Emotet Malware IoCs 2019/02/13

## Emotet Malware Document links/IOCs for 02/13/19 as of 02/13/19 23:59 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 02/13/19 ####
```

http://104.155.134.95/verif.myacc.docs.net/
http://104.155.65.6/Telekom/Rechnung/01_19/
http://104.155.65.6/wp-admin/Telekom/Rechnung/01_19/
http://104.198.73.104/secure.myacc.send.com/
http://104.211.226.28/secure.myacc.send.net/
http://104.223.40.40/trust.myaccount.send.net/
http://104.248.66.24/secure.accounts.resourses.biz/
http://108.61.214.253/trust.accs.docs.com/
http://114.34.129.103/trust.accs.docs.net/
http://128.199.172.4/sec.myaccount.send.biz/
http://13.112.69.225/wp-content/verif.myaccount.resourses.net/
http://13.233.183.227/verif.accounts.docs.net/
http://13.233.183.227/verif.myaccount.resourses.com/
http://13.233.31.203/trust.accs.resourses.net/
http://130.211.205.139/verif.accounts.resourses.biz/
http://132.145.153.89/trust.accs.send.net/
http://132.145.153.89/verif.accs.resourses.com/
http://138.197.72.9/secure.accounts.resourses.com/
http://139.59.6.216/secure.myacc.resourses.com/
http://140.227.27.252/wp-content/verif.accs.docs.com/
http://159.65.146.232/secure.myacc.send.net/
http://159.65.83.246/Telekom/Rechnung/012019/
http://159.65.83.246/Telekom/Transaktion/012019/
http://159.89.107.36/secure.myaccount.resourses.biz/
http://159.89.153.180/trust.myaccount.send.com/
http://167.99.10.129/Telekom/Rechnungen/012019/
http://178.128.54.239/sec.accs.docs.com/
http://178.128.54.239/secure.accs.resourses.net/
http://178.236.210.22/secure.myaccount.docs.biz/
http://178.62.102.110/secure.myacc.resourses.net/
http://178.62.213.188/Telekom/Rechnungen/012019/
http://178.62.233.192/Telekom/RechnungOnline/012019/
http://18.217.211.183/wordpress/trust.accs.send.biz/
http://18.218.56.72/wp-content/secure.myacc.send.net/
http://18.222.169.76/trust.accs.docs.com/
http://18.222.169.76/verif.myaccount.send.com/
http://18.223.125.61/trust.accounts.docs.com/
http://188.131.164.117/secure.accounts.send.com/
http://188.192.104.226/wordpress/secure.myacc.send.biz/
http://192.241.145.236/verif.accounts.docs.net/
http://198.101.246.240/vk_wp/wp-includes/trust.accs.docs.biz/
http://1lorawicz.pl/plan/Telekom/Rechnungen/012019/
http://204.48.21.209/secure.myacc.resourses.com/
http://204.93.160.43/Telekom/RechnungOnline/012019/
http://207.148.31.160/sec.myaccount.docs.biz/
http://211.238.147.196/@eaDir/secure.myacc.resourses.net/
http://211.238.147.196/@eaDir/verif.accs.docs.net/
http://23.235.202.43/secure.myacc.resourses.com/
http://23.235.202.43/verif.myacc.docs.com/
http://2647403-1.web-hosting.es/Telekom/Rechnung/012019/
http://3.92.174.100/sec.myacc.send.com/
http://3.dohodtut.ru/trust.accounts.docs.net/
http://34.208.141.93/Telekom/RechnungOnline/012019/
http://34.242.190.144/secure.accs.docs.com/
http://35.184.197.183/Telekom/Rechnung/012019/
http://35.184.197.183/Telekom/Transaktion/01_19/
http://35.196.135.186/wordpress/Telekom/RechnungOnline/012019/
http://35.196.135.186/wordpress/Telekom/Transaktion/012019/
http://35.200.161.87/Telekom/Rechnung/01_19/
http://35.202.250.4/sec.myacc.send.com/
http://35.247.37.148/Telekom/Transaktion/012019/
http://37.139.27.218/secure.myaccount.send.net/
http://51.77.192.138/sec.myaccount.resourses.com/
http://51.77.192.138/verif.myaccount.resourses.biz/
http://52.15.227.66/Telekom/RechnungOnline/012019/
http://52.15.227.66/Telekom/Transaktion/01_19/
http://52.202.101.89/verif.myaccount.docs.com/
http://52.211.179.190/Telekom/RechnungOnline/012019/
http://52.52.3.72/wp-content/uploads/sec.accs.send.net/
http://52.63.119.3/verif.accounts.send.net/
http://52.89.55.218/wp-content/Telekom/Rechnungen/012019/
http://54.153.245.124/verif.myacc.resourses.com/
http://54.167.192.134/trust.myacc.docs.biz/
http://54.175.140.118/secure.myacc.docs.net/
http://54.202.85.204/trust.accounts.docs.net/
http://54.202.85.204/trust.accs.docs.net/
http://54.224.240.34/Telekom/Rechnung/012019/
http://54.234.174.153/sec.accs.resourses.biz/
http://54.38.35.144/verif.accounts.docs.net/
http://55kotel.ru/sec.myaccount.send.com/
http://62.141.55.98/wp/sec.accounts.send.biz/
http://63.34.12.228/secure.myaccount.docs.biz/
http://67.209.114.215/Telekom/RechnungOnline/012019/
http://78.207.210.11/@eaDir/secure.accounts.send.biz/
http://81.56.198.200/Telekom/Transaktion/01_19/
http://85.115.23.247/wp-content/uploads/secure.myaccount.docs.net/
http://85.115.23.247/wp-content/uploads/verif.accs.send.biz/
http://91.89.196.92/wordpress/verif.myaccount.resourses.net/
http://accounts.elementlabs.xyz/sec.myaccount.resourses.net/
http://actu-switch.fr/Telekom/Transaktion/01_19/
http://adam-ch.com/trust.myaccount.docs.biz/
http://adbord.com/css/verif.accs.send.com/
http://aded.co.in/Telekom/Transaktion/012019/
http://adepan.frameweb.ro/Telekom/RechnungOnline/012019/
http://admrent.com/secure.accounts.send.biz/
http://aemo-mecanique-usinage.fr/sec.accounts.resourses.net/
http://afroozshimi.com/verif.accounts.resourses.com/
http://afshari.yazdvip.ir/sec.myacc.resourses.biz/
http://agilife.pl/sec.myaccount.send.net/
http://allaboutpoolsnbuilder.com/Telekom/Rechnung/01_19/
http://amiraskari.info/verif.myacc.docs.biz/
http://anambrabrothers.org/secure.accs.resourses.com/
http://antarestur.com.br/Telekom/Transaktion/01_19/
http://apee296.co.ke/Telekom/RechnungOnline/01_19/
http://apotheek-vollenhove.nl/Telekom/Rechnungen/012019/
http://app.websoham.com/verif.myacc.docs.com/
http://arepeleste.com.br/verif.accs.send.net/
http://arkyreyma.com/secure.myacc.send.net/
http://aterrosanitarioouroverde.com.br/Telekom/Rechnungen/012019/
http://atribud.cv.ua/secure.myaccount.docs.biz/
http://awcq60100.com/sec.accounts.resourses.net/
http://banquetshop.hu/secure.accounts.docs.biz/
http://bartosz.work/secure.myaccount.docs.biz/
http://batdongsanphonoi.vn/secure.myacc.docs.biz/
http://baza-dekora.ru/Telekom/Rechnung/012019/
http://bestcook.hu/trust.myacc.send.net/
http://bestcook.hu/trust.myacc.sendnet/
http://bkkbubblebar.com/trust.accounts.send.net/
http://blogg.postvaxel.se/verif.accs.docs.net/
http://bonex.it/trust.accs.send.biz/
http://bramjpluss.com/trust.myacc.docs.biz/
http://bs-testsitethree.co.uk/trust.accounts.send.net/
http://bvxk.vatphamtamlinh.net/secure.accs.send.net/
http://cafe.tgeeks.co.tz/verif.accs.docs.biz/
http://calaokepbungalow.com/Telekom/Rechnungen/012019/
http://caree.in/sec.myaccount.resourses.net/
http://carolechabrand.it/Telekom/Transaktion/012019/
http://casfetaudsm.org/verif.myaccount.docs.biz/
http://cbd-planet.ch/sec.myacc.send.com/
http://certificadoenergeticourgente.es/verif.accs.send.com/
http://cityofpossibilities.org/sec.myacc.docs.biz/
http://cngda.tw/secure.myacc.docs.biz/
http://collagenspray1.com/Telekom/Rechnungen/012019/
http://cortijo-los-almendros.supportedholidaysantequera.co.uk/trust.accs.docs.net/
http://dailyxetaihcm.com/sec.myaccount.docs.biz/
http://daisychepkemoi.co.ke/verif.accounts.resourses.com/
http://demo.liuzhixiong.top/trust.accounts.send.net/
http://dentistmomma.com/sec.accounts.resourses.com/
http://dermosaglik.com.tr/trust.myacc.docs.biz/
http://destinazione.poker/verif.myacc.docs.com/
http://detsad-kr.ru/sec.myaccount.send.com/
http://dev.realtordesigns.ca/Telekom/RechnungOnline/01_19/
http://dharmapravah.in/trust.myacc.docs.biz/
http://difalabarghoo.ir/Telekom/Transaktion/012019/
http://distro.attaqwapreneur.com/sec.accs.docs.com/
http://dixe.online/secure.accounts.resourses.biz/
http://dkstudy.com/US_us/Telekom/Transaktion/012019/
http://dlipovskiy.tmweb.ru/Telekom/Rechnungen/01_19/
http://doctorbondarenko.com.ua/verif.myacc.send.biz/
http://dverliga.ru/trust.accounts.docs.com/
http://dztech.ind.br/wp-content/uploads/sec.accs.send.com/
http://ec2-13-112-69-225.ap-northeast-1.compute.amazonaws.com/wp-content/verif.myaccount.resourses.net/
http://ejder.com.tr/verif.accounts.send.com/
http://elaragones.mx/sec.accounts.resourses.com/
http://elshipping.com.br/sec.accounts.resourses.net/
http://email.rocricambi.com/c/eJxVjUELgjAYhn-NHsecc-lhBwkrCKQCoeu2b0PTqW0Tq1-f0Cl4Lw8PPC9wIqFgEHe8asjZHO9NeVvZ0s6h02G92LpeK9qf6uSqR_byhoFIHz1-Nh-aZxHFYgzCaY_UZOOW72SWwA4YzkRaUJ3kVBVSSSw1YDBGxgNvQ5ijtIzIYRvBFNEckQQRXGzstVqcRvYtlEJbdlqc_8U3GTtegrBo34rBauf_3795-EDA/
http://embrava.eu/trust.accs.resourses.com/
http://emploired.com/trust.myacc.resourses.biz/
http://emrecengiz.com.tr/secure.accounts.docs.biz/
http://eosago99.com/trust.myaccount.send.biz/
http://ercanendustri.com/Telekom/Transaktion/012019/
http://esgaming.com.br/wp-content/secure.accounts.docs.net/
http://es-solution.ru/sec.myaccount.resourses.com/
http://estacionclick.com/sec.accounts.send.biz/
http://eunmingwan.com/verif.myaccount.send.net/
http://fancy.direxpro.md/Telekom/Rechnungen/012019/
http://farmsys.scketon.com/secure.myaccount.send.biz/
http://farzandeshad.com/wp-includes/Telekom/Transaktion/012019/
http://fgroup.net/sec.accounts.send.net/
http://foldio360.nl/Telekom/Transaktion/012019/
http://forum.reshalka.com/verif.accounts.docs.net/
http://franksrobomachines.com/sec.accs.resourses.biz/
http://freestreetgist.com/secure.myaccount.docs.biz/
http://frog.cl/secure.accs.send.biz/
http://further.tv/trust.myaccount.docs.biz/
http://giftingtimes.in/trust.accs.send.net/
http://gjsdiscos.org.uk/verif.myaccount.resourses.biz/
http://glfishsuppliesgrimsby.co.uk/trust.myaccount.resourses.com/
http://globalshippinglinecft.jobpreneurship.com/verif.accs.docs.biz/
http://glorialoring.com/Telekom/RechnungOnline/012019/
http://gor-gorizont.ru/Telekom/Transaktion/012019/
http://goruklecilingirci.com/verif.accs.resourses.biz/
http://greeksoft.gr/sec.myacc.docs.com/
http://hapoo.pet/sec.accs.resourses.biz/
http://hcforklift-eg.com/trust.myacc.resourses.com/
http://heizungsnotdienst-sofort.de/verif.myacc.docs.net/
http://helpdesk.lesitedemamsp.fr/Telekom/Rechnung/012019/
http://herbeauty.info/trust.accs.resourses.com/
http://hgrmsf.com.ng/Telekom/RechnungOnline/012019/
http://hidenlove.jobpreneurship.com/sec.myaccount.send.net/
http://holdopen.com.tr/trust.accs.docs.net/
http://hosting.mrsofttech.com/sec.myacc.send.net/
http://hvanli.com/verif.accs.send.com/
http://hvanli.com/verif.myaccount.docs.net/
http://iglesiacristianabetesda.org/sec.myaccount.resourses.net/
http://industrid3.nusch.id/sec.myacc.resourses.net/
http://inlend.ru/Telekom/RechnungOnline/012019/
http://irnanoshop.com/sec.myaccount.docs.net/
http://italianfishrestaurantgh.com/Telekom/Rechnungen/012019/
http://itexpress.kz/trust.myacc.docs.net/
http://jaihanuman.us/wp-content/uploads/9/secure.myacc.docs.net/
http://jaintigers.com/secure.accounts.resourses.net/
http://jardinmisamiguitos.cl/Telekom/Transaktion/012019/
http://jardinsterapias.com.br/Telekom/Transaktion/01_19/
http://jntrader.com/secure.myaccount.docs.com/
http://jointpluspro.premiumbeautyhair.com/trust.accounts.docs.net/
http://jrbdecorators.com/trust.myacc.docs.net/
http://jy-property.com/verif.myaccount.docs.biz/
http://kanyambu35.co.ke/Telekom/Transaktion/01_19/
http://karditsa.org/Telekom/Rechnung/01_19/
http://karditsa.org/Telekom/Transaktion/01_19/
http://kbsconsulting.es/secure.myaccount.send.com/
http://keylord.com.hk/Telekom/RechnungOnline/01_19/
http://khaledlakmes.com/mm.microsoft.com/med/drm/2QPwFELb/2QPwFELb/
http://khtc.hcmut.edu.vn/trust.myacc.docs.net/
http://kingscargogroup.com/Telekom/RechnungOnline/01_19/
http://kishket.ru/Telekom/Rechnung/012019/
http://kndesign.com.br/Telekom/Transaktion/012019/
http://kn-paradise.net.vn/trust.accs.send.net/
http://kritikaprasher.com/secure.myacc.resourses.net/
http://kwingaliz.co.ke/Telekom/RechnungOnline/01_19/
http://kynangbanhang.edu.vn/wp-admin/Telekom/Rechnung/01_19/
http://lakornhot.com/verif.accs.resourses.net/
http://lanco-flower.ir/secure.myacc.docs.com/
http://lesamisdamedee.org/Telekom/Transaktion/01_19/
http://lienquangiare.vn/sec.myaccount.send.net/
http://lightboxweb.com.br/secure.myaccount.docs.com/
http://link2u.nl/verif.accounts.resourses.com/
http://lionabrasives.ru/Telekom/Rechnung/01_19/
http://luckylibertarian.com/Telekom/Transaktion/01_19/
http://lucymwathi.co.ke/verif.myacc.resourses.com/
http://magyarporcelan.hu/Telekom/Rechnung/012019/
http://mail.sismoonisogoli.ir/sec.myacc.docs.biz/
http://mak-sports.kz/Telekom/RechnungOnline/012019/
http://marmorems.com.br/secure.accounts.resourses.biz/
http://masjidsolar.nl/verif.accs.docs.biz/
http://maskproduction.ru/trust.accounts.send.biz/
http://matex.biz/secure.myaccount.docs.net/
http://maxtraidingru.437.com1.ru/sec.myacc.docs.com/
http://mayphatrasua.com/trust.accounts.send.com/
http://mayruamatlumispa.com.vn/Telekom/Transaktion/012019/
http://mebelni-master.ru/sec.accounts.docs.com/
http://mediarox.com/sec.accs.docs.net/
http://merebleke.com/sec.myacc.send.biz/
http://missionautosalesinc.com/trust.myaccount.resourses.biz/
http://mobyset-service.ru/Telekom/Rechnung/01_19/
http://monalisacabeleireiros.com.br/Telekom/Rechnung/01_19/
http://nightonline.ru/images/trust.accs.docs.biz/
http://nt-kmv.ru/trust.accs.docs.net/
http://oakridgecapitalservice.greenstonelendinggroup.com/Telekom/Rechnungen/012019/
http://oil-dt.ru/Telekom/Transaktion/012019/
http://ortotomsk.ru/trust.accs.docs.biz/
http://pesochnica.com/sec.accounts.resourses.net/
http://photowizard.com.ua/verif.accounts.resourses.com/
http://php.mavalerio.com.br/trust.myacc.send.com/
http://play0.revosales.ru/Telekom/Rechnungen/012019/
http://porh1.myjino.ru/Telekom/Rechnungen/012019/
http://printingphuket.com/secure.myaccount.send.biz/
http://produccion.sanmartindelosandes.gov.ar/wp-content/uploads/secure.myacc.resourses.biz/
http://pro-iherb.u1296248.cp.regruhosting.ru/trust.myaccount.send.net/
http://pro-obed.ru/trust.myacc.send.com/
http://quoteshub.in/secure.myacc.docs.net/
http://rcagency.royalcastagency.com/Telekom/Transaktion/012019/
http://rupbasanbandung.com/trust.accounts.docs.biz/
http://s92902tb.beget.tech/trust.myaccount.send.biz/
http://salesround.com/verif.accs.send.biz/
http://saleswork.nl/verif.accounts.resourses.com/
http://saltech.sg/wp-includes/Text/Diff/Renderer/secure.accounts.docs.biz/
http://seksmag.nl/sec.accs.docs.net/
http://shlifovka.by/secure.myacc.send.com/
http://shlifovka.by/trust.myaccount.resourses.com/
http://sigelcorp.com.br/Telekom/Transaktion/012019/
http://skantina.nl/wp-content/uploads/Telekom/Transaktion/01_19/
http://staging.fanthefirecreative.com/mobileforming/public/uploads/sec.accounts.send.biz/
http://sukhachova.com/verif.accs.docs.com/
http://test.sala-avangarda.pl/verif.accs.docs.com/
http://testcrowd.nl/Telekom/Rechnung/01_19/
http://thaithiennam.vn/Telekom/RechnungOnline/012019/
http://thefragrancefreeshop.com/Telekom/Transaktion/012019/
http://thucphamchucnanghanquoc.vn/secure.accs.docs.biz/
http://toprecipe.co.uk/verif.accounts.docs.com/
http://trueblissnovelties.com/secure.myacc.resourses.com/
http://ulco.tv/Telekom/Rechnung/012019/
http://venta72.ru/trust.accs.docs.net/
http://venturelendingllc.com/Telekom/Transaktion/012019/
http://viticomvietnam.com/secure.accounts.send.biz/
http://viticomvietnam.com/trust.myaccount.send.com/
http://volvo-moskva.ru/Telekom/Rechnung/01_19/
http://wavecrestaoao.com/verif.accs.send.net/
http://weglamour.xyz/verif.accounts.docs.net/
http://weiweinote.com/verif.accounts.docs.com/
http://whiskyshipper.com/wp-content/secure.accs.docs.net/
http://wordpress-219768-716732.cloudwaysapps.com/verif.myaccount.resourses.com/
http://wp.lz-coeus.top/secure.myaccount.resourses.biz/
http://www.aemo-mecanique-usinage.fr/sec.accounts.resourses.net/
http://www.easyride.ru/Telekom/RechnungOnline/01_19/
http://www.forodigitalpyme.es/sec.accs.docs.biz/
http://www.jonnyhassall.co.uk/Telekom/Rechnung/012019/
http://www.lespetitsplatsdetina.com/sec.accs.send.net/
http://www.luckylibertarian.com/Telekom/Transaktion/01_19/
http://www.marconuenlist.ch/trust.myaccount.send.com/
http://www.qqenglish.com.cn/verif.myacc.send.com/
http://www.salesround.com/verif.accs.send.biz/
http://xn----7sbb4abj9beddh.xn--p1ai/Telekom/RechnungOnline/01_19/
http://zprb.ru/idx_sym/sec.accs.resourses.com/
https://198.101.246.240/vk_wp/wp-includes/trust.accs.docs.biz/
https://78.207.210.11/@eaDir/secure.myaccount.send.net/
https://agilife.pl/sec.myaccount.send.net/
https://bkkbubblebar.com/trust.accounts.send.net/
https://dkstudy.com/US_us/Telekom/Transaktion/012019/
https://forum.reshalka.com/verif.accounts.docs.net/
https://jardinsterapias.com.br/Telekom/Transaktion/01_19/
https://misophoniatreatment.com/Telekom/Rechnungen/012019/
https://my.mail.de/dl/16396560ccdf7536b3dde030d4b7e0e0/
https://tischer.ro/trust.myacc.resourses.com/
https://www.dkstudy.com/US_us/Telekom/Transaktion/012019/


