Emotet Malware IoCs 01/21/2019

## Emotet Malware Document links/IOCs for 01/21/19 as of 01/21/19 21:00 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 01/21/19 ####
```

http://aeco.ir/Clients/012019/
http://aimypie.com/AMAZON/DE/Zahlungsdetails/012019/
http://airmanship.nl/Amazon/DE/Zahlungsdetails/01_19/
http://alfemimoda.com/Amazon/DE/Kunden/01_19/
http://allo-prono.fr/Amazon/Kunden-transaktion/012019/
http://amitisazma.com/wp-includes/Transactions/2019-01/
http://appsproplus.fr/Transactions/01_19/
http://ar.caginerhastanesi.com.tr/Amazon/DE/Transaktion/012019/
http://arneck-rescue.com/AMAZON/DE/Kunden_Messages/2019-01/
http://atkcgnew.evgeni7e.beget.tech/Amazon/DE/Transaktion_details/012019/
http://aztel.ca/wp-content/plugins/Amazon/Zahlungen/2019-01/
http://biometricsystems.ru/Amazon/DE/Kunden-transaktion/01_19/
http://blogg.postvaxel.se/Amazon/Dokumente/01_19/
http://cbsr.com.pk/Clients/2019-01/
http://checkreview.ooo/Amazon/Bestellung_details/2019-01/
http://cms.berichtvoorjou.nl/Amazon/Bestelldetails/2019-01/
http://cnjlxdy.gq/Messages/01_19/
http://como-consulting.be/Information/012019/
http://copsnailsanddrinks.fr/Amazon/DE/Kunden-transaktion/2019-01/
http://dev.umasterov.org/Amazon/DE/Transaktion/012019/
http://dev.umasterov.org/Transactions/2019-01/
http://dijitalbaskicenter.com/AMAZON/DE/Transaktion/012019/
http://dirc-madagascar.ru/Amazon/Dokumente/01_19/
http://directsnel.nl/AMAZON/DE/Kunden_transaktion/01_19/
http://distinctiveblog.ir/Amazon/Zahlungsdetails/2019-01/
http://en.tag.ir/wp-admin/Clients_transactions/2019-01/
http://eroes.nl/Amazon/DE/Kunden/012019/
http://etsj.futminna.edu.ng/Details/01_19/
http://g-ec2.images-amazon.com/images/G/01/abis-ui/merchants/amazon.de/
http://gephesf.pontocritico.org/Rechnung/2018/
http://goldengateschool.in/Transaction_details/01_19/
http://grantkulinar.ru/Amazon/DE/Kunden_Messages/01_19/
http://hjsanders.nl/Amazon/DE/Kunden-transaktion/012019/
http://igloo-formation.fr/Amazon/DE/Transaktion/012019/
http://improve-it.uy/Rechnungen/2018/
http://ivydental.vn/Amazon/DE/Kunden-transaktion/012019/
http://jcpersonaliza.com.br/Clients_information/01_19/
http://jk-consulting.nl/AMAZON/DE/Bestellung-details/012019/
http://jongewolf.nl/AMAZON/Transaktion/012019/
http://justexam.xyz/Payment_details/01_19/
http://kadinveyasam.org/wp-content/Amazon/Details/01_19/
http://kamdhenu.technoexam.com/Amazon/DE/Zahlungsdetails/01_19/
http://kcespolska.pl/Details/2019-01/
http://kosolve.com/AMAZON/DE/Transaktion-details/2019-01/
http://liarla.com/Payment_details/2019-01/
http://lokanou.webinview.com/Amazon/Kunden_transaktion/01_19/
http://lvajnczdy.cf/wp-admin/Clients_Messages/01_19/
http://marionsigwalt.fr/Transactions/012019/
http://marisel.com.ua/AMAZON/Bestelldetails/2019-01/
http://maytinhdau.vn/x5gsrus/Clients_Messages/012019/
http://megatramtg.com/Amazon/Informationen/01_19/
http://mingroups.vn/AMAZON/DE/Dokumente/012019/
http://mskala2.rise-up.nsk.ru/Amazon/Zahlungen/01_19/
http://nanesenie-tatu.granat.nsk.ru/Amazon/DE/Dokumente/2019-01/
http://newcanadianmedia.ca/templates/beez_20/AMAZON/DE/Transaktion/012019/
http://newwayit.vn/admin/authors/Amazon/Zahlungen/2019-01/
http://nhakhoavieta.com/Amazon/DE/Bestelldetails/2019-01/
http://nigeriafasbmbcongress.futminna.edu.ng/Clients_Messages/012019/
http://njeas.futminna.edu.ng/Clients_transactions/01_19/
http://oculista.com.br/Amazon/Dokumente/012019/
http://otohondavungtau.com/Amazon/Bestelldetails/01_19/
http://petersatherley.live/Payments/012019/
http://phuckien.com.vn/Amazon/Informationen/01_19/
http://quahandmade.org/Amazon/DE/Transaktion-details/012019/
http://queensaccessories.co.za/Details/01_19/
http://rahkarinoo.com/Amazon/Kunden-informationen/2019-01/
http://rapport-de-stage-tevai-sallaberry.fr/AMAZON/DE/Kunden_informationen/01_19/
http://rdweb.ir/Details/01_19/
http://realdesignn.ir/multimedia/Clients_transactions/012019/
http://realistickeportrety.sk/wp-admin/Amazon/Kunden/012019/
http://robbedinbarcelona.com/Clients_transactions/01_19/
http://sbern.com/AMAZON/Bestelldetails/2019-01/
http://shootinstars.in/AMAZON/DE/Informationen/012019/
http://smsold401.smsold.com/Amazon/Kunden_Messages/01_19/
http://sobrinosroma.mx/Amazon/DE/Kunden_Messages/2019-01/
