Emotet Malware IoCs 2019/01/25

## Emotet Malware Document links/IOCs for 01/25/19 as of 01/25/19 20:30 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 01/25/19 ####
```

http://121.242.207.115/asi.nic.in/wp-content/uploads/Documents/01_19/
http://3d-universal.com/re/wp-content/wptouch-data/Payments/01_19/
http://airmanship.nl/AMAZON/Details/2019-01/
http://airmanship.nl/PayPal/EN/Orders-details/012019/
http://alfemimoda.com/Amazon/DE/Informationen/012019/
http://allopizzanuit.fr/Transaktion/012019/
http://amocrmkrg.kz/PayPal/En/Orders-details/01_19/
http://antigua.aguilarnoticias.com/PayPal/En/Orders_details/2019-01/
http://autosarir.ir/AQGwu-iFIpEXgvQ2A5qL_RQntSsgY-Tc9/
http://bachhoatrangia.com/Amazon/DE/Bestellung-details/2019-01/
http://blogg.postvaxel.se/Amazon/Kunden-transaktion/01_19/
http://cabare-mebel.ru/ayLV-pSr2MSq07AUuIze_xvZBsylAr-Eko/
http://circolokomotiv.com/Documents/2019-01/
http://circolokomotiv.com/PayPal/Orders-details/01_19/
http://clubmestre.com/Amazon/Zahlungen/2019-01/
http://cms.berichtvoorjou.nl/Paypal/En/Clients_information/2019-01/
http://dijitalbaskicenter.com/Amazon/Kunden-transaktion/2019-01/
http://drcarrico.com.br/dfljt-wKB6MiFXqquEJf_TmLCFMRot-TRJ/
http://dr-martini-sylvestre-stomatologue-strasbourg.fr/logs/Clients_transactions/2019-01/
http://duanmizukipark.com/nhGx-c14vl0MP8LBbo8f_ovYVAgiTm-jFX/
http://ermaproduction.com/wp-content/AMAZON/DE/Zahlungsdetails/01_19/
http://erolatak.com/pfdeH-7vTwTZSPnHJOW9_MaxhNHEQ-8BT/
http://evertriumph.com/hXdO-7RFDLAHeWjdcO28_aBHHwOvYM-Zo/
http://fergus.vn/KAvW-afR8LCiZVe73VH_fyNLhLyt-yyP/
http://focusbrand.cn/Documents/012019/
http://fokusterkini.com/bsEA-igGswxdT4nankpK_HutluYnO-pQ/
http://furjesporta.hu/eWMh-zPipsvCxrwwExGt_WfongBlJ-Ca/
http://genetekkampus.com/GqwPr-tItIbTqC5jvOHZ_aaLfTdVy-iQ3/
http://gephesf.pontocritico.org/AMAZON/Bestelldetails/2019-01/
http://glazastiks.ru/Amazon/DE/Kunden/012019/
http://gtcquangnam.com/FEvp-IyMaLqhuoK9Otc_zHuoMReQ-Ihu/
http://gtctravel.com.vn/wJLR-DwSszXcNSbr9uh_fOmtPVEq-ph7/
http://hireanaccountant.ca/NNCt-eaEoy0YvmtDv4s_wiftgvYYM-f8X/
http://hitechkitchenzone.com/kWUU-fI70IImPkHwM87_aooerWEj-oVU/
http://hjsanders.nl/PayPal/EN/Orders_details/2019-01/
http://hocphatnguyenthuy.com/shtNp-149Zpj04XyJVEUi_MPavcdSOF-s1W/
http://hourofcode.cn/wIkhe-GFy9730k974Sfi_aDSwtRsEN-TBH/
http://humanjournal.site/Clients_information/012019/
http://humanointegral.cl/qxvjR-OO4eFa0qRDY4JBG_ALDYWEuUw-2w/
http://igsm.co/wp-admin/slco-rz0jnAmCnZBTd4f_cbWZfbaVm-rlM/
http://ikola.sk/hsPcK-XJU59H5pvZRbFe_ldgPYzqLV-NP/
http://inspireworksmarketing.com/AMAZON/DE/Kunden_Messages/01_19/
http://inspireworksmarketing.com/PayPal/EN/Payments/2019-01/
http://investasiafoundation.com/Paypal/En/Transactions/2019-01/
http://jaydipchowdharyblog.com/Paypal/En/Payments_details/2019-01/
http://johnnycrap.com/Amazon/Bestelldetails/012019/
http://jongewolf.nl/AMAZON/Informationen/2019-01/
http://justexam.xyz/Rechnungen/012019/
http://kargopol-wood.ru/img/Paypal/En/Clients/012019/
http://kccompany.com.vn/Documents/01_19/
http://kortinakomarno.sk/Rechnungen/012019./
http://kortinakomarno.sk/Rechnungen/012019/
http://kosolve.com/Amazon/Kunden_informationen/01_19/
http://latuagrottaferrata.it/TVcAO-1zoyJssmUoeZTS_pAxGXxnH-kPy/
http://lepdecor.kz/RzmN-HaEMyWijHbzVa2E_PWVphDsmc-3rK/
http://libertycastle.com.pk/oBCF-FBkXaEbTmyiuaxs_DeQQsjsUA-x6q/
http://lokanou.webinview.com/DE_de/PAYPAL/Details/012019/
http://lomax.com.gt/ZHyCn-AggOnd0xCvkLk7J_jTZBCMWu-L1/
http://mail.firstrain.in.cp-ht-3.bigrockservers.com/Paypal/En/Transaction_details/2019-01/
http://marineservice.lt/QPqT-8ce9joyHYKSYGA_IYPxcCKht-w2/
http://marisel.com.ua/Amazon/DE/Kunden/2019-01/
http://mayphatrasua.com/Amazon/DE/Kunden/012019/
http://meuwi.com/ACpA-bRT1VeSxqGWag4_QMuJZthu-YH/
http://migoshen.org/PayPal/EN/Orders_details/012019/
http://mileageindia.com/KpkU-74ihWW2V2Dx6hbQ_pEZRbfvq-x6w/
http://mingroups.vn/Information/012019/
http://mohasaneh.com/UAuF-PDO9wbZbucDXHVc_gRTHPCDm-RM/
http://mrlearning.in/PAYPAL/Orders-details/012019/
http://mskala2.rise-up.nsk.ru/Paypal/En/Orders-details/012019/
http://mukeshgoyal.in/PayPal/Details/2019-01/
http://mutevazisaheserler.com/Payment_details/01_19/
http://mywoods.by/Rechnung/01_19/
http://nanodigestmag.com/PayPal/Orders_details/012019/
http://ncko.net/oRgr-kA1B3kiEiMwud4_FiBYHnRla-V9s/
http://nebrodiescursionileanza.com/NheI-gZo6DOpk0mOL9Ef_ngJlWXeDq-CE/
http://new.cinqueterrewinetasting.com/Amazon/DE/Zahlungen/012019/
http://nhadatnambac.com/MFVMi-M28tbrXshEhadCb_XaKcEeCyN-WMb/
http://nightonline.ru/images/bKPX-yT3RSMWKFrNeULX_kDwzYhgq-xJ/
http://nootropics.tk/zRJtG-vy2dFeqtW9PdTw_OHVepVYdP-Y2/
http://northernpost.in/AMAZON/Informationen/012019/
http://noveltybankstatement.com/CgLRN-gvetzSRHQUHaZR_CSIqzNqWJ-mY/
http://nysswea.org/aNoPt-Ts26qwycF1fYrL_HcfAWBtP-rY/
http://offblack.de/Paypal/En/Transactions/012019/
http://osteklenie-balkonov.tomsk.ru/Payment_details/012019/
http://osteklenie-balkonov.tomsk.ru/PayPal/EN/Messages/012019/
http://otdelka-balkona.tomsk.ru/Information/01_19/
http://ozon.misatheme.com/MwXc-s1JM8aL6xIMWPCM_wmwLBfZA-iND/
http://permiandev.com/Messages/2019-01/
http://phantran.vn/TUBu-vdqJbvW7FkBGAg_yFblRjLrI-BA/
http://phelieuasia.com/wp-admin/PayPal/En/Information/01_19/
http://pmcphidim.edu.np/PayPal/En/Payments/01_19/
http://poverka-schetchikov.novosibirsk.ru/FaKHI-fuvOXz2VmkRnfFX_PzKTjKmG-4As/
http://preview.enroutedigitallab.com/PayPal/Orders_details/01_19/
http://print4purpose.com/public_html/Messages/01_19/
http://privateinvestigatorhomestead.com/GgosE-AGHq6gE8C0X91W_FApjeLsEY-6rD/
http://pte.vn/Rechnungen/012019/
http://queekebook.com/SSDA-tp8LOUiYjmmkx3D_JZkRXEZu-wq/
http://rahkarinoo.com/AMAZON/DE/Bestellung-details/2019-01/
http://raki.rise-up.nsk.ru/TwldW-CnR3UDPUQv7dYOM_Hkitflimn-u0G/
http://regenerationcongo.com/AMAZON/DE/Transaktion_details/2019-01/
http://register.srru.ac.th/Amazon/Bestellung_details/01_19/
http://register.srru.ac.th/PayPal/EN/Clients_information/01_19/
http://rekolaudace.cz/PayPal/Payments_details/2019-01/
http://rukiyekayabasi.com/GeHO-O1HiCjCwwt4t7S_EoTrpgbS-0ne/
http://saigonthinhvuong.net/Attachments/2019-01/
http://sakhifashionhub.net/nZupp-ZbrYwBRiWpYwMrD_DyzBXPnI-7XY/
http://salediplomacy.com/Paypal/En/Documents/2019-01/
http://samet-gunes.com/NUXsI-VzCyYHnbFOb5oHj_ptCYnDyQ-cQ2/
http://sebastien-marot.fr/Clients_Messages/2019-01/
http://shlifovka.by/PAYPAL/Orders-details/012019/
http://shopfit.com.sg/ZBxH-wlJrUX7MSqma6LN_VLRpgAFF-3g/
http://shopfit.com.sg/ZBxH-wlJrUX7MSqma6LN_VLRpgAFF-3g/index.php.suspected/
http://sosh47.citycheb.ru/Amazon/DE/Dokumente/2019-01/
http://sosh47.citycheb.ru/components/PayPal/Documents/012019/
http://sozdanie-sajtov.rise-up.nsk.ru/Amazon/DE/Bestelldetails/2019-01/
http://sskymedia.com/Amazon/DE/Details/012019/
http://stoutarc.com/Paypal/En/Orders_details/2019-01/
http://topstick.co.kr/wp-content/uploads/Transactions/012019/
http://towerchina.com.cn/Amazon/DE/Kunden_Messages/2019-01/
http://trajetto.nl/aRFJl-K3ZpSpTwgKqlIuA_DOQmjDAUf-o8t/
http://tugas2.syauqi.web.id/wp-includes/Transaktion/012019/
http://tunerg.com/PayPal/Attachments/012019/
http://uborka-snega.spectehnika.novosibirsk.ru/Messages/01_19/
http://vesnyanka.by/Transaction_details/01_19/
http://visiskirtingivisilygus.lt/IOMQp-1umMKOp3l97PmPA_tSHHYpYAY-9G/
http://vsb.reveance.nl/PayPal/Messages/012019/
http://web113.s152.goserver.host/Payment_details/2019-01/
http://westland-onderhoud.nl/Rechnungs/012019/
http://www.amayayurveda.com/Amazon/Zahlungen/012019/
http://www.anello.it/qgGSW-EFT3YemXaG4dPO_KoxnuXAtL-7J/
http://www.ermaproduction.com/wp-content/AMAZON/DE/Zahlungsdetails/01_19/
http://www.ermaproduction.com/wp-content/PayPal/Payments_details/012019/
http://www.fitografia.net/ZFZXo-xAdYApCw7VM0eK4_URIdXpKUs-XgF/
http://www.focusbrand.cn/Documents/012019/
http://www.forodigitalpyme.es/Attachments/012019/
http://www.glazastiks.ru/Amazon/DE/Kunden/012019/
http://www.hjsanders.nl/PayPal/En/Payments_details/01_19/
http://www.hopeintlschool.org/AMAZON/DE/Bestellung_details/2019-01/
http://www.humanjournal.site/Clients_information/012019/
http://www.idgnet.nl/PayPal/Clients_Messages/012019/
http://www.merrylandsmasjid.org.au/mOhy-7zlLpJpHRHDS800_NVhGSZAF-Qb/
http://www.oculista.com.br/PayPal/En/Messages/01_19/
http://www.pivmag02.ru/Amazon/DE/Kunden_transaktion/2019-01/
http://www.stockabbigliamento.it/Information/012019/
http://www.topstick.co.kr/wp-content/uploads/Transactions/012019/
http://www.tovbekapisi.com/bZqmB-Ky38FVKRTRykJt_FVSPCbtY-ria/
http://www.xn----8sbef8axpew9i.xn--p1ai/PayPal/En/Transactions/012019/
http://www.xn--d1albnc.xn--p1ai/Amazon/Zahlungen/2019-01/
http://www.xn--d1albnc.xn--p1ai/PayPal/Messages/2019-01/
http://www.yulimaria.com/wp-content/uploads/Documents/01_19/
http://xn--80apaabfhzk7a5ck.xn--p1ai/PayPal/Payments_details/2019-01/
http://xn--90aeb9ae9a.xn--p1ai/PayPal/Payments_details/012019/
http://zapmodulservice.ru/PayPal/EN/Transactions-details/012019/
https://linkprotect.cudasvc.com/url?a=http://3d-universal.com/re/wp-content/wptouch-data/Payments/01_19&c=E11qWcTkyCqrC6dFowKo_ue7Zm7wvaVP5zN6JbevmUOoLnBVWWb3EnoenXe4kFqX63t7M3qpPAh8kzqeT7iOQj4fiWirF0wFFNt7xcMJQkbA&typo=1/
https://noithatshop.vn/KKBit-LMAx05IFBvvNDA_VOGjgNyLB-XI9/
https://register.srru.ac.th/Amazon/Bestellung_details/01_19/
https://u7071798.ct.sendgrid.net/wf/click?upn=G-2ByCp-2B1j4sBoQiDdxUODHivbI1uk8yz7hnUHPl129zw9WT18pCPzNt5BRyfLiOK-2FodNXgjeiCzqauSqZpz50sLdVaW-2FPBtSzI4Z20Hd31V4-3D_URLxTgkT0241B622CTIw8tPSpcs-2F0SJ33TanX3ZQot82xjtUmqAUhrqegpIRROsV5XhIYeAscmL8DVpOgtPRAPGuEEOlB5SH1RK-2FSkp7gcFQXvxRfW-2FNuIQu3QqV6uroJuLQJTYHlMt5cown6-2BhVxanbBBgdgqr4VhjKZERW4YSmEekvUmlRvWWEi0pAdL46Qrdj-2FMZNQ-2FC4otkXq-2Bb9Iocwc07qsgtGb4xEQ3FYE-3D/
https://u7071798.ct.sendgrid.net/wf/click?upn=PFRZ3XBQrAlIUMLzSa5eBBKBzsFQREjzVFGOBNAETvwC8m2dyxZ0aiaYMRV-2FXNnCD-2FfEK0z5-2B2RVursgBvXrpA-3D-3D_-2BimExKXCkNmfgAsC-2B7i0Qw43OHqMHcX3ChY-2FSAqe92F7fHAsa74CZUPvHL6nSeEOfabUlUFW12O-2BDZHoB49fg2XmPLmY-2BKxuEqBKjYi0PHBgPJClg6XelsXMyNlXIT9NVb77-2FRp-2FNCwrCtmxOsZXzMv6oRO5gMjfWHBB6QwfHBAIXzyFQQhZpkJG1g-2BNWEh8Tk53aF0axLpLC1QVOtNJzqC-2F8pHZeMM-2BEHY0dxxRg-3D/
https://u7071798.ct.sendgrid.net/wf/click?upn=VdUB2A0IWnktGssGSY4JIvn-2F6e-2FdrvF1E-2BzRQSsLLo4rnl-2F9erZ2GWJM-2FiyT7kdc4pR3GhjoBg9Yz56oClMPIjiBFJCdHeauzI-2FXEVUDf8c-3D_Umzh8971vhGbDHjh3kZT5exKux3BxZDw8Pan-2BC4zMnD-2Fv5xnoL3j4WAXD28sOfUdWOzhbSWSUJ6HKGFYFDEu-2BHJY41dcvCDBSYQSw8pxmKvLJQR7Nw-2BCQXxym9KzBuXV1ZC-2BBsq1kEYvWAL-2Bpq-2FXIbopaSaHK6ppA6yfDrPVezrx7XyxUl6hYGwAoWHyYFm5Bhvea2i9J-2BH4vTstlCdJsAIPH6DJxYGtGkmu6b7oU-3D/
https://u8349684.ct.sendgrid.net/wf/click?upn=c9mPpkfVPAGHXqKep1Y1sI7okRwUsAt0FQhFGAx7T2FnZ4pKxlOYvxJTghWwCcNOrd3oyx64sYB6IRm2flGkSMnK2zi5qjlgjpb9tKTg-2BeA-3D_FHtOPhcNAbksvWcpoFmyAjGoKC2wZHQTuxFktl8MtUb0-2FTJ-2B7xLimcPJc01tkzsveyGD5pBV9Koo2qkw0OI9hKkkXHz-2FOG-2BTykAb1WuxdpbjdCkguRT91Essc1dilgbsUxMZutw9WYWy7-2BTlcIhG62Q6v3wSDcqYRbUU-2F5Ddjhcu9RhlSvjvhH4aiHfztm2ME1biGmeJCNw2Vzde6CbA-3D-3D/