```
#### Epoch 2 Document/Downloader links seen for 02/13/19 ####
```

http://104.155.134.95/EN_en/company/WgYd-cyY_mcgNPRnVf-E8/
http://104.211.226.28/En/file/SgIS-4TUmZ_cTftxeU-xTR/
http://104.223.40.40/wp-admin/download/shMfe-dM_nnFgX-sRy/
http://104.248.140.207/EN_en/download/0234405946/ZDyA-U0FPh_dvfsnUKXu-CG/
http://114.34.129.103/EN_en/file/Invoice_number/bxFD-ub4_IXOswJjtk-dFG/
http://115.66.127.67/download/aDPLm-tqNX_xcoeRtq-rz/
http://115.66.127.67/En_us/Invoice_number/ZsHTW-GFAJ_xaonYTpnK-1GD/
http://118.25.176.38/US/download/New_invoice/EMQRa-Mp6_Ik-r8N/
http://119.254.12.142/US_us/download/Invoice_Notice/DEhK-cRi_XfFFEn-rui/
http://128.199.187.124/EN_en/Invoice_number/ncuQs-C0hW_uPvdSfApY-zz/
http://128.199.207.179/EN_en/corporation/949706293103860/RNFCL-bK_rDb-RL/
http://128.199.68.28/En/download/New_invoice/kKsF-l1_pT-F7/
http://13.112.69.225/wp-content/Copy_Invoice/kiUmW-O7_ambwybOW-6G/
http://13.126.61.11/EN_en/Copy_Invoice/3537640860405/dkXlq-Ij_ZxmVpj-fLJ/
http://13.233.16.248/US/document/Copy_Invoice/UcTM-jrT8T_F-AIH/
http://13.233.173.191/wp-content/US/llc/MwFSH-aOkOo_WKGErDSh-3pU/
http://13.233.22.226/EN_en/info/PGTH-QJ_DJfTjdA-2d/
http://13.233.6.83/Copy_Invoice/zjCeD-YGO_w-TWs/
http://13.251.184.56/PeOI-pSLj_AlnHhVk-QDI/
http://13.92.177.54/corporation/Copy_Invoice/oYHZ-DU3_FMxI-vE/
http://130.211.205.139/HtDDY-RBS_s-6w5/
http://139.59.130.73/KAAECAW0228023/DE/Zahlung/
http://139.59.182.250/En/llc/Invoice_Notice/26997967767947/xFUlr-Ng4Hq_drWklraru-fK/
http://139.59.6.216/xerox/Copy_Invoice/71723785755653/htJHM-sg_BZ-FL/
http://158.69.135.116/EN_en/info/VLavl-5jWa_NN-Yxz/
http://159.203.101.9/En_us/llc/1909649/HBnm-4g7qj_vZSlWoOrD-JU/
http://159.65.142.218/wp-admin/file/rlQCK-AEA_TOLYw-ti/
http://159.65.142.218/wp-admin/llc/04418048552093/nUfSR-uftR_NvMPXE-JKX/
http://159.65.65.213/file/Ryzo-3h_qp-jAt/
http://159.89.167.92/llc/New_invoice/57979132/ukUI-Avt_NXbMuPG-0I/
http://160.16.198.220/EN_en/Invoice_Notice/yuCZQ-FZi5_fO-Eff/
http://176.32.32.140/ZZJHJIWWHC4541074/GER/Rechnungsanschrift/
http://178.159.38.201/scan/New_invoice/15786797473/XDfOk-bE_oSKgZvT-Wf/
http://178.62.213.188/DE_de/POTJCPC8133291/Rech/Rechnungsanschrift/
http://179.191.88.69/xerox/Invoice/3864374247/fqFZm-qU0_sQNFd-wH/
http://18.184.16.5/US_us/llc/New_invoice/iCPK-udcxr_KAYpXyRLg-gU/
http://18.188.113.212/En/scan/iQxC-0G_L-JA/
http://18.206.204.30/wp-content/uploads/En_us/llc/New_invoice/mgwTk-v4gG_kKXYie-ikF/
http://18.217.211.183/wordpress/US/company/sbzb-NaBu_ZVKxdz-FrX/
http://18.218.56.72/wp-content/US/ZgjN-7JOe_B-u0A/
http://18.221.1.168/corporation/Rthgy-VE_DqQJ-iP/
http://18.223.20.43/EN_en/xerox/Invoice_number/LaejY-Xt_sgrNPE-YD/
http://18.223.20.43/US/llc/Copy_Invoice/202956035/wyZr-NIkXO_dEpTjku-0i/
http://188.166.161.57/company/Inv/IuWV-Bf_DK-Sjk/
http://190.164.186.104/xerox/Copy_Invoice/64069841415/isqdt-LqXK_eoS-K8/
http://195.88.208.202/Invoice_Notice/oEiD-xKQZZ_OQokrU-au/
http://1stgroupco.mn/De_de/EQLHDFO3496533/Rechnung/DOC-Dokument/
http://204.48.21.209/US_us/file/9953721/mOaj-POrQ5_FtPW-2r/
http://204.93.160.43/DE/MPOFSQSQZS7461881/Rechnungskorrektur/DOC-Dokument/
http://206.189.154.46/En_us/info/New_invoice/tPds-xIodr_VDgMFSO-s9d/
http://206.189.45.178/wp-content/uploads/Invoice_Notice/oudp-KzRr3_RQelWff-qDs/
http://206.189.68.184/info/Copy_Invoice/UbGx-f3dRT_VhMvguZhW-jcC/
http://211.20.204.164/EN_en/document/Invoice/lXKc-EXZ_YnnTIO-1pt/
http://212.47.233.25/wordpress/wp-content/RWACHN5834441/gescanntes-Dokument/FORM/
http://3.112.13.31/EN_en/llc/Inv/QbLAG-DMjut_T-Gt/
http://3.120.147.8/download/9428618769/sary-0cZ_cEYzUU-2u/
http://3.16.186.154/download/361415307/dWup-Mg_XPrcp-e5H/
http://34.220.101.62/US/Invoice/yDNsy-UFfiS_ZK-Iy/
http://34.242.220.49/scan/Invoice_Notice/kwGY-KT_ApUI-Tl/
http://35.170.104.162/Februar2019/OILSFDX0082973/Rechnungskorrektur/Fakturierung/
http://35.176.197.139/US/company/Invoice/Yegah-4UC2R_EqbBA-uK/
http://35.204.88.6/45103872657/Aiwa-tzPq_Tem-ASt/
http://35.226.135.179/wp-content/uploads/US_us/corporation/Invoice/TZVZ-ISF0_HWTouY-G0N/
http://35.232.73.116/scan/898053748436506/ttSQH-TTO_nNouWKfU-fsG/
http://35.247.37.148/En/corporation/pTdW-py_grtITFZu-Sw/
http://40.69.23.131/US_us/company/New_invoice/PpUcl-3bjaO_X-s42/
http://45.32.82.29/wp-admin/includes/file/Inv/OEjq-qUs_p-yx/
http://46.101.52.174/doc/Invoice_Notice/DCjw-HXt2D_G-uT/
http://4you.by/EN_en/Invoice/Spox-CdGV_JwqsnyDRI-FF/
http://52.196.225.91/wordpress/corporation/Copy_Invoice/xveJ-E22p_TURm-pkB/
http://52.205.176.136/xerox/iCtfU-ck8_vlrGAB-Dx/
http://52.63.119.3/En_us/doc/Invoice_Notice/1095987397054/IIPw-Eoa_M-au9/
http://52.66.236.210/Februar2019/XQLEZND7115793/Rechnungs-Details/FORM/
http://52.89.55.218/wp-content/de_DE/TIJHADTEWZ0988890/DE/Zahlungserinnerung/
http://54.146.46.168/US_us/Copy_Invoice/hyiq-sVFoU_sZtalczx-DU/
http://54.153.245.124/En_us/Copy_Invoice/YhNNA-ZeEBY_ek-JfG/
http://54.164.84.17/En_us/info/Copy_Invoice/632505435818/TCSp-Zj2_ND-gp/
http://54.165.253.1/En/download/yuNuR-hf4a_oiVfXYk-YY/
http://54.234.174.153/corporation/Invoice_number/IBPk-HDo_PwtXEj-4o/
http://54.250.159.171/En_us/2446830/NqWP-TQObp_cgfZBBxnl-NP/
http://54.250.159.171/US/company/Invoice_number/123405918808120/nZdg-6se_PlUK-UQ/
http://67.209.114.215/US_us/New_invoice/WurVn-MoQ_KZruyHDR-kp/
http://82.253.156.136/wordpress/En/Copy_Invoice/eIqV-HZWan_frkIOz-fTS/
http://85.171.136.37/@eaDir/US_us/doc/KRtTq-fyMl_lR-4hp/
http://91.208.94.170/llc/Invoice_Notice/95666243/BJyge-dPk_KilCqD-ND/
http://95.177.143.55/Inv/YSgzD-zXdwz_Bi-Wi/
http://acdhon.com/doc/GJHjE-Ut8_oFh-YJ/
http://acenationalevent.ft.unand.ac.id/De/RHUMAKTGL6749674/Dokumente/DOC-Dokument/
http://admin.staging.buildsmart.io/US/doc/New_invoice/zswk-ai_mE-d1l/
http://aghigh.yazdvip.ir/De/IVCGEFAP6613031/Rechnungs-Details/Rechnungszahlung/
http://aktemuryonetim.com/xerox/PSBeF-0Y0q_PvlxGzloD-j0/
http://alainghazal.com/De/ETMYLTL8953726/Rechnungs/DOC-Dokument/
http://alainghazal.com/De_de/XPXTELNF7478951/Rechnungs-Details/Hilfestellung/
http://alikarakartalsigorta.com/EN_en/doc/Invoice_Notice/sVEC-bob_oqeMbLqn-4LO/
http://alirezasohrabi-hrm.com/Februar2019/SLKYBNAGLR5676838/Bestellungen/Zahlung/
http://allens.youcheckit.ca/de_DE/RUJARNHQD3830836/Scan/Fakturierung/
http://allens.youcheckit.ca/En_us/Invoice/Lktaj-Hf_HZBPJ-9S/
http://allopizzanuit.fr/De_de/JDYJFAQV1248975/Rechnungs/Fakturierung/
http://ameen-brothers.com/xerox/2264903039002/PaAw-Cl_kIKMu-2L/
http://amirimh.ir/wp-content/90020980/MCHfF-Vv2Q_wh-jL/
http://anhsangtuthien.com/doc/Copy_Invoice/33277038235/KYxP-HWT0_Yt-bXW/
http://aquilastudios.se/En/corporation/9649763/vJie-jP8_m-5D/
http://arayana.ir/llc/Invoice/EqxR-oS_fMyy-KSS/
http://archmove.com.br/file/Copy_Invoice/2170832/mRfE-olO_Aiemp-ui/
http://attaqwapreneur.com/resources16/Inv/jNAiu-6FoB_it-nZo/
http://aulsystem.com/US_us/scan/Inv/bGyh-QnW_WLBwUcNkh-PZ/
http://azs-service.victoria-makeup.kz/llc/3631933909174/zzeeW-ikQ_HeyX-ob/
http://babaunangdong.com/US/company/NWus-uY_WYDqQzxO-QA5/
http://barabooseniorhigh.com/De/PJCLEXQXV7099833/DE/Rechnungsanschrift/
http://beheshtimaal.com/scan/New_invoice/Wxpp-f1_NZMKf-n7/
http://beta.compspb.ru/De_de/FFIZUMLUCI4809632/Dokumente/DETAILS/
http://bjtechnologies.net/DE_de/GGLPOHEMJH2841406/Rechnungs-Details/Rechnungszahlung/
http://blog.cvsd.k12.pa.us/24820689936/document/Invoice_Notice/xJEM-Gcp_shRcNfl-Uf/
http://bornkickers.kounterdev.com/wp-content/uploads/US/qKFgO-I3_lqhr-p22/
http://botmechanic.io/document/Invoice/122815139860138/VZKR-YLT_syeTcnx-6gX/
http://brazenfreight.co.za/de_DE/RERPSNQS6194206/gescanntes-Dokument/RECHNUNG/
http://bristols6.wiserobot.space/Invoice_Notice/9227865/oIwkc-11_SXoUv-qc8/
http://britanniasuperior.uk/NDohX-BhSDg_yMzBa-wh/
http://btcfansclub.premiumbeautyhair.com/llc/Copy_Invoice/ufMDA-zRdk_OVQtBtbk-Q4K/
http://buddhistworld.in/llc/cQwTK-EgUIV_srZlW-VCN/
http://buglabog.xyz/llc/Inv/VJOnW-a8ePB_QzDUmff-rHl/
http://bumaga-a4.ru/EN_en/info/Invoice/sYZpL-tBr_fHgthTAl-fSZ/
http://buonbantenmien.com/De_de/VECWDHW4786715/Rechnung/Fakturierung/
http://buseguzellikmerkezi.com/De/GWUMRBOBA6128156/de/Rechnungszahlung/
http://buwamat.com.pl/En/company/Inv/fZEt-jJR_dQ-n5c/
http://cachechief.com/En_us/xerox/Copy_Invoice/XQGSw-KkhD5_rIZrXDxV-fy3/
http://camsexsnol.nl/De/OKUGFJDBVU7012434/gescanntes-Dokument/DOC/
http://captipic.com/EN_en/file/KIaE-a8xIU_JQ-iW/
http://car-partner.ru/Februar2019/MZEALCIHPL7706516/Rechnungs/DOC-Dokument/
http://casabrasileiracuritiba.com/DE/BATOJM2200849/Rechnungskorrektur/RECHNUNG/
http://casebkk.com.10771880-82-20181018162907.webstarterz.com/En_us/file/JXjO-pW70_LnY-dIO/
http://cashin.ca/US/xerox/LInKO-mf_ybRVceE-wgd/
http://cech.gdansk.pl/US_us/corporation/nflO-0g_zGDw-v75/
http://celtis.company/En/doc/New_invoice/SqOe-3pcD1_ckvrT-H6I/
http://chenhaitian.com/En_us/xerox/New_invoice/KtoLC-W2_tyzjGc-5f/
http://cifal.pl/EN_en/xerox/Mvglf-Mie_SbwiR-k7/
http://cild.edu.vn/Februar2019/LAJRGBOOG0342164/DE_de/RECHNUNG/
http://clashofclansgems.nl/US_us/30186813/ztaT-1p4J3_W-lat/
http://cleaneatologyblog.com/New_invoice/inFy-JO_mUqLLp-Ce/
http://clients.nashikclick.com/US_us/document/zNDZu-Qx_vjh-WHt/
http://colbydix.com/EN_en/scan/New_invoice/228118929/YzES-htLS0_txGqTmqkH-B9C/
http://cozuare.cozuare.com/WTDRRBGCGP8139006/Dokumente/FORM/
http://croustifondant.fr/Invoice/7721241/mNCkj-MD8E_ib-cj/
http://csti-cyprus.org/FDRSXDY9472977/de/Rechnungsanschrift/
http://dauphu.com.vn/frtzdqo/EN_en/Ynyih-vUM_QwFvPBrs-S2H/
http://decorinfo.ru/En_us/document/Inv/kEqPV-E0nEH_Fehi-vC0/
http://deenjeevantimes.in/En/file/JoQQR-Af4_rgFaUjp-1F/
http://deltaviptemizlik.com/Februar2019/XFXBVDSJ2130539/Rechnung/Fakturierung/
http://demo.evthemes.info/Invoice_Notice/qPBHn-RG7_oEZrS-XOb/
http://denaboresh.betonbor.ir/Invoice_Notice/KgwSj-LOI0_xCJ-ZN/
http://deolia.ru/EN_en/xerox/New_invoice/atAzQ-hx4X_hqTiKHnRZ-sCd/
http://depcontrolorg.rudenko.ua/En/info/Invoice_number/ERfr-1TNIf_W-j3L/
http://dermatologysechenov.ru/DE/EAYEFW2808924/Rech/DOC/
http://dev.go.bookingrobin.com/US/hIPYq-zTm_ZrflKdXwr-7s/
http://dev.hooliv.com/wp-includes/llc/Invoice/GjTR-0tDmQ_ufbypMsb-hI/
http://dglass.cl/US_us/Inv/21860983900/ooSb-D7_ZQo-mr/
http://digitfile.ir/download/Inv/Soet-s4xz_Zb-vBK/
http://dijitalkalkinma.org/De_de/ISQOBU2986689/Scan/Rechnungszahlung/
http://dijitalthink.com/VHJMVMPOK7953055/de/DETAILS/
http://dizinler.site/En/scan/Invoice_number/Fxvm-USL_Jem-3S6/
http://doctorbondarenko.urbanhealth.com.ua/De/LASLNJ4680356/Scan/Zahlung/
http://dorispeter.co.ke/US/download/Invoice_number/VSYB-hdJ_uFqjk-cy/
http://drnilton.com.br/document/tSyDD-ucWo_PspeK-uX/
http://drtahminehrahimi.com/de_DE/HLWUYRC5906567/Rechnungs/DOC/
http://eco-fun.ru/De_de/KPUGOF1777468/Rechnungs-docs/Rechnungszahlung/
http://edenykiraly.hu/En/Invoice/fwEsj-J9os_yEaxkqC-psM/
http://edialplast.ru/De_de/ZIYHNLFNA3334407/Bestellungen/DETAILS/
http://efdesign.ir/de_DE/KYSJLLCUS3016175/Rechnungs-Details/Hilfestellung/
http://erem.com.ua/EN_en/llc/Invoice_number/619453489984/VAKj-Wv0Wm_nFV-Vl/
http://eroes.nl/Inv/kbwU-V0xXX_uDMdxque-lg/
http://essastones.com/DE_de/VJUZGDEL3702027/de/FORM/
http://es-solution.u1296248.cp.regruhosting.ru/file/ROpMZ-OJIU8_jJc-INK/
http://euniceolsenmedia.com/Invoice_number/9035569694/gOitV-IgFC_fjHLGquMO-jlr/
http://explorehue.com/corporation/059767712543/FlyI-uBcdu_KAasjYjt-hW/
http://farshzagros.com/info/Copy_Invoice/660292314540/aasCj-FF1CD_s-Nm/
http://fenichka.ru/En/company/OHTV-0cd_UtWIeX-0AH/
http://fetes.ru/YIKOHPB6475498/Rech/FORM/
http://fiat-fullback.ru/EN_en/company/208024765241/bYPag-RSE_IYUE-zw/
http://foodfithealthy.com/UVDLFV6662688/Bestellungen/DOC-Dokument/
http://footballnowandthan.com/US_us/file/Invoice_number/aGXZ-acgZ_HculmxG-rOO/
http://g5englishtoday.ir/US_us/scan/Copy_Invoice/MEDAR-gy_ugVGuSe-fI0/
http://galeriakolash.com.ve/EN_en/Copy_Invoice/3823962600/yxTb-Klswi_NQuCYHBEV-4a/
http://galinakulesh.ru/En/Copy_Invoice/FTMNP-t4LX1_sC-HY/
http://gbconnection.vn/Invoice_number/HXxh-fLJ_tZ-mGT/
http://gcfilms.org/En/corporation/Copy_Invoice/doHgv-8bY_ZHBTWtZ-mLI/
http://ge.kreo.co.ke/En_us/llc/fthS-kiaO_DWj-Xf/
http://giancarloraso.com/US/download/qrZvo-Z3O04_bKRwVcLq-iJ/
http://gmcvietnam.com/US_us/info/613374712/Cpsk-a4Eh_WqszGu-dC/
http://groundswellfilms.org/download/Inv/npGHK-yqo_XD-ue/
http://gslegno.com/De/MYAUGF0391792/Rechnungs-Details/DETAILS/
http://haamin360.ir/En_us/document/SkpMY-sK_mJOEMFcfd-Hj/
http://handom.u1296248.cp.regruhosting.ru/Februar2019/LSLCDNTC3850919/Rechnung/RECH/
http://hashtagvietnam.com/RWDSLA9599608/Rechnungs-Details/FORM/
http://herbaty.zzdb.pl/De_de/ECVEDVE6816030/Rechnung/RECHNUNG/
http://hifucancertreatment.com/wp-content/uploads/EN_en/scan/waVr-0A_mVwcJ-SBz/
http://hipecard.yazdvip.ir/de_DE/HZLIAIMQ7385451/GER/Zahlung/
http://hoanglonglighting.com/de_DE/SNUIDMQ1187026/Rechnung/Rechnungsanschrift/
http://horse-moskva.myjino.ru/De/EBFUFPHB5662487/Scan/Hilfestellung/
http://horse-moskva.ru/En/Invoice/738908009963389/lWnS-H2Cu_Xbeezsrx-mMn/
http://hourofcode.cn/ckYQ-swPJ_dJ-qf/
http://htmedia.net/En_us/doc/Invoice_number/322374698567650/Uyuif-6iV_cYEx-x7/
http://idecor.ge/US/xerox/565711769621028/NrRJ-KIh_mCQC-8em/
http://iiccfp.com/info/Invoice_Notice/96187351938/hpGZ-WqTa_Zu-GO/
http://ilo-drink.nl/corporation/56243092/AQRv-C65sd_jPnXLO-Cd/
http://imperiaskygardens-minhkhai.com/US_us/company/Copy_Invoice/11172195445/CAxgJ-MTOPe_hlfcJvIJ-iw/
http://ingramjapan.com/En_us/document/Inv/bahX-pvh_dDIg-wz/
http://inhouse.fitser.com/FlourishingC/php/v1/wp-content/cache/info/joAJE-P7_mTGs-wh/
http://insurecar.ru/de_DE/ICMSEASF5714812/Rech/RECH/
http://ipnat.ru/fyCk-SJJ4b_PoSweGcd-gwr/
http://istratrans.ru/llc/fmDd-K1p_h-yxr/
http://itexpress.victoria-makeup.kz/corporation/qKcpb-62_aD-KnY/
http://japanijob.com/uploads/info/LFCr-mTkA_qpt-elO/
http://jaspinformatica.com/US_us/scan/Copy_Invoice/Bibd-nOH_KyoVziKW-Z5z/
http://jerko.novi-net.net/stimac/US_us/file/Invoice_Notice/gBtQt-TSq_wBfXj-DUk/
http://josjuniour.co.ke/De_de/LOYQYZ9180731/Rechnungs-Details/Hilfestellung/
http://kamajankowska.com/EN_en/document/Inv/ZuwUt-VKJj7_NsfrLOxDB-BB/
http://kebunrayabaturraden.id/En/llc/Invoice_number/MdUt-CdMA_Vnav-W4y/
http://kgr.kirov.spb.ru/Copy_Invoice/xYDp-erk_WogHeTD-o6M/
http://kguki-skd.ru/VMYUPANF6935683/Rech/Zahlungserinnerung/
http://khaledlakmes.com/llc/New_invoice/ZtDW-kJ46_Faeed-HyH/
http://khpm.ir/Februar2019/WXZGEFSDW8579548/Dokumente/Zahlungserinnerung/
http://kiabongo.ru/de_DE/VQOXIRMIBW5374595/Rechnungs-docs/Rechnungsanschrift/
http://kirstenborum.com/De/YDPADIFC5848993/Rechnungs-Details/Rechnungsanschrift/
http://kishroyall.com/info/Copy_Invoice/vWvGP-b8PGG_nfoKhdp-Mw/
http://klinika-himki.u2818345.cp.regruhosting.ru/DE/OLRDBHSV4393466/Rechnung/Fakturierung/
http://kostrzewapr.pl/css/EN_en/LUEQ-03j_HcgPoYnh-S1P/
http://kupiklopik.ru/US/info/Invoice/JWRed-sKDK_R-oP/
http://kurzal.ru/wordpress/wp-content/uploads/EN_en/xerox/Copy_Invoice/037995644072/ypFYI-V36NG_N-oqO/
http://kymviet.vn/EN_en/corporation/New_invoice/GHtP-Sz_J-b6w/
http://kynangdaotao.com/corporation/Invoice/24280260/gshoJ-rrLax_ohyo-AYH/
http://kynanggiaotiepungxu.edu.vn/EN_en/llc/Invoice_number/EUia-uj1Xc_iPcQ-UqS/
http://laur.be/US_us/company/TnDwD-p0Tj4_ZkNroqaJ-27/
http://laylalanemusic.com/US/info/Invoice/XEGK-waw4L_rEfiyNp-Rc2/
http://legalserv.in/scan/Invoice_number/PsFOe-ZcW_k-HM/
http://level1collective.com/info/Invoice_Notice/oqkwv-qT2dc_XqXsi-LsT/
http://lionestateturkey.com/EN_en/download/Invoice/stOfP-bzI_fry-y73/
http://liszkaokna.pl/En/info/Invoice_Notice/IyCK-Ot_ELdtn-zqB/
http://lmgprophesy.com/US_us/doc/lLHhS-P7t_HnVOY-0Q/
http://lubraperfis.com.br/En_us/company/New_invoice/NqJst-IOh_BURkbxF-oM/
http://madrastrends.com/EN_en/scan/VBbW-YgV1_FlHNc-Ka/
http://mantoerika.yazdvip.ir/DE/DHAUJEYVPX3329168/Scan/DOC-Dokument/
http://marinavinhomes.vn/En_us/02033242755291/UjlU-CH4_r-or9/
http://mask.studio/EN_en/Invoice/gyAzN-KV8Y_LCfsR-pUG/
http://mat-bansgh.com/DE/YZFCRSAWKE1998409/Bestellungen/RECH/
http://maternalnadir.org.br/US_us/Copy_Invoice/zXvOq-1mmj_o-Ac/
http://matongcaocap.vn/En_us/Copy_Invoice/QDiN-OuMUp_j-GJK/
http://miennamoto.com/corporation/Inv/HrQp-lg8JX_QdlMm-OK/
http://milimile.pl/US/Invoice/9885325/fhKa-Bx8_nxivy-rBQ/
http://mingroups.vn/En/document/vqimK-93_ujgxHBl-2T/
http://mskhistory.ru/En_us/download/Copy_Invoice/XWqc-r9k2N_rPLixhE-fBQ/
http://nailbar-fecity.ru/DE/EKEKTJWU1887316/GER/Zahlungserinnerung/