http://somov-igor.ru/Amazon/Informationen/2019-01/
http://songlinhtran.vn/wp-content/Clients_information/01_19/
http://sosh47.citycheb.ru/Amazon/DE/Kunden_transaktion/2019-01/
http://sskymedia.com/Amazon/Zahlungsdetails/2019-01/
http://stats.emalaya.org/Amazon/DE/Transaktion/01_19/
http://swanpark.dothidongsaigon.com/Amazon/DE/Bestelldetails/01_19/
http://take-one2.com/Amazon/Zahlungen/2019-01/
http://talktowendyssurvey.us/wp-admin/Attachments/01_19/
http://teacherinnovator.com/wp-includes/Amazon/Transaktion/2019-01/
http://themanorcentralparknguyenxien.net/Amazon/Kunden_Messages/012019/
http://tingera.com/Clients_transactions/01_19/
http://towerchina.com.cn/Amazon/DE/Zahlungen/2019-01/
http://tritonwoodworkers.org.au/Attachments/01_19/
http://tsg-orbita.ru/Amazon/DE/Kunden_informationen/012019/
http://tunerg.com/Amazon/DE/Kunden_transaktion/012019/
http://uborka-snega.spectehnika.novosibirsk.ru/AMAZON/Kunden_Messages/2019-01/
http://universobolao.com.br/Details/2019-01/
http://viralvidespro.xyz/Details/01_19/
http://www.abmtrust.org/cgi-bin/Amazon/DE/Details/012019/
http://www.biometricsystems.ru/Amazon/DE/Kunden-transaktion/01_19/
http://www.droobedu.com/Amazon/DE/Transaktion/012019/
http://www.dsltech.co.uk/Amazon/Bestellung_details/01_19/
http://www.etsybizthai.com/Amazon/DE/Kunden-informationen/012019/
http://www.glazastiks.ru/Amazon/DE/Dokumente/01_19/
http://www.grantkulinar.ru/Amazon/DE/Kunden_Messages/01_19/
http://www.hopeintlschool.org/Januar2019/Amazon/DE/Zahlungen/01_19/
http://www.immo-en-israel.com/Amazon/DE/Bestelldetails/2019-01/
http://www.kiber-soft.net/assets/AMAZON/Kunden-transaktion/012019/
http://www.odesagroup.com/wp-content/Transaktion/201812/
http://www.pwpami.pl/Amazon/DE/Kunden/01_19/
http://www.salonbellasa.sk/Amazon/Bestellung_details/2019-01/
http://www.web.pa-cirebon.go.id/Amazon/DE/Kunden-transaktion/01_19/
http://www.wholehealthcrew.com/Transactions/01_19/
http://www.xn----8sbef8axpew9i.xn--p1ai/Amazon/Kunden/01_19/
http://xn--80aealqgfg1azg.xn--p1ai/Documents/012019/
http://xn--80apaabfhzk7a5ck.xn--p1ai/Amazon/DE/Details/2019-01/
http://xn--90aeb9ae9a.xn--p1ai/Amazon/DE/Kunden-informationen/012019/
http://ykpsvczdy.cf/wp-admin/includes/Information/01_19/
http://ylimody.cf/wp-admin/Transaction_details/012019/
http://zonnestroomtilburg.nl/Clients/012019/
https://www.gtp.usgtf.com/AMAZON/Kunden/012019/

```
#### Epoch 2 Document/Downloader links seen for 01/21/19 ####
```

http://3.dohodtut.ru/HJPSb-qFf_VWHYIKyES-alN/INV/90912FORPO/649150722404/En/Important-Please-Read/
http://64.69.83.43/gacl/admin/templates_c/RLeW-eC_npGHKhcLK-vc/INVOICE/En/Paid-Invoice-Credit-Card-Receipt/
http://aconiaformation.fr/MnBNF-gV_MeI-l6/InvoiceCodeChanges/US/Open-Past-Due-Orders/
http://agentfox.io/ZAqo-QB5_tJXk-pL/H96/invoicing/EN_en/Past-Due-Invoices/
http://amerigau.com/wp-content/uploads/De/UCDHIQAEJK5374308/Rechnungs/Zahlung/
http://andrewsalmon.co.uk/kokMx-ddRbM_BnsfV-8Z/INVOICE/US/Invoice-for-u/a-01/19/2019/
http://animoderne.com/EtDPv-iWVf_EMvBnPKnv-5e/ACH/PaymentInfo/En/0-Past-Due-Invoices/
http://anthinhland.onlinenhadat.net/De/GQXMFMHA8941736/Scan/Rechnungsanschrift/
http://antigua.aguilarnoticias.com/De/QIEYLHN3815625/gescanntes-Dokument/Rechnungszahlung/
http://appliancestalk.com/cgi-bin/RQYil-iP_ytDEwOF-yYC/INV/803038FORPO/6442295196/US_us/Paid-Invoice-Credit-Card-Receipt/
http://apresearch.in/DLmp-xu_OLaIwMvn-LI/INVOICE/63494/OVERPAYMENT/US_us/Invoice-Corrections-for-22/75/
http://ar.caginerhastanesi.com.tr/IdVEX-GT6_m-nF/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/En_us/Document-needed/
http://aryahospitalksh.com/gSxF-O0_lDfhym-3m/Invoice/89540320/En_us/Overdue-payment/
http://astra-empress.com.ve/KDFLk-UcdJ_IYAwjC-DjA/PaymentStatus/En_us/Inv-30408-PO-9T735477/
http://atashneda.com/cqnc-rfli_zDFNCUjoO-cr/PaymentStatus/EN_en/Overdue-payment/
http://authenticrooftiles.com/PPLp-iNl_HBHWHvI-eD/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/En/Open-Past-Due-Orders/
http://ayumi.ishiura.org/DE/CPKUAJMBS7568397/Rechnungs-Details/Zahlung/
http://ayumi.ishiura.org/ixOFR-ofPu_O-omE/INV/210081FORPO/31065215734/En_us/Outstanding-Invoices/
http://batdongsan3b.com/Januar2019/BZBUKMWJ8074612/Dokumente/DOC-Dokument/