```
#### Epoch 2 Document/Downloader links seen for 01/25/19 ####
```

http://163.172.233.237/mzFL-88_LR-Zkn/ACH/PaymentInfo/En/Paid-Invoice/
http://207.180.213.67/wp-content/kRjwT-nfcQ_kiAUlf-J1/Ref/6309849882En_us/Past-Due-Invoices/
http://24-site.ru/kZcYj-1l72r_q-vRI/97126/SurveyQuestionsEN_en/Invoice-Number-28550/
http://64.69.83.43/gacl/admin/templates_c/qaLV-26mxR_OLru-lP/INV/1099342FORPO/43888737770/EN_en/Question/
http://82.223.67.251/rgpd/wp-content/plugins/peters-login-redirect/UUgZg-eT_sZh-jPk/PaymentStatus/US_us/Invoice-Corrections-for-95/89/
http://aeverydayhealth.com/ejYS-9X_k-zg0/Ref/18164125US/Outstanding-Invoices/
http://altovahealthcare.com/wp-content/uploads/MkVYc-DeB_TRbCGaSsv-0Gl/InvoiceCodeChanges/En_us/New-order/
http://altuntuval.com/fVkH-V24u_WoZPWomJ-kMa/PaymentStatus/US_us/Paid-Invoice-Credit-Card-Receipt/
http://amjradvogados.com.br/byag-H4C_EVSQ-bcC/En_us/Overdue-payment/
http://asncustoms.ru/fXAAv-pqq_tkPVxs-4WZ/ACH/PaymentAdvice/En_us/Inv-829711-PO-0M133564/
http://ayot.ir/QHKFa-2l6q_GMd-ljW/INVOICE/75844/OVERPAYMENT/EN_en/Past-Due-Invoice/
http://ayse-nuraltan.com/DXyE-o5_U-pL/InvoiceCodeChanges/En_us/Important-Please-Read/
http://aztel.ca/wp-content/plugins/sqsv-Std_uvIGRe-9Ep/Ref/01050368EN_en/Invoice-Number-051679/
http://baixenoibai24h.com/wBNX-ee4_DLoyeljlC-usD/InvoiceCodeChanges/EN_en/ACH-form/
http://bepmoc.com.vn/De/YLBAKXJTNB0455531/Rechnungs-docs/Hilfestellung/
http://bietthunghiduong24h.info/yaCq-4i_cy-8s/GF154/invoicing/EN_en/Service-Report-92723/
http://billfritzjr.com/Lngr-D7bH_cKnuPBV-tC/Ref/12481130En/Inv-653966-PO-4D904439/
http://biquyettansoi.com/tSqEV-PJLF_g-bAj/Inv/219383978/En_us/New-order/
http://blogg.postvaxel.se/GUTY-NqVTb_DMvfIKk-an/2790076/SurveyQuestionsUS_us/Paid-Invoices/
http://blogs.thule.su/NdyaC-0Fgr_hAu-BrX/InvoiceCodeChanges/En_us/Paid-Invoice/
http://blogtintuc.tk/LMpnY-Y7U_rkfi-hWw/Invoice/44002916/En/ACH-form/
http://bobors.se/TbPWU-AB_awzHdUXB-wUU/INVOICE/40635/OVERPAYMENT/En/Invoice/
http://carolineredaction.fr/hnZz-6YMj_jbMIZ-Mg/ACH/PaymentAdvice/US_us/Invoices-Overdue/
http://childrenrightsfoundation.org/LWLX-nGc5_o-bZ/EXT/PaymentStatus/US/Service-Report-04048/
http://cididlawfirm.com/wp-snapshots/vxBi-Nj_r-VN/COMET/SIGNS/PAYMENT/NOTIFICATION/01/25/2019/En/Outstanding-Invoices/
http://clubvteme.by/xcQdX-m9HNG_aMqymZ-eOc/InvoiceCodeChanges/En_us/Invoice-Number-996777/
http://copsnailsanddrinks.fr/QbkXD-Zt_TcFJCv-d1/72962/SurveyQuestionsUS_us/Invoices-attached/
http://corretordejoanete.site/hetWw-iiVD_iPk-Gt0/INV/7764369FORPO/38005552944/US_us/Outstanding-Invoices/
http://deltaviptemizlik.com/noaieugd/sotpie/xIvEa-JzJM_lUxtgCRiy-Gls/INVOICE/24047/OVERPAYMENT/EN_en/Past-Due-Invoices/
http://devitforward.com/gVuAe-Nx_WBXMmu-9h/Invoice/6215502/US/Question/
http://dijitalbaskicenter.com/kRDPa-Sb_vEgM-lI/Southwire/VHE426424981/En/Outstanding-Invoices/
http://dirc-madagascar.ru/ZVwi-6liIg_eHPTHhMW-K5/Invoice/134873105/En_us/Past-Due-Invoices/
http://distinctiveblog.ir/Ywli-Zr_TFFnnH-p5/INV/4410555FORPO/485132683782/US_us/Invoices-attached/
http://ebrubozkurt.com/MXPws-RglrV_ZkuIP-mv/INVOICE/US/Document-needed/
http://eclectiqueindustries.com/RboA-7wfoV_u-oJ5/InvoiceCodeChanges/US/Overdue-payment/
http://efreedommaker.com/nmSh-alc7_mOsiTpShN-SS8/ACH/PaymentInfo/US/Invoice-Number-38944/
http://elinmobiliario.com.ec/hHsmR-CeT_zrDyM-OMe/Inv/476835203/En_us/Outstanding-Invoices/
http://ema-trans.kz/De/BRVWCRI0031559/Rechnungs/RECHNUNG/
http://enerjiiklimlendirme.com/wZQD-qGgN1_rtKkl-xbM/Inv/18824630068/US_us/Scan/
http://fakhria.com/pACW-PW_AHaecmPY-Fuj/INV/59421FORPO/1455331694/EN_en/Service-Invoice/
http://fixi.mobi/wp-content/plugins/XPak-sV_kwv-cd/Inv/6801363642/En_us/Past-Due-Invoices/
http://forex-directory-online.net/HfDL-i4b_BDDxzfX-8L6/ACH/PaymentInfo/US_us/Paid-Invoice-Credit-Card-Receipt/
http://frontlineinsure.com/GKDY-01Yp_BSjHShd-5ZQ/INVOICE/En_us/Open-invoices/
http://fuckcraigslist.com/oIWM-o5_wUyuqoWp-AX/invoices/1128/46925/US/Open-invoices/
http://galvanengenharia.com/EpIF-Z9Pv_kUpYdJh-2AM/ACH/PaymentInfo/US_us/Document-needed/
http://gazenap.ru/ZCWot-lHN_bswF-JG/INVOICE/83987/OVERPAYMENT/En/Invoice-for-you/
http://genieoptinmagic.com/BDGZ-MD_EjpdwQ-b8T/INVOICE/3721/OVERPAYMENT/En_us/Paid-Invoices/
http://geniit.com/YqLK-T0_twFLANTE-H1i/InvoiceCodeChanges/EN_en/Invoices-Overdue/
http://gephesf.pontocritico.org/umAw-o5_UUbFs-uCF/INVOICE/En_us/Service-Invoice/
http://geshtalt.mk/fMmMr-fKg_aAeeqo-Zp/INV/5495510FORPO/8488195105/EN_en/New-order/
http://gitrgc17.gribbio.com/suteU-Ejt_o-Ik/invoices/10528/47996/US/Open-Past-Due-Orders/
http://greencampus.uho.ac.id/wp-content/uploads/XUVW-BBo_Iby-yGC/Ref/39593838US/Paid-Invoices/
http://gustochain.com/hQSJH-dlE5_HmlZdQt-nwn/Southwire/QGV5273031915/US/Outstanding-Invoices/
http://hauteloirebio.fr/DE/WGTPMSKO1436419/Rechnungs/DETAILS/
http://hayatihusada.com/LsaZx-bX_mijmcuP-bxM/INVOICE/0248/OVERPAYMENT/En/Open-invoices/
http://iccl.club/Rzjye-QwV_Xlx-4Zu/InvoiceCodeChanges/En/Open-invoices/
http://icpspa.cl/zQbWF-wC_u-55f/ACH/PaymentInfo/US/0-Past-Due-Invoices/
http://ielts-india.in/dsCrP-arVG_y-Ajx/ACH/PaymentAdvice/US_us/326-57-461082-240-326-57-461082-316/
http://ijabr.futminna.edu.ng/kcqV-H9NM_PPAqHpIP-9yD/03977/SurveyQuestionsEn/Past-Due-Invoices/
http://insomnia.kz/liJh-ujH_XGI-Ef2/PaymentStatus/US/Invoice-Number-420850/
http://insuranceandinvestment.co.in/NedrW-xSc_yiqID-fN/ACH/PaymentInfo/En_us/Past-Due-Invoices/
http://iranianjahesh.com/FQSOR-Mq_bGIgsQw-7A/PaymentStatus/En/Past-Due-Invoices/
http://isalver.com/lkXwr-zyxv_tzI-WB/Invoice/932325577/En/Inv-651471-PO-7O870622/
http://ivydevelopments.com/TFrs-th_gHFYHPQwL-Qyr/EN_en/Invoices-attached/
http://jaspinformatica.com/hBRoh-iQ_sERBf-q07/Ref/057696758EN_en/Inv-03724-PO-0Z187395/
http://jk-consulting.nl/xYgVO-9Uy_Qvdot-JnP/COMET/SIGNS/PAYMENT/NOTIFICATION/01/25/2019/En_us/Open-Past-Due-Orders/
http://k.iepedacitodecielo.edu.co/PZkmv-u45wQ_xL-6D/InvoiceCodeChanges/En_us/Question/
http://kadinveyasam.org/nLWv-9P0xL_yEkNUE-vH/HG88/invoicing/EN_en/Important-Please-Read/
http://kardelenozelegitim.com/wp-content/IZgmq-ruI5F_Ck-4sj/COMET/SIGNS/PAYMENT/NOTIFICATION/01/26/2019/EN_en/Open-invoices/
http://kosolve.com/tcmAD-gw6lG_xETleF-tlo/EXT/PaymentStatus/EN_en/Invoice-receipt/
http://koup.co.in/ksTW-EvQG_FqIsa-kg/EN_en/Invoice-Number-546014/
http://kymviet.vn/RfGA-xxdb_UCGYltTD-uB/I807/invoicing/US_us/Invoice-Corrections-for-58/44/
http://lbuliwawdy.cf/VjHe-yy_nLHoXmnpl-Ly/ACH/PaymentAdvice/En_us/Need-to-send-the-attachment/
http://leodruker.com/eNvSE-R4_IIYh-kB/QL898/invoicing/En/Companies-Invoice-17693186/
http://light-tree.com/dLTp-x4LG6_Tuteo-xHA/EXT/PaymentStatus/US_us/Open-invoices/
http://lioiousdy.cf/yAfH-xk_elbwzFly-qt/ACH/PaymentInfo/En_us/Invoices-attached/
http://marisel.com.ua/JRgp-0bODz_svAIgilqL-Rj7/ACH/PaymentInfo/US/Service-Report-87144/
http://markfathers.com/DHtN-KFQ_Fzva-l1/Southwire/YHA54403054/EN_en/Invoice-Number-37584/
http://mayphatrasua.com/tIVm-0uC_d-p3l/InvoiceCodeChanges/US/Scan/
http://mike.trmbldigital.xyz/wp-includes/MrRBw-44qG_seako-O7J/9899306/SurveyQuestionsEn_us/Invoice-for-q/r-01/25/2019/
http://millennialsuccesscentre.com/iwnCj-9TkX_ivVO-xIv/INVOICE/En_us/Invoice-76415018-January/
http://motoprimerj.com.br/nciR-Jhq_XpfJYYh-aUQ/Ref/34880099En/Invoice-receipt/
http://mrcleaner.ca/nGGW-glHw_tTUVEY-TF/invoices/7414/8418/EN_en/Open-invoices/
http://mrnichols.emotedigital.com.au/LCpAf-BkTw4_jIybLQFCY-Chx/En_us/Paid-Invoice/
http://noscan.us/MAMp-2aWNR_vC-IGr/94136/SurveyQuestionsUS_us/Overdue-payment/
http://numlian.com/nHGU-jAgoQ_a-GTN/Inv/04109288952/EN_en/Invoices-Overdue/
http://oceangate.parkhomes.vn/giVC-hS_YOLHdGgAJ-J6/Southwire/ILW69911308/EN_en/Open-invoices/
http://old.norsec.kz/De/SKGXKF4728683/DE_de/DOC-Dokument/
http://ontamada.ru/LohV-gqh_mAFfNxUU-9G/EXT/PaymentStatus/En/Outstanding-Invoices/
http://otdelka-balkona.tomsk.ru/NFqak-IHRaK_Vtjiwjt-kjE/INVOICE/0927/OVERPAYMENT/En_us/Invoice-5710554/
http://otohondavungtau.com/JuzGd-T9KQq_PeMJUtREb-p9/Southwire/TTY45653086/En/Overdue-payment/
http://policereporterplus.com/EmPYM-QZcI2_HC-ZrG/Invoice/58443851/EN_en/Paid-Invoice/
http://pos.vi-bus.com/UnzH-OGGwO_RnguWpC-nso/INVOICE/En_us/Companies-Invoice-8939908/
http://privateinvestigatormiamibeach.com/ZtmEf-iqVJ_TR-FG/EN_en/Invoice/