http://namirest.ir/Februar2019/MSQNNJWZB9943428/de/Zahlungserinnerung/
http://napier.eu/corporation/Inv/toth-7zfm_JUUNfxq-5o3/
http://naturescapescostabrava.com/EN_en/download/bwTc-h2LFm_KLTRHSN-hYK/
http://navigatorpojizni.ru/company/Invoice/eAeJ-h7qna_py-Vw/
http://navolnejm.ru/de_DE/LOURSABTA7504461/Rechnungs/Zahlungserinnerung/
http://newsfeedkings.palab.info/New_invoice/oeLUK-6II_zjnwqie-x3/
http://newsmediainvestigasi.com/US_us/doc/73649729271/vVPuj-SSs_I-2q/
http://nikavkuchyni.sk/EN_en/company/09054053629/Ytkh-myr_jxhpmLdA-NNb/
http://noithatshop.vn/US_us/xerox/Invoice/KsSCN-zUX_yk-T6D/
http://noitiet.familyhospital.vn/DE_de/SAKIUGVO0710659/Bestellungen/Zahlungserinnerung/
http://nonfree.ru/company/Inv/975956727/NKErr-s90_fjVgbaUI-wVO/
http://nosomosgenios.com/De_de/XORHWFB3951892/Rechnung/FORM/
http://okna-csm.ru/DE/YWLSIIHXTL4996204/Scan/RECHNUNG/
http://orionmarketing.ru/En/corporation/Copy_Invoice/WuRwl-HAJ90_xRTt-zpk/
http://parentlism.com/En_us/download/VWOBL-VNBa_syuIW-0iu/
http://patient7.com/file/4436736/Lgva-DpbSx_w-1hm/
http://pechi150.ru/Februar2019/YFWZTW3358544/Rechnungs-Details/FORM/
http://pharmavgate.com/US_us/file/Copy_Invoice/uewk-hpvk_ox-zP/
http://play2.revosales.ru/US_us/doc/Inv/sAUCY-xrh_yxm-m7q/
http://plc24.u1296248.cp.regruhosting.ru/EN_en/Invoice/226211865611/TkeNs-Udm_AKS-fq/
http://pobedastaff.ru/DE_de/JCZWLGCIK6961723/Rech/Zahlung/
http://port-vostochny.ru/document/Invoice/mEjvW-9yrE0_KXix-jk/
http://precounterbrand.com/de_DE/ZSLJDNYRI7013367/Rech/Hilfestellung/
http://print.abcreative.com/DE/YGVLJI2079121/Rechnungs/Rechnungszahlung/
http://prostranstvorosta.ru/EN_en/scan/TWGwh-nz_WT-Aok/
http://rca2.royalcastagency.com/de_DE/CITTBFHW0442375/Rechnungs-Details/Rechnungszahlung/
http://rissan.ru/file/mqpx-nwl_Wgn-qzC/
http://rohrreinigung-wiener-neustadt.at/En/info/QxzU-a4vRc_mipHrTA-RKH/
http://rronrestaurant.com/En/llc/UzDg-Wuq6_jsEM-Pj/
http://saleswork.nl/9883973888669/sKfw-JJWCx_zdAVRkDnn-xq/
http://sanxuathopcod.com/US_us/xerox/iRJbH-YV0_HaIxhp-TQY/
http://satellit-group.ru/US_us/download/Invoice_Notice/nZNM-s4V_rTBCUp-91/
http://seara.com.br/resources/En/llc/DmRIj-QB8rB_wQmAwnBh-lw/
http://secondmortgagerates.ca/EN_en/company/TURn-PY03_URCgOL-yTN/
http://seksmag.nl/company/eZYu-2yP_t-EX/
http://sergiogio.com/US/llc/kuMWh-yD_ogLs-7y1/
http://sexchatsnol.nl/De/IJFMMWAY9545443/Dokumente/Hilfestellung/
http://silveroks.com.ua/En_us/627468215593877/Ojhu-Tgo_kjOAmcZ-no/
http://site-internet-belfort.fr/DE/HBSUQGSTVK9220852/Scan/Rechnungsanschrift/
http://skill-centric.com/US_us/doc/Inv/WJdcs-EXg1h_ZxLd-N2/
http://softsale.ie/scan/tUECA-EFC_AXRVlr-lZM/
http://sosh47.citycheb.ru/info/Copy_Invoice/73524541/LbPQm-v4y_Ykd-MCY/
http://sts-hk.com/wp-content/Inv/PsDXW-WSI2_mcFhg-sj/
http://sugarconcentrates.com/En/file/Inv/7230677278/xQRl-myZ_k-tf/
http://svornitologia.org/file/FKDIF-Lk_bHS-iKs/
http://symbisystems.com/de_DE/ETVWYU7661166/Bestellungen/Hilfestellung/
http://tarhanco.ir/En/info/Invoice_Notice/74938550/cfGp-wJy_nRrdRwlOg-TH/
http://tekirmak.com.tr/US_us/doc/Invoice_Notice/ZbKO-6u60_EFCPbr-9X6/
http://testari-online.ro/tk4zjcl/URqX-1JoR_Kbhs-b5w/
http://thales-las.cfdt-fgmm.fr/cgi-bin/US/Inv/KpDF-1H5rN_GLFtoTK-kSE/
http://theemergeteam.org/De_de/UZBDIRNQQV5784434/Rech/DOC-Dokument/
http://thptngochoi.edu.vn/EN_en/Copy_Invoice/2062248484057/nmOn-8aV_jwvJqkc-bcB/
http://thptngochoi.edu.vn/wp-content/uploads/AKTN-A7O_ikebSn-Wi/
http://tiaramarket.ir/DE/IXTQPWMLC9359449/Rechnungs-docs/Fakturierung/
http://tinpanalley.com/De_de/PTTJHU8194170/Rechnungskorrektur/Zahlung/
http://trandinhtuan.edu.vn/DE/SNDLABM5014270/DE/RECHNUNG/
http://trezvo32.ru/EN_en/New_invoice/EghJb-0F_NWnVnmxN-Aw/
http://truenorthtimber.com/DE/IPOXYGSBR5170225/Bestellungen/Rechnungszahlung/
http://tsogomediakit.co.za/US/info/Inv/raGw-m3_POzZX-XFv/
http://uit.suharev.top/En/corporation/Invoice/piwfE-wK_IVL-V3S/
http://vieclam.f5mobile.vn/scan/Invoice_number/zQUsj-BHma_VKPn-qc/
http://view52.com/info/New_invoice/mgcW-rh_PJaApL-ds/
http://vsharbakty.kz/En_us/scan/Invoice_number/AePD-W2GjS_wfVVgCL-Vks/
http://weresolve.ca/doc/Invoice/KmtQq-Vs8yN_VmpHLQ-KJP/
http://wompros.com/US_us/document/Copy_Invoice/BsgAO-XH_mhJ-xG/
http://www.2jrconcept.com/scan/Invoice_number/odkOb-WNR_zqMTga-OCC/
http://www.biaozhai.com/En/xerox/Invoice/YInU-zLIH_YdBSb-Ztl/
http://www.car-partner.ru/DE/OFXKAA4727189/Rechnungs-Details/RECH/
http://www.car-partner.ru/Februar2019/MZEALCIHPL7706516/Rechnungs/DOC-Dokument/
http://www.cbmagency.com/company/1595560/FnAI-nC5_lDgvO-REl/
http://www.forodigitalpyme.es/En/download/iiJNr-RvP_lMcn-8t9/
http://www.liszkaokna.pl/EN_en/doc/ocYgC-GNoc_UlXTOo-nkJ/
http://www.pattani.mcu.ac.th/wp-content/uploads/US_us/xerox/Invoice_Notice/5179098/jRUW-jVOF_O-am2/
http://www.portal.gamehivepk.com/En/info/Invoice_number/VEKmT-LN6RU_GtE-NT/
http://www.seara.com.br/resources/En/llc/DmRIj-QB8rB_wQmAwnBh-lw/
http://www.seksmag.nl/company/eZYu-2yP_t-EX/
http://www.xn----8sbef8axpew9i.xn--p1ai/En/HAZna-MBGL_kxSHOZ-OQ/
http://xn--116-eddot8cge.xn--p1ai/US/UxeAF-KtEV_UdOuTI-t8q/
http://xn----7sbbdfeovrgh2b6al.xn--p1ai/DE/IBBQJRSSBW3158678/Dokumente/DOC/
http://xn----7sbhaobqpf0albbckrilel.xn--p1ai/En/download/Invoice_Notice/4446036/zVaNa-ft2_KWQgGYn-wn1/
http://xn--90achbqoo0ahef9czcb.xn--p1ai/US_us/company/6600588342/pREm-2Rq1_TGFAyK-wvi/
http://xn--90aeb9ae9a.xn--p1ai/xerox/NGWL-eHat_nrqqdaZ-36/
http://xn-----9kccsa1afbhzcgd9a1ay5l.xn--p1ai/scan/NaLsb-ny_jvJEYzTpq-yqR/
http://xn----dtbicbmcv0cdfeb.xn--p1ai/US_us/file/JZhX-uoAxG_uryptRJ-EIH/
http://x-soft.tomsk.ru/EN_en/doc/Invoice/vdcb-8AvQ7_oxW-qr/
http://yduoclaocai.info/US_us/info/spbI-AyS_rmgdelklP-tW/
http://yduoclongan.info/EN_en/info/Invoice_Notice/qzLF-QWNk_eUaJAFR-h3/
http://yduocsonla.info/US/company/pnco-tGoyj_WkURfifQ-zP/
http://yojolife.site/US_us/download/Copy_Invoice/hsxh-Bycx_FxUt-CI/
https://admin.staging.buildsmart.io/US/doc/New_invoice/zswk-ai_mE-d1l/
https://captipic.com/EN_en/file/KIaE-a8xIU_JQ-iW/
https://noithatshop.vn/US_us/xerox/Invoice/KsSCN-zUX_yk-T6D/
https://precounterbrand.com/de_DE/ZSLJDNYRI7013367/Rech/Hilfestellung/
https://tischer.ro/US/document/Invoice/thmRA-M2eu_ct-9s/
https://view52.com/info/New_invoice/mgcW-rh_PJaApL-ds/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-13 23:06:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
24accce394df4d28c0b496cacbcb0245e52c3401fccfaf14fb0ac8cf65a08ca4
fb2cba6b4c4b890a1a32cf2fd63be332e63375af7bb32fb43c6fcd1c8b27aed0
10aa53666e6b7b7535f5312e4a560134d7cca9926869dd49646c5105fd1a046f
e6b79db99b399198a61b836acb552f49c58e491bebda5dc7125d2a3f8b798f1f
f596bdd66454e9d2f00391920394679dacc80ec65d77e5cacfb01f73b3fafb8d
cebe799eb13204e363f9d18a0be2885e4668ca32ffbe1bcbe0d6071ddc5fe541
60bcaac606692210b3caefe17ecf597d49db8d529978d6726a7269b4a14dc641
4941777a3a7e4899df063ba472ea528865537ce43178b5db6aed072e61bc500c
1b8f1db3cc4c467bca294bafe4ef2082c83c385e75cc4fc589eb2b32a6d0c279
d31d8513d07a01c8cd627c745d0959263d122f95729d2cfcf951c9e8f741f2de
21efd9ba28b1813c2703fc87c58e1aec248d98417bcd25f6eef30321794d55fd
e95846c16abcb48406d3e68b89c6c57335d72683501f7a9bd60d2e7894fedaa2
9e59bde0e624352a96df24f41cf11136837b60e61c4a954bc2d41784c1710e77
36e96af0d786eeefe5749d3b60ab2dfa044ca4da0644012c8c15dc5a6df36e17
48cad76efb958c7d247a27f4636d464536d78174b5379f744c86be9b22020fd8
c131a04ef143915bef40c4816d7c065d86f15e1e00b15f26500895151f466fed
e23125b787324e0bdcba37250c3e9d784b57f901f885a109029f260bacf30000
619324ffdc2376cb39135e2705c1034eb856bd564698c886a15b176aa95df5cb
646a4bfb639145a8babab15ee88b8ff1744e68dbbc59f9085d4e2321171873de
30af6a16431fa52b727d75db674bec79d21b4687876ee26f57c137dcaeea5ca1
02733ad79a16b0fb62e4dfe438aaf227d6a456fe60445aa595cad125d72c9294
8e610df0d3b2a0b27aecd4d74baa2303621a4e1cdcdfd62a9a0518ad813276de
c72ca32025175570b30d91669466db659f84b9b910498b3d1b8ff673feb48213
dda878698d942e6bc8c8f114507f1a00878dcb205ef1a5569fe1e7968e4e8fba

http://gardenstrutturelegno.com/pafgY1kbyB/
http://mhoment.com/LM20Ymp/
http://extrashades.com/CfK0g0aQ4r/
http://gandharaminerals.com/4J2ko2vsYO/
http://baovevietnamtoancau.com/wp-admin/includes/uZ8bAUa52/

Creation Time	2019-02-13 20:40:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
2f65ba0ecfd26fa06e238822d9c0f8bc60b0dcd003afbd7568b1fd1ee6bbd191
8b2d47e5a73549627b750060ba8486001f834e5897e948a33c761e824a194d7a
8a4710cbc3d8903fa8870fc77945590b9f173bca15aa4726dda2a90cf824ac4e
8050b4496e395a91f1363fc1af60a243811a170eccefe723b8f04e93e403a013
a8935cec25cba6087f777d981084dbe4f8b1dce2fecdf8e7c16d9aeb21ce339f
46bce1e470af13227d4949322b92cacd5a4bae10eabb3fc5cd46fa2f34b76a29
15b0891d13aefc17adf3ba8fdf570dba763f32661aa72177b4dad8e9c3da74db
2c37b028750583ce64e4d72afa37e0f78524f01fe712ba5987ebecce445941a7
9e0d36cfd8196baeed740ebf985200c58f5fb8c9ca4e51a22b5d17588592664c
19eb33287c0dbe81fd1cd45b926a1d1f8370c86737febf340ddfd2d6227efda1
e87d937b5348dc1ff3387cb3b974d14ed08f3e198f8bfea03b7124f7f40a79cb

http://khobep.com/I2TSaRa/
http://dominicanos.xyz/hujBocy/
http://103.11.22.51/wp-content/uploads/ZEgGVHJS/
http://18.217.96.49/z54U0nF/
http://162.243.254.239/quoteandbuy/CcSkzUOiUa/

Creation Time	2019-02-13 20:40:00 (XML Based - ENG - Unzoomed Indigo/White)
2019-02-13T17:02:00Z
SHA256:
2a560c34218a2891c42ec9f98bfed13ca5943807645c75c842ad4ac439ea8d8c
a19e665cc0175cb926e4553594cea21ea2f9ca8214bc7be803e3a79e4cb90a12
20a4ee40eb1eccf213ba1c22a3c624f58257fd74e16c70b75359ba6c921f191d
1dd4c9b26fd12bc6d730c0577b64ff7b0efb12551a6ab1795dc3ca82055d2357
76c3ed723e9cd25cfec37ce0c95ff76777c38d68c1d770113aaa7a474fe52d7d
f1a35c17aa78b71f0b6bbf6c29be48343bf70f8a31cca7efeb7aa5ce7baa5975
b1967a5b9cba0bb2df20e4f381230e8ca57a625360352119e36480dd6f7d2028
baa587db0fbb8cd910d8b74afa61ec314c1fb2eb43bc728a4bd86f203f0ddd13
6af30cba9d84c8ab311b99a2da7448d8c52590f6353a57aa2a16190bf6289fbb
3aad4ccd7967968602faf5cc7fd976ca80c217ccb09364d96e72255512d6a8cb
5cf60cc9a8727e35066e3ad086d10a8aeefb25cecb9e93e57befe3dc5a6e5a18
719dfd9b9d878b7a562166d34e3d8cf6e5f37ea40ac9148b7a464fad51adcd61
852042bbd9f6779ff384cfac5945167b3137d7d42cc8da117e11b924e4a6bee2
a530577fd77b89e6a3c3c864ad573c30558ca3f3d9d461328858d920b5f8ee3d
5f1293aa97f471e1e9c032e318c9eecd6c5f579d0ebe11dd5b095a958b99d61e
85b5a781fc3e37715e678e6c60fdb2fbe32488a2e08bb7d5c5789ae67b87b8f4
3455048d655320dfe9fa1d3466a5608862008dc9f6c22dc972d44399fb1c799e
dafee22b05d007a79529c0c13386d9cc1cbd3e877ddf40136687e85b701ba0da
605a05f83e1cb664d4a320f2bf561013a0eced86d7d9b1be8465bb1f3687bff7

http://www.prowidor.com/35hflpam3A/
http://139.59.64.173/hlMSx0fm/
http://13.126.61.22/Tkjz49D/
http://52.63.71.120/jP7Bi6vPVK/
http://13.125.133.209/8v3dAOp/

Creation Time	2019-02-13 13:07:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
ea31594f27362ee525951c5a3d47a94b66cdbb51a7227c4381d622df57c7c7bc
7080872d446da577eb335cd74a38c37ae31265ffb258b25ebd098091baa4184b
c2e4b54a7932b96ca2075864c85597912d2ffcaaa405bed657626dc77b576c9b
860668c17a32eba0c4acf14375efd4fa058714d6264c8fa9e493edf202743428
d4b7e7faa885f62f12103a9eae627ee1ad46f68d726799be8a45f1e7eaadad8a
a90b540e8eece86cf545dc8a8d6c12ce00c471abeefb493f1e9956c040553535
adffe4b315c0aea994b38a4bfdfa1a11efa89e4e5ecc9900ec05509580bfc882
ac4371a326d988ed75aaf306330a54f5ef77372649be421149ea0936febd603e
fd6d3fed5485d19798b1169fdf5e5e5101c8a0042301dd10785d1645230b6062
b2b2934c98c2c1b218cf95d9feb0a071a4a7b507db0cf58576b9d2a86c23188f
a21f14cf5dc2d8c7935dbca6445bcca1a9897996bc53643c70711405ea59fd50
06bff6b182fe08d86d047c82b2448fb304bf0fe9ce92bac5a167555964bc763f
0d3789b5613f17c62f50c421781af224a5130f936b147f9b459c39acfbe9c413
fbe47ae3f19c47b0491937eae4a5e1a7f3d9045eee380ccaae2dc5ee6d009663
51af1bd9c9be21faa36768d9b164fecdb1804cd56ea8b8098cd5efa963849e42
adf4a20c7d15365bb9ab64eba58030602afb74ba8e191326a9250aef4fcd9eeb
a7493a60890bf551e4dcc1522f6106655cb6c6bac4bb969a91ef1ac69b328953
762010819aac35827bd1a7c75b41cdcbe005b0930bd382f44b95a716fc3abb03

http://www.venturelendingllc.com/Wxw9QNt8I/
http://barabooseniorhigh.com/FWLR2ZT/
http://mimiabner.com/x7bQDOiSJe/
http://vesidailucachau.com/F1zcXKyj/
http://altuntuval.com/8cfiGmIXk/


Creation Time	2019-02-13 06:37:00 (XML Based - ENG - Off-Center Light Blue/White)
SHA256:
efb1e8f8152824daf78efa2063cc544b04f1d65c7b1abc381a88a06938a20f59
fb03f1953d58f9b53fdc06bd23041caaaf10ebb46fb8df944864de2f08fc805d
3f339883556f1ddf4689050cdeb892495acde82b3adac21555682b392b90e0dd
6752d12b102e5a4d1659d124985edac7cca933abff7deee38e0902e21353718e
00f03991dafaaae758848789831086c742aa81845ee5fb19a83ecabd1c414159
b001ebc3672141a9de3796139845db2b3b56c45d58f84eb26da483fcfbe88144
b72540e462c1c4fa30f17c1c31003d63e1d772435f20cec49e17c01587b39106
e3192d0ad18c7bfd98e879c8a40afb3496835792aeedf6032572072f278967c7
cffd67ad6d37e4e1eb12796319b45b65042c81ddfd5d1f03598ce31b40e748c9
dfc2e982f50d7df16be5e88f9f9901cbb318490167f7669e20c262ffd8f87ce4
e188f739adac12f4e2af06a853946ff709c543c4120903485edf2f079b35385b
8a320256d039685389a6d124c1e6990c21812f75b7b77f89dc2a2160810785f7
93d5b37c299fa4d7a59a35598a41240c92e7e4e7c241e7a4c84abb48d71c3efd
69cd78eec9c073bf2910b3ed4abb675908adc820e25c3e33ff0b154158c96641
5142bec748ae56c16cc76f6d6480b17b93de5b2278e85b32be8d56032e51330f
7ab45f42eda01aba9f541e2c9f5c0b05f5941ee594fbd040145256adf7bf2e82
c7c93c7d3d849010ad878a938d2b2adc9e8c9b5ec8fa3a9e2f96a733a6b00f44
cac96efc1e664c5e4b613a9ed50b0420ba4b7b934c2be982825c3e7203dd6b16
341953de8c3974331f355ca207cca324dce68ed588b9f230356fbe184b733b87
72c87c8eb43ed965400e91aa64820f564ea8756ab7744fd415261ed8d064ce37
cfe381fcbb5c0d45a7f40822df5d5967cab21cc454387f9469a7bba8c503aa4a
daebac726cb32acadc0768549242a41e6571532abd94cabc363fad589a9394d3
306559a01b5640c2526f1f495447da0187d97cf7a826030a7479d116b6e9a886
9606d86e7bb72309086d117efdbf55637e1b781631d02504f92f2148f1c7d122
b1e225ebae83ccd9d734b479af36b360c89376f19db90eaad428da585dbefdc8
484d5c3f438d79241e18f68f7fc3e74cf2143b8bb594be239fc3aa8e76fbaec3
5f1a3bb61b448a13bc80ffe19270c44890075ea7fc4ec6d23a39b826acb6a478

http://klimaanlagetorrevieja.com/wp-admin/user/FvhkXmTk/
http://mathkinz.com/3I9gVQ8a6s/
http://kappadigitalsgh.com/Ra5i3gDews/
http://cinemaschool.pro/Hj40c1MBud/
http://www.allroundopallevlakken.nl/RZz78YV7V/

Creation Time	2019-02-12 23:03:00 (XML Based - ENG - Off-Center Light Blue/White)
SHA256:
5725aac54f9e0b682c8e90c5adc8e25b1a97ee60aa1ad40f7b5154772e428bf9
1b78380dc87da33f1be03698c6fb1c97047fb83b0869db614ad78af739d239e4
a191014e996660ccd4930823f3aec798e391d37abeabf9e04e6e6912becca395
ab09084e5321b552445689d057851b4f551c58506dbced9576b1856aa0517c39
b4a345d4ddf08dec5bd8ee9647d5e96aa37c7c7348c597a460592573f9ad4926
6c1710a1a3c916f3bc8ca4eee0eab976c39fb0b24b520e8a4e9ca7e9106c84f5
d86dffa3c6861d289c115394cdcda950fa8ea88a50c6fd8c7f3f6b8720085c88
821b71c9fd3b62272475c4311e1f54cde3a467e2a9d618a3c0657dc9da1c8000
27994b3f209c967e37970d872653ac1491e9cc374356b41b59f2ac6e79ead2b0
5ed50dc45d82af9b0d7efa545b2bd94e6e8598ef96741b40090129fee9a6fba7
813b8b26db590fc346a8f2feee33409f46c1066cace60353f29725330193b5d7
618dfc008bdb3a3382b14ac227b0fea281aaad41f3ebb38d6596bb37717843a6
4a3ade44ebed61b0b5c86ced8d1e85ea3ce21981a7f365a0d8d1c25c014e2ffa
29a50b67b06ac1e762d2b7fcbefd9dc32acf813a68c437a9673e70dbfc3c9da3
4458ae6f0ddafefff59ae71480e104dbe486a205219695877e2652ce3865b933
766bbe194f281546b2675c63ddf61c89fa005e6cf6734e7fad4e74392f87821a
35fc2c38e0e4afb2068daf99019495b9264f8c44d5db3ba6b6aec5d389f7207f
f538ee8501fc30e1c4ae2fa514858952069c77db02f433c7211361c7de4a0342
fc6cb533a710fa5bdaba2a06f103a8147b78911613d5ec0520bd0c4282c49acd
dcc6711a8116b1e24aec79e5066b4aa738c2afce77656c5150bb3326aaf8579c
1f80bc1a597f55db4ecbf15b6485381153514e782469db4b9e64ddcc2f8badab
a05e4ab8c16c70515ea939a15cd9498e94cb939b600326d18937aa515e3fe8c2
a4ef612e70535abbbdb168a51f1d7e524ea19747e93616dd5daeaca728cb1fb6
0e7f4733841d308e03be632e980133f37432ec209e5f755a6f2f4365153279fd
76cd96db24625e3d9ae47f7618ac30591f6c15e7b4a3446d57c03f586737373c
0d782eae48a64d70cf4a4c87db6d0d0f5410f894b0babeaf927352d4e2574029
3722e38dfc6445a03e843fad423a8f401c24465817c2c65c7150d459851f9e1e
dcf2062518f5f3fbf54499fbbe8ad8c1ab2b26dbe92ab36f1be3720b61d2808b
31269fda4663bc5f6bba68346a4d151ac496cede9f82b0efebc3337aeb4d459c
618b59745eb94d620354bcefe413d57c1d937bd7fb15193c7388e8b2cb8ff79f

http://threemenandamovie.com/80cpPqqvN/
http://www.shop.kaishclasses.com/SWOQMT0yK/
http://carbotech-tr.com/R2QbHfp0g6/
http://yunhali.net/wgY34DKiTK/
http://vcpesaas.com/u1yK11gR/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 02/13/19 ####
```

