Emotet Malware IoCs 2019/02/21

## Emotet Malware Document links/IOCs for 02/21/19 as of 02/21/19 23:59 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 02/21/19 ####
```

http://100.24.104.187/wp-content/De_de/AMQJRLG9681899/gescanntes-Dokument/DOC/
http://104.130.211.29/wp-admin/de_DE/BKUJRIV5425410/Rechnungskorrektur/DOC-Dokument/index.php.suspected/
http://104.248.155.127/De_de/ZJORQKX4764583/Bestellungen/DOC-Dokument/
http://107.23.200.84/Company/Online/secur/list/ujiByeGF5RoEEyegzwZoK/
http://114.116.171.195/organization/online_billing/billing/sec/read/w4q5Uo7KNjnFkIYrrUfVVb/
http://13.113.116.176/wordpress/DE/MJKTOMZR4714865/Scan/DETAILS/
http://13.114.47.124/DE/PLBXLZNHH3616069/Rechnungs/DOC/
http://13.232.2.61/wp-content/uploads/company/business/secur/list/5utiFtsfe4m1WFMWXPG/
http://13.251.144.86/DE/MXYOEWEXAZ2393991/Bestellungen/DOC/
http://13.55.221.15/wp-content/de_DE/LRNDSYPFT6585983/Rechnungs/Zahlungserinnerung/
http://13.59.135.197/De/ICEDHBQZA5558282/Rechnung/Zahlungserinnerung/
http://132.145.153.89/De_de/QTNKRZLH5339461/Rech/Zahlung/
http://159.65.142.218/wp-admin/organization/business/sec/read/j897y6FqeNTxGOMJcFaS/
http://178.62.226.34/photosite2/organization/online_billing/billing/thrust/view/uJwftYLqfUeej5Ice1mJf/
http://178.62.63.119/organization/online_billing/billing/secur/file/qGLZuP8H5UtyYWHHw9XcG9bKfF24/
http://18.130.106.226/De_de/MMTOIGD6534124/Bestellungen/RECH/
http://18.136.24.106/wordpress/secure/accounts/sec/view/VrZlSrqt4RgGGiPkqgb/
http://18.179.166.252/secure/business/sec/read/dSiJQXTERxJurLGrA5dG57/
http://18.205.117.241/wp-content/uploads/secure/business/open/read/WTFDUY315MuoYA6/
http://18.207.109.124/Februar2019/WQPDVBZH5734905/DE_de/DETAILS/
http://18.213.62.169/wp-content/uploads/company/online_billing/billing/thrust/read/REXdQRuFiTJ8UQOrtKX3DhNE4/
http://199.43.199.16/wp-admin/secure/online_billing/billing/sec/file/WEnbQsfEIWOI8DTOwCEPA/
http://206.189.181.0/De/JFNNQGBB9249994/Rechnungs-Details/DOC-Dokument/
http://206.189.45.178/wp-content/uploads/secure/business/sec/view/rmkNcaZisc2JYfU/
http://206.189.94.136/organization/online_billing/billing/thrust/list/EVbYGzyzzeHQPK8Gy/
http://3.121.44.244/wp-content/secure/online/thrust/list/aWAmsiXqfMWfMQ7OEnPOc/
http://3.87.40.220/DE/CCXVOODB6153566/Rechnung/Rechnungszahlung/
http://3.89.91.237/organization/online_billing/billing/open/view/Wx0na6JcnBx3dVbx6yI/
http://34.224.99.185/company/account/secur/read/o0x4ugas5PadGjCnHe/
http://34.227.190.147/secure/online_billing/billing/secur/file/XI59H0u7ufW3mp6fkh/
http://35.175.200.75/company/online/secur/view/v2039QibJ6qHh6MovNqpfFg9y/
http://35.192.67.231/De/MUEERPW2483146/Rechnung/Rechnungsanschrift/
http://35.200.238.170/DE/QLGNVXWAGD4073361/Rechnungs/Zahlung/
http://35.201.228.154/organization/online/thrust/file/3LHmAxy6t5arkBRUunbkO4Fcm/
http://35.202.17.56/wp-content/company/accounts/open/read/GP0AqnGhWlOGyJAV0YV3/
http://35.203.116.213/wordpress/DE/EBFCVJZAEL8485365/DE_de/Fakturierung/
http://35.224.158.246/secure/online/sec/list/9Nlv6G5fedNePWL/
http://35.225.3.162/company/online/thrust/view/5EN8nQCbqHFuzYHx6m89oWBRaHW/
http://35.232.194.7/organization/online/sec/file/kKq6HV6QXvwANW8r21/
http://35.239.61.50/secure/business/sec/file/NBQzjP33uX1jD6pSH/
http://35.246.241.107/secure/account/open/read/LHGw3JZxOfJNeOtB9da67/
http://35.246.241.107/secure/account/open/read/LHGw3JZxOfJNeOtB9da67\/
http://35.247.112.235/De/ZCVTFIJ0800509/Rechnungs-docs/DOC-Dokument/
http://50.53.45.102/secure/online_billing/billing/thrust/list/4ifNAdCT9yhTJBsSyoNx/
http://51-iblog.com/wp-content/uploads/secure/accounts/sec/view/6mZFjl9C3pqp3RAeNStjBLNQtFC/
http://54.172.85.221/KHHIBW1641608/GER/Zahlung/
http://54.197.30.41/organization/business/sec/file/tK3CCVIOgI9tMNkZR/
http://5hbx.com/secure/online/open/read/Bll40Xs1Pz1aKrvfqnay5MGbZ/
http://73.114.227.141/secure/account/secur/view/8WRv4neE0G270uBDi0/
http://78.207.210.11/@eaDir/De_de/EUXFSLYLHK8552945/gescanntes-Dokument/Rechnungsanschrift/
http://89nepeansea.com/secure/online_billing/billing/sec/read/7Erq5iKs7bUIr8nU4BeIs7iII/
http://abenefits.com.hk/company/accounts/thrust/read/lgNexSAOA0Qv8OdjZwu6Rrgs1w3v/
http://acdhon.com/DE_de/ZWORMBOSOP2547152/Bestellungen/RECH/
http://actinio.com.ar/company/account/open/list/Wlprsj0at8sGR8wMmF49A08yAAh/
http://adenasaman.com/company/business/sec/view/RaFTkC38CQhjKDil/
http://afrominingtz.com/secure/business/secur/read/EqEFaEKDGZl9nIlK6KcJ9rRRXk/
http://agemars.dev.kubeitalia.it/DE/NMHZRWAVC0941356/Rechnungs/Rechnungsanschrift/
http://aghigh.yazdvip.ir/secure/account/thrust/list/Vf8CIZ5372MssNTgMY28K78FZY/
http://aghpl.com/secure/online/open/read/jzpcGPWYd4ABT1g/
http://albercaspoolfactory.com/organization/accounts/secur/list/YSyp6O4OHM21J9GKNr87mHHIZSc/
http://alextip.com/organization/online_billing/billing/secur/view/j4WyqmQcS5HaCbiKkbWuIFe/
http://alfomindomitrasukses.com/secure/account/secur/read/mjXSX6O5EHSuQDnp/
http://allaboutpoolsnbuilder.com/secure/online/secur/view/RSAbw2HCkErl7cWXU/
http://amare-spa.ru/secure/business/open/view/f4t5ZkzoSOQ83rUaf/
http://ameen-brothers.com/secure/online_billing/billing/open/list/l2WGRE7IXUCA4Qgvms7T6/
http://amlak1316.ir/DE_de/BGXYINYWPT4035831/DE_de/FORM/
http://amthanhanhsangtheanh.com/wp-content/uploads/organization/account/thrust/read/QGYZNzSofbXVG5eA59aG/
http://anpartsselskab.dk/organization/accounts/thrust/file/mZOTvS1bt59yjEHHH/
http://apartamentyeuropa.pl/company/online/sec/view/BtLRIjX59vLoYlIaup7YYwMx/
http://aplusserve.com/company/accounts/secur/file/nxeryqMZR1COJxaSmqFEfyAV5JQ6/
http://aquilastudios.se/De_de/XTZULCD9531673/Rechnungs/Rechnungszahlung/
http://arcpine.com/NNMLGU6236452/Rechnung/RECHNUNG/
http://arodannovaplanta.es/de_DE/ULLKFJDFF4627846/GER/Zahlungserinnerung/
http://art-by-the-yard.com/organization/online_billing/billing/secur/file/WCgbYgFpSe0ApHgg/
http://asabme.ir/De_de/MHSDVVLD9080254/gescanntes-Dokument/FORM/
http://asandarou.com/organization/online_billing/billing/sec/file/PWJB2473K10oSL53/
http://asfaltov.kz/organization/business/thrust/file/Z2dXMzlpHewao0HvPxCc/
http://ashwamedhtechnologies.com/company/account/sec/read/UsEmaK5KoBf3YfDoeM/
http://avis2018.cherrydemoserver10.com/company/online/sec/read/JZfs4outmFUUL3PbdKyVqvvXcQ8/
http://awcq60100.com/company/online/sec/file/Fajq2at44D9LxeZ0WmKGkOnYf1XY/
http://az-moga-angliiski.com/organization/online_billing/billing/thrust/view/xiF056v4gZjehDEQO62/
http://bangtaiinox.com/company/online_billing/billing/open/read/tcfIO0MpsuA5MRs/
http://beautyandfashionworld.com/company/online/thrust/file/dvr8MntetxhB5SMTtsBu/
http://beepme.eu/DE_de/BGGWVOKOW7997274/Dokumente/Rechnungsanschrift/index.php.suspected/
http://beta.retailzoo.com.au/organization/online_billing/billing/open/list/JL5O931BXncnF7m043KT4zk/
http://biankhoahoc.com/organization/business/thrust/list/bcL7aDI8rpzssnYLra/
http://bizresilience.com/Februar2019/HQVVQHGW8580256/Rechnungs-Details/DOC/
http://blog.aliatakay.com/company/business/open/view/xvnFfSi0k8bpau0/
http://blog.piotrszarmach.com/organization/online/thrust/read/u6OOgUPgIte22IC1NSZGmK6AtFL/
http://bobvr.com/secure/online/open/read/kvXVf97Yc8my5UbQYTdVJpp9L/
http://book.oop.vn/wp-content/uploads/company/accounts/open/read/BrP5PLO7FSsqN6brudrf0/
http://brandradiator.com/secure/business/sec/file/F7MGV4qsimG0oqWDCcwQoit/
http://brisson-taxidermiste.fr/De/JMCJXDLJVB6221669/Scan/Zahlung/
http://burodetuin.nl/cgi-bin/company/account/thrust/view/DTE7sKc37irpDMeqW2hCRd/
http://caaw-asia.com/company/online/secur/view/mQsp2HBnKAvpvgkbjBHFcNLT/
http://canhocaocap24h.info/de_DE/UIVPAXRRES7413316/Rechnungs/Fakturierung/
http://cash-lovers.com/DE/ERKLTUYS3001419/DE/Rechnungsanschrift/
http://chiltern.org/secure/online_billing/billing/sec/view/UxpYYrvnx8VoHYJn/
http://cmasempresa.com/company/account/thrust/read/1WF2iJLZNT9KLsNV/
http://cngda.tw/company/online/secur/read/WZIARwRNzO2JxU5Li4j4/
http://collabtocreate.nl/organization/business/open/file/6XQt5c8MXyQv8Z7ni/
http://contabilidadecontacerta.com.br/secure/online_billing/billing/open/list/udINp9Y0HlpSePtu3CLMMIQgxKx/
http://coolpedals.co.uk/secure/accounts/thrust/view/ECSvRvXxwRBrr0yNvqSXQajyU/
http://crestailiaca.com/PHXQOU0845448/de/RECH/
http://crsturkeyf.com/company/account/sec/list/irVFFvmRoN6Lugrx/
http://crypto-strategy.ru/De/VZTTOKH8096938/Scan/FORM/
http://curate.aixen.co/company/accounts/sec/list/9eiETpz0uvZxms9/
http://dansavanh.in.th/wp-includes/organization/business/thrust/file/zRJamFLXft8SfQWLE3h33o/
http://danytacreaciones.cl/company/online/sec/view/fQvMMLiUNMEt5nFMJF4I/
http://deverlop.familyhospital.vn/ZUCSWKJMO9174326/Rechnungs-Details/RECHNUNG/
http://digim.asia/secure/account/open/view/fkTfuyupTDJMwpqVecfblxPQTd/
http://digitalelectioncampaign.com/secure/accounts/secur/list/jtGcwQhnEpG2sH7r/
http://dinosaursworld2.gotoip1.com/secure/business/sec/list/hffehyo5wmB0wopsARoF7Gt4/
http://dkstudy.com/secure/account/thrust/file/Qe50bWLgyJ2aXzFTJvbm8/
http://dorsapanel.com/secure/online/open/read/tp299ND2Vi4JJX2xkplo/
http://dpnappi.org/secure/accounts/thrust/view/46mdSV8feQCwWQG8hb6/
http://duniasex.pukimakkau.me/organization/online_billing/billing/thrust/read/kBfJ7SdoDXKaXS6JeFzEA/
http://dztech.ind.br/wp-content/uploads/secure/business/open/list/BDdfem76rrOZaV1RmeclUm/
http://ekros.com.tr/secure/account/thrust/file/31PNJd8k9PNvSIhZsmBJ/
http://emirates-tradingcc.com/wp-content/organization/business/secur/view/R2MyTIfxORDhoodesJZVT6HqvBo/
http://emprestimobmg.net/company/account/thrust/file/8qdQFkjwscxFBhEQSJlHHl/
http://envi1.com/TUUTBFHRE4723469/de/Rechnungszahlung/
http://epmusic.ir/organization/business/sec/read/YnFu0JMIJPxeVJ5wwZxD8u5b/
http://ff52.ru/secure/account/secur/list/mdTBDCmgmxtE9hAcLPW/
http://ficfriorp.com.br/company/account/thrust/read/uy255I4lTEIJQl00Uv0nT/
http://fidanlargida.com/organization/online_billing/billing/secur/file/c1eMOzVnFdpil0HkUSkEAu/
http://forecast-weather.eu/company/online/thrust/file/0fM8b5ptCb8kYJw/
http://forexaddictt.com/organization/accounts/thrust/view/QSkHYzSbypdPy9jhdaQ/
http://forumsiswa.com/secure/online_billing/billing/secur/file/MVip6oh2b6O0qOnXk6d1t/
http://fp.unived.ac.id/wp-content/uploads/organization/business/thrust/view/b2rHQM1yUgR2MV8oU9oFpe1P/
http://frazer.devurai.com/organization/account/secur/file/8fdcqROa9KqB47n/
http://furqanyaqoubphysio.com/organization/online_billing/billing/open/list/Kis0K4GzAB85yLqbYOSlmd6qN/
http://galavni.co.il/organization/business/secur/read/IJJ8DJisOXCDDfqT/
http://gen.id/wp-content/uploads/organization/online/thrust/read/50vgImRJijhe0MstuM0/
http://gfe.co.th/company/account/thrust/read/DxAr3aKzcwRQBvIN1/
http://gk-innen-test.de/secure/online/thrust/view/I1f6nABv7RAgc5S0xki2nfWwYlR/
http://gruposgs.net/secure/online_billing/billing/sec/list/jaLVX3y1r4rcX2NAdTEN2/
http://halotravel.org/organization/account/secur/file/00Jjk1yPvWzusCHUFVT602/
http://hashtagvietnam.com/company/business/secur/read/j31fCHVr1Vpvkguy9auB8/
http://haunnhyundaibacninh.com/DE/FBXNJU6927043/Rechnungskorrektur/RECHNUNG/
http://hayalbu.com/organization/accounts/sec/read/KaiOuAIxwca0CpRuYh3dG3hqzfLW/
http://hdsystem.it/organization/accounts/secur/list/rPKkl2mKEVQ8lIq2Fr52c/
http://hellojarvis.co/organization/accounts/sec/view/7WV9D8vWsiVB1T2IiFH49CTFb/
http://help.iorad.com/wp-content/uploads/organization/accounts/open/read/188Ipby88cvybNUnYdnGL6qO54/
http://herewegonepal.com/company/accounts/thrust/list/SS9u54tuM8u33r1gC5IFGtj2zI/
http://herojo.nl/secure/online/sec/file/QOfWv981GnFqvVnOaAjQbQ/
http://hidaya.pl/organization/online_billing/billing/sec/list/YDmtnP2x2RLQOdHLauCuS/
http://hillmann.ru/company/online_billing/billing/open/view/ptcE7DoGkS0HzazvR/
http://hindislogan.com/De/OWIQNN6626986/Bestellungen/Zahlung/
http://h-surgeon.info/secure/account/thrust/view/gl5t2fvAiG1J9Ai7NQ0GNLUGi9U/
http://humanwigshair.net/secure/account/open/read/a9uHo3GBgyIQmMkpwARR3lcC3/
http://huyhoanggia.vn/secure/account/thrust/view/Sgg4Vl3mQAPGLp9RKDu5/
http://ibakery.tungwahcsd.org/media/secure/online_billing/billing/thrust/read/KSWTGFK7KORsaxyNMYHZ0rtE33/
http://icspi.ui.ac.id/secure/online/thrust/file/qrR7dFLAUbhYaAeoFdZQOfpN/
http://idecor.ge/organization/online_billing/billing/thrust/list/m2PcEcdPQCYdOdXUL/index.php.suspected/
http://ihsan152.ru/organization/online_billing/billing/sec/read/O3swsypBJA9Zz33nw/
http://iltopdeltop.com/De_de/UISNZHLXNH4502632/Rechnungs/Fakturierung/
http://incascomex.com.br/organization/online_billing/billing/open/view/h2AtuJWIPxt9BbPKiRUP/
http://infinityresort.com.np/secure/account/open/read/AJxSdXRxrdZHxfIqEQjGtk1bh3BF/
http://innuvem.com/secure/account/thrust/read/U0iISSf9L5jHGDkGKl8aQqWz/
http://intoconsultants.com/organization/online_billing/billing/open/view/OZrc2Wqzml87v70uslnCH/
http://intoconsultants.com/organization/online_billing/billing/open/view/OZrc2Wqzml87v70uslnCH\/
http://intranet.neointelligence.com.br/De/DKPSPKXEF2050205/de/Hilfestellung/
http://jachtklubelektron.pl/organization/online/thrust/list/2KiDx09dESihhwpLgfW/
http://jahanco.org/organization/online/open/file/f7sPQHGGLWcbiFo9/
http://jainworldgroup.com/company/account/open/view/mHJyZhMIubfyrNyjHT/
http://jamais.ovh/company/accounts/thrust/file/cGAzbjLyMfzBE8klDtN3m7Yh/
http://jason-portilla.com/organization/business/sec/list/dxLPkaBOK3svwhWLhy9n/
http://justbikebcn.com/organization/online/open/file/BpRLzzy131FgFdWxOHDAGxatRcHo/
http://juzosum.com/secure/business/sec/file/NwvufO33MflTdv7/
http://kancelariaolczykjozefowicz.pl/secure/account/thrust/view/4zOn27MeuRxejcfyKKNH5WK/
http://kasilingamtravels.in/organization/accounts/sec/view/yFn1vUcrW8rdLzjwDZyT7RL7/
http://keshtafzoon.com/secure/online/thrust/file/B370nV9rJKUvIBryUCl/
http://kienthuctrimun.com/organization/accounts/sec/read/SL92iANsxS4yRmmsff6caqcfz/
http://kimchatham.com/company/account/open/file/D68pEpTz334PLKtsd/
http://kimiagostartanha.com/secure/business/secur/file/oDExdXrVa9eur0fau/
http://kingcoffeetni.com/company/account/secur/view/n8cLmmlNgppoWt3Cg/
http://kinhbacchemical.com/TOJKQB6689314/Rechnungs-docs/RECH/
http://kjtg.info/organization/online_billing/billing/secur/file/jUszttl9ihltRtxPOjjp4kDV/
http://kn-paradise.net.vn/SKQIEFFQUX0064509/Rechnungs/RECHNUNG/
http://lar.biz/De_de/JODYKZVGFS3208530/Rechnung/Zahlung/
http://latinos-latins.online/organization/online/secur/view/BaFJAhSshde9WokVem9m9FhyD0q/
http://lazell.pl/wp-includes/DE_de/MCQRSXA6896107/DE_de/DOC-Dokument/
http://lds.in.ua/VQMHAY6331329/Rechnungs-Details/Zahlungserinnerung/
http://lenkinabasta.com/company/accounts/sec/read/9E5TXdEgPeSnZDqBRbFmsX7OyHc/
http://lesastucesdemilie.fr/secure/accounts/open/read/26Ist02B2khvTix/
http://lesprivatzenith.com/company/business/sec/list/iB5r2ZewBbKf1V0zkVBcWTS6/
http://lionestateturkey.com/DE_de/ASRECT5933419/Rechnungs-Details/Zahlungserinnerung/
http://lionestateturkey.com/DE_de/ASRECT5933419/Rechnungs-Details/Zahlungserinnerung/index.php.suspected/
http://lsaca-nigeria.org/secure/online_billing/billing/secur/read/r9CLMnjmazSPxs7L25xMvoG/
http://marketingonline.vn/organization/online_billing/billing/thrust/view/FADMRA6UuLip0E5Ca/
http://mohinhgohandmadedtoys.com/De/DKBNLFVAM9134708/de/Rechnungszahlung/
http://nmce2015.nichost.ru/DE/UTTWFGM6465272/DE_de/DOC-Dokument/
http://noscan.us/company/business/thrust/list/Sj7uEchUEiPJdolOEU/
http://omidsalamat.ir/news1/DE/IECQEBD9453814/de/RECH/
http://onisadieta.ru/company/account/secur/view/lSeqiIU8xUbRMp5gCwg0ljx6wq/
http://opcbgpharma.com/De/UPFZOAMSLU8868921/DE/Rechnungsanschrift/
http://ortotomsk.ru/company/business/secur/view/jaiti6FhNEB8vieWSk/
http://palmer-llc.kz/secure/account/secur/view/EXtilFk5tmb5wPNnV/
http://patient7.com/secure/accounts/open/view/oa3ZgdPGtrJFpHPhRKJMR8X48pVT/
http://petparents.com.br/secure/online_billing/billing/sec/list/4aGCq1Tmu7kuUONq1uO/
http://pmvc.pt/secure/business/secur/read/7rK5jo1fduP2t0uwUsg/
http://posicionamientowebcadiz.es/secure/online_billing/billing/thrust/list/fottmahfLHrDyX6IEoDNcDBapOPn/
http://powervalves.com.ar/DE/TDBUKPA4382389/Rech/RECHNUNG/
http://powervalves.com.ar/DE_de/NCJZTR3766628/Rechnungs/RECH/
http://print.abcreative.com/DE_de/PHSJEQZOCL0899069/Bestellungen/DOC/index.php.suspected/
http://pronews.vn/company/accounts/open/list/rw2DI8dd1FwQ3GUv0UMb/
http://research.fph.tu.ac.th/wp-content/uploads/secure/business/secur/view/bOci15OOJT1X9GE08uQjoYoSTW9f/
http://saigonthinhvuong.net/secure/accounts/secur/view/uvEGwM6XHCrKiTtsZH/
http://samettanriverdi.com/DE/LUUAKEX2140183/Dokumente/DOC/
http://school6.chernyahovsk.ru/De_de/RFVTKTI2685196/Scan/Zahlung/
http://sealonbd.com/De/XOTJGYZH3053108/Rechnungskorrektur/Zahlungserinnerung/
http://sem-ingegneria.com/company/account/thrust/view/oin57gS8YhBkbyU2Bla/
http://sieure.asia/company/accounts/sec/read/GoLDJTMRpOeCNRzLm2GadekUK6B/
http://snki.ekon.go.id/secure/online/secur/read/6X6rKRIIHKIg58fhi0MYhbf/
http://stage.abichama.bm.vinil.co/wp-content/uploads/secure/online_billing/billing/thrust/list/Y4Gv905SwY8v4NtKjIM8/
http://stihiproigrushki.ru/AURTFK8163337/Bestellungen/DOC/
http://tcl-japan.ru/organization/business/thrust/file/X2Xs3s9e0dSv3QbXjfEzz/
http://thaithiennam.vn/De/CGAMRKVQ9965014/Rechnung/Fakturierung/
http://thammydiemquynh.com/De/CFOULKFZ8281757/GER/RECH/
http://thanhlapdoanhnghiephnh.com/company/accounts/sec/view/JVTQLElA695aO7X7kVl4VrrvK/
http://theemergeteam.org/company/online/sec/file/qN2Gsdt8LHVBCnGpsw/
http://threemenandamovie.com/secure/business/open/view/6B855GVLki5xY8G6/
http://tmmaf.org/wp-content/company/accounts/sec/file/sNVMhwIUxfxi1EAXPYgGOzc/
http://tongdailyson.com/De_de/YRGVFHUPF7308238/Rechnungs-Details/DOC/
http://trandinhtuan.vn/secure/online/sec/file/IiyCkishsUYILCeJS7aOnYMcfk/
http://trialgrouparquitectos.com/wp-content/uploads/company/online/open/file/GjOb3SkZKkjMRzy6ndwp/
http://tricountydentalsociety.com/organization/accounts/sec/read/dOSuotyDkWxEgNHZK77UUGb/
http://tricountydentalsociety.com/secure/business/open/view/fUI7FdiN4p3WztmkGoXEvtup40Ie/
http://vcpesaas.com/secure/business/open/read/6eJW2YLNjOS64gujbzYd/
http://webnuskin.com/company/online_billing/billing/sec/list/ktDvIMUewAl2QdY/
http://wompros.com/organization/business/thrust/read/R5BkWvQQEJRWQNEYJv026tPy0/
http://wompros.com/secure/online/thrust/read/GPfQ0KA0UcZE1NM/
http://www.51-iblog.com/wp-content/uploads/secure/accounts/sec/view/6mZFjl9C3pqp3RAeNStjBLNQtFC/
http://www.annual.fph.tu.ac.th/wp-content/uploads/De/ILFUWJCY5333684/Rechnungs-Details/Zahlung/
http://www.armand-productions.com/company/online_billing/billing/secur/list/O8Ts2KN379UgRHCvamwys/
http://www.cateringbangkok.in.th/wp-content/DE/KWJKVKW7732846/GER/DETAILS/
http://www.cbmagency.com/QQGBITWVL2410153/Rechnungs-docs/DOC-Dokument/
http://www.coolpedals.co.uk/secure/accounts/thrust/view/ECSvRvXxwRBrr0yNvqSXQajyU/
http://www.ermapictures.com/wp-content/De/IJYEBKWF5648107/Scan/DOC-Dokument/
http://xn--777-9cdpxv4b3g4a.xn--p1ai/de_DE/YCMYWBMSZ1047007/Bestellungen/RECH/
http://xn----7sbbdfeovrgh2b6al.xn--p1ai/organization/business/open/view/l4RvYgM1pcGB2UU/
http://xn--80aaldkhjg6a9c.xn--p1ai/Februar2019/BPBGYBCC6106816/de/DETAILS/
http://xn--90achbqoo0ahef9czcb.xn--p1ai/organization/business/thrust/view/eCThqujtPdvzENPt3zB3oW/
http://xn--b3cfud2a8bbhes3dcy9ig0ce4k2g.com/organization/online/secur/file/LzgeP9wCmxgkGPRpfpnyj/
http://yduoclongan.info/secure/account/secur/list/eKSp9f7jyQhjQmyFtZufUBwAu/
http://yduocvinhphuc.info/secure/accounts/sec/read/RDbxOZWa6UFTav0SnEEUOs8eG/
http://yfani.com/secure/account/sec/view/QnBuvihwBymQa0H0QKAsH0UTc/
https://crestailiaca.com/PHXQOU0845448/de/RECH/
https://dkstudy.com/secure/account/thrust/file/Qe50bWLgyJ2aXzFTJvbm8/
https://www.dkstudy.com/secure/account/thrust/file/Qe50bWLgyJ2aXzFTJvbm8/