http://quahandmade.org/TErCM-y4BQh_aTVhq-pL/PaymentStatus/En/Scan/
http://quangninh.biz/UsyAz-WG_UGLsGnX-zPq/INVOICE/US/Invoice-Number-84807/
http://rdweb.ir/NXYb-XG_B-pU/17530/SurveyQuestionsUS/Past-Due-Invoice/
http://realgen-marketing.nl/FOela-tj6d_yMQjNKZWe-3G/Ref/25880599En/Invoice-for-you/
http://sad-naberejniy.hostedu.ru/yXDh-Ix_jQXEH-bUN/PaymentStatus/EN_en/787-57-798526-453-787-57-798526-618/
http://saintjohnscba.com.ar/QFyPQ-UrED_J-imi/ACH/PaymentAdvice/En_us/Need-to-send-the-attachment/
http://sanjibanisevasangathan.com/mVMw-zl82y_T-aYO/INVOICE/En_us/Outstanding-Invoices/
http://sassearch.net/GAYsI-cID4_jbBAl-ikf/Invoice/654623054/US_us/Outstanding-Invoices/
http://sevensites.es/woSw-o7K_VZ-b4/Inv/34554975163/US/Scan/
http://simrahsoftware.com/zPTYr-zP_RX-sd/Southwire/TQM49397368/En_us/Paid-Invoices/
http://sinotopoutdoor.com/YgjjE-QLfFS_OOSm-39/InvoiceCodeChanges/US_us/Inv-871526-PO-3V606193/
http://snsdriver.com/FcpN-chXCl_sF-03/INVOICE/81473/OVERPAYMENT/US_us/Service-Invoice/
http://sosacres.com/lMMe-Wgmlc_ebV-bE/invoices/31256/74457/En_us/6-Past-Due-Invoices/
http://sozdanie-sajtov.rise-up.nsk.ru/zwZQ-88_ab-Mw/PaymentStatus/US/Invoice/
http://subramfamily.com/boyku/REcWv-GTr_AINbrMnew-NU/Ref/47308674US/Past-Due-Invoices/
http://swiftley.com/KKanU-dH_gOqcGf-zU/08764/SurveyQuestionsUS_us/Past-Due-Invoices/
http://tarjetaenlinea.com.ve/vpMJE-qmhWI_tFMAEF-4Ao/Inv/4565122370/En/Past-Due-Invoices/
http://temptest123.reveance.nl/pZTiY-42Ph_Tm-sxN/INV/8092495FORPO/7356184607/En_us/Important-Please-Read/
http://test.laitspa.it/cinepromozione/LZdP-MCwZ_mb-Ua/invoices/9347/4001/EN_en/Open-invoices/
http://thuraya.kz/wbQOM-AHOf7_TnPMDSYM-rT/EXT/PaymentStatus/US_us/6-Past-Due-Invoices/
http://titheringtons.com/rxlc-ZO_vTahDHWAl-k8/JJ733/invoicing/En/Invoice-for-b/w-01/25/2019/
http://towerchina.com.cn/FdtBG-cO_sxJNbVSij-xM/INVOICE/En_us/Invoice/
http://traktorski-deli.si/eMRUV-6xIX_uzvOfEKFt-4yq/EXT/PaymentStatus/US/Overdue-payment/
http://turbineblog.ir/deyh-NlkTd_KmhedwOn-93K/INVOICE/En/Open-invoices/
http://uborka-snega.spectehnika.novosibirsk.ru/KiFu-2098i_aKBXtW-kJ/Ref/8727086170US/ACH-form/
http://ulco.tv/KsFn-67BHI_fFEpOIrup-tH/PaymentStatus/US/Past-Due-Invoices/
http://upcom-pro.be/Januar2019/LGZTHVO1701615/Rechnungs-Details/DOC/
http://vysotnye-raboty.tomsk.ru/EcPf-hcDx_AKIe-9Q/INVOICE/En/Important-Please-Read/
http://wordpress-147603-423492.cloudwaysapps.com/KeqK-v7Tq_JFfCuxvm-Xpw/EXT/PaymentStatus/US/Invoices-attached/
http://www.alternance84.fr/gXqcX-8sMkz_sSCbm-Dgm/ACH/PaymentAdvice/En_us/Invoice/
http://www.alternance84.fr/kovTl-hbI1_yUmcQOjFT-tT/Invoice/81263158/En_us/Past-Due-Invoices/
http://www.biometricsystems.ru/IcGDV-mjWxd_ooO-Hz/INVOICE/91634/OVERPAYMENT/US_us/4-Past-Due-Invoices/
http://www.cashcow.ai/test1/vdENx-as_nKglpxB-Ta/G820/invoicing/EN_en/Document-needed/
http://www.devitforward.com/gVuAe-Nx_WBXMmu-9h/Invoice/6215502/US/Question/
http://www.editocom.info/UUrM-psOAi_T-13g/PaymentStatus/EN_en/Invoice-Number-88846/
http://www.elinmobiliario.com.ec/hHsmR-CeT_zrDyM-OMe/Inv/476835203/En_us/Outstanding-Invoices/
http://www.focusbrand.cn/xGVmS-PML_lc-Cro/invoices/4694/4884/EN_en/New-order/
http://www.hayatihusada.com/LoYir-qrXnW_ivjwTKnV-dPi/En_us/Invoice-for-you/
http://www.holzheuer.de/QUec-mrbSN_FuyOen-JY/US_us/Invoice-for-c/g-01/25/2019/
http://www.hopeintlschool.org/jygh-gVX_wTfkm-Z2E/Invoice/406132370/EN_en/Invoice-for-you/
http://www.ingrossostock.it/EDSJ-FN_hvXGApWUw-J9/US_us/Open-invoices/
http://www.kredyty-hipoteczne24.com.pl/Luiss-ujzG_KtZ-CWp/COMET/SIGNS/PAYMENT/NOTIFICATION/01/25/2019/EN_en/Important-Please-Read/
http://www.mohammadishmam.com/OVDt-t1gq_EtZDwVpZW-dY/invoices/71496/01314/En_us/Open-Past-Due-Orders/
http://www.odesagroup.com/RDvXy-uB_ZyQMGhvi-BC/INVOICE/80896/OVERPAYMENT/EN_en/Invoice-receipt/
http://www.oussamatravel.com/oZIP-LF_WLed-wk/Ref/74468031US_us/Overdue-payment/
http://www.pattani.mcu.ac.th/wp-content/uploads/XnUjR-IDqf_YIllRQ-Q17/PaymentStatus/US/Important-Please-Read/
http://www.pro-ind.ru/mYeN-unA_DAAOC-u3O/Ref/31076593EN_en/Question/
http://www.retro11legendblue.com/lYSRR-NsaK_SJhhwez-N9/COMET/SIGNS/PAYMENT/NOTIFICATION/01/25/2019/EN_en/Outstanding-Invoices/
http://www.tomorrow-foundation.com/fr/wp-content/uploads/xhgV-hGf6W_XVYZ-MUS/Southwire/MRR7854427356/US_us/Paid-Invoice/
http://www.traktorski-deli.si/RLnb-jdd_qMbWVpe-Bi/Invoice/0143040/En/Invoice-Corrections-for-53/67/
http://www.wins-power.com/PPQtx-KHRq_DflbMJ-vJJ/Ref/372822985EN_en/Past-Due-Invoices/
http://www.yulimaria.com/wp-content/uploads/qFoh-Ax_QzXXBz-EZU/Invoice/2480086/US_us/Invoice-39198173-January/
http://www.zsz-spb.ru/vEGZ-JnKM0_eQes-Q7/ACH/PaymentInfo/En_us/Invoice-3782853-January/
http://yclasdy.cf/vhzV-Okb_pAkDId-rxm/EXT/PaymentStatus/EN_en/Past-Due-Invoices/
http://yostao.com/nYZC-oMW_TurVeik-wf/EXT/PaymentStatus/US/Service-Invoice/
http://zmogui.lt/yhVcH-GJUwG_vt-fg/ACH/PaymentAdvice/EN_en/Invoice-for-you/
https://gtp.usgtf.com/pBPvN-AB5_NTpV-if/Inv/7680152019/US/Paid-Invoices/
https://installatiebedrijfroosendaal.nl/rASD-A84w_xTC-Oa2/En_us/Service-Report-35114/
https://linkprotect.cudasvc.com/url?a=http://amjradvogados.com.br/byag-H4C_EVSQ-bcC/En_us/Overdue-payment&c=E1YkQdkVeWlZEB5QHIdGIrxZpUcyauS16kERroZtf8JJsAtoRPQOVWTNDTGOYzrAtTaS0xORPU_rhB9Wr48dcBxeUmL_7oJ5uh3qI1jyCJxw&typo=1/
https://linkprotect.cudasvc.com/url?a=http://iccl.club/Rzjye-QwV_Xlx-4Zu/InvoiceCodeChanges/En/Open-invoices&c=E1PvV5eByM7tY9kjzRd2_jFmRkx7sYjxCouS92NqpmVnWJ56tsMc8pz-Pm6c37W5zFyXHkrO63FRuPDjE2whMIxCOw1e5yleFTGEh62ZdxPzs1Eg&typo=1/
https://linkprotect.cudasvc.com/url?a=http://tarjetaenlinea.com.ve/vpMJE-qmhWI_tFMAEF-4Ao/Inv/4565122370/En/Past-Due-Invoices&c=E1xis073an1r2zG67syRMa1jplwws8T-1fN8nka_rVIkkCNa52fNJlrmLW9SfxQXfYHxVHeZhEJRHErW-PpyFepCfkKSF-pMWmbUJ3bh-E&typo=0/
https://linkprotect.cudasvc.com/url?a=http://www.hopeintlschool.org/jygh-gVX_wTfkm-Z2E/Invoice/406132370/EN_en/Invoice-for-you&c=E1_6Zs8wxvd1C3-RFr1-4cHexIsQ7q1KeezfPKIElDfetZHfI1T4Hf5p5kpip1g4lOEHQqWyGHFq0E4aTmCbbBA4ZtR-tMuY9KUtfB5noki2T8bBMd583NEvsFSg&typo=1/
https://www.ibpminstitute.org/JsdiN-Rbw_HEj-xS/INV/1560201FORPO/65082052326/En/Document-needed/
https://www.norsterra.cn/pExV-1g5_PTWUzf-1C/153922/SurveyQuestionsEn_us/Paid-Invoices/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-01-25 18:09:00  (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
e6670dbdaa8a4bd42c8e0ccb3c230c55c8e079db98248325d2e42f1f834e1856
82a827da4faaaef946204e03d283dace1f5a89a6c5407aec46f6fde6e1595686
13367393d9d148052fda0bc3dfc30845e2b79f9512762afb308fac7845f96b3f
cc0ba4e544320ca57255fb28519964fc761932953fd7e6625125d0759e186408
dc6fa70e565713a494a807bdb409d93b265fadfb55175dd7a9929c6aaa695029
064290c398ff5f5d91d0b1baa7294c4bda2c9c264e036f84d16cd67a1ac259e6
c1f80a87f0f84b013c5ac348393999d29cdd496b7d9ab0a394356cb339b3d4dc
22aa3df10d5204453d2af2c41f85a0ca4a5662cb3be2be243866f3bfb9b8a43a
6df8ac1b82796f69514ac94010081245a7772e4e65ea6931ca1dd8aaeebc971d
15ccee926260c7ac95a234efa04e72b6c178d9fbabec664776e7b98b4e46ca88
0a255976626ca2cb83db142e5692385530760847522b7edb231dcbef92e7e343
e2db7db557254d7fd12e750999241dd44d815548070b1a5763f290bf5e20135b
3f55a2b305c4e402037e738a2278c4a7655ebfc0ab52b50dcddad1539539ab2d
d757f681255a5777b8b27008fdf4e4f9ffc21655fccb471671e250c864142694
0b224525d261dac5222512b4766c9f28c9ff507e2fd8518af0ff2de2a168bf2a
dd158d6f73a95496358dd5599cbe3ed2c78becc7e9af06267c083bc31db14fd0
12a78c5bad7498d94c6551ad5183f116e0bd611ff4ff4ffd931c77e8179106a2
18ff8f353f91db4eacf6e6e8ede40330cba416853066f0dd9a2118a81b92aac0
85945f9d3086d0fc0c720abd907cfe98424f3f9253aff27902f667ff20cd44db
585c35f5a6ac3ffd2ee3ab7977cd016ee572226852fb7747538eab7291885e63
c8c5e3d5c4d6115d4a6d3375b77baadaf7824799680f8b8a66543b603b1e6996
186675105bcf6041496c6f1cf3f82e3625a89bbe4a77d1a36e9d57264efd975f
823b85d1a807365a221dcd31b17695ea3ae6675a5fa87d4a6aacba21778f6c56
a65e97e7e409a92aba51ba9a8cdf782a51ea83e2790e9355e765c45faf76d7fa
fb2650357f54ffe4584f255565bf8cc9f6920530024b6ab1be74da0a846d9ae3
b83681faf7f5c782485d63f02d7811a15c1e101f7c5b8e513d70f7d72dee395d
126f248302598d9ff85fe0a40990a6a54c97ce0e0d75c1e5dd087eda5e1d2026
e3a9d7938993434a80d22563ac416585375069aaf200e525acd33d503885fd4c
6a83f5f131c68f4407569894a645515105887c0429987cca0ce521ea8386ec85
637f8c64ef0ffc10c1a7b83318d3fd11e1145bb3d9d2f057a4fdaf21b42a8074