79ff5d22a89b1aca1f11d367b9747e079b4525905b9e82a087750516272f4531
43423d82e33dcbfb44b753cee3d5a881e73fecf4f792c876bf8081c7ec2704ec
682b02b1f671242aef2744368015828cb0347f153c142e15da57ae01e3b4594a
0ce690cb81359ea21f0e6122c3472bc3226ea8e58e7de26324a316f339f066d9
4544d7f484afe42846ffc029ec01af1aa4a0f83155cd750c5197277398d373b7
a1181f21d51db3d77370f22d19e5612f0687555153e1c5f7b2147532df46c518
b99ae42bad52bfce2379b367cba82431a39d1e07dfefefd8f54adc3fe54c849d
5bb735f2a20c9afaeca4fb1cc3c1eaf21885f1821a2ca5f51597b3db5ce35db9
132059c882c33da8d0b66b2369aa046a8f6f0e3c7650f2be3d953cb9f2fb5e1f
f22fba7835f57ba28c8531fd9b5e5a09d86a77f17cd6b7c954af833d293b589b
5b3c4ec0685377d0e940fe69c5a17378f4a281cc4df889bdd125c3b51fa266e4
463c51256e38d76209d67de8064474e33bdaac01776d0afcaa15b381da04dbbd
1b6cd280b78f5a54d22fabc91dc3d6c9209622ada66f84a357196fb0226c6a5e
25aaecf7f0d2fbaf8860b11c8899982912aed82d8387e87d9938bcea89a0ba8a
fdcf53bece72f5fc1d2f8f1ae3d66bd71c7c83d76911898d4618b03ce2484f1c
3600f92d0ae57d6bcffcfdd613399282648f8822fb7632f92b6ada1d09c147b0
e1b08e394b1cf4ae1aa7d9be1aa65c868e1a8f5039a311df6f9d240ecf0b99f1
6062bdc7516373893f784d3b7576726fd99acd0369f74653d8f2c555d1ab8764
ec1e475c5046c3e5a4b1b3959dff2b9f056a37ba50a0fa666e3a89d7afe41597
63ce82124d8cd0845f3673c84fde4bc80421f836a4bae7df51e926b341722d2b
cc00671dad8af635fbd8d05bc44795cf7674bd70f729541fbda2da7ec4bd1721
79920881aa7435e36a7c1f8e70221021d180cd6c20bf86082445fce8c5a46006
2bae26b1821a5e9fb4ab4c5d5f630991999ca12ff1965a259805759fed52bec9
ce6a4e3ccd4b3adfa4b4ba9f1de3ad1ebdd8338b1416acca6c1128adee7cc5bc
d2e3f18bc0c11936ea764426bd7abec07de03d077620cc76ddf3cfd4f05d702e