```
#### Epoch 2 Document/Downloader links seen for 02/21/19 ####
```

http://104.155.134.95/En/WwovG-58A_KSOQHnUxj-QMq/
http://104.248.149.170/file/SfuIH-mT6Qj_YBHPyGQ-lhX/
http://118.25.176.38/US/file/pzNrj-UiBO_xho-hm/
http://119.254.12.142/US_us/corporation/Invoice_number/aXwy-4a_IPVAwL-Yrb/
http://119.9.136.146/DE_de/FHCJMNDJSV1109237/
http://128.199.207.179/US/document/Inv/hTdoS-bd5_rq-JcZ/
http://13.125.71.19/wordpress/DE/TCUFDVAH6061065/gescanntes-Dokument/Zahlungserinnerung/
http://13.127.110.92/Februar2019/LEUAIIEJAL8408929/Rechnungs/Hilfestellung/
http://13.127.212.245/Februar2019/ZNMKNCMPM3005827/DE/FORM/
http://13.229.109.5/Februar2019/TBVZJCNS9637058/Bestellungen/RECH/
http://13.229.172.62/de_DE/KDXAYPYK3367149/Rechnungs-Details/Rechnungsanschrift/
http://13.233.31.203/US/8203538/hWNpZ-Rbjd_SG-9y/
http://13.234.1.52/De_de/ZDZIHUC0334335/Scan/Fakturierung/
http://13.251.226.193/document/Invoice/UaMrw-ip4_jUZEbER-VuP/
http://13.73.162.155/De/IGGIYNZKGL8673935/Rechnung/Rechnungszahlung/
http://139.59.64.173/document/Viug-LTDg_DmjGWykv-EZ/
http://139.59.64.173/US_us/scan/Invoice/FLUxi-tOKFC_fKTRi-FwZ/
http://159.65.83.246/Februar2019/MCJAGEVEJ9676275/Scan/Hilfestellung/
http://159.89.153.180/US/corporation/gzjt-hFUt_HVt-6m/
http://160.16.198.220/scan/Inv/NFqVR-RQ_aLTZfrBiO-fYA/
http://178.62.102.110/En/llc/Inv/873706184896/rUHbR-pwe_UL-Tq6/
http://18.130.111.206/wp/De/IKRKKME7312351/Rechnungs-docs/DOC/
http://18.130.198.164/En_us/info/grrW-nn_oOOSf-90/
http://18.215.39.47/xerox/Invoice_Notice/tttkD-wP2U_qT-bRb/
http://183.179.198.165/DE_de/UUSVKK4236423/
http://193.77.216.20/De_de/EKXNHOUOB9032443/Rechnungs/RECHNUNG/
http://193.77.216.20/US_us/scan/Invoice_number/eaFz-bA1hG_IrMD-5it/
http://1sana1bana.estepeta.com.tr/De_de/IKZIUAQSS1493072/
http://206.189.45.178/wp-content/uploads/De/BJBUZMEG0557084/de/RECHNUNG/
http://3.89.91.237/oYen-ii0u_WkLaQiA-yG/
http://34.199.99.97/De/NAZVZXEI6813517/Scan/DOC/
http://34.207.117.230/US/download/NZWY-rq_ipPnSN-rh/
http://34.207.166.101/Invoice_number/LlcMC-CKC_JGrbSa-Ng/
http://34.229.139.248/wp-admin/xerox/LIwps-0je_q-jFr/
http://34.229.7.66/Februar2019/DAHDDBMJW2146584/
http://34.242.190.144/xerox/Inv/zgCUj-nAfuR_ppga-Wwe/
http://35.184.197.183/De_de/WEXQNPI4060956/Rechnungs-Details/DOC-Dokument/
http://35.196.135.186/wordpress/New_invoice/fGfDG-G1_FETDbeYUr-ali/
http://35.201.217.150/US/doc/Invoice_number/eRPb-Ndm_LjEOze-PLj/
http://35.202.19.221/US_us/file/Invoice/AKUs-dQQ_b-kPn/
http://35.204.88.6/De/CYGXBSEJ4369423/de/DETAILS/
http://35.221.42.220/DE/TNAPIDRBFS9083544/
http://35.224.60.155/En/New_invoice/ghWhY-V0_yvpA-WHk/
http://35.225.248.161/info/Invoice_number/11420779303162/YVwQv-GsXB_PVKJ-ap/
http://35.229.246.203/corporation/New_invoice/oQWtS-CkZg_hRD-PuQ/
http://35.232.140.239/US/company/Invoice_number/20700106739/LhHp-GXYt_mYKRy-rjR/
http://35.233.127.71/EN_en/xerox/Inv/0720232/trdJ-l35_eIcM-Udi/
http://35.238.151.118/3878440825601/fpyrQ-i9e6_qAXj-kZY/
http://35.240.15.202/DE_de/WBNSWBWRBD6757520/
http://35.245.131.38/wp-admin/DE_de/FCGBMSYZC9096529/
http://47.74.7.148/US/document/GtnNi-j3_dEE-FW/
http://51bairen.com/En_us/llc/Copy_Invoice/56522700058/BMgt-XqA_oiG-d5O/
http://52.203.11.219/US/llc/Copy_Invoice/EpCd-97_cmddv-h8/
http://52.204.186.102/de_DE/CPFNRNIW0961547/
http://52.32.197.6/nanolumens/resources/US/JrLt-QHA_J-sB/
http://52.6.128.217/EN_en/doc/xVji-wF_lx-8b/
http://52.70.239.229/blog/wp-content/uploads/En/file/bByf-BM_Ws-54L/
http://54.146.46.168/DE/BGMHJYILP5652933/DE/RECH/
http://54.153.245.124/document/Invoice_number/snqMU-136A_J-50/
http://54.233.125.210/xerox/fodU-Tt_IrwbyYK-xf/
http://54.234.174.153/US_us/Invoice_Notice/734489132/vsQIJ-C52_WlNCNM-9tZ/
http://54.237.192.64/wp-content/uploads/US_us/Invoice/828012874/MCbq-YwMrD_aRZkulZ-3d/
http://54.242.95.50/wp-content/info/New_invoice/nqdP-EjFx_qPWHdpQr-Bd/
http://54.250.159.171/US_us/corporation/mlKxT-I19OF_MChYwJVdO-FD/
http://54.83.117.78/DE_de/CRFPKDIYLB1388563/
http://8.29.139.221/llc/New_invoice/JJeFF-1u_GjlYOVJKW-5Eg/
http://80.209.224.106/wp-content/download/Invoice/XuRxo-HNI_kXeWE-3YW/
http://9casino.net/De_de/TYPRETLCO7440472/
http://a4o.pl/Februar2019/HQEXOJERQG6192106/
http://achauseed.com/En_us/492834478594/MFGXV-7sd_t-fxs/
http://acmemetal.com.hk/En/llc/Invoice_number/6993952/bBWI-yT7_UrAeDYI-dXs/
http://agencetf.com/DE_de/XAKGASXIRP0788780/
http://agilife.pl/En_us/Inv/ZcdZ-F81E_AiSEQrVi-dv/
http://akillidershane.com/HGYSOVNDC1400602/
http://alabarderomadrid.es/DE/JSFVSAFMT2784134/
http://alabarderomadrid.es/De_de/TSJDXHDXKV4126027/Rechnungs-Details/Rechnungsanschrift/
http://alabarderomadrid.es/Februar2019/NSWKHW6075602/gescanntes-Dokument/FORM/
http://alainghazal.com/De_de/BMCUOX5828606/Rechnungs/Rechnungszahlung/
http://allens.youcheckit.ca/US/llc/Invoice_Notice/Bhaz-1LPbd_aqlUAKe-bCY/
http://allens.youcheckit.ca/US/llc/Invoice_Notice/Bhaz-1LPbd_aqlUAKe-bCY?/
http://allopizzanuit.fr/De_de/APWVQAFFB8960027/Rechnungs-docs/Hilfestellung/
http://amatiran.online/scan/Inv/ZRpb-S20J_pneMMM-dq/
http://amatis.in/de_DE/BWECPOHZO0143535/
http://ameen-brothers.com/EN_en/file/kVaxG-oFlv_w-Gjy/
http://andrees.com.es/En/scan/ovPr-tq_hRZaIcP-At/
http://anedma.com/DE/GNYIIPKF5603792/
http://ap.dev.steosoft.pl/wp-admin/includes/UVDJKTJI7694410/
http://aqualand-chalets.com/info/Copy_Invoice/SKGQF-c0jS_WqICNh-hOX/
http://askalu.nl/De_de/KJPGBWC2516661/
http://aufaazkia.com/wp-includes/de_DE/JLZMMG7815673/
http://authenticity.id/De/CDZBKC8917266/
http://ayosinau.id/EN_en/file/Copy_Invoice/bzGvo-DyU_CeuI-Zt/
http://azhand-gostar.ir/wp-snapshots/DE_de/OUJRVV3389600/
http://barabooseniorhigh.com/US/Invoice_Notice/kRIOU-DqB_ZsSqnJZFD-kfz/
http://base.n24rostov.ru/US/WVWYZ-WjTW_KXk-ni/
http://behosa.com/De_de/PNXIVN9594467/DE/RECHNUNG/
http://beta.itelasoft.com.au/US_us/file/orpWh-Jfou_yce-2g/
http://bietthunghiduong24h.info/document/Invoice/Cevp-XWMZ_Sl-2U0/
http://bigbike-society.com/En/file/Copy_Invoice/DLFgR-zEkr_rW-YmM/
http://birminghampcc.com/scan/Invoice/BEaz-hnqXV_wU-9t/
http://biznesbezgranic.arrsa.pl/US_us/Invoice_Notice/ykiIz-P4sJW_O-bR/
http://bkm-adwokaci.pl/res/En/Copy_Invoice/NexAt-nx_dWYibmDm-G2k/
http://bkup.melodiehayes.com/En_us/document/Invoice/rdBHr-3ZA_irqwIHSH-iX/
http://blog.thatwesguy.com/En/scan/Invoice/sdPVI-goz_JpOM-ZMh/
http://bonex.it/US/Inv/2438647724/KpUgA-a9_xxNz-2G/
http://cafeonelove.com/llc/Invoice_Notice/zAfs-nLuMf_JeDcKkAV-8Wt/
http://caminaconmigo.org/wp-content/uploads/company/Invoice/weND-vc19_Jre-T9/
http://captipic.com/Invoice_number/zDyWf-TXK_hMsKz-sd/
http://caroulepourtoit.com/llc/Invoice/ZPos-OP_mgS-D7/
http://carsibazar.com/US_us/company/CMBz-wsH_hGEJN-i5/
http://ccbaike.cn/US_us/file/biZk-XF5_kQoAcg-shF/
http://cebubesthouse.com/En_us/llc/1082146976/doJd-aomn_PsenVF-RT6/
http://chenhaitian.com/EN_en/llc/Invoice_Notice/BlCU-S3_MSDKDpUQ-qq/
http://chuthapdobg.org.vn/tmp/Invoice/hgjz-zS1_rC-tl3/
http://cild.edu.vn/De/KHJTVCIZWI8168573/GER/RECH/
http://clipestan.com/Februar2019/GUNCNBMTIZ7662057/Dokumente/DOC-Dokument/
http://cngda.tw/file/Invoice_Notice/7669311965/IryL-ib_aSYF-n8o/
http://cocoon.co.il/scan/619161318/nRGP-wZsm_mkEqea-3h/
http://communication-responsable.aacc.fr/document/shxCk-tW1_I-edA/
http://construccionesrm.com.ar/US/corporation/Invoice/6295745/iUfi-T7_nLhlJ-dU/
http://convisa.co.cr/US_us/xerox/OSYT-UjJ_KwJkHAoBt-yQ/
http://cotafric.net/wp-content/uploads/file/SBfFc-Hl8u_nnM-UF/
http://creasign.ma/EN_en/Copy_Invoice/DvsX-Nf2u_UndscgaMr-t7u/
http://creativedistribuciones.com.co/US/document/Invoice_number/CrwWK-Ut8oG_qE-vs/
http://cryptoholders.org/de_DE/TUTPSG5968355/Scan/DETAILS/
http://csvina.vn/de_DE/INEEXZ5854989/
http://dafia.org/dafia/wp-content/uploads/document/Invoice_Notice/zDzek-TW_Awh-X9E/
http://daroart.eu/De_de/QGUXAECR9949724/Bestellungen/Rechnungsanschrift/
http://datsunute.com/Invoice/mrHcC-16tfG_iUSoE-Udg/
http://dbcomestic.com/wp-admin/US/file/UnSG-hv_BWAXI-vZ/
http://dctrcdd.davaocity.gov.ph/wp-content/DE/TUTPXZSGXW4275167/Rechnungs-Details/RECH/
http://demeidenchocolaensnoep.nl/En/doc/WRfS-GIVg_mJNyemHnP-pHY/
http://demo.liuzhixiong.top/US/lfjP-5nJfJ_JVLGfa-tXM/
http://dentistaoliveriblog.it/DE/VNXRWGZMYW4277681/Scan/Fakturierung/
http://dentistmomma.com/US_us/corporation/EKaok-mK_puUnx-zb/
http://dev.familyhospital.vn/Februar2019/EOLESPTW4462255/Rechnungs-Details/Rechnungsanschrift/
http://dixe.online/wp-admin/Februar2019/YZJUJGP4945866/
http://dockrover.com/Februar2019/VTHDYM7453619/Rechnungs-Details/Rechnungsanschrift/index.php.suspected/
http://domainnamefinder.org/En_us/download/Invoice/rCCAZ-ZuVlA_EJMuW-nJ/
http://dotactive.com.au/corporation/GIee-HTOa_M-JqV/
http://drm-solutions.com.hr/US/doc/New_invoice/55619191667/LYkwt-yaBRW_UEHIB-HjL/
http://drsaultorres.com/info/400685534/RgKD-f4R_gSaaxdtK-BFn/
http://dunia-training.com/doc/Invoice_Notice/wUwML-FF_OLK-776/
http://dverliga.ru/En_us/corporation/Invoice_Notice/DVahQ-cLr_Gqhq-OlY/
http://eastgodavari.papputv.com/EN_en/file/Copy_Invoice/eDcfR-PNGRb_pNkVJCoy-aj/
http://ec2-18-130-79-113.eu-west-2.compute.amazonaws.com/wp-content/De_de/VKBSYTCEJW3284904/
http://edax.com.pl/file/Copy_Invoice/ZrEN-y5_LTeWjrNh-4UO/
http://edubarrecheguren.lat/EN_en/Inv/kckW-d8Jz_bXz-zA/
http://efotur.com/Copy_Invoice/AwFPb-y7d_dDpcCVWB-C68/
http://ejder.com.tr/US_us/xerox/New_invoice/jMzdO-9s_wPk-Em5/
http://elaptop.hu/llc/uvvs-sb_LNCXuK-wD/
http://ellsworth.diagency.co.uk/EN_en/Invoice_number/YrsRY-WOhx_snonDYSS-oUq/
http://emregunaydin.com.tr/US/file/Invoice/CoxEu-SQRFC_sfFjt-sV/
http://esquema.elevaagencia.com.br/info/APKC-Ul_Vt-Ww/
http://ex-bestgroup.com/scan/mefN-KJ_mKBshDXz-RV/
http://eyzaguirretennis.com/En/llc/Invoice_number/ljwi-qzlF_KII-bfU/
http://face.smartwatchviet.net/US/doc/Invoice_number/19474660798706/nrvr-OvXZq_OlvWL-P7/
http://farmsys.in/info/Invoice/ZWqrS-lQ8E_vC-mk/
http://farmsys.in/US/xerox/Invoice_Notice/WNUat-PQ_SaPVP-Txz/
http://farshzagros.com/DE_de/LLVNER2168947/Bestellungen/RECHNUNG/
http://fastier.com.ar/94725758922/ayULB-ncEkl_gzRr-N0/
http://fb.saltermitchell.com/avily05/de_DE/UGLOKZC3857777/
http://fb.saltermitchell.com/Februar2019/FVSCUWBHMY3334648/Bestellungen/FORM/
http://ferrata.co.id/Inv/oZyK-Aeu_qoJJP-01/
http://fiourbano.com.br/US/file/AdMe-d5_rT-ttO/
http://flapcon.com/De/JDWIES2590578/DE_de/BHZMQAD0156374/
http://floradna.com/En_us/document/rEZBy-Ti_IBmIgb-1K/
http://fms.limited/En/company/Invoice_number/PWbmx-6iM_LHuMKwCQh-PV/
http://fondtomafound.org/wvvw/En_us/llc/Invoice_Notice/SDan-fJ_PRmjfFbQF-D7C/
http://fonopar.com.br/wp-admin/ZGqL-Oa_DxSunp-2qG/
http://freemaster.online/En_us/Invoice_number/fJxGB-qy_n-03/
http://frescoharmonica.com/EN_en/xerox/fJSm-asGF_m-rrJ/
http://frij.gricd.com/company/Inv/oghvd-m6Y2_ipiV-g4/
http://frog.cl/xerox/Invoice/GJLg-mj_sWxLJm-Hj/
http://fwpanels.com/De/ABHYSQR9969074/Rechnung/Hilfestellung/
http://gaminggo.website/dbssxdydaf/file/jeMNh-Ra_puh-g0j/
http://gbconnection.vn/New_invoice/rMoc-MKhBh_LFzUzYM-xKe/
http://gcpfs.info/EN_en/Invoice_Notice/tSPM-UG2C_PHRbW-Rhd/
http://genitbd.com/En_us/Inv/yGbrP-N1GGO_DpNySfrn-ppQ/
http://ggq.kr/ljcu-hx_EZnDjjlvn-4k/