http://batdongsanbamien24h.com/tLMMM-NPQ_jJKMWeS-bZj/ACH/PaymentAdvice/EN_en/Service-Report-3588/
http://blogg.postvaxel.se/lzVtT-QdFfM_bu-zqP/ACH/PaymentInfo/US_us/Question/
http://bloggers.swarajyaawards.com/wp-content/De_de/FBBSRV7576256/de/DOC-Dokument/
http://butgoviet.com/ptCZf-SCq3F_W-jja/US/Outstanding-Invoices/
http://cardealersforbadcredit.net/zlvkejwe/VLIbZ-0f_DVVLdjUsy-3dA/ACH/PaymentInfo/US_us/Invoice-for-n/n-01/18/2019/
http://cbc-platform.org/wp-admin/de_DE/OLEQYDY9386951/Rechnungs/Fakturierung/
http://cbrrbdy.gq/LjquP-adxy_uMHckUtc-Pbm/Invoice/175472286/US/Inv-85999-PO-9D432791/
http://chzhfdy.gq/eAwG-Lm_ewDvQz-Jy/Invoice/983945882/En_us/Invoice-Corrections-for-66/89/
http://clarisse-hervouet.fr/mpaw-yL_GuX-d2G/ACH/PaymentInfo/US_us/Inv-81204-PO-7D336498/
http://clinicainnovate.com.br/QBDOi-cIKB_lochwKe-Yq/INV/9791369FORPO/9496030558/US/Past-Due-Invoice/
http://cms.berichtvoorjou.nl/hwsCx-Czve_fm-xE/Ref/16789462En_us/Invoice-2239940-January/
http://constructiis3.ro/wp-content/vfdTD-Kw_E-bX/Invoice/584235869/US/Past-Due-Invoices/
http://creditorgroup.com/pKVV-eaE_bSkiso-1xn/InvoiceCodeChanges/US/Past-Due-Invoices/
http://csrcampaign.com/lAdk-5Ur_CKHF-jg8/INVOICE/94996/OVERPAYMENT/EN_en/Past-Due-Invoices/
http://cumbrehambrecero.com/XXHKFSJT2382648/Rechnungskorrektur/Zahlungserinnerung/
http://demo.gtcticket.com/fGSG-cIx8_TE-iq/INVOICE/EN_en/Important-Please-Read/
http://demos.technoexam.com/BTOZZAFYMR9557661/Rechnungs-docs/Zahlungserinnerung/
http://denleddplighting.com/DE_de/EXARGVEK3940455/Rechnungs/DETAILS/
http://dhgl.vn/de_DE/QATCJBF4115723/Rech/Rechnungszahlung/
http://dirc-madagascar.ru/MqvEc-D8trE_R-9RK/Inv/76965924789/En/Inv-277031-PO-5X526676/
http://distinctiveblog.ir/EDHfD-gq_AIWqWukK-cph/InvoiceCodeChanges/EN_en/Paid-Invoice/
http://drapart.org/Qxafy-OR_pzW-lT/INVOICE/10270/OVERPAYMENT/US_us/Document-needed/
http://driveformiles.org/bKlw-VZss_sgXBQuT-BL/ACH/PaymentAdvice/US_us/Past-Due-Invoices/
http://dsltech.co.uk/ZQQP-WaI_sTENQmYGW-hAP/QB24/invoicing/US/Service-Invoice/
http://eirak.co/DE_de/VBJDIVDSP7762719/Rechnung/RECHNUNG/
http://emmanuelboos.info/YqLad-p5ij_na-5eF/Ref/9928911859EN_en/New-order/
http://ero4790k.com/XUBb-INgV_L-gJ8/INVOICE/0576/OVERPAYMENT/US/Paid-Invoice-Credit-Card-Receipt/
http://erolatak.com/gBpq-VQ9Q_nRIU-ab/Invoice/2786267/En_us/Paid-Invoice-Credit-Card-Receipt/
http://etsybizthai.com/Januar2019/VRXISNNOP8568904/Rechnungs/DOC-Dokument/
http://evaviet.net/AdFY-Lh_VHbLQqxMe-qgA/INVOICE/6802/OVERPAYMENT/EN_en/Open-Past-Due-Orders/
http://excellenceconstructiongroup.com/DE/QSOGROAGRG9316000/Rechnungs-Details/FORM/
http://excellenceconstructiongroup.com/RRzFk-0RZJ_JuB-Qc/INVOICE/13887/OVERPAYMENT/En_us/New-order/
http://fce-transport.nl/rhMHW-fcLes_fmF-z82/154512/SurveyQuestionsUS/Scan/
http://fidesconstantia.com/DE_de/AUANSFQDL0240912/Rechnungs/DOC/
http://fidesconstantia.com/Ywxfz-nr0_VxHR-TE/Southwire/XUB8632375051/US_us/Outstanding-Invoices/
http://fira.org.za/Bkzx-MCwZ_QbR-MR/invoices/53832/6396/US/Invoice-Number-53760/
http://forma-31.ru/vTCv-VcT0_oU-zjp/803067/SurveyQuestionsUS/Companies-Invoice-09329127/
http://ftp.spbv.org/tMTLW-w2ClF_HsMlQPNNq-pGg/J33/invoicing/US/Invoice/
http://g-ec2.images-amazon.com/images/G/01/abis-ui/merchants/amazon.de/
http://glazastiks.ru/gaLjP-Ra_noqrx-S0i/InvoiceCodeChanges/US_us/Need-to-send-the-attachment/
http://hembacka.fi/ATkQ-kUu_NnN-Evp/INVOICE/US/Inv-25688-PO-1O647571/
http://hjsanders.nl/rXqy-tOpX_bkl-K1/Invoice/8882088/EN_en/Need-to-send-the-attachment/
http://hopeswithin.org/nKSOT-QWrY_ZRO-wft/Invoice/01535830/En_us/Invoice-for-you/
http://idgnet.nl/tWcpZ-cp7P_kaA-xA/PaymentStatus/En_us/ACH-form/
http://inspireworksmarketing.com/De_de/HPDAUWBIJL3003841/Rechnung/DOC/
http://ipeople.vn/De_de/XYJXWR0172067/Rechnungs-docs/Fakturierung/
http://isikbahce.com/De_de/GXYERKB9310998/Rechnungskorrektur/Zahlung/
http://jameshunt.org/De_de/HUBDUH7489586/DE_de/Zahlungserinnerung/
http://jcpersonaliza.com.br/De/RCSGOAYRP8889311/DE/Fakturierung/
http://johnnycrap.com/jXbo-Bzb_cQo-h0t/InvoiceCodeChanges/En_us/Question/
http://joinerycity.co.uk/oaXpS-8fLnn_swV-po/EN_en/Companies-Invoice-5251735/
http://jongerenpit.nl/De/YRBLMY2624859/gescanntes-Dokument/DOC-Dokument/
http://k.iepedacitodecielo.edu.co/de_DE/UUJMYXL5755767/Rechnung/Zahlungserinnerung/