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-13 23:48:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
f12c3d3147732dd1837e14f342cfd70c082708124d97558c9c5caf20a100bd3f
c1e542cb3be56dce530c4b97765a172a94d7b2b3e3cbf6d9fb2e23f2f10f8fb2
2f7248c175ec1da0279ae994e20d817c5d82a0af4ae77989868bf64a501b60a6
88eb0f7bcb66bc62b55621f50a19fb923350453cd6816cccc422dc32d9dad59e
c38e6b749e64976caac387bc52fe55279fdc9fe2630995626efdb0d9fdaea731
ff3f4879e17cd72486722d1712cf26a8d7a8f2d1f307d927a7940ed9e5be5330
88a2c90031155ebd1b406fe1524664efb62a6833512db27a98bc3c6416462aee
a965da800c5e4ffe753e22557c1746d63c01ba6c08280b853bba4a0e72e779fa
4068918e0d70f988023b85ebcf4177aae3f893604f9cc8766d43bf4f0c9266ad
8c6417f6a9d2d6256436c219e59232c0fdcafdbcbe8182b36c1e0370aa4055c3
79efd0c5cfc8f807bd4a3cfdf8994da0bbdcb54dd7d0e811ce291efbbe9f1502
139d633d16933b0d389164796f9ea35f965376d38e39a304440c7b9a4c245dbf
542577becb112330695a96e67f02926bd57020637e6a7756a3511711383550f8
fe543bf0b5918614e53130a7358098f6af1d7650867c7cde2c5e1cdd2a36c9f1
6c4a90e858e33965eed2a0da8bb29fa58c4b52a94824e57f4028d09795638dae
8ddd163ef158c0f5ea2c1b50029b1462088e5a98805449045d8d25e2cf6fe207
03c228319f317c2b78d1a041e396dddb067b2072f7d21d73db0aad149548c865
c4d5eb16e247de7d862e97622bfc7f1c37ddd21e73ba80e706cc7d10a5dc29bb
6f8babc146a8c3a582cabed6ef91731c2987f843e3a4623c0d951c0de13ee213
20fbb46e90f174bd6faab4af0d756c30e92baaf3b333926007a24434dec69035
052488cda45ad6ec29fbc46265495586eadd9e9e02b74f34b5d43b0a4293036b
dea89eeff5c8b4e855d406cef6954619c5add1eac5aac97f45407c02c141c2a6
e5c55d7780afd1432528adb675fa550097e850edc999ae28efcaaddd905573c8
78bb21dd9e0b70ad08bea194f26daead7af712907c64edc89e1632a0aea41c4e
2a9335e5a98d985878c7de229ee67ddcd92762eb1d875213773cf054af8412ec
cfe4efa103f660717a0fd3af9af97b5cf08fcb120c19a869c0f04d71a161114f
5d680196c68ac6029c83fdcf17b413e5cd82366c46326997f8b608b0e94d0de7
5072a0de55aa41713827fe476ba832c622bb5fc412b1ffc92fee45f5c3237e29
e299f7a1b7b7de00850d383f989bc12f1c16b06f6b1646f0b375fa1a452811fb
2d4d7fb923bca4b57f355c1e99ccd3f3057be2a7251db9c910b2f025187d0a56
f8a841f2d60e35c4f6b5651bc77ec27ee0ea378b5805d791255d92340a2fc1d8