http://ghazalconcert.com/scan/Invoice_number/OzATE-luN5H_MTykzmSt-32/
http://giancarloraso.com/En_us/ETVc-RuzBL_ar-1Ze/
http://girlydesignart.com/doc/auiE-IRUc_jfaS-Imv/
http://goldenlakehoabinh.com/En_us/document/Invoice/QvZzP-kT_chcEge-nV/
http://goldensotka.com.ua/US_us/company/New_invoice/MQhi-2fAV8_YcGbq-no/
http://greez.club/En/xerox/Copy_Invoice/863397311939/COlov-3vi_ylmnIGVir-yS/
http://groundswellfilms.org/FLRIQOKW1501524/Rechnung/Rechnungszahlung/
http://halmstadorienthall.se/corporation/Invoice_number/eVXHL-QG_AuBso-u1/
http://halotravel.org/EN_en/xerox/399528119/ZPRnc-Es42_lNAbkDMp-L9P/
http://hansole.org/info/BBDY-fnf6_OfJj-R1/
http://hapoo.pet/De/VXPACJBW7392599/GER/Hilfestellung/
http://help.saiyou.me/DE_de/NKYQVOSZOT6013887/De_de/GHKWNMACB2480034/
http://himalayacorp.vn/En/Copy_Invoice/602218923301931/SYevx-jGG_shQLfvT-Xq/
http://hnhwkq.com/EN_en/download/Invoice/qGcJv-3qA_webSuxER-cV/
http://hoanganhvunguyen.com/US/Invoice_number/wXbDp-6J4o_Xa-XY/
http://hongcheng.org.hk/US/download/MEHB-Juibl_ygk-sz/
http://honglip.com.sg/En/corporation/Invoice_Notice/AQDb-SePyp_RY-UXB/
http://horse-moskva.ru/En/Invoice_Notice/9413365295891/KrsZk-XdrEe_nVyOBOL-sL/
http://hostdm.com.br/US/company/Inv/MBWtu-v0_K-s1/
http://hourofcode.cn/De/FTTLDGN7338525/Rechnungs-Details/Hilfestellung/
http://htpinvestment.com.vn/corporation/Inv/bkcXb-6aNl8_aF-Q1F/
http://hyper.gaminggo.website/DE/DE/MGCRMUHE2025190/
http://hyper.gaminggo.website/DE/NGSHJBDZ9493402/de/DOC/
http://idiskbd.com/alokitonabinagar.com/scan/Inv/CkfL-UIww3_vTkwPke-IEF/
http://ihatehimsomuch.com/de_DE/HIHGFYCBMO1373082/Rechnung/RECHNUNG/
http://ihatehimsomuch.com/Februar2019/HNEOLZYF0641796/
http://ile-olujiday.com/En_us/Invoice_number/Azpl-1y_HYOjeQhvm-H5v/
http://iltopdeltop.com/de_DE/IANJTUAEE4785475/
http://immanuelprayerhouse.com/EN_en/document/aBGx-w5zH_fsZI-hX/
http://ingramjapan.com/US/corporation/kAuuC-LxnRQ_ev-gg/
http://inhouse.fitser.com/ceascope/php/wp-content/plugins/contact-form-7/US/file/Invoice_number/jBLkJ-ajr82_QCjXmOB-k82/
http://intensi.cz/EN_en/llc/jYjl-Uq_HPe-N3e/
http://iqhomeyapi.com/DE/QTJUMYYBF7855310/DE_de/Rechnungszahlung/
http://iranchah.com/En/xerox/Invoice_Notice/POlmn-ylo1h_VwtSNysTA-CV/
http://iran-tax.com/US/Inv/LhWEW-KG_yAA-vVK/
http://iso-wcert.com/doc/Copy_Invoice/5593042/uWji-T4QB_wisfpWe-abt/
http://israelhumanresources.ru/doc/Inv/072936000705/WWjYH-Vz_Xmy-NQ/
http://istratrans.ru/corporation/Invoice_number/351917407428730/FizH-5Bnoj_RdcpQHiVU-AOF/
http://iya.net.cn/En/llc/ariE-ILe_lRHu-c7/
http://izavu.com/DE_de/PUWBIYD3363260/
http://jacque.lp18.mmi-nancy.fr/llc/Invoice_number/pXCN-UUMn_UKYSnWIb-xd/
http://jakador.com/US/info/Invoice/uiUZl-YAosI_zbcXOgMHv-B20/
http://jamprograms.com/EN_en/doc/Inv/cqnIq-abr_LotaY-BZQ/
http://jaspinformatica.com/HRdFL-IZC_yV-VS/
http://jcpgm.org/download/Inv/yZGE-H8_AD-kZ/
http://jimbira-sakho.net/US_us/scan/mWYTH-3Q5u_EH-cZi/
http://jm.pattronizer.com/En_us/corporation/Eepw-6pd_sJpPqcrF-fA/
http://jurhidrico.com/0875753535/XuBK-U8_WBIZzlssy-64q/
http://kaliningrad-itc.ru/Invoice_number/bWrM-Sq_uFlyKmV-pZ/
http://kamajankowska.com/DE_de/TRXOWRYINA1097305/Rechnungs/RECH/
http://khoangsanbg.com.vn/themes/De_de/JAKPOL2671693/
http://khsportfolio.dk/llc/Invoice_number/xhXVO-Y8e_rd-45x/
http://kndesign.com.br/EN_en/info/Invoice/QiRv-Cn_B-rwx/
http://koszulenawymiar.pl/xerox/Invoice_number/Eomyj-1tjUv_TMcuzwPBW-Z2/
http://krisen.ca/US_us/company/Invoice_number/krsL-sL0Rl_MEHS-bU/
http://kriziachiesa.it/US/xerox/Invoice_number/08345135522/AtyIj-hORf_AWcEv-85/
http://kursiuklinika.lt/language/US_us/download/rwkFB-XM_vUjnFSn-LB0/
http://kymviet.vn/US_us/xerox/Invoice_Notice/xgAU-VAPeY_XWS-Kxi/
http://kynangbanhang.edu.vn/Februar2019/BJRVAYZ7803452/Rechnungs/DETAILS/
http://kynanggiaotiepungxu.edu.vn/info/PJrRM-qjS_LypV-giD/
http://kynangthuyettrinh.edu.vn/de_DE/FGLBXCAG9942671/Rechnung/FORM/
http://kynangthuyettrinh.edu.vn/EN_en/xerox/Copy_Invoice/MTUd-RE9c_ZOjEMbPN-FA/
http://kynangthuyettrinh.edu.vn/MWEMJN5994446/Rechnung/RECHNUNG/
http://lanco-flower.ir/305355513877/cQDda-rvb9_ktRmfX-iWt/
http://latuagrottaferrata.it/De_de/HYIMFYPDR7720398/gescanntes-Dokument/DETAILS/
http://laylalanemusic.com/DE/TIXJZV4153771/GER/RECHNUNG/
http://lazell.pl/wp-includes/de_DE/FBLWXUCY2886002/Rechnungs/FORM/
http://lesamisdamedee.org/US/download/Inv/33722889806/CSeTZ-v9ZW_pLmCOOFRp-DZX/
http://lienquangiare.vn/US/download/851501985/VbzG-91_B-Ll/
http://liketop.tk/Februar2019/DEWZDFS5921051/Rechnungs/Fakturierung/
http://lionestateturkey.com/LSWAGCST5581606/
http://log1992.com/file/453766394/PTlqq-Ex2k_awIHhTin-lMO/
http://lubraperfis.com.br/Februar2019/BNHFDHJ3055032/Scan/Rechnungsanschrift/
http://mantoerika.yazdvip.ir/xerox/Copy_Invoice/BLvZd-boDwE_vmYCwE-kP8/?/
http://mantoerika.yazdvip.ir/xerox/Copy_Invoice/BLvZd-boDwE_vmYCwE-kP8?/
http://marasopel.com/administrator/US_us/download/New_invoice/oaQy-9p_tcrMIFe-7M/
http://masjidsolar.nl/EN_en/doc/Invoice_Notice/yeKx-z3_pQRN-OH/
http://mask.studio/Februar2019/WDEJKKTMWV8742548/Rechnung/FORM/
http://maskproduction.ru/US_us/scan/Copy_Invoice/574264353827648/zfXmL-Z3_DOhxv-Pg/
http://matex.biz/En/company/New_invoice/kxTg-XJr_ddPRb-D0x/
http://matongcaocap.vn/IUEMUPSROR4940478/Rechnung/FORM/
http://megl.ca/llc/Invoice_Notice/VZYa-iN3oZ_MmWHxgsT-C7A/
http://mhills.fr/En_us/llc/Invoice/kSnU-Mid_bQPY-OW/
http://miennamoto.com/De/AHYWAWWKO5529630/Bestellungen/RECH/
http://mir-perevozok.com.ua/company/Inv/JdaNK-E0IW_urnLFmwhE-uB/
http://missionautosalesinc.com/document/Invoice_number/3251088/OGod-ayjn_KZvovLhU-0F1/
http://mrm.lt/company/Invoice/mRLa-XVx19_ZQh-p2m/
http://multishop.ga/MQMWGGO6503348/Rechnungs-Details/DOC-Dokument/
http://ngkidshop.com/DE/CWIRDUAYAA0892717/
http://ngkidshop.com/De/PNTCBH8949302/Rechnungs-docs/FORM/
http://nmce2015.nichost.ru/De/GGRLXCWV7353951/Rechnungs-docs/Hilfestellung/
http://noithatchungcudep.info/wp-content/doc/hpyFR-gY_NQ-xv/
http://nonton.myvidio.site/DE/KZYJVKAKK9205612/DE/JKZFRAZE6345889/
http://noscan.us/Invoice/871430326423/vvQp-D8_rndLvX-sW/
http://ortotomsk.ru/De_de/EHDBXWZBJO7581980/GER/Hilfestellung/
http://pby.com.tr/EN_en/file/1447413675216/oRRFB-Q7f_Q-BQJ/
http://pby.com.tr/scan/Invoice_number/vvTA-Awq_OCIL-tb/
http://phamthudesigner.com/US_us/doc/Copy_Invoice/wNHb-YzG_YbSbGu-Zj/
http://play4fitness.co.uk/US_us/corporation/Copy_Invoice/ECCp-M72g_lIUDwz-Y1H/
http://pronews.vn/US_us/New_invoice/wHaiP-1tU7_axT-neZ/
http://radioviverbem.com.br/download/Copy_Invoice/uzJJ-1qMu_CUdmQR-WBG/
http://research.fph.tu.ac.th/wp-content/uploads/En/corporation/Invoice/VRtDa-f1H_QK-Bws/
http://rohrreinigung-klosterneuburg.at/LjCq-M7p_sVjQmrudi-q7S/
http://rohrreinigung-klosterneuburg.at/UQHCGSRR9409584/Rechnungs-Details/Hilfestellung/
http://romantis.penghasilan.website/En/llc/0204066758/wVcLq-vu8C_hV-Tj/
http://salahealthy.ir/file/Invoice_Notice/DDKGV-C0_Hfa-8EG/
http://secondmortgagerates.ca/DE_de/GFAGQYSJXI9239534/Rechnungs/Rechnungsanschrift/
http://secondmortgagerates.ca/DE_de/HEYWXUF5339793/Rech/Fakturierung/
http://shovot27-m.uz/US/scan/New_invoice/bGmAK-rbvfu_gTdafih-soY/
http://sieure.asia/AT_T_Online/US/llc/pjil-jeGv_tjPGFx-jx/
http://sosh47.citycheb.ru/de_DE/WKZXJI0470165/Rechnungskorrektur/Fakturierung/
http://soyuzhandpan.com/EN_en/scan/Invoice_number/IEwUe-RsKy3_IfBO-lG/
http://sts-hk.com/edjf-jUsEj_le-FD/
http://sweethusky.com/Februar2019/ELUKSM1691772/Rechnungs/DOC-Dokument/
http://talk-academy.vn/En/Invoice_Notice/ygaB-bQF3_BLMQjp-2S/
http://tasarlagelsin.net/DE_de/ECBJUGXDF4914787/
http://techboy.vn/En_us/Copy_Invoice/LUFS-yg_dbUUibF-Je1/
http://thammydiemquynh.com/DE/SRVVFCTS3984940/Rechnungs-Details/Zahlung/
http://thammydiemquynh.com/DE/SRVVFCTS3984940/Rechnungs-Details/Zahlung/index.php.suspected/
http://thanhlapdoanhnghiephnh.com/En/doc/456598441/rQWx-WU40_eWNphD-FKn/
http://thinhphatstore.com/xerox/KjsEB-f4T_uTWKfAO-Zr/
http://tischer.ro/En_us/company/Invoice_Notice/fqNB-r9n_XkDb-Z8/
http://tisoft.vn/En/Invoice_number/302314378501059/rxGg-AQP_u-n78/
http://tolstyakitut.ru/En_us/corporation/HWnKG-HU3L_qyyex-aB/
http://toprecipe.co.uk/EN_en/aBzBO-kkSQ_kBUc-Iqp/index.php.suspected/
http://toprecipe.co.uk/En_us/download/47942822592/MLaNo-OZ_QMSUAMRi-Mf/
http://trialgrouparquitectos.com/wp-content/uploads/Invoice_number/CNqU-501_BvSKJ-n3c/index.php.suspected/
http://ulco.tv/doc/Invoice_number/WRSTM-CHkG_mv-Pjb/
http://ulco.tv/US/document/YhrA-tCKR8_jfPi-DMh/
http://up2m.politanisamarinda.ac.id/wp-content/download/SnUlr-KB_ekxzo-KN/
http://vaws.nl/US/346743887801/VNQR-V3N3Z_y-6G5/
http://vienquanly.edu.vn/DE/FXJNZLWKVN4867450/Bestellungen/Zahlung/
http://viticomvietnam.com/file/KznQ-08qJw_LhSfktv-MH/
http://viticomvietnam.com/US/doc/Inv/xpuF-Da_saTtcD-roD/
http://weiweinote.com/US/New_invoice/yiURQ-1c_K-Gop/
http://weresolve.ca/file/Invoice/vKVR-lro_frym-X62/
http://wp.berbahku.id.or.id/Inv/uzZA-w7_uM-TgW/
http://wpdemo.wctravel.com.au/En/file/wJZbG-k2I_Cw-am\/
http://wpdemo.wctravel.com.au/EN_en/Invoice_Notice/3587030376176/LuApR-pna_EJX-dW/
http://www.aerdtc.gov.mm/wp-content/uploads/En_us/scan/Inv/QPkH-xYMz0_rf-gU/
http://www.anvd.ne/wp-content/kZgN-ahV_iWjLK-Pv/
http://www.birminghampcc.com/scan/Invoice/BEaz-hnqXV_wU-9t/
http://www.cbmagency.com/DE/KRYUXSHE4155921/Rechnungs-docs/Fakturierung/
http://www.dkstudy.com/LGCAITZQT8921006/de/Rechnungsanschrift/
http://www.envi1.com/De/IDBTFZOCC5628343/Rechnungs/RECH/
http://www.face.smartwatchviet.net/En_us/company/Invoice/0149826687/qDPTP-ZIvu_n-itv/
http://www.flapcon.com/Februar2019/YAKEKVU9414009/de/RECH/
http://www.ingrossostock.it/De_de/EVVKTQ3712970/Rechnungs-Details/Zahlung/
http://www.mhills.fr/En_us/llc/Invoice/kSnU-Mid_bQPY-OW/
http://www.play4fitness.co.uk/US_us/corporation/Copy_Invoice/ECCp-M72g_lIUDwz-Y1H/
http://www.porteous.ch/llc/Invoice_number/pyVl-y6_Z-kJ/
http://www.sweethusky.com/De/QOEYOC7374386/Rechnungs/DOC/
http://www.sweethusky.com/Februar2019/ELUKSM1691772/Rechnungs/DOC-Dokument/
http://www.tasarlagelsin.net/DE_de/ECBJUGXDF4914787/
http://www.timothymills.org.uk/corporation/Copy_Invoice/uXaER-jbJ_DYX-lyE/
http://www.wiramelayu.com/DE_de/SFYRPSBT4193902/
http://yduocbinhthuan.info/En/xerox/Invoice/LhiI-F4b_qT-rI/
http://yduoclaocai.info/US/download/Invoice_number/SoDgn-ky_uHWnL-z6X/
http://yduocsonla.info/En_us/Copy_Invoice/40639519133651/rxUE-8CdD_PzJojjy-1rD/
http://yduocthanhoa.info/En/Invoice/PhhUW-q93_PwlmSH-o5O/
http://ylgcelik.site/DE_de/DHUYMDQ8753701/Rechnungs-Details/RECHNUNG/
https://captipic.com/Invoice_number/zDyWf-TXK_hMsKz-sd/
https://carsibazar.com/US_us/company/CMBz-wsH_hGEJN-i5/
https://crestailiaca.com/DE_de/MDWNLCGEB2511352/de/Rechnungsanschrift/
https://drsaultorres.com/info/400685534/RgKD-f4R_gSaaxdtK-BFn/
https://ftp.smartcarpool.co.kr/lf_care/user_picture/download/Tjcvo-DyeDk_bfrd-lw/
https://protect-us.mimecast.com/s/357TC5yx0ZfRY4quOzKwy?domain=54.234.174.153/
https://www.dkstudy.com/LGCAITZQT8921006/de/Rechnungsanschrift/
https://www.verykool.net/vk_wp/wp-includes/de_DE/CQPQBPLVMY8380956/
https://www.verykool.net/vk_wp/wp-includes/de_DE/FBNUBDLC0797768/Rechnungs-Details/Rechnungszahlung/