14a7a98a5112670a720954db3e781171bccef4a64e46abf8dc797412f06cd6d7
7578cb5d7fdbedb58af39071aebcaf5a79802462eb9de815d88496a096135428
7dada1cf0143a4317d584fb4ca426cbc8530b4ca6c70b8dda6cf253d023ea161
2f452a23c546181b1182416e80cf41c6c17f8f896a5702943aa8400022bfffca
f2a9b814e81e89f5a88322a21f7324c5a1f4ffe1616d4cfed2c27becc8f7361d
ce30fa7953732d651274a2aab3c100c55340df06fa1e669eb0dcd9f1a3f9982a
7dd96bb8860fbde286229161989785b01b35f826a064489f9ff966dd0ab2da2b
13f5f1c78fcb67cb11db707ce647060213bb457f5f2ba31a22be7520f4a87ae2
318e8d2f1de7ef91c5d742e93802d15738eca94d59709c51147841c419e30043
a350883dfb9922f900a2a8b7fda2f3f39fb1460539c1692fce0b48ea115858cb


http://bloggers.swarajyaawards.com/wp-content/HVkwzPX/
http://dev.umasterov.org/Ks930TSSPA/
http://www.grantkulinar.ru/NCTIn4jMv/
http://www.glazastiks.ru/fTq86CZSl/



Creation Time	2019-01-25 12:58:00  (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
4080c309a2d3a1cb3708570f3a404fb0f340997da8861b518ab9e4312c827b6a
677397150f47326d81bcc56fe71dd9c40f7985d32528f2bb66ac40099b06fce5
8a5c08cd5d2ea754815a52b96daba85cd5c123c03408621178a157a09cde407a
cff8d3dd0eaec18a9f98b28bde4b2136841628c8372ee055727702e95b702bb2
3cb1973fc2faf2cd7f541bb8acdf74192049029d9d19cfb0fffbb955d1992744
1623ed5a2def090ad99269de6855e123e694de78afbf9357ce4e71405cfc3220
4fe19845222f51d91773ad10c9a57edc60ff18147a76e49e4327ba8ab494842b
68f6d97a9ae3c20714aac7ee02905894e9e2aed0e638668ec80f7a0550224346
c15dd1d5457ed46106642bf76b04375a58c0f0b06e28ed4befbfd9cb4fe1844e
204c5435e21ef2291750fb3329659c80d55baf64b2037f937b20ac49444b30de
81cc9d9594454a9a43b07cab98008cd72b34e720aff42423da1f99dea85a66ba
c74c6bac614bbb5e9c3b1b59af84506a895675ec49c9f8d3b2331a64df90e336
d97af7fab4a5dedb28ffccfbbf62d0ec6810c71bacd12f634e21320ca8e8b0b8
28d3a639f7ba75778e955a690ad2e47d299fe0817c8adbb0e434fc7203ea2887
5f5e17b9f0d4afa4ae6d5e4bdda01fcedbe009ec593dbe37451146378e44d768
8c102eedd7974d6fc7a56a76b46447ce138e3ec6684b1e54a579a9dadccdeeea
361b36f9e376cc1bf372e629bdf16cc047ae7c11f69e819a2c789cc79f19a1df
0ca2efd21a0eadc5c2e7d4603f34cf4497064804059289b7bbd2317fd5bbee0f
ae60c5a1dabfe92e7cfa30ec6f0450379d6f9b341ebfdb591d69de52dd1a7ab5
9da459e87f29181ca801f817e197b51d1aa99f350717d48b0bbaa7d5ef9c89d4
c6c6667f1d72c836ab7e25be0068e9871b617a55b3e2dc792db3f2670e986588
d0e175ab6cd67e4013a219232336d21e1ed12a509e090fdd1e57658fa00529d0
a1c29fda8600e2d13b06de26d15f2c13bc9cce41e0b09e42ccafd2679b3e50c4
69dcf38f2c5156e86bc143488adad5f6676310cbdc2b58e81c4ebd152ace0346
f378439fa3a79a700d459fe834e50216d8c2945f1f036cfd9de7c2ff0c8dbb71
5183c461cd2174959d3b574ced102875d6fe920d5f1a3647b8dff5f1decc428e
8af7babf896177add36cda13534df3a121fd338a79242077bcae4844fb3d1c77
2d61c87e0d7ffdb81ab5a205b041d1fed1458e3b60bf100aa92935ee0f373703
aa35568ef2d0a79dce299b3d3512498c6733ec233b093888e9d724465e4266c4
72fc001d67b2b006d70221e6b33465d2c79757b1c8b1ed19985ebb172663ee7f

http://johnnycrap.com/F3lAO3lioJ/
http://rahkarinoo.com/F3e1JB1FQG/
http://regenerationcongo.com/JCgol5mc3/
http://mimiabner.com/5hGe52Hrj/
http://sskymedia.com/EMuTsy5/


Creation Time	2019-01-25 07:30:00  (XML Based - ENG - Off-Center Light Blue White)
SHA256:
29a90dabce12c219060298554250dc36361c405327596711eab877f3e5b45cc7
47cc02e8ccceda8591bef82a36b739939a962680599af265a7bac1a863b2696c
89ebbedd33ad7bf92e61770fd639ba57b336dcce4946b01d2a8dbce556f7e866
a91978d7a170d67e558b63b501615276720b0812fd5db609655058b1fd3206b6
38836e453ede62fb4aedf3d28b08917411c5c44203f5a4abb6dbef59c106b7bc
22b974c56d3d5020a3ef2abeb813f0522ae191301bf88ffddf76cce729604013
990cbc4fb255ab6a4f3fdf16e40c4c3f016217b9088bc4a7229ce314ee453e5b
c77df7177246aafd456745622ec15c2a073f8cc8f76b5754398b57641cd7c294
917fe7331d263bce5872e7b21c571f756319ad1658a5fa9f83b464a5aa527034
eba03beb9c7a81c7898d465c8778a495a2ad000811fe953740b784f2909626d2
684822d2aaff04fd326cbf8f583ea905037ad72206a6887fc27c352ae37564a7
ebb1b1cb87172e05b83d7730c756954a46da05754fb20a1809001fe13059ad67
cd313a60cd8b6f38854d6879a71d00df27f4c984ad67dbf9fa142b2c31da4fa1
037f92df901f7467393e9490af045780eaeb67cd900449bb8bf792e8c8df1845
3dfb0f18cca242a576f3cac0786dc25fa5456fc8597860ab0409cca70d622597
5764e15088bc0ca8c4514b094566acf33a833d31660a19810e4f4bdc7c1db948
c2687d39dfbd744ac8c002bf4b9410543b162b8ffbd16657b010f43c9ef93592
e9b04869b730bdaa225966e459bd85b08fc37cd848729d6727b2eb5b2be9ff0f
844b8e0135ff8f53eeb2d9cc4400e02181af592b2f7202b11e53e48e825d9c8b
44f78456259f4bcd3baafc6b8b6356691ecb985203bdf08d4265c2897f3c45de
444ae0bc91a1de6bd65d83cdb26f1b66233d44a62281a44e5141db6ce325c173
21e7ab4e12e4dc3693e2ddc85b1a58c098a280019adf81d9aa363d18b843c850
dc182e1b911ca091a0935763395c39859942fbe4549363cd49a532f86969a877
a1c6ca9b50734c8f8a53bcd10acb263060589dd9bf7dbb2052f61b7191c1d7ce
d7b1bb0bc556e9f0d363b1227d1406ffa00a6e00b8a2fc1051ff68d4e83e5bf5
d13cf1c490bf93f2c69ec0611923d459d4857bfeae2103d55e7abcf262067cc8
263bee3744ccc26c8b64ab790059484618de48a167b0d92eb706d6c78e9e6e2f
a2d4d8c683ecd47dfb93d8c06dba797516b56468e0dde006fe64e303efb38530
9b5e410f911f23edca1f195bf7a081eb12be5bf210c5d88bd182d388ac631113
45f04c53e75e575dc21d5fc154b61a5f31f2e6c54e1c2755fe1219ed1637bb54
0a1e38a40c7483085ad44b5c30c44f124c17efd1fc83ed6cbbc02ee27eaf2e6d

http://phongvegiaphien.com/WJ6buIiRcU/
http://macsamericangrille.com/33wi1mGHjK/
http://krupalenterprise.com/7aZrc7Uee/
http://wc3prince.ru/OklFV4wG/
http://myrltech.com/Hx8cJ9RQ4/

Creation Time	2019-01-24 20:51:00  (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
4b3a78f59a23dae878f3eb73c3eeb560300685598f3384365bb57670cedd23e3
9ad251dab2ab938a6bc715f3b90f723f91518544948fa417bfb71ca37acab7a5
861f347f1bd084c390f05c0cb50bfa2db008f96225a5088feb0dba9d0e4f7341
5118fcade7291afe5f69369b8b332fdf2693bda3e64d8b80a193d8725954a1fa
d0308725b167e7424bdc448b74612f22b531222f83cbb822d3ceb64c238e90a9
248b8e780cd60c1b0689c15777f23cdc55fe72a161c32579d28aaca35d3b30cc
9de5cebd8df9134f0ed935c4a5ae2315b79e3cc30294be25e255bc166b0c2e72
941db05e4e17de070d14224184a401621cc191ed7d359325b43f1cb34d668636
057b65e168e48816b40f82608d05cc5034e7daeacab139c778498e83d0bd5107
be9ed35692f327377b7cf870855de33ecd247ac55cbdc0daed3a10d0642df0df
7dfbe3bb7d4a4604ea5bc4239858ab848569e9bdabaffbd3f527a3ad61de43d3
8e89c5671884798aaaf26feab4b71011b23a6aa8f8cf8375e64acce42ffb2c4d
f8a4e398a1bd506775bb260a41190e6273a8f8ba2a6622152b9ff5ae3e419bac
8325807acba17722bb5117863e79f3cae536fd270524f02c631d255b3dc20af8
98eb91cda650e388cae1c79a0a3f1e8f6c08edde40ce2e98ffd427b9b372b9e0
a1c073d3e6b50b20b852f77e8eb223157d9ffd45cac6c02d545c7820d907cf62
41900613c7054ca5ab2c4b6246b1feb80f1e3aac5ac2906cdf365bd94953a449
0df0f1549404dcab74d520b5b7e306f5a63991e12d4b4194117966ae461046ce
8cef0fca678e46e39d4283f378911fedb867ccf6d372f319909f39777e8486d8
92a62520f7819201306962acb821b4f004c074bf732f580ea96ce6ef6ccd7e5b
fc070a2e12ff5f2194cea59debdeda9f8f203c7166e545cd20639943e3969b38
c5f59229d61a20335daeba1fb58a1325242aaa2243200ae2557706b1f9fb7471
cad1ee08b61eb536266ccb6ddb60e984f9cb435e2c2bd842b4386833562a8683
673b183311925f2d5a5ad31335c0265494862f923958e1c637980260fd4ed485
7ab5993a0e102b88ec4634bddc099021601cdc2aad30649319a780a138bbf793
cf5a632f3b25fb49a710226d8c0e5285391b33742d80144f5089879e68fb0d02
84c5d50e2f0158e5ce7dd695c46981105d4fbb9eddf9b64f7f176acdfdc0713d
3a2c95bf791d66c9d55fed9243c2402ce5470056e3ba19f920231c8df8b5ee73
fb1c8b4b6eadd69c21918d67ca9aab0639b1cdb0fd75ad1205f5a71ed9b28f14
60ff868a235433320b72348b38efa4ff3df9e94f228c55c2f20804f86de68820
2afd37b18eb20a9ec090b80ec07e298dbc92e6e9c743cc009d6948fa1a856bd3
6b1500b1c829af194d824c38f5a434c0a87c44cc38a9aa87a47dc9fe68be3641
5845601b2c8817ddd5a4930041859630960a67e69cd02dd1b791b2dd4102209c
6f67af19ac08592c0d08b97848017a73a87c20521f1af481effe5c30fc30b2b1
0906858828e34414ddfffbcbf0fb31f38c72fb68a2f95d595e895b69a165d2bc
3dd6ea67bc3c2a033c90fe3da4d85d8857d6ad5c5fca91d4f3be01e3dc48f0ac
a7cddc468ed507316e2c77f699f3d78f15c9d3de6eff2cc182931db4e032ad26
16cdb31168fd3d6e4701f30247f617bfaece740446ba69828157ad3c153c814e
bd7136c26b24158dc664f8523c495fa186131f7518ef5994b317b4b593651ee4
6ee0c17573b84404af2f2302e60b68063469212f538456e6a87bb487b43fa818
65aa054fe2e51372f2fde531b386b89b2e01137743d5f08c6da0489f793dd4fa

http://creditpretinternational.com/gWybm7Y/
http://madocksexchange.com/ygUE9tbbF/
http://melaniaclinic.com/fYsRaol/
http://jaydipchowdharyblog.com/Y8ZKhf58/
http://houseefashioon.my/DhP0g4hsHS/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 01/25/19 ####
```