http://kantova.com/De_de/AUHLNNLK3368340/Rechnung/Rechnungsanschrift/
http://kcespolska.pl/DE_de/CDVMLSNMKX9250310/de/DOC/
http://khothietbivesinh24h.com/de_DE/HOHUBSQIU0791210/Scan/DOC-Dokument/
http://kleinamsterdam.be/xzjKi-ysPD_e-XtN/InvoiceCodeChanges/EN_en/Overdue-payment/
http://kosarhaber.xyz/De_de/SRRPFEYN0329359/de/Rechnungsanschrift/
http://kosolve.com/tzJC-OcOxP_RpPnYL-j0v/INVOICE/US/Important-Please-Read/
http://ktml.org/DE_de/JXDXFPLFLC5606213/Rechnung/Hilfestellung/
http://ktml.org/dMAAQ-1XJxI_lxsT-vx/En/Service-Report-1340/
http://lagbag.it/De_de/AVTOSDHJVP4735513/Dokumente/RECHNUNG/
http://lamppm.asertiva.cl/lismr-G8_sgBQ-nLq/invoices/60259/12719/US/Invoice-59553663/
http://lespetitsloupsmaraichers.fr/BxjVt-w11j_EpfLuG-IUQ/ACH/PaymentAdvice/US_us/Invoice-for-l/b-01/19/2019/
http://lineupsports.me/QUqZf-PuY5_OoqmyFN-M17/invoices/9917/2063/EN_en/Overdue-payment/
http://linkingphase.com/bNWtV-qgbS_P-hH/INVOICE/US/Inv-981974-PO-2L436830/
http://lokanou.webinview.com/lOWSK-di_NM-aCu/Southwire/SWV2406069411/EN_en/Outstanding-Invoices/
http://lstasshdy.cf/wp-admin/waYqM-ZlD_fxwSJkAU-o7H/INV/47127FORPO/44322944468/US/280-30-169584-494-280-30-169584-161/
http://mail.buligbugto.org/klNNj-pE_nJ-9I/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/En_us/475-03-845602-783-475-03-845602-522/
http://mandalafest.com/JIpB-dzix_XVBWNwNJg-KN/EXT/PaymentStatus/En/New-order/
http://mandezik.com/ERqy-96Sw_Wh-hEI/PaymentStatus/US_us/Invoices-attached/
http://masswheyshop.com/IRwAb-F1UD_agyjAlFdT-J9/En_us/Scan/
http://mayphatrasua.com/de_DE/TBWAXYXGA0601308/Rechnungs-docs/Rechnungsanschrift/
http://megatramtg.com/site/cache/ajax_login_form/bfXSu-jHhN_UmQs-pO/ACH/PaymentAdvice/US/Service-Report-14175/
http://migoshen.org/DE/KBGRUOQQA8984685/Rechnungs/Hilfestellung/
http://migoshen.org/wXib-VaB1n_kQT-1Yf/EXT/PaymentStatus/US/Invoice/
http://milan-light.savel.ru/DAaZ-ECDN_MGqfftAK-PN5/628367/SurveyQuestionsUS_us/7-Past-Due-Invoices/
http://millennialsberkarya.com/wp-admin/js/widgets/de_DE/LDEGADRLW4528301/Rechnungs-docs/Rechnungsanschrift/
http://mingroups.vn/flCY-rOBZV_J-CfH/En/Important-Please-Read/
http://mroffers.co.ke/LIvgv-lU8b_SGsUmH-wj/INVOICE/9613/OVERPAYMENT/US/Past-Due-Invoices/
http://msobrasciviles.cl/Gvuu-u3_brGnf-LN/10753/SurveyQuestionsEn/Invoice-Corrections-for-87/47/
http://mstudija.lt/Celhs-upjH_uarOJm-hY/ACH/PaymentAdvice/US_us/Scan/
http://nancycheng.nl/ibEhu-5NL_KP-qHJ/ACH/PaymentInfo/US/Sales-Invoice/
http://nbhgroup.in/Januar2019/FBAHKDQBMQ7553976/Rechnungs/DETAILS/
http://nghiataman.com/DE/IRXLICAZBL1302586/Scan/Zahlungserinnerung/
http://nhakhoavieta.com/lplB-PwLai_rSROuND-om/83053/SurveyQuestionsEN_en/Past-Due-Invoices/
http://northernpost.in/DE/KXIMFNOSPW5298241/Rechnungs/RECHNUNG/
http://northernpost.in/HSHvT-nbQB_E-VD/15150/SurveyQuestionsEn/Open-invoices/
http://nouslesentrepreneurs.fr/yIwTQ-iTd_eumU-vL/COMET/SIGNS/PAYMENT/NOTIFICATION/01/19/2019/En_us/Overdue-payment/
http://oceangate.parkhomes.vn/De/TRNDTSST2042561/DE_de/Hilfestellung/
http://oceangate.parkhomes.vn/laRsA-lKx_mQ-vd/Ref/817226888EN_en/Invoice-receipt/
http://offblack.de/De_de/PBEPTPAQ3759053/DE_de/RECHNUNG/
http://offblack.de/vPhT-jn2_eohiYtJyr-Dm/InvoiceCodeChanges/En/Past-Due-Invoices/
http://pe-co.nl/EvtAY-g1_KJjAmq-jj/INVOICE/US_us/Invoice-receipt/
http://petparents.com.br/bqshe-KO_yXFudV-FS/Ref/740935652En/Outstanding-Invoices/
http://phelieuasia.com/De/NYSPUHR0404414/gescanntes-Dokument/RECH/
http://photomoura.ir/AKAKXIPTR3763530/Rechnungs-docs/DOC/
http://photomoura.ir/AycO-8O3m_pYtxSGxNn-lP/INVOICE/EN_en/ACH-form/
http://plan.sk/DE/SWGKZG2660823/Rechnungs/Hilfestellung/
http://pmcorporation.fr/yiKCL-Er5cf_Dkj-Je/US_us/Overdue-payment/
http://pwpami.pl/nfSsn-qp_WtSxvlgb-NYu/PaymentStatus/En/New-order/
http://qigong-gironde.fr/ETszQ-ci_aglRKgmK-alC/EXT/PaymentStatus/US_us/Open-invoices/
http://quentinberra.fr/ZvMh-sX_eRQN-TP/Z31/invoicing/En/Invoice-for-you/
http://radintrader.com/DE/SDKBZOZ6602838/Rechnung/FORM/
http://rahkarinoo.com/AKBw-yV_aWOehADX-jM4/INVOICE/En/Companies-Invoice-84280381/
http://rccgregion15juniorchurch.org/BGbmS-5W_BDP-aj0/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/EN_en/Past-Due-Invoice/