```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-21 19:28:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
046f87c718018b50c7c6f539d11492b8fa6e4325e3da77a64f6a702287e5c824
4b75a9159e22f9e5ae12ab9c732b7075e1965c92be52b859eca1b03eb86ac805
ee60f9e2d38218109aff1d443750aeec436be61873d04466a24c2178928ada5c
a7e75c95eb4d7dbd3236888c12dd4ba59ae69500620a07521120637a6f8abd23
b8644d9f61436749be8678f246cdcc25ef58eef190f10a6ce079fb689caf3ef5
1186b28adceb8145a036958af9b666a86f94350606c58559013fd7e0bf5b2d10
2f5f36a66a982a2f0457a6d1b04c50f2da186c5b97464b3be5a7eac114ed467f
7c8c775210220e5ceee72c0c7459877dbcb72068aa6011fa6a29f5e3fda1b5f8
84c269a26193867fcf59b3ef37fbb87619721f18163f233f1e7612a423617050
ef843662c0f3ee87c56de95a49c430e90696798956eb5ce980f08b85f4dcb05a
763e1568e57bc1bc0eea550a996790ae3a08f66eb9a1164257f2ef35875745cc
32b93c3a0e095ddba394079ec1d18f3a2707172ae7780b213a6973b2d87e565d
d87ab889091040521fc76bda0abdab6bc37bd3afbcb3d4421b3b0c8c2808e15e
e5d8ca1e7faa58e8016549b308650709b9609ed2f655abb165826ebda065a256
753e6d5f8b2922939f905cc0f324c06acd0d6a3a033691e256ebfd37779583e1
1e979dd7f93ebf27f9559e151d508110058bc0ae24e7443bda6d206e8040db26
a421681d1d6a43b2ca18bb57d596a9002e3a0442fa5cdee0e2b30098aadcbf47
cd63352e1eae206ee6d7b9646fa765a6638d7a6c093a6f035d04a798300f2672
0e31b64c56b8b6fb914bc519d0564490c31ddbe81da51a56d1f71ea15635bbb1
f980dc8dc9418b78ad40625e3e2490083d2b1f3a8d0bbd7ee6ad02d6043e218f
0a0d6e36083123462b0362f0909ceee2eeb962e4fe2bdc3428c452184e701d94
4c1c586ea91084e4ab171a2a1faec85244e823f4ac0e282faab996a6b33f0700
df4a92dacf24f62e230b0656dabe555c231d1c42c7bd3d1f6128c528458fd3c2
4ff00fef96a8b96ba389bee1744b3e33a5143b64c6402fdd4bf0d8db8be6ccb2
99cfc1d7303f75ab1a8ba4ab3f60a7ae67c36eed36aa2098858b9607e2c462bd
2836974c689831bb98cbfe91a85f59c42a50b1888c82db496d53e1132886f7a3
155d10bea9e7018e6b20ee840db81ab1938d69531697c41a6896bf1a5b7b6517
857473dbe88b80da3e1580876384cec6a84cdc85b2a0274a81d5437ae361cf4a
90ebcdca1a7f6f2ad9a52d8edf26a7e75d4741625d08616c1f6631b4b7f3b426
20c303567a05318e7ef208304abb8fcaa52329bd26e4584db4db399949fc3241
9f192124b2235421f53196db5c9e1d538be1d30b5580a3b284bbc953440f9f06
4950451b96939bc5e872b286398930509981767a8a840e80306f35d1c5d3c173
50b8e39e1cd2c2886542d0a3c9bcea3e91298fca4af62b23e6a46994335cda19
b408dda7bc388d61fc3032a57d1680f68e81f90b698deff1897a01899cf554d0
269d5a38bc77f5228031fa16b3b19dea79b6f4095331dc4e6e8edabbd35df36e
2c5985fb3d6419f4a0e8861860b9aa6f5eefec3f55d41a163e25aef684e597b2
3ada6e8496565c7288c045e0dcd7d4d019ca3aaca855d2d25d4c83ac7945e9c4
5a928ccfdda8165fffe7c25fd7dca4270f64f25f6efbb401ae0859058bbe1e7f
e8a539d214ec2ed141d9619bbc2bc1d6b9d73541eca7a0fde94139d7b108774a
4701102fd7b71169276d8dae3065e6c15fd4667d6fda5375b90e0458a4a5c257
5f528344740d8555e9a2eef46a7cfb33391ad44274c8e7f303e8bb14cdcebe03
0b4a62a24b9990ff092bb55fa4375f6e47ab0f423f7e8a9f59ddbfe315626d7a
ed707d534ff4671e1db0ef802074f9b146f7ca4d0c7d4ee7f42e29fe84a3cca2
eaf3d751be767274ae82b72a2d5946ff06ba2e2c8969a8c17f4705e4a0dceb98
8cdc3a56ab924c1b4ef340ef6fc7246e7c433e2ef7ad6102685faad5f0b40798