e0e6e9ab5fb53869304ddacb67b6c02ad3a487d3aa9ae2bb31c593283d70a6f8
57e0817881e5ecd77e111916c8e2514c86f2b3b777f0806267c716d484c32ccc
3636d9104e3631790eb1c42432dd5e31475d5ec67ba933b721fec3337c0068bd
195b9e507b726d9202053bf90e65aceb062d0e43ac995f4caf3432f9fd3ec076
9e967a5fbbe6e2a38b16921f6ee5bd2c5c56584ec7efd1b0c7a6e97b521c1e4d
815febe790b61988c69d4bae25085203acfe212013ee04eac1466dc10c0a499a
caec6ffbcc591911221770a1957ad0d414d09fdbc6927039d844f03f0352896a
f249e5572eed5b1d70aa4f44c5fb5897bf1794a5ca3276c9080b370b6595d7b6
843a50d54c3530d2640fdd918dd7cb8c573a4b367a451ae6198695e24d2a0053
5854c9639971074ea28f41cbc638be6a33001f26e650bb3cf7c3ebfe5708469a
c5b2441e1c05e86fc76e03549126af995ff221b7869bbdbf8333f10c9636db28
48820e36d9e5914860c9ffdc2fc70511406550c4fedad5f6e21646a0abb6bf76
37a000cd97233076cd3150c4dbde11d3d31237906b55866b7503fdc38cd1de08
f4b983b9ab26edc8e241a0c0e85030beb2534205f69060eebc660408477d3ef5
c9f3e8ba54f8ca9d3df39c17ab8674896a348b7340c956141fda1c437465bac8
d59d55a5dafbd0e01f5a4b3c070df1394eb8b8c06789bc6f6ba46785715c75c8
795a3457dd30c106dde4cbf08ed3c0e6c08d0f60e8e154c7b48543335be9d95e
46153c38feef9cc93a8f38ad1b0acfc7d1ee0627ed039a09f79027390189e2a0
aaa89f524bd147cc8a94244bdb9f3727c3f65a090536890ba0c59a74216e8e01
fd96c2a2d45a23f1f385cf42bf570e235c07096a372d013d13ff21b2570838b3
3440a3f1a3abb5ddb346aefa5712df0176bb01caa952a20ad46d8b8da0faddd4
42fa57e597bdeb53ba18de6d5587cadf99924ef2d2769d1f8f13d791f7336077