http://pro-obed.u1296248.cp.regruhosting.ru/l29uxpBrAX/
http://farmsys.in/N9ttrjKXR7xE/
http://everybodybags.com/hsBstnnD9s2CpH/
http://eyestopper.ru/22h8ErlH8uzqnbb/
http://kuhni-vivat.ru/q2ECLyVCmWNeG_z2gp/

Creation Time	2019-02-13 20:01:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
fcf9df1bcfc715e500783fbf17c8c722195ddc2c904bb92b7e6592c5a506be17
13030ab37d594aa9d94a0f8dbcb48f69815fbafa762f1adf25dd9164f7f6a722
5c87d337b594116ce60ae86b48c1c3ba52729bbaf2ad104966efdcf4060d73db
23a64e615308d625887475fe88e312dc5587298739f7ef3a2747ec7169a8e5ed
3ca6fb7b3c14305a0c058bd70064084e390431d479063d28adc9078ed037976e
1bda76c2ba98b86a09eedcd6c61ea967072ed354eda52de12da7bdeb94c028c7
ee5cac2feadf5ac1faaf2140aecc3025ca6d564f3ded2ad3e1669be850bd98f1
14879556eb8860a2715d97c72784359bbadff250f88f23dd04d4cccdac7dc007
cdb02a66ce1bac81c2ec4cb7c30c1e5ccc1cf40a5443f086fe5e0194a44eda09
f6ae9d88d9b1a62209b3c09883907169d8b2e7205b301ce148969fa9a5ac5eb3
7afe82f46fd35382d90e6e1b080e031592b4294939056cfd152f2af7c8ac7338
305728b912ac45e6f9bd2dc0e4341038faf9c4db0beda74a9d990202984f42d6
87476cb142b08b99b38551267bc4c4012d3878b5dd3e12ddcc6e640df0248cc0
7d13b50b4660f44796587f9c06cc69f08e4b42a6b072a841206e8d29f768054d
f2b87084fd7d4a484703f69de9d3cf58b0c897986acf91b3e31b42819e96ad9b
df0b385295b7a32fa230b90b99abb754549c0f3284e3447653fd81092fbe16d3
460194fa3ba0f9b9179be9681769fb9ad7c133b7c320f58620844771cdc3949a
61e5ca9f1e931ff8882f60251afad2cd028d25522ba76c23351e10bc36f445fc
75c7c860e60286636e9d1123b4f15249f99f8db352e4cdeeb6d801a347ab263f
984a53018dd913b82bb05d824bf31f259a0b5568a144d348a0087f404128c468
c540e1e175493947abd9f110ef717ddf1b23c8202e5867a137a58cd5bbb55c0f
a78e5bece22ad3a02142966a716039213bee06c8fdddbf8a01588428515874bb