http://rdweb.ir/De_de/JKOHNKCG9463530/Rechnung/FORM/
http://realgen-webdesign.nl/GxqkZ-XM_dQrxPUU-Zb3/invoices/5524/5747/En_us/Invoice-93042534-January/
http://redwing.com.eg/cIPlC-3G_uIxOd-UKh/Invoice/18742280/US_us/Invoice-for-x/k-01/18/2019/
http://register.srru.ac.th/DE/JAZAJFEE6790716/de/Zahlungserinnerung/
http://revistarevival.com/zwXt-nA3tk_biSZ-P0/EXT/PaymentStatus/EN_en/Paid-Invoice-Credit-Card-Receipt/
http://robbedinbarcelona.com/De/HNQIZKRNC9539809/Rechnungs/Fakturierung/
http://rozwijamy.biz/wp-content/uploads/flwe-3yXO_TTxLoNHf-YI/EXT/PaymentStatus/US/Companies-Invoice-16854071/
http://runtah.com/Januar2019/GPEUKCTJD7403282/Rechnung/DETAILS/
http://saigonthinhvuong.net/gGAUL-ymV_ggng-Ueu/Invoice/9151000/US/Open-Past-Due-Orders/
http://saintjohnscba.com.ar/NJUUNQIN9619001/Rech/Fakturierung/
http://samet-celik.com/sYaq-Kbwsd_Ze-irZ/invoices/4353/55382/US_us/Invoice-receipt/
http://sanmarengenharia.com.br/xhyib-Q8NvA_tyfqMfJ-Vz1/0039425/SurveyQuestionsUS/Invoice-2027925-January/
http://seitenstreifen.ch/DE_de/VGTTTGTVPC7100092/Rech/FORM/
http://sevensites.es/DE_de/AWJZCAJU9962569/gescanntes-Dokument/Hilfestellung/
http://sgtsrl.it/dnEe-mV9_CwHIrBs-Ui/INVOICE/En_us/Invoice-receipt/
http://shafanikan.com/rdPuM-d3ai_JgiXobg-Jdo/ACH/PaymentAdvice/EN_en/Invoice/
http://shlifovka.by/DE/BLWUVJVEWG0182392/Rechnung/DOC-Dokument/
http://shootinstars.in/WtMdY-ZQzY_xQbf-yEo/ACH/PaymentInfo/US_us/Past-Due-Invoice/
http://shop.avn.parts/GsAA-7QQ6X_tHrCvgz-3v/EXT/PaymentStatus/US_us/Invoice-1322320/
http://sidelineking.xyz/URJHB-Eiye9_cRHCODsUJ-L9/US/Outstanding-Invoices/
http://smsin.site/BCNP-iazWR_EOdXmtiXO-Lz/Southwire/HZD87624096/En/ACH-form/
http://smsold401.smsold.com/WhXS-B1tD_aEDWHSRHG-FJh/invoices/4313/7912/En_us/956-19-758612-186-956-19-758612-699/
http://sofathugian.vn/De_de/ZYYILV4223386/gescanntes-Dokument/Fakturierung/
http://sofathugian.vn/EKgOS-mZ5_KfbZG-Ylp/15643/SurveyQuestionsEN_en/Past-Due-Invoices/
http://songlinhtran.vn/De_de/FLXKASKLF6060035/de/Zahlungserinnerung/
http://sos-debouchage-dumeny.com/yPeg-tmw7X_JZWVIOxrF-gb1/En_us/Paid-Invoice/
http://southernthatch.co.za/oMDzp-3II_s-kZ/PaymentStatus/En_us/Scan/
http://southpacificawaits.com/JVfqY-VQs_FCtWBvz-FSr/Invoice/63259968/EN_en/Invoice-20415544/
http://spcoretraining.com/RKIJM-Zc_CbZyocABK-e5/En_us/Invoice-57753072-January/
http://squawkcoffeehouse.com/DE_de/TCOVKRZN4845615/GER/Zahlung/
http://sskymedia.com/VMYB-ht_JAQo-gi/INV/99401FORPO/20673114777/US/Outstanding-Invoices/
http://starbilisim.net/DE_de/OQYWPMVVP1922453/Rechnung/Hilfestellung/
http://stats.www.giancarlopuppo.com/tmp/NvBJ-Lo_MkWf-iVA/Invoice/5181591/US_us/Outstanding-Invoices/
http://stoutarc.com/De_de/SMPCQWS7472135/Rechnung/Rechnungszahlung/
http://suglafish.com/FZWw-Sxtp_G-vv/ACH/PaymentInfo/EN_en/Past-Due-Invoices/
http://swanpark.dothidongsaigon.com/Iqgz-39o_sx-Wr8/RJzJ-q9oj_sWuryxl-g1/invoices/4092/07436/En/Inv-845562-PO-0L433922/
http://temptest123.reveance.nl/sitdb-TO_a-6G/US_us/Outstanding-Invoices/
http://thelivingstonfamily.net/de_DE/HNEVVRJEW5764667/gescanntes-Dokument/Fakturierung/
http://theonlineezzy.store/Januar2019/WUOEQFA2991401/Dokumente/RECH/
http://therxreview.com/CTYMSWGWC0665949/Rechnungskorrektur/Fakturierung/
http://thesunavenuequan2.com/UfKnh-DDzIZ_aAl-3W6/EXT/PaymentStatus/US/Past-Due-Invoices/
http://thevesuvio.com/GOAQ-yog_N-uw6/Ref/2606341144En_us/Scan/
http://titheringtons.com/Januar2019/MMITODABK9295143/Rechnungs/Rechnungsanschrift/
http://titheringtons.com/SXrZG-xH5_sh-dc/invoices/7595/8458/US_us/Service-Report-0593/
http://tommie.tlpdesignstudios.com/BmDqb-EgM_ltZIEMYW-TG/INV/75370FORPO/8323587825/En/Sales-Invoice/
http://trottmyworld.ch/Xsxj-Rz_SimE-fuu/INVOICE/74831/OVERPAYMENT/En/Paid-Invoices/
http://truongland.com/Januar2019/MZLPRPL3458226/DE_de/Fakturierung/
http://ucfoundation.online/OaTLO-pE0bN_nSw-5N/INVOICE/En_us/Invoices-attached/
http://universobolao.com.br/Januar2019/QSAZOMIIE8953100/DE/RECHNUNG/
http://vndaily.site/xzXL-RBE_iTzbYbXt-P8g/PaymentStatus/En_us/471-01-466452-809-471-01-466452-917/
http://vnxpress24h.com/lAmdd-Nom6_thBiJ-fy/invoices/6958/89166/US_us/Need-to-send-the-attachment/
http://waggrouponline.org/NTYgH-3u_n-wh/Ref/302484694US_us/Important-Please-Read/