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```



Creation Time 	2019-01-25 22:10:00	(XML Based - ENG - Unzoomed Indigo/White)
SHA256:
7bd2a0d362235424a0c8652e5686a6ad949ad56be8deb85c600ae67a378b12a1
6f25456b3c29abcaf850775675c1c03cbc0929c9cdbb00c84bb009de96994cc2
4b36e6c853c0917f469b5264e618a64286121e700cfa3d2ce5573182c939d345
a6479afed5dd70ddaaaaad6e2dfbe42b01a62a268b5a7215aba0b15acdcc86d2
f8c0760c515eec1913f0a5dfdd5dc7bc0c86a9e419d472fe91b5b19baf85354a
da802e4ded89d03156a9759904ae07b4a74753a09f08552f3ac026343684f409
b89e7cbed3db91c2ae7b5f866d256bfffa29c663a4529afb3f3d789efa5e709e
2f491856cc6bfc7db199b86f6b5a79d5d94fe36c230ed4c181142cdc0ac58fca
a3447f8c332758038812b2f1c0bebfe0532f10a8d462cd91aebf8be27eb591bf
95a42d6551ffbc8c15a8fcaed54f90d2350acc5648ce06112101dab5f7216968
b717507b960c2bcedc8a87129198102103a3abad50721ac2324523baf0f90359
72ba987f74b0e0ebcd3cc16a12bfce7f0d525994ea9025f5b4d7f3fb9bde0851
b2488e1bd4ff72d754e966dfdddc5e6164467086af3984afd694412687747b63
59e159988978a0d16a7ed5a44e6127403a2d9daea9482f13e48cf34c0dc998fc
b74d9571a9c424545367951491f6770fa1a4be5be83bef825a3ed3a9a12aa807
aafd126035174d095ebca1a048450e4230d1a072069d214ef4b4621e888c9f4a
ae049bf884fcca8e07fd85e018f7f56a632765b2ce746cab788bb6dcf9cfe0c4

http://gpsalagoas.com.br/mZb9Ev99/
http://rockmayak.ru/uDwCv6rHyzRXC/
http://haberkirmizibeyaz.com/7NNaC35tpv4qr7ca/
http://hoanglecompany.vn/EaGimpLKxVUr_eo/
http://dcfloraldecor.lt/RiU3O8FFMsM/