http://52.236.174.152/jvWJzuX5kVly/
http://35.190.186.53/1znMVkdMfAPn8G_f8vhtU7XS/
http://103.254.86.219/rdfcrm/custom/history/tGT4LaJxsnASp/
http://159.65.65.213/2TsF5icjLdR_6yyM5jk/
http://193.77.216.20/sOHJcxww2XdiSVz_e/

Creation Time	2019-02-13 16:53:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
371d3f11c7cbc36239676b3690bc970604fbf547f35d125d006de30c89f884fa
5094247357495554d383011af8c71e3439227ef86fc84faead93be595ff773ac
3ed49ee4c91375b2cb98d742fee27f74d7023be0909e7a81ee563be68c90d96f
2a864cdc72147e676d02a461b5752345b1627d4e42d4e1cf292dc22ca7ccc103
df3e2b108b30b7a1151160db533f05c26ef845a7e4411116e2cad0fc47902af3
14746ba97bcbfdf3eadc4de6807984c44fdb4749195937c9fb6b6f4642a62347
235a6fa22f1fe41c21f3e797e0a89cb5936856028384b1c9ae71797ccbe01973
88763b972ea516b103245f37f6f865ea2383fe18abb2be54049d2c1e309939bd
0cf39d99bcdd0734e95c8330830c3a4fd66b19321a4b324fb1072251739fbb42
e303dc7be41b32d961062825848a25ef5de66928788a90f676add092cdaea75f
fbc65fd2d9679ddbb51c60883b6ed0abc6fe6a05d8b96e6261c09c9c18293eaa
834d7290c5b4eab6354ae9846008762df3a8141b3926d1fcabe3b1ecb56f704b
b7f94b7a0b316768f0605052ac24265735874aabefc4db75f90332ebb57e357c
4fc9d758af41312c31e8404d6fa1ce3486a518119701739b321eb6ab1d2fddc2
a29050cf42eb42ac0f2bd0f8b09a8d5b9db98d3bd58b5988ecf704ef1e6f33e1
523c14fa073ec0b6b8faea8621118aa495c434badb475dcfc58e5cd7bdcb0b7c
5205bb3ecf08a1c9d9c47f9bd4b70724340034bee8b6137b53682f8643e9daba
480c061a4be0f2ad02f4f02b13f26cd2fba83f41cb9520adae821fd41b3a57aa
536f390311a4b540cf5768da255144c24cb47d84ac3ed2b99ed11703f18c3862
aef842a602a410168ac11b1c17686fb7abd557591bfdd2a88d63d089c1e4f912
5ced07a0df00e724ebb62e744f69a4bdc4047a364258a794995845fb3e0aa11c
f11689d6109af04fcb0666e36be4fd5738d72856e37195870d715d64875652f3

http://159.89.153.180/PirPKmVSvCUrD_faC0bF8/
http://207.154.223.104/usgfmGl/
http://zhiko.ir/5lJEfpVX9e7_6Hm/
http://pro-iherb.ru/IeuJlgdj6_D/
http://varzeshpress.com/wp-admin/7W2CoXQJAHI_8PXLADey7/

Creation Time	2019-02-13 13:03:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
9c10e1d6e107fa755cd741c294765fcf692e12b67696c49984594b72cea1cc67
e2611ace3e10fffa9ce9ca980d7ec95a38d8b2e2bfa18f2db108989cd6c09792
d025ffd8f6df5ab50fb3ee7f6c2aff4f4c7bfa1524a41af5102406e1a3e3ab76
d5730f24551f1eb9c52e83f4572eeee3243dd5324d8c620fe91b94a9c7fb1552
88c352f76c8e224571c55c94681d66b65389521d53b0f85eda14ecebdfab74ff
5aa461045030040ce7298570ce74964c9add4de55a154552109228b65acb522b
1f0243688bbbeafac3da73172779abaf062c3babce6a96ffa4f8cf7e26575c7b
369708bc9937235978ffb8d809722814536ee047dffcfc50c1ed09bcea6eed7e
cb241768197028432198ff735ceb5260da13624748e46b384d75dc8d59b85bb6
64694ab774374279c2b72c4e58a8dd481f4ebfe53d6e8890d1de9014ceb541e0
e4265a53345eeaca82917dcd846c58ac7d4d6dae1f99055d9415a5a759b5650c
53bfebe9d98dcb2f31bba66c17641419467aaeb230b3e22d374e1fa75678f3a3
c33ccf1f2cccd5b6bf0c64173529b2369b21cb7711671f5eb39ac10d6280d5d8
b8d030c7d0228870de8bd65d62b13804dee44269065314ccffce1a4bede371e9
84913b6588da3e062ec350eb91929979cd8f9592778d2dc107307acf2f2bf05b
e979342ca8e2b6fa4c8bc60fa4e90e6be493ca73c199d04635d8f68423bb7927
c9ca949f047f829f579b4cebe4a5deac8e75565fe69a01fbeecf43ff03fb925a
a0d4bb6f46609ea18344a82ea724601abff30aabd93ecaf7ce5bf4ae7348460c
ab43550acb8061c77b7e89e1b14fdf8514378c596fee88af2016214f593ac789
9f51918746416b2d8b1d6062030afc723ea45f65a97b29737aeb7fa0004ebb2a
6e53b891aed384eca0a218eb9a7944c3b3b08809caaa7d998bbfd5979ba339c3

http://www.sweethusky.com/AOqo8vpAhh7q4_YsqQn5/
http://mahaluxmibricks.com/yQxPKo3cK5E/
http://nimitta.life/3T0kP8twlY6d/
http://davidemarocco.com/CXwGuvGGCpO/
http://magnetcard.ir/TMYqoqc_rmwcl/

Creation Time	2019-02-13 07:22:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
21bb40ec221b915e0740c9505c1ef227f4d17d80b0cd4c4666b68d00e760a814
814fc239c1d7adf7b8566d9a2590941cd36076d9d811796d7aa0da770a858f47
14789fb215cc2d03e2758deeeb8f0e96f64ebd5b097495e32109f93104d18c00
200c9a7142fc66501f2d9d51e6c25dfd7cbfc9b7892ad9f92feb8c849ffd8876
8f79767fe9ce914eaa39d59b9909c3be5c026953415c7d8e926f8801414522ee
a2a9c7f6a2da84c4db5e6b724cb70064ece346550df104b35a4cdf86eeb97056
8645082712aa0dd22084f7ac5a05e5734219b9b56cfb5635e82a4addadd3ce8e
97553c2b1a1521b54b7c8bd64de298f32e8ca853a3362b61437086ce5d956eef
eaec15b385dfbd29a26ab5e6f58a85662c3e1c0f3d7c862779836b30083ec1a4
8e2adb3657352b7f44388bb55236a370e78d4beece031045d91e4bcf532114f6
0a6f9353d2d75aaaba7d92887c17d12f85a069a6445e69c9c573cc271578605f
3db73446abcba2bee46adbf3aaef02d262f9f1714e6ee00a0f9fef3f8863e770
a4c962b9ef464b863c431e03ad9ecc12361aea397028b0f3aa8a0b02fab6ccb1
276a772e34632e0f02997e45c48dd161335d9c1bc0bf1a98e4117d9aa719ef0f
d354cdf32147b8f652b6782180cc39a45400663810a0f7485280f781e07b404d
59b3060f0d64fe6309dbe03e038f2718b0f76007f2bb5fbd1c62bc4216668cad
d11bd02787f71befabc66b6b59d7636a800df74b1402b186055502a2f5f194e2
ed6b61fd97fcf29a9b548ce5028328766a45b30980f8a24c7ddf201a9fe304bd
24a58cbcbc314ea1d72a0ea1cdbd8f46c1624cca315589549fe77cc2e916bee6
09c144d073586057a18a9c3726acbee30d98f513645c4bb723aab94092120b9d
7464fe790432b4c580c3cfd2450c3d8b6b1ca5d1c06be0d317941870e5fd4f6f
a32cca9e83cc5f3e7366b9eb313fc5899a8acba8cb34b2ee404763a5952f89cc
a2bccb866ad22237cb80a8cb906492e0916870c21f842e50ab48edfb3ed8d95e
ddd96ebe81d58702ea97e05d70d537b7c8fa8338b0333bfe31adb59c9beda62b
b06a5c9940e273b868ed3065c5df153935804dcda242b39946abd37b55af118b
482290fef437231fd754cf8830a58a327110a9456717b6bcf347f88f980ea550
9ed9c72e286a6a125178a2e2c43cf487a2b1ee9c0460f44298b9aab8b3f30a96
6ae677a4163ad569ef8976ef0c53074ec56260578ed742d05343928f84254fa7
c82723c1500dfbf7d646d542c3d2090a7efd6c46aa37aa34996b8e6b48a20288
285a9bf1915a90e289f32fe471c023d4524fd96c990eb759f8985a1396d9e8ee
ccaa86a17bfc8359bd5d4a6df69bbfb1014290dbfeb98e78b0011163ba85d958
fca9b9dcdd866545b0eadab66438496a43368580f36047c1c4933cc9dd8fc196

http://cpextech.com/XoSu0UFgeRod5G/
http://parsinstore.com/alYc5u7PCe_w/
http://happyfishcompany.com/2vqObycriG/
http://midwestfoods.com/wp-content/odbfx8yt_5yvdgPL6/
http://nguyendachung.com/wp-includes/baxKC0aEHBtA_Hhay4/