http://uat-essence.oablab.com/cEP88qz/
http://34.207.179.222/GPc2ykD/
http://204.236.197.55/ZmkN6EP/
http://107.23.200.84/EmllsJND2W/
http://radioviverbem.com.br/SZYTAZDa/

Creation Time	2019-02-21 16:02:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
72f8f36503fee81cb94101360b4a818f4ca293383d0fa2698177135e6d3ad02e
a0a926469f468261834d6b6abd70b6a626d03408cf7b73bbe8c39e6b0acf3f74
7c25a52b3df28d736ae0dc129acfd7cef828753e24e2b328870dc8c8ee63c142
6ca4057339dc1e8b1cf203969d32f94dffe5b7f30d74d515b992eb5f8b82323e
6ea2c3eff96f11f2283b3abe723d1a86c61cdb44fe2cd17ff9ae10ad20cf1a65
67f07beab41c78304551ba5cf24918d78dd6621626145ec164f21f99f0581427
8dfb004e386950a6ac3cee1e890cb8d503ffa3ec347422d74dd21b54c9e8bfe9
4c0ad99eb7984eed6d561d0759d2e7fb705291f5ed82fd2986e19f94dbbfb5ee
ec6d2bc3b18b259ef7d9b7b9fd11a59930e8a64aaeb2cb5f2227dab86cdaf495
22c8cad80f14337d24c3cc6a419eb885e8adf02b91808ba3401f36717c189192
6ef6d24af64ceaea46019106f030394c4fa8961ee6c554d1ffc41c3207bbad55
748a9d4a8f7f3f221340ead90f7a75c53e224058831f2535003f0ea5bdd29c70
b817b86de7889ccd9e05c6643378ffd23cb6bf21f2ea0c910600f59d0f3e2722
3c496d24793899f2045191fa63fe3dccb0d54ab6f4ca1b414647aca3e9a9a76b
c285c8fcf0c50bc1a50f671b6b2bceef37219c09ac8ce01df4aef50452b7d19e
2b8126bad5c6a553fef27196e4f63f03bd6f771da259335d2cd793f1d162b390
c43ac1853ba5cd8e87430531b3c16706c109445dc0d7aa5e295a575d6c027642
2247ea393a089116c2311ec077d662089ae460016dd3fecfbaa31935b0b39801
59160cb6f9b91540b287acd08ff6c833cadb0c847e80ad5a9ccbbd227bf8d465
5efaa29779c448ad86f7b3144aa41743abcad1dd39f85629593fc72fcd01a809

http://dataland-network.com/NLKzKKZi/
http://ajs-c.com/I6t0zoJW/
http://www.iephb.ru/7xcNngj/
http://postvirale.com/x6aVZ1vHp/
http://104.248.143.179/TUaMxzG/