Creation Time 	2019-01-25 18:19:00	(XML Based - ENG - Unzoomed Indigo/White)
SHA256:
e42d491bdcde82c87e85daefdbd032d885873b6fff917a3df35860a22f84f0a0
5e002f7129854f253d212f90786b8a40e533c45e1795828c228d00db69d501fe
124f7be7900fb3e8b0286206dc288e05fb000ecfd253912bc2c6fa14fc7dc092
a874629bdd0a49cbc5bb5d5315ea944830fbaeefdd82c7dd9fadd8af95090eb2
641997c2e2af35165bcbffea23230a94da8eb0f8d96fb0d0c1cbeef213fd7f8a
7f7c9f6de90cbfeca9441f1ef560a1da77718c364cc68f6bf7fba2b148e14cd7
8fef3c1a35ddd00a08bcbbf0c5b89d8ab6ed1d26bf91f242623294f16f44bd9d
866e71e55f12eb8a1295a20eb186f1b8f3fcb53f4972e92f1468f8f114321dbd
683f1cd1378a2c4b15b773e4e29566d23e335a451f3ac91aaf1dd4c0b8b6ba2e
8fd8045988fc972706bf67b5a8be74f31156537a614452b275dbee92579c1a59
72a9c666bacc3fab5e7174841a35fc3411241f5d88f9dc430c1b6774d90d49d9
1cdf819c7ae46d04e05ecf8969184bbcee88ec6d04b2f840cae063add6f0886c
d5f411736df73d22eb6dd495149bce7769f99f85ae996259c19828fbb72ed684
3cfed378330dadfdfef606c9fd72dc602bd66605a15f7156783611422c2b0599
aadff987e092bd0303bf10cd0aa7a451a8fd3fda8ea16fdb144bcab51b2c39e5
1b8e6b48f620d95b09a2deb30ae2dab71a313dd4d8917280a401ef0be7cb62f4
578f82543b675b0211f7975658c884abac0a729c2225c25f3f6c0cf15da2f0c3
cf88cc238a5b462ef46a77b843d559ce2536430da7542a8ac6b8257747df0935
cc7c46cf39ee04d62702599bf2809efa0160ae34e09b95a8b61d98de83a8f671
663e5b2be92f616c3d016908456790310ad5b0b3c0b333e11b467ee678d3035d
6d01efd03697912e0ad66eb8da8dfa5769fa9411da67852243618cd4798842e1

http://smemy.com/5s1dhHR50we_vVlpARD/
http://tuandecal.net/MJ1aW1Lsww6dh/
http://www.rijschool-marketing.nl/r1s6CzhhAdA6J/
http://autopart.tomsk.ru/block/v8oMwC71U09thyym3_IM87/
http://ratemystartup.ru/MA1kLb23SIUs/

Creation Time 	2019-01-25 16:16:00	(XML Based - ENG - Unzoomed Indigo/White)
SHA256:
d2ed116a474b7d7268c9f91fa883efe4619f5e4091a224031f624fdc89795c6d
0fa22e6008f5bc2712ef58181753b4be464f23682af0619ba2e9322694ed6244
a7e67c40523417036259961a8ba7d4d793cafb5a0abe7931d17a359e444ee942
dc7d3c892567b60ec0003806ec124ad85679326dfeb2ff11b6d7a67b1f4c1ada
64afc03062df6f23d2ccc80e7f0e1e8dd9e151fe0726167e4df2f41a1e11ee15
02c2ced1ad49c51b0125a450a10e431bdff484ab7ae55f2acf7023eb0f1b7ba5
ed99d83214c99c701406cfb5e72089ab651362db837bc6d04084bfb4ae1003bb
5969616a889d0c2e711804d6c266750fed040c03ae0f52a04d436ec9a9c32fca
d508a2e54f30d990fb3f63b3ad6e62f9387727f113ece1756b2f4f97382a48b7
794393440b7dcfd955c8dc403efec9f818aab72909b60a02c2c01cf41f8b37ae
415ad2f008750e57d333b856bdf16f5d13721d363741073ce340dcab5814824b
f3647ec8454d7231f61f29ad9c6c0897eba1e7242e738a9154a7b7690d660d0f

http://leadersta.com/ZdsxZDdJ8a/
http://granbonsai.com/E8O1Uc5awNVU/
http://web-cude.com/wp-admin/huEZ8gXOLxqu_Hai5jicFl/
http://hzmrussia.ru/wp-admin/images/Q5N8LH6S1nAf5dV_RXwp/
http://ispytanie.savel.ru/Sy144QX5S9RkF/

Creation Time 	2019-01-25 13:00:00	(XML Based - ENG - Unzoomed Indigo/White)
SHA256:
621461aa02e721eab7fdd620c870273aadfb2ac01704bd13c9003bc884cfd452
b4c6ef1dfa9a06e8bcaa7db1b3249260e3f8bab3bf66c1f79a1856b1c34bb789
266487f75a65b92c0eee06c37bcb00b75e649a5ea39ca2fe6a284b05ec68e9c8
c5d35475ea8471c5b820a94dbe454e568e5b5273f88e71ad59ba613da5b6584a
b3b4059ce72624f914f9ee06556dca1a4d4a9911f11969bf184bf2309a837d10
02ff7455f44b0665ca946931501af60806495272aa2a5d5aab7444a1ab395f95
75c331ddf97936b7fd3fb3b9738d976ae312bbca813fb3125585a0f076eda009
96069dbda24ead2c6469cd43a5fdc0d7c0ae9316a27a72381e822b215f09bd8c
1cff972a3032531c592f101b67bbd25c3af7616e7133a4fcfcee44ed19ef1eec
d404ca08908fd2c3f911d85c12c7150ec0128931e22fc848daebe6a305baebe3
49767afc8695c10594682aa803ce06f1f5d691230aa668f4781cbdafb72e55bc
3626d2b1b8d760ecdad5015c6e0420ce4b3e5c03ca32233ce3000fd1765c8416
34a3a7f1f647ea06faa81da64c1d9767ab66dc2a062520c8343f66b4cbd33798
bedca3faf465bce738371b5fe1ee017fdaad87518e19ec43b87fb384c2e733d4
3ca38747747cbfae350ae946681c835c34bf1046021a5c50cafdcea263df58ca
3d531dcd50432a0a9be387ce6ba395f0928697ac9014f3d8a79273dfd6bde2a7
95361ba95a5387b705ec3e3bf3a119a72ab550382f91233e116a7ecfbed043b3
2ceac4ff0ba01864db7cd26b4c84bce68006a7613ab6c2550561743c6053b8ad

http://beyondbathroomsandplumbing.co.uk/hNCIxykdZ85/
http://allinmadagascar.com/8j74oPGHNf_aHuw08Hib/
http://therxreview.com/BYT1D3keQi/
http://leonardokubrick.com/TCx3yCt8wf3/
http://clubmestre.com/qRd7K5sf5_4/

Creation Time 	2019-01-25 06:51:00	(XML Based - ENG - Unzoomed Indigo/White)
SHA256:
7ba6de4617c43d4c36ce8463874d0b072a401627c4ca249ebf709c08cf215b54
2f5c9e27db92ba0c33059995c757102420ff9cf306799f09c665ef3e8aff1e81
c90bfc4a5c12e7bfc91f491c3989ad8fde3ef01b02dab66188645bf0407aeb3e
d70ab3b0f2f4e30acc7f6d56d1a2134fd2662fb0234028293fc8e23a3a4d3bf3
77984fbae2073f4f253d867935a54133c0825460dda54a9101e0bb2b2a794671
8b62d98c06656678cecc6ba2fc74e908cc0de4bce6e939cb6c345a1f2a5af9b6
5cdcf2d4922bc97dd43e05d2423ffb31d02d4e7407b8627cdbe71e025c01ec35
b12ef71f7b2d2daa94ef4c5c1293739637fbd6b5e3362cc3aaa87c2e8849e6ea
cc0a6f4a4957d0b0ca40c55c25fda6b352b21db6a3a4cc4e082900501f778869
0400885272b35c6fab8a5837832af3128f995bf884e964ddf5b984331acf56f6
71f2d6a4bc2041358922b5cda32b2129ba6ad629d037e1be6d8ed92373c096e8
c054c99fc7a6022c8a5bc4bdee0399a2f9f0ea75d9ad86418ee71ceed10ef808
f960280656971e9a19ab0f31e4d917762e01badabef38cf78d3a01e7899d69db
701605897478cf10f0f7ea8902653b47f8896596ec7ad8d8cd4a4d1a5447dff0
96f9e1112fe835cd34cfac858a2df19b1bd392ea06f7cad173b845ecd5c37cba
6e4fee8b0533743d4a18116a864650b09790bddcf942a40392749bfddededd5a
5835b520db5bdd237bc523267aa7af0b20ff31d97c876124bd1c8621710c4c3e
205bbf3f476158dedde09d05eee916defe36e55ac79b61cd396afcad208303c9
7d3603d20eea95c56b71434d6882069f8ce553ad23b88cdda413962af4228d4a
5c04ea76996456a66c42779c7192b9a212aeb527c63ade3feceffea438561684
a88c8d3bd3dd2cf5cdf0f4a640ab43dca18e348f0e037e48dea90d88f3460a7a
77b5e49a2c5d376ece96abdf21e887f5f170f96a75978974ce8cef4e0f6a3c61
ad1aa3d0d265c4bdb4883a4fb0d9a845e9739d00ca95cd92f3c7b62c43d1c49c
1f1aa740380b3fe340c3c62f1c99ff7f1ba82e0b70e05444d3581bb50bb2fe99
5d7f5a1e4350fb8ccaba5b0b6586f66728b74809300edd5c875e44b02918a439
b6d0a454595e158b954f7c5a632b2239eb23a2cfa29fa34dad3dbb75d0c398e9
d8e99b4c6997b3e0a2195da8e5f1efc991d6ca6c4fd0e2d7770570fa9957f28a
e78251e75a5cc05df87ccafc517368fce93df8e64f650c6fe99afa3a831095d0

http://www.corm-informatique.fr/NTi1X8FaTj_MkXQ/
http://nishantvora.com/mejMphi6t7Xc/
http://www.ploeger.ru/ze4QPfAqDmjO/
http://biznes.rise-up.nsk.ru/77W2Ih2deTU/
http://empresadereformasentenerife.com/SHwWXNduOp0F9jnW_Hn/