Creation Time	2019-02-12 19:00:00 (Doc 2007 Based - ENG - Zoomed Indigo/White)
SHA256:
ceb007931bb5b6219960d813008c28421b7b7abfcc05d0813df212ddcfa5b64f

http://bignorthbarbell.com/yuf2G22rSI3c0s/
http://mail.dentaladvance.pt/iyRttLHb/
http://3d.tdselectronics.com/IWZfq9gD/
http://greenflagtrails.co.za/HOHvd9NFU_BaZ62/
http://kuoying.net/wp-admin/NcdixzAUZNsxHs0_8DoIcKe/

Creation Time	2019-02-12 19:44:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
4d12ed34441fe2e465f3970728abffbc76d5a588b39ad3161f2b2dc9fd711aea
2a82e054cf0952cba51ff4967636c4d1c8e2360ac42c1eb7413863980426042e
a5394b843f84949178acbd4d4533c08009ad11e474e3ebdf9b16e251accb2ecd
3d80603be0d5672f12c6e2525974687f78d2edda7ee817e093e947f60537b2ef
1d341d716fe5ce577b3cc061913f8f1dd133263d654d3810764864b389023e3a
76ba05fb7693e6f73095e182751e2b8ca5383a9ad826a6c233976d45d398bf4c
80b58ec414425dd89f34d2d46622d6707e16c1181c04a86ae18279fe3c9d7793
aa8f85055234a1315feef510b177289ea9ab9417f287040fa9fc5eb99d0d8a30
0f4869263aca0033a984e987cc96fcc19dad5dbc3fe6840864d87a45abd48554
ef8df1bdbc4be0f037360baa4c719be4848018cb76dc85e6c298b7e5c0c8708d
a55aa934cc7fe5bf206b1930c7893a2fa068763d2656d36259ee1c29f563f681
481931d27496fe2ed1f13af908e7eb1917429c43a7ab2db6177cdbbb5601e902
e9cbc12b2fa25b7ce54fe396128f702718fd89c3b7ed3ec6ae1f3b5c17467a98
248bd5ff6a4d44f8e54b69789a8a322e89fece8e81d0b703695198e24b4b18be
efa318382d151b2b3bb24f127f7e1b8294671a30072e036c4fddf0787399f445
0724d302fca719266eb7affa0678f980b14494a9a5cb691b109c41dc9d60873c
4243d427a13e1d07448aab7d8ad2c31700bdd002c5e05d81e9602c32877ed2a1
cae5fcb92271eac3f193651511661e63dd090391cb5f46107e222506bb15c46c
c6fe62ccd70ee860b6aa7f280368d2806162fec09376d8c580ee8e707aada495
5efa7772a4b59015846e9673ddb16b75245e43e7e561080aedeb4962271245cb
4e41e9af78f6883063e2adb3569a6016e9b3e05e01abf2267426e0c24f97345e

http://bignorthbarbell.com/yuf2G22rSI3c0s/
http://mail.dentaladvance.pt/iyRttLHb/
http://3d.tdselectronics.com/IWZfq9gD/
http://greenflagtrails.co.za/HOHvd9NFU_BaZ62/
http://kuoying.net/wp-admin/NcdixzAUZNsxHs0_8DoIcKe/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 02/13/19 ####
```

70fd7eb41a4c8299db3d589e9ae3e3f13b0beb9d0a3aa7d4a256ef6020bb1640
deaabd909eba1c0884eb8d8f51c001133d9ed02c1e1a0af433345ca7b219f4ae
52d0c979230296f4ecb625f7e3ffb2e29ae483e31b4fe3745f97db838a3a52a6
f5355e49f9339ea52f1880a2d28409259377ff0203f205c6fcf24d8311767688
951371e4eb84feff4bc420dee46861527abc3ce3e8c30f48c9f1230f2c400dd8
3edf600ca69b01dd28ee138e3339a4c2d1a291e385f40a6a8ad753f3e6c9b6cf
9f4b4d9bac1de776a87d0f8aaac913a400ad1404156e25c969337c22fa218087
a2ff8474a4a5e40b6811ae9f507869caf13dafde423ab02df9646cbfaed14a7a
3e3c9c02aaf669fd8163d5ba273af06f87edfb924356ef8cab7db4f1f633ce02
868dd68adad44a58550097e4a548e748108be31918860aac26a0f8c156a892ca
f5890a6654d32803e04067034ca414f08800b26eb418ce6178e02fb90ccb143b
bdc8fe181b88897acd98f44716356bc207f5b6b502c2d0507620387839440ce2
e68c19a5ac4da8ef2545ed46a6b309df04d4c4dc59b3f9dcb6252f7b56972813
3edf600ca69b01dd28ee138e3339a4c2d1a291e385f40a6a8ad753f3e6c9b6cf
c1656d535a988bc7b9f2c6a618e3b399637b56aa89554caabb2e623ab76adf5e
df25d1ca6cf92c922c852a7166ac3d5e832b6efdbe7ebe46facf6ec53019e54a
0cbbd13e0a79df3a9ce93e281119d764e05bba51ab79c562ea7677c312b8b777
939ae62589694effb6767f7d6217db30acca561d60ac9ac589718d428333860a
f2990a95ed74b5fb9dbb19f39efdf3ce9dd8c5da4f2819c43e28742cffe89219
5e23fde7e5c00b268e534911900da319eacae2ed49823f0e5fca31b34a443c3f
2dfbc59610d2b0bf7ebb4afba043b6edf600916868cbc550e5599179f5c7092c
2ab97e1560bfffa42fd24c206556e391b67419916fff759a638dbca644c24284
0635a0da1fc79d1edca1a55c9253430aa592f1a88d0eb06f72716e32776a0842
90cb1d3a393cdc6f300006aefee91d38d14b67fd5dbb8fc60c6c07ef4456c9de
f9a9bfa1354af89a5709ad0882fca24d3ffffc406750bd8519ec6dac177a3ea1
79333259cb46279c804cba748ce67ec87edc25c49935d040c1e0b121152fb054
7e643e13b09022d0235ac034fd3a314d273da53de20622150efa48212c22affe
0cd9bd97fbd6106f464b34e4d8f780c1febaa465e9bc98bc6c11f1d59b5bbd2d


```
#### Epoch 1 C2s ####
```

104.200.80.44:20
109.104.79.48:8080
12.6.183.21:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
181.15.224.57:80
181.167.251.10:8080
181.56.165.97:53
185.86.148.222:8080
186.4.127.72:995
186.72.205.234:22
187.145.0.129:7080
189.173.176.115:443
189.178.109.181:143
189.183.68.180:7080
190.117.226.104:8080
190.186.110.202:22
190.96.172.225:8090
192.155.90.90:7080
192.163.199.254:8080
200.116.200.136:8080
201.212.113.14:50000
210.2.86.72:8080
219.94.254.93:8080
23.254.203.51:8080
24.194.252.25:80
24.37.161.242:80
5.9.128.163:8080
51.255.50.164:8080
51.77.109.100:80
64.40.163.8:143
66.209.69.165:443
69.163.33.82:8080
70.167.72.96:143
71.40.213.82:8080
72.47.248.48:8080
74.45.170.110:80
74.62.52.222:20
75.110.229.201:443
76.94.36.57:80
80.15.172.81:50000
90.63.245.70:8080
92.48.118.27:8080
98.121.75.14:80
98.238.127.216:21

```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
181.169.2.89:8080
181.58.30.155
198.58.114.91:4143
216.98.148.157:8080
31.167.70.26:8080
64.178.246.207:8080
73.83.148.166:443
74.57.246.27:8080

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

100.35.190.8:443
107.13.149.212:8443
118.130.116.170:22
133.242.164.31:7080
138.201.140.110:8080
138.94.252.226:80
153.121.36.202:7080
169.57.61.42:80
173.255.196.209:8080
173.255.250.241:443
178.62.37.188:443
184.186.222.145:8443
189.222.174.85:8080
190.114.242.130:20
190.183.39.78:50000
190.40.100.7:8080
201.211.167.72:8080
207.119.180.154:80
208.78.100.202:8080
211.115.111.19:443
217.13.106.160:7080
24.173.121.154:993
24.227.158.234:21
24.228.124.151:7080
40.132.40.83:443
41.21.224.121:7080
45.123.3.54:443
45.63.17.206:8080
5.230.147.179:8080
50.31.0.160:8080
50.80.9.93:143
50.93.34.66:443
61.76.180.18:443
62.75.187.192:8080
62.75.191.231:8080
66.57.212.114:50000
67.205.149.117:443
68.192.249.20:143
69.198.17.7:8080
71.42.166.139:8080
75.164.190.148:990
75.69.2.222:80
75.97.212.250:7080
76.94.226.173:20
79.75.233.224:21
83.222.124.62:8080
87.106.210.123:80
94.76.200.114:8080
95.10.12.151:80
96.37.137.42:80

```
#### Epoch 2 - Spam/Stealer C2s ####
```

31.167.70.26:8080
64.178.246.207:8080
73.83.148.166:443

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 01/29/2019)It has been awhile since I refreshed this section so I wanted to update it and bring it up to date.

I have been tracking Epoch 1 and Epoch 2 since May of 2018. Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for
communications. Epoch 2 is currently the larger of the two botnets and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing
version of Emotet at one point in May/June of 2018. Now Epoch 1 seems to be the smaller of the two since this time period. Despite having unique unshared
C2 infrastructures, these two botnets have been seen to move bots from one to the other and show similar behavoirs seemingly controlled by a single
entity/group. Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an Epoch 2
document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those being delivered
in maldocs on Epoch 2 at any time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and Epoch 2 may
have a document hosted on host.tld/B.
- The RSA keys will change every month or so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours to stay ahead
of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from is to find the payload and then check the C2s/RSA Key.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://pastebin.com/nyMReSRW - @Jan0fficial
https://pastebin.com/GZ1etXmR - @James_inthe_box
https://pastebin.com/efBV2MXt - @pollo290987
https://twitter.com/pancak3lullz/status/1095746290963619840 - @pancak3lullz
https://otx.alienvault.com/pulse/5c64ad26c4af270e238fff51 - @SecSome

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial
@shotgunner101, @HerbieZimmerman, @Outkast_TI

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial,
@OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Things picked back up for me today and I was at about 190 malspams with most of those being the Purple Button template with the same subjects
mentioned before. These are all from E1 so far. Spamming was heavy around 11:00EST and primarily done by 13:00EST. I received a couple PDFs and
another attached doc type malspam. The ATT billing template may be making a reappearance soon as a saw one of these come in late.

The other major change today that was found by @jcarndt here:
https://twitter.com/jcarndt/status/1095741218833817600

As can be seen, all powershell is now running un the WMIPrvSE.EXE context instead of winword.exe -> Powershell.exe only.

@Ledtech3 also came up with a cleanup for the VBA code here:
https://github.com/PCsXcetra/Clean-Junk-Code-From-VBA

C2s changed on E1 and E2 today. However the counts remained the same at a total of 47 combos and 50 combos on each respectively.

Keys are still the same. Not much else to report.

Till tomorrow for more "love" from Emotet on Valentine's Day.


```
#### Sandbox 02/13/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-02-14 at 05:00 UTC - https://cape.contextis.com/analysis/36963/

```

```

Epoch 2 C2 run on 2019-02-14 at 05:00 UTC - https://cape.contextis.com/analysis/36960/

```