb54d99cd/ - @SecSome


```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial
@shotgunner101, @HerbieZimmerman, @Outkast_TI



C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial,
@OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic,
@abuse_ch/urlhaus.abuse.ch and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

This was the lowest malspam day I have had in awhile. Only 9 managed to come in by the end of the day. I hear the other organizations were getting the normal amount or more.
Looks like other people may have gotten my malspaam or Emotet finally gave up on me... ya right.

Other than this lots of the same templates being used.(Verizon Billing/ Wire Transfer). Some of them pretend to be responding to a thread but they have odd things like AW: subject
in an English speaking country when that is for German Re or FW. So they are not very good. A lot of people reported attachment spam today but
the URL counts were high.

E1 changed C2s today and E2's C2s are still the same.

Not much else to report.

Till Tomorrow.

```
#### Sandbox 02/05/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-02-06 at 05:00 UTC https://cape.contextis.com/analysis/35220/

```

```

Epoch 2 C2 run on 2019-02-06 at 05:00 UTC https://cape.contextis.com/analysis/35221/

```