http://washuis.nl/VtzTI-an_TkRQS-94/PaymentStatus/US_us/Invoice-Number-872839/
http://web.pa-cirebon.go.id/de_DE/QQKZNE9320400/DE_de/Zahlung/
http://web63.s150.goserver.host/De/HVAIXTXKE8593138/Rech/RECHNUNG/
http://webview.bvibus.com/exWP-yING_DqBpZIA-ip/INV/474605FORPO/382136162612/En_us/Invoice-0002914/
http://welovecreative.co.nz/zZPlc-MClAf_ZSrRmdT-4hr/PaymentStatus/US/Sales-Invoice/
http://westland-onderhoud.nl/LtLiq-dQQ_Up-Ejj/ACH/PaymentAdvice/US_us/Invoice-receipt/
http://whitekhamovniki.ru/DE_de/VKQYLXONG9799894/Rechnungs/DOC-Dokument/
http://wijdoenbeter.be/XVeT-Zsn_KQ-DAd/PaymentStatus/US/Invoice-1866321-January/
http://wordpress-147603-423492.cloudwaysapps.com/YRDUKVKU0936501/Rechnungs-Details/Fakturierung/
http://wtede.com/sKMWJ-RjNWQ_YerwTQ-K00/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US/Question/
http://www.abmtrust.org/GYOz-CKpQ_J-tEv/InvoiceCodeChanges/US_us/Invoices-attached/
http://www.agentfox.io/De/DVMYPHHV4807680/Rechnungskorrektur/DOC-Dokument/
http://www.agentfox.io/ZAqo-QB5_tJXk-pL/H96/invoicing/EN_en/Past-Due-Invoices/
http://www.apresearch.in/DLmp-xu_OLaIwMvn-LI/INVOICE/63494/OVERPAYMENT/US_us/Invoice-Corrections-for-22/75/
http://www.array.com.ua/ysfhC-un_QLqZxh-SSR/COMET/SIGNS/PAYMENT/NOTIFICATION/01/19/2019/US/Paid-Invoice-Credit-Card-Receipt/
http://www.chervinsky.ru/QBUPBD1709242/Rechnungs-Details/RECH/
http://www.craigryan.eu/wLIuP-Lx_Rf-04L/INVOICE/En/Invoice-receipt/
http://www.dsltech.co.uk/ZQQP-WaI_sTENQmYGW-hAP/QB24/invoicing/US/Service-Invoice/
http://www.emmanuelboos.info/De_de/LJIQSDOUO3961102/Rechnung/Rechnungszahlung/
http://www.emmanuelboos.info/YqLad-p5ij_na-5eF/Ref/9928911859EN_en/New-order/
http://www.ermaproduction.com/wp-content/De/OESANEY3270156/Rech/Hilfestellung/
http://www.fatma-bouchiha-psychologue.fr/zrfMX-P3RD_l-li9/InvoiceCodeChanges/En/Service-Invoice/
http://www.forma-31.ru/De/KVHFNE8175184/Bestellungen/Fakturierung/
http://www.glazastiks.ru/gaLjP-Ra_noqrx-S0i/InvoiceCodeChanges/US_us/Need-to-send-the-attachment/
http://www.grantkulinar.ru/AaLL-70_iFWIrwpBW-nS/EXT/PaymentStatus/En_us/Document-needed/
http://www.hjsanders.nl/rXqy-tOpX_bkl-K1/Invoice/8882088/EN_en/Need-to-send-the-attachment/
http://www.housesittingreference.com/CTcA-8M_kFNRfQBku-dQI/Invoice/8751108/US_us/Open-invoices/
http://www.idgnet.nl/tWcpZ-cp7P_kaA-xA/PaymentStatus/En_us/ACH-form/
http://www.irsoradio.nl/Januar2019/LIHYUQUBW8878022/DE/DOC-Dokument/
http://www.kiber-soft.ru/DE/VEWBTCVBPA7430885/Scan/DOC/
http://www.lexfort.ru/ofarA-OG_h-omH/600387/SurveyQuestionsEN_en/Important-Please-Read/
http://www.ljfpajpdy.cf/dHkb-7q_eQPWxlLr-x2/Ref/2723472224US_us/ACH-form/
http://www.modern-autoparts.com/De_de/XYXMIFU0687605/Rechnung/Rechnungsanschrift/
http://www.nancycheng.nl/ibEhu-5NL_KP-qHJ/ACH/PaymentInfo/US/Sales-Invoice/
http://www.oculista.com.br/DE_de/ZVJPUXM7033441/Bestellungen/RECH/
http://www.ontamada.ru/De_de/PVFOPGUPDT4647941/Rechnungs-docs/FORM/
http://www.panafspace.com/ZXLa-4r_rd-uD5/ACH/PaymentAdvice/En/Service-Invoice/
http://www.pivmag02.ru/de_DE/HXQSLDMEK9381401/Rechnung/FORM/
http://www.polatlimatbaa.com/Januar2019/WCCLVMX7186480/Rechnung/Hilfestellung/
http://www.pro-ind.ru/CAZDROFBFQ1893765/Rechnungs/Rechnungsanschrift/
http://www.pro-ind.ru/yaiQ-6wzWY_vcJn-WdR/Ref/5409569504En/ACH-form/
http://www.pwpami.pl/nfSsn-qp_WtSxvlgb-NYu/PaymentStatus/En/New-order/
http://www.scanliftmaskin.no/paYB-juX36_aNODsId-PqI/Inv/82509032526/US_us/Open-invoices/
http://www.skyrim-gow.fr/MIuE-U3YoH_wTpD-G3/204943/SurveyQuestionsEN_en/Scan/
http://www.southafricanvenousforum.co.za/CPzf-Pg7F_xiOGP-l3n/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US_us/Paid-Invoice/
http://www.sp11dzm.ru/de_DE/PABSKYA2875086/Rechnung/Fakturierung/
http://www.ubocapacitacion.cl/DUYan-5pTF_yIlYRE-aJ/C832/invoicing/US/Open-Past-Due-Orders/
http://www.universalsmile.org/MCcs-VjO_ZHVDPH-aa/INVOICE/US_us/Need-to-send-the-attachment/
http://www.vincopoker.com/De/EADCMDBLPE7352743/Rechnungskorrektur/Hilfestellung/
http://www.web.pa-cirebon.go.id/KGLp-2zo0_Q-fRg/INVOICE/41749/OVERPAYMENT/US/Overdue-payment/
http://www.wholehealthcrew.com/KGLVPY3262807/Dokumente/Rechnungszahlung/
http://www.windailygh.com/cBeX-jJ_YnmrS-xFi/Invoice/910581862/En_us/Past-Due-Invoices/