Creation Time	2019-02-21 14:01:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
de0375bb02c9ee35ed5abf40bea64ac325e8e8c0f11044b9061a5d5f1b3652dc
0f187f266a7f980776537018648b86b03ceb0e98c5d4d5ada2edb679a584bcb1
f9d580839ded49fcf72a4c595ecc004ed2593ad6e87ebc93ec7b5aa8ee83f1ee
092132a91c31f91a982bfb500628e30ca4d92db2c00e85eaf3466349504e9d56
45414667e245e5ff1b7a525ab63e7316ae60c936914e118cbca3bfa9fceeb065
1b426aa2b7174a4d6a069e1fa457a8f688982089f39ef4de2d35034a464b2e8b
391aac42483279562a3033b3ed838a6d67c23848a0a01a4c7a05d7778ef99296
a722036761be881a9977d624a590e910b9f2632f21665e15a643b2dc25596763
79401158aaaac4ec98e768969eee7da40861db3869fd8c36185189a368181771
c5995175bc45b814d8b57207958faf22699f441e06e16281f1859a9caa647165
81149aa3a1622b6f745fd50d1ea7aad51df7012b7bae5620d266769084a300fc
fec778feab458f2c25a06a45f7070ba0edb40c0843669909127e60c13676ad91

http://13.54.153.118/hYKUEGPp/
http://13.127.32.1/pwZE5HdZKw/
http://3.0.82.215/gcvkISJt/
http://12pm.strannayaskazka.ru/EWMDoLW
http://34.238.152.238/zG9qBNNp/

Creation Time	2019-02-21 10:20:00	(DOC Based - ENG - Unzoomed Indigo/White)
SHA256:
b9c937fa4603e99efca283ca5b615a6952b62168baf2f7a64ea3cb4316b9c69a
46200b1cbb63008321e6d8c42abee46701464b1f037de0910c237fc69a44939b
0ab63b9d18b6cc203d0eded9c9b6753c7a259f5408f7cc7160f7893398e728d6
9952468d91525ee1e25080cbfa6b3ac71599143099ecd3797b7db69a2470c18c
4aa4f8e7ad9a6e288881d682dd957caec8519083c2dd537a4f92d2e48a57e879
da8fb04d0fd7b7e66f34238b9150ce89db77f5952e2c863252f3d8feeb91602e
b5e3fdc49a042d1cf5023a5b8829556cece6ec86b469355a98e7dab8b9fc7f84
f574ae2643ff26d92691d89dda9eabc1142ba59703f5e39352ceb766c16a2721
4c8c99d97cb4c90b90e64add8d3b628728b83dab90b4a56577fee94765381546
453f8bbed4d14b720b70a71d1cc72f0e038d9b36532a8017c8eed4d2029c6358
3b5886ad43ab8b2992e5b7c84d83a51c1be5fd49bd3350656f8c7c5e02a2e742
c5878c154e79fe399a4480e947fc138c108ba8281f89b1204ec2ece76984318e
7a166f99a6fa6a578a6be7a96def558d3c2de9104a4badca10afc165c383714e
7d13b89105096a6f50e24a03c1668a680fce0253c760ec868aa9291043e71fab
efa4bd596b96c43779768551190fe10ad28a94e75866eabf388421207e645785
194155bc13fd032ae4b9a84930243f6576e8e3a2e3cf333408ef99b40259f66e
ab6f53e4a1a8e3137ae307eaa274f36e31d77c9e5ad1109e1f58aa10dfdafc98
ed57fad51150b0846662f5268685254777367699077f7627f1b4dfcbf8aff6a7
a11f33ec97834a2c8b87abe9b04e3fb0132ba481f5489dd62f5b44c571abd6c2

http://tony-shoes.com/7JzXexTmCI/
http://mediarox.com/6wcdQDCe/
http://13.211.153.58/zLoop5rD/
http://178.128.238.130/lgbLuD18/
http://13.250.36.131/luDCfRPwaD/

Creation Time	2019-02-21 06:59:00	(DOC Based - ENG - Unzoomed Indigo/White)
SHA256:
6f0bc8c229080344f5623c0eca3e11d678c5ca55ad8802d2d44f8090db59b973
729d860a52e775dfdf7fcfea235efd5b6892fad6aba2c31586cecda2f6bbe994
5582ead41cca3919877ec65de38014bef2cfb9132d5e509420bb6d03a5b933b4
38ef51e9b2a37b1bde68b6cc8d1edab13083451503bc11764ab5ea12ec509319
210211315bdd3ebac1b94ac3ff1ab075edffc5c3c7aab4e2b721a9ffe173793d
3b877298150998de551ed5888b4f44c4aefed74f21252602b4812d8b1cc841b5
027515961c71ef138fb58fbdef999a3220ffca5539a919cdc2252e00503991de
a5f628181dc9f2324041f3959266af57c133141c40016ecc98e7e506d9697e08
0325029ff4ae0db4f263b3514a71ae6bdaecff512a9cdf0d9c12f4bb3ddb9d3d
8c499deeea0b1e3c79f3f2c5e8448e52907b150038dd91c7d3b52c8b34f26c35
1de7c2c24d4481112a7fa71c646a92e4deec7603475630e318b645cd0ebb8ef1
5dc01e24b8216611827b24fd788b1f993bc383e5cbb7fad4f9d80f4ee4a4bf3d
c85658bb3f574b17d721d850c4fdf0c70f74d9ccc935a95ea9e53076b6b2919f
8d2f7cae6c185a756e8edef7df03cb3ed2d5b38fbd82a5dee6bcd77c74c01db4
0a95dab3594a1d88580ddea96dbf9e51071bea815fb50798d31ad66df8166daf
8e2b14f966473e3d57962fca3aded4deb706c2f29e115b6e4eef5982eaf8c5b4
0a5ffe91e93aa44e93c8500bee173fd8f5abf6dc2839499ac21d662fa4411c93
15c066434b15fe7f3b2a36ed8ae129fee1794627232bd42840603ff22a3ab5fc
63c9f110415b70cff1b8f70d3ad4d70df1154873383d71ee944729b0dde65af1
aff1c7deecca592915d7a25f29b5ff903e1b4ad9fe9d9e6e43b7173e2a1fce54
7ab9f57db983715b820ee8913514c99250676bce7c250684048bada95ff13f86
ae19ca9d92f4835f2ae85ccb1c72fe425a1bd215c0f126439d93b6baece8cfde
9de85909cc4ee8e33e2dc275efd0caf4180d25e803f128a590f2ad22bcfd742d
1647667e5375233b1d8345a611e2a6d741bb19f12f5abb48b0a620a7ec642d6e
4419391bc65cdbf78b9637d7d0e4b8a2a41c76248179245c9b5ebe70f08ebbc2
f780835ca46da955e013e9ce99d349c7698db58098e07ee5c93549f711f4788d
e4ed7ad8c638d7e87fb53b90dac63f9fb24ccf7d43a7cd485a4f10d6cc8eeb43
da25cf29e0cd1beaee8d1233d6c04731601709cb64d8dc1d5bea6befdab49cbd
fc8f71a5d008f694f2ec2a2a9ad0e3d9cedb7c175c03faed256de0a5123ee264
995cb2ddd0b85aeeccb0b325c14ac7df06cfed3e5f92a80f8161d907792e5048
983a28295ccdedb59648d19c4dd3f7f6dcafcf17df836a475d7aa3ed27a29058
03e587d47d0c7da8804e5e4ac3eb76aba18e3733f806af58f766741785d5d37a
d23e3182c44aac8dec5a4956e77e93ea1eddd57502a39331adcca76af506b295
3f8184918c4fbe173fd7abd3d90160428896f1765d81c56f1214704bcff53bff
71a956d958a1709f830885fb597dd376065e17d0bd449ce6a2df2fb78425c196
6313a14f5f2025df868fed397d0359ffd1099b8fe72fc7b00836d6f1f353385a
b99d9d34584c709aab4025967a116e1199843f57d4e995573d3b6495ea61fbb1
b53493fca6be28cbdf529f4b6b717769c7d1bc3977b96646d8d3cdd1a9dc4321
0a430c521e0b67b41fe962570eddc2f391c29bc0d9b688b2a35c834cd08a58ae
58d1710bae0a222ccf0055d9a920e279f5bffe7d28706d0f1be372ab7f5891e5
b3e5bd637701c81e236118f2f3cfa9a6dda269466dda9d57d8e1c55d52825c88
b651953d67fc88e645362198eb5b3bf7e2165b9c26e219e67849c74a6d84d199
c3fb3f18de34a46a19603593876a8354c9295991046d21f28cfd2ce582a1a94e

http://81.56.198.200/vzDYQ0vT/
http://sosh47.citycheb.ru/Epe9RyrbX/
http://thptngochoi.edu.vn/3X1Gc99SU/
http://fit-school.ru/zCBKJesoEs/
http://diaocthiennam.vn/tcD61klP/

Creation Time	2019-02-20 19:52:00	(DOC Based - ENG - Unzoomed Indigo/White)
SHA256:
d7daa3e7d6af360eac911448d0cbd06a5c1091656f6f57947fea331539090c06
b980a31be735ebd09c5fbefa980d6d391f524992ff6c318bcf41f45331700dc8
7a8a992ae41423cbe967a4ccad97f6651998afe3ca15c1a52d3d3ce54da01dd5
352f263aa6fb53c0af98d06b41715f2b95f22a552311590ea5274010bd0066ba
814bbe5c1a7870ce1c6daedc9c2bf2f0a06b427fb0fc2722282050dfc4d23aca
1ab482a9578a8ace5ddeb94fb2745990a3047703a5441a75e4441a834becaaa5
65469469d39b1269b8e5224581ce2ddb6dd2734146c6fc1dba84f6e73f3c0628
f3e0613f8fff58cec7f7f845d16727720377c243bccf5f5c4c03d33cb6b24de0
7e46fc20ab6b868fc8882baa711a8a13627b6534d007b57d49836fede5980a3a
35bf063e6dd8b8206f4e9addd0d2b414f4af0219eb7be21fb177d9595dbd99e2
8f6bb521278717300a6540dae7aad647849ca1afdb473fc0c8948a6b076e6db0
466526f17bde4e439bd8d58a8699f0bdfdb74a4b432e05c328e831edfc28e3ab
c80595119d5f4167df2556e02b2b398b85d68550f6e57ee290cc06b6e43c9338
72e2a2f62db74486dee49185e7d4ff4503d2e57fc6fdb38ca8c0283b102ac16e
d7e4a682d070aa64b9e80e538be931a107ae0f09d8fe1f6cdd15399559dacdd4
b54971d5b4972bf4b715a6824aa3dfe52c98d786976dd262797e6e1dad3d9cda
6336caf69c312beeb5c0990e869a216d9b5be107b7f95c451e1c4bcadefd27b7
44e4b3b3c3dbad182ca8337408a5328a9e931b82c53c536aaf36eab8b65c8e2c
5f3cc9185d40d87005f8ec69e0c3a6abe9383c472d208da942f9e0b4e519b43b
d32e65963524e9358a3a923daf56c6297b37495e3c37c36503765caedb930e2e
a60a1a8a7a3bbde83c23a92839052f017f3549e909f64e2fc24d70367418b836
321b254efa18e7ac7ec89ae066e3a7787523e5d8a9b1a0fdc3cf8c3d3d18cfe2
33aca259484d507602eb2ba31a1e82f329c2e22ca47ea42a7e1c2d55ec37d5c5
aca0c9da888459f045866e8ad9b945c3ea194f727095673c156e7460a5a6b37b
9fbbd50581f7889d4b7558f23c2beb041884f1d94a448502b8d2fc4bf7195e1a
80a0f8f8f094769f13b070e3cb2ff774c4ee0e19fa3dcf6f520eed6e58b3bbce
4cf2b3c4a505e546eb8f8a2b6798507395ca7d19dc96c3209b09a28a2c17d04f
2c8c6c852a36878b83bad6b36b2f37d6defd31aa2cc56be765203a8b240eaaf9
cf044e317b3b2a8e39d738da75adfc28f0fd0fffb3ebf5ac4ce21763e7c28f05
e25d157a32adb2e424cfd00d6377821fc78af48904d0fcd1aa7bd77593bcc495
11e37fea71e99b05d6635f11db4e1b87bfb37952dc920a8a0e3197b68461968d
a7b66e5010cde5cba839634299acd7cc7ccd750864bc6a64dbeff307dceddc79
f033dbdf64cc673bb42c279aa5453f5f1685558d1299f824b5751c9b8774d428
e4b42a06fdba7617cca99bf5d1c47bcb7369a35c5ba4d7de8aedd7047c7c6734
c2a6ed736920ee11a237ef8dd9ff09172664a1a6860da660349b8ae5995f25c8
68a5b66ede664ab79755dc81a9dc1a2ad77af09051cdca4f343b3aa9f5451604
15a950da0a13747c19411db98f2008d357bee36309aec1a59526f03f76c36beb
1bde50567bdceed4b1eb98f395573b723c90894dc32178d4f92c8db7a927ebbf

http://portriverhotel.com/wlaSpzROD/
http://developerparrot.com/od58PWJHeK/
http://bk-brandstory.mdscreative.com/aEPEdU126g/
http://view52.com/xWR3nltYA/
http://bvxk.vatphamtamlinh.net/IVcDxFb/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 02/21/19 ####
```

87d882779340aecdda529abc74dbe37c5c0c4e80c5f4b1fb7c5de20f0a8b00d1
331c9274fa6c42c30642e3adca515f62978fbfeea6c960b84533e034eca781ed
bd9dafd2ec4d568ab6f22dab072011ce270838bbde5832c0aa2c67d955c61644
1f47c39e3108a321006e977ce2a7152975e62fdd6dc8bc40accadfc44cf37e73
78e6743db855335f42501726ab727c48e8827c2f09044890440479813a273584
9593092048912561c63128bdbea649a70089e033f3bb675280e4b59cfa6dc0fe
69427ef96b8f7b00b94c6f4f94f893b247c02a25df3609cecbb1aee0c6284225
d32967e1b865c1e0751e499f587da02da38174b80d62a1b04cf265b389b41aad
215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b
057da781f68382e06cf90db8a7f9642c569d15c2c2e2d113599a6aab17c8cbfe
2eab3b3505d7212c37b6dfba9365d3fa41bd517a462f0647c3fe9370491c870a
1f7da8761c8d7354387d99b541f4c2879e70c8336379df9a4334f4398c607d8f
bde9bd2d5877fcfa2cd83dd7d1ea89711d34f035318706ee2c4d208a995767d7
6b8f33f828ef9e6e8cdde4fc671c7d38e3711afcb8fcfadb92e958293bf79783
347aaa8d2a04d6670ad7a1049a8b9ab364c3fb24b8306ab4d272eac3e7750c95
941abfaaef1f3285e32891b28dfe09418f798b501c0ec6dc81f97e1f3eb0f095
fd8e04a29e93ec49feab7fe5d8508cc56bb3d1cbbc9a64a83f740f76dbd2e663
9d6572891b5e0756b4927c2d524025ea9736b888ef36113252ad8b25f04ad3d7
3eff7e946bcb1190cd4eb94b532a4b41011e63e56db0779961a67ed16f20048b
3af198f08a100a4420df0899b073a82e4c706b645d115fdc10d20565c63b148a
b3591959761fd908961a52283ea73d3c8461e8907003ec1453df84fad9cdcc79
298088d9668dc6f9221d39b5e8d4be342d9f948789543cfeddfd814db9acfbb6
4bbac2f6d477f2e79ba4463e1e454c235cec139f0c45ab95e2cff3d3d97db118
1f1601f3ff34650b14c849a101307098d4e12e0deaf3351fd6b41506665a1464
4c2cc7f138c6a33a8179ab23f425a31dccfe24941679b37534186a63b1c0d3db
341ce32962ae4fff6580a879122d02a41d2ac545627f05392ea433c8764c5f78
938d362c5f46c6db7ca7d10eafbfa2e08c66feb216ed53a5c7bf2637425faae6
315e62e87bc1c56b4944b9c14fcef8f496ad4ca9e07a8fa6ed9e43caaae6ad9b