Creation Time 	2019-01-24 21:11:00	(XML Based - ENG - Unzoomed Indigo/White)
SHA256:
19597e6d8add104c96b26aa9f97d8f198063550c8e679ee204f63a3aa73d2f47
34e9b5c3ac32cb44462abcf40ba8d2e7ae40d1e8615d7f9feac78afc3a6d5872
af55c121ac3f0dbfbbe0a5f27c38b2a2abeb280404c7eb7f975a6a107c65e617
3a8392323c7baa37ac46bc94a24d12fb23ddd3bc8f62f9d8820cc033f83993d0
98564ff725f49fe7c524de5175f5d9e905c9df282aed774e8df373c52e4e7761
7bee77eb8a82592ff5e10ed05d87c21ef74b12ab4b556868762747c0cefc83ab
bf8e3a72f5aab7336932724df62cc713087dcc132457dbf41da6030c1b656aef
ffbacf8af1ec37c184ec303dcd5680a36eff71734f9487678fea4ae8a84de36e
587da261db5dcff46736c64fdf4d0d94c30b6268882691c30f50e518b4c8ac9c
1ccc8c5156460e186579d23fedf2478e8361f8f0988c5d3c23ec77c44bae7dbb
ef849902273fae9da552384668603f752e4b59431eae6a277cbe880b6696ce6d
f0b31462d6070603a5288c0c3850f9f98b1b89179bd46d46a1d6e1d0bad7c6e5
ad970109b2372b9df53bcf8c517b75342b0910b5914930ab3de92393352e4266
e9a7a0a33bbdc4d77bd413b8ca6b887ffb58aef273104e30802e71081d63b179
d3e532e7c6d84cfa1ac05eced73101ebf4fd10d9cabf5045a039a1ad2863af62
4adfd11f7f96762bda1d634ee9be503687e18109eefac7a72bb9c2590287fd10
92b2a3a649730e5de2109c2e8d6136a7ac438fa2b6804ad8d8223712674aaf28
38c05a6a24491e08c41c3e67a963ca3797bac57eaaac7e9df4e856010821b776
60445973c29a79abccb9488faad57236de308f77ef702c84bd2cb8063fb298c0
0230882e1b3807b4ecc9cf9a76150898480471bca5cdda795c340635885529b6
f024680b83c18ba27c82c089c0cf08a338362fc4db282ab1c188202558476230
d066e338e42908621e50b2a953cb19a08877b102e2ded59531f016dbebd1cb63
137c0f5dd60bfcce990e30dcee154965069e42fb78a774228601e069a6022492
a6e7d0d1eff6c8ee0c060e35405db6803e543b3bb60101a65c8942d43e3b1c2f
77bf69a2d9bddf1afd916d9dfbdf78534a235f7ba691e681d689f4739cc72ecb
10b22be3566c4f92d2a676e3331f1637f01305068c20cc72b50b58439fa84bbc
e7f10724bc0dc83a7af05e2803bf5ed9a55d260b422f668d8afa0cb4c563c6f9
7061da3ae23c95688e9ac32be19c7e7212ae158cbfa61cda5ce59458cf177444
6dc745ea96786d8212bce619cb41a63fda87c465108b2473db7173452b73d7ce
6b5a27bff483c190b7dfb441fea3ee42ec9001b93a01cd0914c947940a4ae16b
33d74d1c3d4b734d36d7b32fee55c68bc0d15db8ad94b41f3d7bd6eba0c65286
0e22c40323137348da9f24af2a2267c3f4c8590cfabaf4b822ce9144c2367aae
6295e72a5cc79f26427bf84b481758025e172e2c80db850abb716efbc858aea0
e9bdaa27af50e7b4245d17d9670db852bca4a061f6744bc502101f09ad9ade8a
6931b860614e8e772f4e612798b2b363e18325bcdf9a014fd7fe1b7ce638e4e2
f0c79afca549bfaa56762ef101af8d1b2c0e6d4455e7092bc4ce2c6df805ac65
c10697fe3cb84d0c29fd62a2f5083bcbd7c0693c8e0aa96154679f917eb8a735
c72da8d329c3f9fb1256977ef9598ddc9c71010529cf47a39119972492cbcdc5
3da6fda094bd239debaa63ebf2740581844b256943495ce7045d07aa2923611d
240425bf2c94d58ea9fe0a7dc6033cf532bc81aa2a2cfc3bdf14b9d45e8164cd
ba76d97647b34add1ac99ef63fc9747662fac1e05176d8967922c721782d80af
d9cccc30e36fd59b6841e8ea4d791bb3be06d5510832d719c75d556352e1d115
6672048fb5378ac76a0e079bca6bc20c4680504f872f5655f0c5c2f74b78ad25
227671b6b0585077640c3b7924fb71ad4d4d45e07edb06b0452e9fdbe7ce34d0
91538973d32d5fe3fcf83be77a88bdda44229657f26986934e5676cc3f430d67
9721761568822e5e9ff06abb9bf2f43ad17c6520548823a93e6d7f5afa9b02f4

http://scholarshipfinder.ga/J7GiTu9gH1HL_P/
http://shopsabz.com/wp-content/wbUYqG8BHG4xos_otiOmeHxN/
http://khoahoc.bluebird.vn/4vfxvww/tketlmqsBZdRPw_U/
http://mississipi2011.com.br/lQ4J8mzYEU6OWt/
http://partnerkamany.ru/SbNT5IaaWb9/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 01/25/19 ####
```

bcb56515902e77e02fef6dd49f512cc839bfa23d7cc07f7264955f017b768fbc
89cdc8e683b5d7faf928d729679240ca998c1f0f42d1a6fc4da62f350977da1a
91260557d191bdba827d28a836e3fe9280baaf133fedc8ea61e6ea71df3ce992
fc5fa720c8fd8c9cfb21431cd0588c0ff08a18943ec20400149032d29d5cc8ab
8521defe4f065fecccbeb04a58b42add6590970755359b2edd458ead7d8a5e1b
dc417307250a024c4db4f121d13c31f460950bfe35b19f9186072020e773befc
1d7743e0200f54d25cff84223e371a32af781c19891c65a12192b478c4f96a9b
272a3278613836cfea5c5570446a05fba016ee8572dbe1e7125c4fcec65ca566
61be0098df1dc6cc4dd025dbf1f55c28181add0051f40140ab22398ad1c36eea
bcb56515902e77e02fef6dd49f512cc839bfa23d7cc07f7264955f017b768fbc
5a7c73db481459cc5506fdb2a27dfb9621e26168eb0e2e273bc1acfe7bc420f2
d28d6fa9964653430b833d538ae41c9796010bc0fb9f962654eb3dd892a1d438
1a760ed8f247fa5677a16d8812b22cdc3346bd7e74ef0a918a66267b845c0a65
4475ce05d7402835906a2380e590105bec6393348a6ef725eea092e64bd44098
233920911eead55422652ca9305ba1de8a5be1c8bef2e4b0d46b25595423a9d0
2c88e13d80e3fe360b45a34876b5aa86cfe92755d5779f29f7fe0775ec622de0
ed24641a405da032479d06700d0f6ad49796816c1c7ab8a4ec7b7bf9fa6495b9
a7476afc795624c7202c399afe2ca40335584159070a684abc52a69cbc187af8
5b4037088bf51c37c2fb7a58849a7fce629b97721728c58bf69f6f7244b999f0


```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
133.242.208.183:8080
138.122.96.100:443
138.59.18.169:53
138.68.139.199:443
142.46.245.2:20
144.76.117.247:8080
148.240.65.44:20
148.240.70.74:22
159.65.76.245:443
165.227.213.173:8080
167.0.166.227:143
181.175.23.114:993
181.49.236.174:53
181.49.96.250:80
184.68.59.166:50000
185.86.148.222:8080
186.70.105.27:80
186.71.23.165:8090
187.155.130.72:8080
189.205.123.101:80
189.223.4.181:995
190.128.27.233:22
190.154.42.107:8080
190.158.241.119:443
190.160.8.4:993
190.183.58.190:20
190.183.58.190:993
190.210.33.41:22
190.25.54.18:443
190.26.98.130:20
192.155.90.90:7080
198.46.157.252:8080
200.105.211.46:53
200.111.255.89:20
200.117.244.36:465
201.146.215.137:22
201.194.127.211:990
210.2.86.72:8080
219.94.254.93:8080
23.254.203.51:8080
24.146.61.59:443
24.66.53.180:20
45.45.77.43:8443
49.212.135.76:443
5.9.128.163:8080
69.163.33.82:8080
69.70.236.34:8080
69.70.238.170:8080
72.47.248.48:8080
79.98.31.206:443
81.82.203.76:143
92.48.118.27:8080
96.21.235.163:8080


```
#### Spam/Stealer C2s ####
```

187.147.153.225:990
216.98.148.157:8080

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

109.121.205.213:465
115.71.233.127:443
119.235.90.232:21
128.234.43.30:993
137.74.173.19:8080
148.103.7.35:80
148.103.82.211:53
152.231.224.62:20
173.255.196.209:8080
175.205.73.49:80
178.254.31.162:8080
178.62.37.188:443
179.8.99.239:443
181.129.30.82:80
181.189.212.120:465
181.225.14.209:8080
181.58.47.34:53
182.180.170.72:22
184.149.7.49:8090
186.108.174.175:53
186.113.19.170:80
186.114.207.82:465
186.118.161.100:995
186.120.159.140:443
186.137.145.245:995
186.19.202.88:80
186.75.241.230:80
187.233.137.90:80
189.149.181.61:465
189.253.39.50:8080
190.183.58.155:8443
190.24.243.186:50000
190.247.62.93:80
190.57.232.244:143
190.72.239.156:8090
190.97.63.104:80
190.98.58.170:465
191.92.81.199:53
193.239.235.209:8080
198.74.58.47:443
201.130.123.206:80
201.190.204.249:990
201.212.241.162:21
201.212.99.24:80
206.248.110.184:8080
207.167.7.141:20
208.78.100.202:8080
211.115.111.19:443
217.13.106.160:7080
217.86.203.2:20
221.147.242.34:8443
24.48.215.63:20
24.48.215.63:80
41.202.77.180:465
41.32.82.216:995
45.123.3.54:443
45.63.17.206:8080
5.230.147.179:8080
50.31.0.160:8080
51.148.59.233:20
62.75.191.231:8080
67.205.149.117:443
69.195.223.154:7080
69.198.17.7:8080
75.99.13.124:7080
83.222.124.62:8080
85.99.247.228:80
86.56.233.166:80
89.211.147.250:80
93.109.229.250:53
95.141.175.240:443
98.142.208.27:443


```
#### Epoch 2 - Spam/Stealer C2s ####
```

120.150.92.75:50000

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now.
Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version
of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change
payloads every 3-6 hours now and payload hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100%
sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the
other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the
other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch
as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/cMWg57TQ - @pollo290987

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic,
@abuse_ch/urlhaus.abuse.ch and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Almost ALL malspam was attachment based today. I saw only a few URLs active and it shows inside of our counts for URLs today. Most of what I saw was
Paypal based malspam in the morning and then Invoice billing for services in the afternoon. Most of the attachments in the afternoon were from E1.
Almost everything was in English until about 18:00 EST and then I got a large wave of Spanish malspam as attachments for once again Invoices.

Not much else to report but on the C2 side C2 counts changed a bit. E2 still at 72 total and E1 at 54.

Have a good weekend all.

```
#### Sandbox 01/25/2019 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run on 01/25/2019 at 23:15 UTC -	https://cape.contextis.com/analysis/32627/
```

```
Epoch 2 C2 run on 01/25/2019 at 23:15 UTC - https://cape.contextis.com/analysis/32628/
```