http://www.wins-power.com/iixF-OV_kqV-NK/INV/00968FORPO/134610688014/En_us/Outstanding-Invoices/
http://www.xn--d1albnc.xn--p1ai/De_de/OYAOFAFYXM7852452/GER/Fakturierung/
http://www.zsz-spb.ru/DE_de/VAGXPIM7136774/GER/FORM/
http://xn--k1afw.net/IpiUS-0O_rq-vgp/ACH/PaymentAdvice/En_us/Invoice-Corrections-for-81/84/
http://yaheedudy.cf/IGPtT-Vms4_cygsPeZm-Dco/invoices/17130/8920/En_us/Outstanding-Invoices/
http://ycykudy.cf/AaZd-zYaEm_kQTf-3c/PaymentStatus/US/Invoices-attached/
http://yserechdy.cf/DlDwk-QmkXa_ZKVbmNQXx-4Z/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US_us/Inv-272991-PO-4O608402/
http://ytteedy.cf/eJEYv-hi_iJkUfGV-rs/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US/ACH-form/
http://yxcsdy.cf/eOFLP-USnc_dXBralDX-9X/QC85/invoicing/En/Invoice-for-you/
http://zamena-schetchikov.novosibirsk.ru/mODgV-bcF_tFaky-kOB/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US/Invoice/
https://cardealersforbadcredit.net/zlvkejwe/VLIbZ-0f_DVVLdjUsy-3dA/ACH/PaymentInfo/US_us/Invoice-for-n/n-01/18/2019/
https://www.gtp.usgtf.com/KgPmS-hyFZE_nfegQoji-wv/En/Open-Past-Due-Orders/


```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-01-21 22:10:00	(XML Based - ENG - Off-Center Light Blue/White)
SHA256:
0dbd2d7d06f699e0dbd31d5dbf03a9f88fb0c0aa800ba3140cf02477cf52c44e
f29619cc817afbdf01b41653afacde38be9fc839375951e8ff17ca738b591b25
a8ea6d394db6af439745253cbb87ce0ba16ff1fc7b35602e25e2eb4293f0c411
fab6144794023cf921501f9acfee40c7984d881b35bd7e138a16ffffd2083eb9
8091c611442ac0c826e9002bbfebc3cbd3386fa111147900022e5639cc04ae2d
001166e5fc2111991963f4028abb647940d213db40aaaf0ef9250eb677a0bad4
3778a3e0aae83869e3531129bc15cfbc381c55ac9a43e43cabd4421ab8ecf309
7d79f3d0be10d2ce5f4509c24adc9cfac58270b5f8f02ca9c0750e84a56c3f36
8ee83ec82fc8516cc3d7e8361ac0db6be96b12f5ce9f47641ab72d407dcf5e1e
6f785dcd067cab0fa9b0ecb39906848fc8d6aa9f0baac884bf87b121a5f24241
7696718fbda700c215d7f9780afa3c667c287fa7bf5c3e2793bd60daaaaa21d9
9a8b17ca23d57b4ec65cc6e61e6dd8948abe51b695f4bf55e73f6ab89b5bf61b
a28bee5e5ecd2ebba646a1b5d3a1b5ef767f9c39f36af873b6af52f4151f7374

http://lanhodiepuytin.com/lGvDuh0D/
http://saigonthinhvuong.net/Vayv0I7/
http://andyclark.xyz/jzy5xdn/
http://www.forodigitalpyme.es/3WYithg/
http://remont-okon.tomsk.ru/Y7fQwCMUaw/


Creation Time	2019-01-21 19:04:00	(XML Based - ENG - Indigo/White)
SHA256:
a6a8168e06a9cee9ffb7a2855439a927aebbe26582805229373a1d7b962192d9
daf9d16302fa899b6711734b2efa10579a4db091b8c843893a6d0d15ba82f416
e5a9c97ffb28524dbfba5ab3dbbb8b069c7ef255aae9e23166637669da0664fb
32adcf092c3f23224a9d38bc1c583b8ce51c474c27fa94e15848c4ca4be19030
0e3597fb00751393672e6653ce3e1cc91c5a3cd95ae4d0b2b2e35e70d1094984
042f8e31440220d50ec3447850e7c97e554d2aa1c087654e9cbf290900f1b7db
e4a7aca85c2f4107943081ea8de24a428ec26e30d40c10a749f42b282d16d20d
924df33875b326e28f33fccc1e89bc5e67b8d77301b300b476da9e2220351299
175eb11d7448a880e4d832abe3b8414860ef276ea77ae566c54f95e63338ce8e
3d5b67921d3480855292b7653cde132d85b2c93747d2c3d392406ccea7d4eba0
2f71a224d95171a545b530c32991e76fa2daeb1d99cc6a75846402b6bb1f2b08
a3bbac9f823d1af6ba8ca8df04b921b3272524b7abe997d4b779ff516bdbea13

http://bobin-head.com/pVUkSZX/
http://demo.jrkcompany.com/W3ZkcwcpK/
http://tral24.su/wwC6RRA/
http://temptest123.reveance.nl/Isp9hnjD/
http://ulco.tv/3avrr8CI/


Creation Time	2019-01-21 10:57:00	(XML Based - ENG - Indigo/White)
SHA256:
9c5f634805fed8f93f99461582bdc596ce636681cdab71cde479c167770e52b1
098f114ed9d47732337af87dc45bc7bf62d768263296825c3a268c5f06fa90e0
45ee893b5887f7a2c2c2961dcecd7bc39431a88d1675cd553f06b255039c97f1
37670dbeb28bc088a3bbbfccaccbdf4a257007252b5eed4f82ea015a990e7090
37e8f6322615f0a13ca99dc93f0aedb8ee73208f5765a86dc98db2d2747f1150
1d4a20628e61657e6cc12b8344482fec6c62c71e494d31bbe5bb847d2cc81236
e85369cda0b46bc4c7f149c201725d49a4f094687e53e05c4591b0a37eeb3b32
b924866a27d742937080b7edc6a6790355eb7453b603beb0d3c31be79fa431f7
6ee4a38e8e6532be44f1731110671315d2e98aa5ae4bcfcebf271f3bef2c3018
eee2a6970ee84215ba377668201d42f374124d94f55212704396084c1e94a647
df3b6c892e048e95cebbe51fbd4efa97529cf8a3b0b80c5b2a0410f2cda5a15a
41bfe37b618bb2481b53677bec72f97cf7fcb897bec590c9c6fea0065c74a3ab
b72dec6f80d365392b34255c29b4caf4f4606a0b9ca707fd4b7fc32fd5aa9b10
d85b9fad30bc4199e6ee1983a345e7992185dac3de3bb18c53ea1dea0e52079e