```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-02-21 21:58:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
98c0ce92e61c133b514b58093e17ffa6df186e40ae7244c9cd6290ec7578b49f
695947db8e78b9520041c1b25b9de373eb1bf0c6aa184a4330d24cc086cd5623
3e8f09a00da64f471232c26c327cca6e04e939c6c11b34f451a0ed73b9e649fe
3a814aba071c0bb25158f9632f177d4f0bb79ebeb6c4184e750c9f1f5be7556f
6f00cb06559ee611ad863f052d203d645455ee83556361d9f3db0c68f6c944b0
cf2d7e0c2bc39625f2aeebb6b8c0950963a8e51b1568c9fb5b4a2dc67e8b3cb1
50c5559035123f045c5ea46d600cf9135707a76519122d18c86b12a0f61e8470
00cd3678ea574e1f132cfa48aedd0fdf7b16879d7a5caa697980a9febec8c49b
96e2cc08140b91a7ea123eae11cd24977a0938193a727a73038ee9a28bedddf2
8f518f6ec04b7ac2c4b43176f0349ba3ced69453359e09948b007324e5af3a07
4b83a7cfd2fc2ef08fff2d87ff6afbcd42ee1d78d8375824fd16601f74bd322e
5fa2a97cd7e989eac9fc9a1ce98af71cc3b77078e8653c7ba9027bf9711ac59c
d095edb1ebe403e34bb7e556d4d572f8adf4cf0a928f1bf78e9dbb2a09cb87a4
89e716291e1bdce7071afb523cef3c1d788bcc7ac5be5252fa4eae61864b1cc9
7e4a41ff4ebe8750f84a1eb1acab55c0e326246d045054888b6acb022d38578e
94243eac3290f53bd56478e0bef9e523060a9398d9f4f66953ea7749491f8cbe
f2ae4e6272a6c254d9685c8b95cf28131e59555be218209c029f99fe05f6542f
d1534d44023fc954eab8281a858ae7ac67ddaae7e369458c63764476a3fcca47
72e48be9ae480b705c2a9e4f6f41c4b18e159504d57a75409c7e4bc937c09384
59933f2acdec3c573634e29f631526a3feddc7899b68724b515a3259f9460b0e
1aa6fcee174dad4fc57da2996ce4881217dc26b34a8fd43f1934ba04a2e94cad
cd168b2a2559b63a988969f95a897fec4cae3583b0867a82a79b8b0f4239e9a1
09885cd35d4a8ce2d2f14197a892dcea9b9164da1ba693bc83c874d2cb169874
1efc84de08d3b53a897fb9eba6e105bc3d0c4d21ed26e16d48d696f1210252b8
0d6804c5eb316f83de77541e46be0fe34438917cdf3e60e7f6980adc2346b07b
0d6a2fb81dadc4ee1338e648a92c62c8ec1520eab9e09d8b508c38e2047e4687
aca925c5e72482417254a5f75b06221aeef8628b2097fd7ab3642fe65125fedb
a448e1c4821fa9c9f41791a8c9d461e09f3d1a00f7ab29ca024175df9204653b
94d1ce79356e2213336f8cf874bc64b8be9303a07caa242dcc6707a49c2296ca
dba985d5697186de88463d3058fec1067d53b31c4f72bde225800c178a70114d
53a3dae9cbee00d4a21c0b5406415757581ebd5fc8ee33602a52a2b5037006b8
c69ffb0d1f57218768ebd8b691576d302580a7cb4a302adfb0718fdeef233b79

http://222.74.214.122/wp-content/9kj6qOXTF_aR9C/
http://79.137.86.189/produits/poissons/zgLvIOdR2vvZj8_KnYC7/
http://dmcgroup.com.vn/k0jINCbJj2n8TL9/
http://english-run.com/yojDPG1mo5rmPXV_sxKAoEp/
http://elk-joy.com/G4AFioRkP1t_oJSEWMw/

Creation Time	2019-02-21 19:22:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
5de54586abeaeedc494e16bbbfa76397dec77c4fa9465d6d41f272df814e486b
d7e79a60d03e036e2db8e3a0ce3b8e8581ebb6863370be4a79f063b3d32ecfd3
52cf1ae1f78a210b6b56d8c8f3fd892da034e191461844cad170d5c0b19a1bfc
4ca7593903a273bb732e51f2e80ab590fca0dd65ea4b3dae4fb12f787979c2e4
bb116a426c4b1c9375c405d3a296a89b27727b0b628069305eb8d2840cb30997
e962d5f06a177b0a5590f72b6919e93f919d6b598e426c597511f60f2d30176c
b8963425658336c6a4b32fb7c9571d4ce3a564dfb3e67b5dcd375795fcab3f9f
36267e58958c449f5f00c3734d461aaf72f2010c7e309c9b3df855ceedf09506
4f8bed1331aa4c29c280e8b30edfa2759fcdb9327624b07b9fc838d5480412dc
92c388f076c1eedfd22d410b2f15cb4a5a7fb0407b6394faac5efc815e9fc496
c6c68b81ae90f6569b3f2d091198f3d5fd1bbe695824e2dbb5fd888279c4adec
1cc9692421e6fba14d694cf8d5d15d7d472ebffdbeacb6ac537e3cf61f71d83e
5f613ed8816c38aeb3a09f7a7f509c11352885e46d63f5e51e5849d5b4a853c0
6721e188fa1fb6c38616d35a57d64037884a7ef4d459ef0bb08c304fa37742a5
338e9bc950664f8018e7ebc241600d80e9b6f7eda2327e4b05a0d80388c47c15
8c63ef3a0c9dcfb30c658f77ad8602ceff72d0ae0d5fd5b04dd6f01a69253f65
cc7e7f0bcc9d9230435e50886c2e24f649ebaaac0206bd0618571627cb7038bf
2cea91ced6c3c011e3fe32c8d306ff81da77287cb8623c331ab54f3574cb9a30

http://35.226.136.239/kMeVidkPdx_eqy/
http://207.180.251.220/wp-content/uploads/h06UBpjeSmYg_t43psHriK/
http://104.248.159.247/yMQqb3saPKBQWfO_Jlrk5N/
http://3.82.177.144/wp-content/uploads/FeTXzsZnZ_dmlGzSfo/
http://datijob.co.il/Q7YjN9wVlgJKJW/

Creation Time	2019-02-21 16:15:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
584698ea070c28bcf3bbe4ad5889bfbc7f4272107f00e89b75088ec83e2fdcec
7f78e313ef062cad5320d8f0168c43281ae20ae68d170b4c93d6fcfd8fda70af
1c6b7ee8515507be36f4a802929ca15bd1c14f4e6aaca6b2e8e93bb88788332e
b5ba3cee1a89d439bddd3c244200b3b46ecdec4e86936966d55a29f1f464886d
590fd7b69550b64fc4d487754ce23d479f3ea803185767605f37bf63aecfc7f2
eae23d5ce5c33b4dd55aa6fab24b024f903cb8f23fb2687b7f13827d763e90bd
b03436541bfe32936608934c4465a5cdaf0ccb5fda46f62f119db742350ab924
7c0c36e434f22974ecbe100978933db027c870ff2b127d07362eec962a5d6273
b7e55c101ec9974e8f730d1ed219cca9eb58348e7a6a65780e2f17f1cf851a04
6d21f6ce703f246305098ec09771d160463e57a1fd05f11d4e3f5b3c85b5534f
7be7dbc965a339854df3f6dabe040aa2841511e208050aa67c13562e8a27fca1
e8b0e8c6dea39b3300d29c1b746426ce613b27fd447c587559e4cdec03ff8a2a
20f2f23b25328fd44d697713103834e908228438afb83a38ba8204eb1095dbe0
1bb6a87b0e8bcfc0dcce7ff29be0d8e9df547add8017a3b35e138cddc71bc7ae
b79adfb88ed865b47fa7a72235711a580e8f8920c30341a77233b2fd6fafda8a
3020eacb8b2b18a9d188b232a6799591cd7ad437ff4f600aeb9eb184f18e65e4
c764eabf079fc18b05d86b61daddb15ba565a9fc4beec761c7e1c8bb7d8944b7

http://35.231.137.207/fCED3bYaD1XTK_p/
http://3.16.174.177/tKSRuSMFVNIr8/
http://3.17.29.197/NWpMBO4ygIN/
http://bradshawtits.xyz/wp/wp-admin/Ia3VO9qvjbvrF_01gkk/
http://fisika.mipa.uns.ac.id/icopia/files/MKOeZ0aA7dRKC/

Creation Time	2019-02-21 13:47:00	(Doc Based - ENG - 365 Blue Box)
SHA256:
e6ba4bd149bfa84ab57c7926c7635e162e459d0e9e419bb3c8d8af8e41c043c9
0964f1d0c17993dd9042cea8c1f811f4a4282f5299f249347fe942c34849e7dc
352d1131fbc03ea999acc8c54dafc2030ac2a22ce0b184868518578fedadded2
0f62f1a90d98c2a406dc8a8c1236652e5eb493149fbae8612fa1bcb3e45c4893
ea36df86bd0ef11800ce5135b8510a4d0e6139691a894361fc286302304c2498
38955e62de4cf0a2ea67c89821badae8bdf076185338f31e79f3a4ec3ee4dea9
2cdffcc8d9d6f3c95b097ca6ab4a24a57aa092734dd6efdfc53431f4160ff48f
50cae3ad5a58a4c52773cf8252ac8afef2ec987541c3313064295d0535969553
8efc1415e59648868a03ae54215350f07085e4b5c514be27c8d11b2b5cc41774
b938e373f9f93b28a0f0e66d4c522d3c12b515d1b5c5f9cab56dd3427a1c7eac

http://neumaticosutilizados.com/1TI81PRQLORR/
http://whiskyshipper.com/wp-content/A8BRS9sLl8i_P8DBsLho/
http://geestdriftnu.com/gqXb3ghkRZJ6tjL8_Y/
http://matex.biz//RQR0RaohiR_P/
http://beepme.eu/OtwnseuMiQetfBs/


Creation Time	2019-02-21 08:10:00	(DOC Based - ENG - Unzoomed Indigo/White)
SHA256:
f6a299d5ea0c1559ab89f27f844fa8b6c7ac965bef9c903a58f0938f56bc2eff
e5eca8b5095baf26e740dbd6079b4fdd801e01df1389929595fe95fa47b0ce6d
e5f3f182d3c6ff7134adb6c91ceacc756d58dd2b666820622ea666f635b0c83f
1f855c451fe8733b23c0936c074a390f53df32326a399129af54378ffb3f7476
3d0e6da8c5aa11bd712f699333d6f5885e0de642cf698f21b3dd88d9347a1a62
6e2f0cecf3e965a54c18310dfc7d907f5298cc931d3dcf9bf03600bdb2aa4284
4a4160342e1169ebda52916e005f4c23529949e0ae95038e177f843250698217
9c14f75986c02e2dcf860ccfaba2b99a1b648c75f3bfdcb6292759696ee1b0af
9b7a9c4d25c55511116386ee0a4b0a392971e29e987a2f27fa8b84632609e2e6
48f3020d0ed59f0b749906577bb0afa735a51feb909c208cde4f0cd436ac7407
ae586d86a8b3f69d8b678cbb30e11d592ac257e41e9f302f9756f568b715f783
6eb29d5790b01793e31404cbaf1bf755e11ae0320fd77edbf61cc18824c9bae2
d7ec4e18e5414dc27d1876e7910ff4ce73759c88cbe857d975253e3c99ca6776
2f1c728459ae97bab36fe1fe9bfbae1140e0b2cc290b8e1dfa72004c418387eb
9c4d39c2c61b2e3fb5b76fb1ea9875fb1041805f85e6a9fcb7d7b91b720f5a7c
9d956e2f9219145d9fcaece3ef7f37721c1b652129bb042962b999fe8a47740d
ef3919a0d672c284dddfde4dfea8731842a5811d4144425ecca6d0fdb33a9b75
26b1712e7ec451a757e7d4e0c1b5313e8cbaccd37882646cb34ed8225608f42b
7d2bd7127e553c0bbe1b97173d80e6e6e67c36edc0040eba08d2354f220ecea3
c9deee84d38dd3e151e2a5fbf26b52967dd9a2f9c87fca3bae20986fbd4ee044
ff5faf120dd73c7f7a18c99049c1a64cee886df98dcb4c168670efac82564c76
179a92ba3314be573380de2049b467d29b33a87f5ee506e357d093e7d7e46f2d
fdb2eb069388b2c1611f5fa08f5924417a0f571811ed5bccb328d8ea951d62ae

http://188.192.104.226/wordpress/WLc3L83MPzz0b_Y5/
http://lojamariadenazare.com/ERoa6umx53Ycv0HN_jhVO7N/
http://bornkickers.kounterdev.com/wp-content/uploads/gUQNEoir/
http://www.51-iblog.com/wp-content/uploads/gPmnfbWc9Z9i/
http://mox-sped.pl/pYfGcvvnDu/


Creation Time	2019-02-20 22:40:00	(DOC Based - ENG - Unzoomed Indigo/White)
SHA256:
bd83ac5597219e3e35c6dc11a2e32d69b9604de5b3a091b3862134cb9a04ef95
5fef45c36a230351dcd174107f3f6a541e2bcc2717fcc9206cca0f50b9dcade9
c7043a2969bb736fd7f871719de057b9e9a1e6fee382c926c33027c0bb662544
e66c9d3fb5cce953ae8a670782d051077b3df858bd699ebb84dc719798da78dd
4684961b11df9664b74b84843f2d7b0b32568fa9c45e4ea92bc14a16c057fdeb
8c16f59af76fa8f09cdde9aeb65bfb6edc8791eac5154165e897e72ef04c9896
86256076aab53e597029235e4bce3a3efe9f71bbb7df11c59a65543279c1245f
06c8637ad271aea1fa4cbd270ce643c8d630d3908df88398f06cad9b0813989d
b5b376647a8bff48124a071a71fbb081f78361695a6920b2e3d95f37c0f4151d
b22448c34f26a1e1cc0f2e608a6c1717b5e42ac5790d15be0ec8e5c4fede0e07
11913692bdb0a4f07a8ae0d313687af38c25ee945ab223705d8e15a080c945af
26f461da7b14255ac600d7a069a35e19f14f416721869ade8a2a9d690c67c699
7bca9566cc5217da968b100c78b615851dec6c9d5a62f52414d8cf4a55ada654
c4d2d9e19df870795daacabb84ca9d8e5f400c30c0d92a64c3bfbfd933f07c86
541d9778452f1406109122db15161ef577331da8f89cb38174e61d6cc7118f5f
8aba440a8492331ec71a1570e3e2f63b8533aba5a22c6cb4be677987e5bf24c9
2e7730080fb9693bad0ef805a4b380225ea5ab79b755eba621354fff1f57be88
8c18249cbdbe4d709965db788358e9ec053fc2f4309c53a11e11c85c6ab86722
65f06f1e554842c9137a397ab1035c7dd7f198b8b7f89dccf6d73e648b26d195
e88dd0545b70d9e2ab35edeb91b67fc9e8fd82e80716809697ac3d176b5ee018
6c765fd57790d538cb5e1660946ddc30171395f22eea66a4c836cb28ae2632bf
01d4d0fc3c4025fb1f570a677a834a5d337398d512c532d660d8fc9d053081f1
8b94da4008ee7e958c9d6c5dba49ba6b9c7a7ddb61e85559e2ede128bb7f22d7
92ef2b031335cf854f2652f244d988771fd32fca2192ee425a673791cf475711
0ffa66af30c25de60b1235bfc329ceab6ffd038fef0873d0c2137befed58ed13
6a3cc4922e3fd31458be04853a71293b1203538be2cf0b470aba5500069cba54
04698d71fe7ba0bcb637c967064b6dbd4f58b726bd2e0f3f4f1d0ec2d07932ca
42c4ae91d99e20371a32377a6a054ffbe13f5e589b0abc06edb62c88e6e2ef17
c60c0239798e85578c1a5a4bf91f5d03ce3e1d6e7df053be1a451756ee6110e8
e1556d5bcaa1b322442536aa8d8c7ec7f348d1412c42243c7f081855b2e8b183
dd8fc292e4a744bf2a649f653c8eb1443375de733234f72e0331c0843a155a82
82fc4d3c376ced491b4a8331488900aa9e6cb262d3e68a1db9fea3bca314a6b0
c35dc68437a3fc08776276f1ac12e51f07c35a43b2820f10eca7081bdb3d9ef7
f08150bdc02648f4f70c6188a490590374a138c9eeb3df5f099cb449f51a6bba
1e75c40c1a432f5751f395fafd6698443037f69432534a0ada185adb4b159580
f4484b82d0496ea55e89be8487b11828d6c2d30c92711a775f3dbb5963e61047
62d371690a5ed65b7fe35c8193a82d5c406a3ab56eef4d1a3307aa4b180d9682
59d867ae18e7749253e76deb4bb97a0e360126fa5b4b98eb3d574805b6b61a41
ddec9ee05008ace4b9c7a7689394b98feeda9f3ab7bacce101116184ad2f3f1f
591ec51ca5a509f3bf8a7e3cc4dd66a6caceca8ca9bc9f7ef19a1ceafc9edb39

http://3.8.150.35/N1Beht0JmWT_60/
http://ifpc.ru/eKKi6q5YUC_WyPjVNX/
http://apkelectrical.com.au/wp-content/3MdEhYTTHULOUo/
http://mausha.ru/PQt3QofoXj/
http://aktivstroi-dv.ru/sIs2eNw5Woa0_fc/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 02/21/19 ####
```

74b6cd0c43f504e87c99a9878a5ad76a1ce013a962db2c10f925d47d77d5b5d6
ffe9637744f90a5ae50a76bb5636a6887a754d19c6a49000bc0ce0c3bad2091b
27a04c08aabcc724cc54e3f6b621a96c925ac17d091f159da6801c90593bc6f8
ad6e4549189365a61aadf0d611c218431a8e5e477288e660d43e52daf4a3851d
6bbf34e977b60578e41521b83a34306805040ec632e1202bbc3c0248f3f4c0fe
45d080cae1115362dbf005838a7c25a19cdf7bda5bbc56280ea2c08ec360d27f
50774a8041d4873350c63daf5d1aa41b03f82e7a43489a7acceb3f43973811a6
2e9a3bd7689d51b80a1a00e24103fb8eaf9af758b4bdb3d0b4d4ca65b9480573
4ac56bb4422ff328a0489b2471584382e89775c5c22e2a8b9b713f7f04d7596e
e64401291306cde44817746f46dee8812a27a16b9cf9946e2fac2fe992c34fcc
38ad4a822b20d798bd551c1353a7da7ae9ee0e5fe70831e50da42de17269408a
13def4daab618ae00752206182d8766e69a73349e7d81f72b6d10b0f9916d635
649453b76d3046a9d773d04257aa6839817b7a1858b6980e727ef4907f0f3df9
0baff85d10061c7d0c17023648f98f8ca6364d5f2722ae0aea92b3e8a59d20cc
d138b4bc0dafd951ab483196984d648ce96eb092262fdc8baf94991725bdb0ea
2dc18b533e82b6bfe4ca849a61197806714d541d8a77ad8feeb02342baa83854
8e29b15e2b889dc013adcfc78dafdd7c1d9acfa499032d8313d4f49fb9062a89
f3636bb58d13acf646e7f8bfb31565416b363b42360f50f81dd972b243ab63d2
f66e29332ca984a6792bcb1c8c7e6745187f96e288bc11fd719e1ece168fd299
f9b2f52fec02a03554fa7301f4f62ed2748c27332096530a1f8d583aeb01e82b
504166cdbe6314f3325e7fd201a3cbca068eb92920adb2d6d91a641bb2c31404
b8db00d1606ac4324f710b92ef925dbd1337eff9df8f53160fe8fbd9d1288e85
d4c931fe54cfb972ba2e77440df680c64a63a225823d1194569d3cd956110cb0
0053a19ffee99db2acdfbdf14ef9caffcc8e436cc29631b30f86b19eeeff46d4
8a249737a7f87ca3281c5bf63255fa92e668a09b962e5642bcb990620491f2a0
41ad241ce81789d1225e05b1fba7284aee28b52c9e6aeac9ec08be906aa3769f
3aee72d5f12b96d1fd9dd265b13cea546c574201fcbed6006b26b0324276c6bd
0eb3d1435feef1ffc20619ad461ebd4ca43f1baff06e98b21ea384d4d5c9e0bd
121f14ce5c55cf2b55e3112cea88bc802a51c61a39479d39b63b3c07145e6449
8162be8570ea994767a874eaac114e022fa6d84e7189b2ae7e09638b75f985c5
942a93fe3b81398f5ad3b010760cd3cb7f1883118034755f4308be9f0aa119e8

```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
109.226.196.123:53
12.6.183.21:8080
123.168.4.66:465
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
162.247.42.61:80
165.227.213.173:8080
168.226.35.218:80
173.68.169.16:80
174.96.202.70:443
181.168.123.241:443
181.56.165.97:53
185.86.148.222:8080
186.10.243.34:21
186.68.100.2:20
187.148.77.84:143
189.147.12.211:995
189.173.176.115:443
190.117.226.104:8080
190.154.155.34:465
190.191.218.44:80
190.85.8.155:8080
190.92.58.150:443
192.155.90.90:7080
192.163.199.254:8080
201.122.94.84:8080
201.212.113.14:50000
208.180.246.147:80
209.159.244.240:443
210.2.86.72:8080
219.94.254.93:8080
23.233.240.77:8443
23.254.203.51:8080
5.9.128.163:8080
51.255.50.164:8080
66.209.69.165:443
69.163.33.82:8080
70.118.28.174:143
71.40.213.82:8080
72.47.248.48:8080
74.45.170.110:80
82.218.163.254:995
90.63.245.70:8080
92.48.118.27:8080
94.155.113.12:465
98.189.192.183:8080

```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
187.134.63.166:8080
189.180.186.235:8080
189.244.82.217:143
212.112.113.235:80
24.191.37.42:443
50.116.63.9:7080
73.185.42.52:8080
75.166.252.40:80

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

129.24.37.8:443
133.242.164.31:7080
138.201.140.110:8080
153.121.36.202:7080
172.248.21.6:8080
173.21.116.239:80
173.255.196.209:8080
173.255.250.241:443
173.63.66.10:20
178.62.37.188:443
181.119.30.28:80
181.119.30.36:80
187.137.179.93:143
187.198.33.171:7080
192.92.6.125:8080
208.78.100.202:8080
211.115.111.19:443
216.255.17.231:21
217.13.106.160:7080
24.153.169.62:443
24.185.185.187:443
24.227.158.234:21
45.123.3.54:443
45.63.17.206:8080
5.230.147.179:8080
50.198.42.246:995
50.31.0.160:8080
58.252.57.205:8080
62.75.187.192:8080
62.75.191.231:8080
63.116.14.206:7080
64.19.74.49:8080
64.228.72.40:7080
67.1.149.24:8443
67.205.149.117:443
69.198.17.7:8080
70.115.70.154:80
70.123.237.77:8080
70.64.76.71:8080
73.186.92.178:22
73.194.61.246:20
75.99.7.18:8443
79.75.233.224:21
83.222.124.62:8080
86.98.217.63:443
86.98.45.135:7080
87.106.210.123:80
94.76.200.114:8080
96.20.172.107:8443
99.139.140.129:80
99.242.223.226:21

```
#### Epoch 2 - Spam/Stealer C2s ####
```

198.58.114.91:4143
213.136.86.219:7080
24.164.79.147:80
47.50.128.85:443
58.108.251.65:443
66.38.64.143:80
71.95.197.230:143
71.95.197.230:993
96.42.13.162:80

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 01/29/2019)It has been awhile since I refreshed this section so I wanted to update it and bring it up to date.

I have been tracking Epoch 1 and Epoch 2 since May of 2018. Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for
communications. Epoch 2 is currently the larger of the two botnets and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing
version of Emotet at one point in May/June of 2018. Now Epoch 1 seems to be the smaller of the two since this time period. Despite having unique unshared
C2 infrastructures, these two botnets have been seen to move bots from one to the other and show similar behavoirs seemingly controlled by a single
entity/group. Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an Epoch 2
document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those being delivered
in maldocs on Epoch 2 at any time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and Epoch 2 may
have a document hosted on host.tld/B.
- The RSA keys will change every month or so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours to stay ahead
of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from is to find the payload and then check the C2s/RSA Key.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://pastebin.com/XphvkZDD - @pollo290987
https://otx.alienvault.com/pulse/5c6f2266e3e3661d1fb952a7/ - @SecSome
https://otx.alienvault.com/pulse/5c6f45c8eca3b535184e3fca/ - @RedBear14679277

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial
@shotgunner101, @HerbieZimmerman, @Outkast_TI

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial,
@OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch
and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Today was not as bad as yesterday but it was not good either. I received over 130 malspams with the majority of those being link type again.
Spamming stopped at about 19:00EST for both botnets again. Most of the malspam I received was during the interval of 16:30-17:45EST.

All of the link based malspam was once again the Freshbooks template. I did get about a dozen E2 type PDF malspams that refered to a bank
account being suspended. Just for fun there was another couple of Spanish based templates that were received.

Nothing new for me but it seems like some of the templates in Germany are very convincing for T-Mobile. CertBund released this notice:
https://twitter.com/certbund/status/1098619806402662401

Those are being seen in PDF and Link based malspam.

E1 C2s are identical to yesterday's report.
E2 C2s once again changed but remained at 51 total combos - Recorded above.

Notice: the @cryptolaemus1 posts may be a little chatty this week with C2s both saying they are from E1 when they are really are either E1 or E2
in disguise. The bot thinks everything is E1 right now but the posts are accurate and complete. For confirmation check these daily posts.

Thankfully tomorrow is Friday and we can put this long week to an end. :) TT

```
#### Sandbox 02/21/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-02-22 at 04:00 UTC - https://cape.contextis.com/analysis/39146/

```

```

Epoch 2 C2 run on 2019-02-22 at 04:00 UTC - https://cape.contextis.com/analysis/39147/

```