0b770b7a7ca98eee3c9165daa4017c40e04c043dc27bd3c346dc092730291069
7ca7e3d501e9c926bccde8d21d14c858d8b9156995b1c82dacfa65b90b98173a
599334c301cdc996f5925f592d1a14be44e1b45cf237d2c545a1767ceb646aa9
00efc1b5e8be9da5d800f9d1ef1e881bad7ef0d438747c372539060bc62480f9
9915f8acc8b7dc4d567b39756f37ab9057b20191daea0584026d255442adf3b2
db1acf4dc255ffa3772c75ebd0967fe68b9cc93ed3a604f6e25c32c8f756117d
3ca9f1c73f70eeef17ce9331560fdc5d6d8c7648632e084ba9a9c019f6ad647d
c5fd1b8dbff6523cb2b20a9ec3a11befe6815a0a87e52561c4ce0e429cfc9d6e
5082ab6ccccca0895f7ef7f4e4425ff4220635e1cdc72cb3cba41affaabc946a
c79948ebffd2dd773133e90c8ae10828c8855379b199163b175e9dca22f1f24d
93f2b4f9e2b1a9b9f8942cdb09d2a8a472fe52c320e798861daf7c5aeb771ef8
2bf544a94ffa89328a8621c1f55ff4717442089dbcce4e5c449d1abed737d0bb
4a8d8ddfec385a885845aa54ee8b645da88ddc4ca2ea2b4eb6d36b0e1cbacb6a
731600f3842fb1d37cd701d66bf8612f43b791ea1c8d9f020ba20396c9bf6690
b4b99f23ff8b793aadbfdfda406aae99bc94c4f60429b7e5f8022605f78f7cdf
2514473dec2909c8c126dbc76219fad4471416a6a4557e9f0c0233d7c5655c03
11900cbe7d474ccc4b03c40c2e119666181a1d362eae31e75d10d6c6506c7897
f963cadd7818260131ab5d9ef7a68979852c949e829db2bf31ce13f80cb14229
69fb7aad83dc94aa4c5b1bcb5e97c9e5ac175b00ab4e687cfae39d4681a32a4e

http://regenerationcongo.com/1TsgZ0K/
http://kids-education-support.com/M5ACow2LY/
http://ojoquesecasan.com/w72cksBNb8/
http://zidanmeubel.com/MYVdz0msnU/
http://leodruker.com/eXDzJC7bV/


Creation Time	2019-01-20 23:00:00	(XML Based - ENG - Indigo/White)
SHA256:
b55bfa75daf61bffcbc482848a2727df0863695906c987edc33d8c76d2b491fe
786ccef453e4dc9d6e963152cde07785e4dfbfb20c867fca6342e898d2a27bab
d560d892b11ecab879b722c87212320fc370f966e20c2bb305b7b858d739e028
60915f0f6caa381734390027899852af13018b8ec633bd3a98cc05c166325719
e98a55e25725a01829877a0dfc7bc05736ae4d824adc3be63902c7bde32d9076
b08165406bdec321e8c4bae9fff4ab5660d9b0518ed36959d4a1bd1450e7ad28
ee20fb24de9701a9b65dfa0c0ee24e2075fe42fbe3a17e01850eb3749d4132ea
bc359432299add72e58353bee36c9d032a7922e6eea0f92d487b752fcff7e4c4
2070f98b38f54685e53b9e16010d353af05aae06cc654de980d77268d78756c5
4db01b43d358ffc05d3a10f58965ac06d1000ea11855f25e69dd15f0c7969e1d
f845b020b2ef0170a9a7c20dd5d4d11dcf9ce6463bb4b3bd21c1cf51f4bf43e1
e32e2ab808e8e298854536d5f5f2643085c822f8d3b463d3375948e463be1a29
c318b81d87ef0359e8329f76d97122cfa7b1547f41338edf9f6f2b58cee70788
3724c3761325ed26ee88f7ef4b563d6ea23f62c5cf9b0bbec58f754fe9d53413
f3c8dc768a6c7fb3fba4d26563e02131affd60ff87e3639cc901508029513b48
9c8206fe9a06bbe82927dfa75b5f4a825d413ec7d09e8e7095730dc16548cd67
4ae36be02cc41ea6f268d9cff6ff11e30e91cacc92eb850f0fdd93441cb78b01
6866a902fd99c1732b2a8b4e3b76c13cf2a79bb6f1c9459df0680ba50757402f

http://mywebnerd.com/qMGOXKLu/
http://mimiabner.com/mGMKKpsuOc/
http://jaspinformatica.com/Gop5g1kiQ/
http://artebru.com/hUBdUVy5d/
http://roytransfer.com/aAlvPhe7e/


Creation Time	2019-01-18 20:30:00	(XML Based - ENG - Light Blue/White)
SHA256:

3ce41d4f43d7626c80735accc264329024b7048565581ce21de5aff0b398a0b9
96411c4e695cd341612d9336f921afd7a77569836a41a69e1902f408e091c8cb
693dad3961589ae707909ec26a390cc2b28e78205553cc23176fc2ca62a7bd80
6e44ccde3b466ea4f61faef2c2abb3103b8c4f9b0ffbe45e4697620c3f8e4a77
eb98bce5a99c6f96b3a7544129867c22c4c4128a1aff874a5d03bee335a1f9ab
5aaefcadd8229e3a68e76512b362557ced3b459ee8bd4def0ee1cdfe4fb5d79d
f8166cc3b79e6f304e64665792c776aa6ccf85c0e80a77fbd3348c1c10f3a260
fd25c759b8c7eb037eebdf11d4436fd911061efa7a621d7a75a67a32845e3886
a5831d56396bc83a69b1409d6fc0e56e26644471c60314a2eedff89548f4232f
7597dad8818463263d42310d87d9d4c4e32ca5258fb6b3b1737756873d3e8d8d
954d1fc8f2e7a328e5e1eb01c44232ba15eb6d5e53c945a4edef04aff308435a
8a88f395576b5c4049bd855306609f3f42b4586516c8e0952d1d0260d5637eac
ec2a8227155f7750a54821130db7f7e39331e8024ec36f3636a4aa11e37d5bf3
ea7d99487ea2c0f7a99d741896a7615afe59ceb23287ebe0109318cba8bcf9ce
814831d959aeb6073fba61303e271ae7c3f1e9f347e12cbcbcfa7688a6015c90
203c608e4f7052e828386e5354731d168b809fbaa44f82132afa5257147d5f00
9a22f6b2b7b6d2356dba2168a2284c364d356f5e7ca03c5cad0979c4801ea903
592e29afa9e032c174a33bb9ee644e6f7a7bbac9df60579112b2b3a68ae9925f
a08c4f014091729d769e1dcaee9bb12baf2be86f81f873bebc8ebb30ba29686f
c5fe3b93b2ab5ce812894de51d179c2944c8bd993a2337b14ad4b5ad6b41f2a1
044c8d619aa6cf8f4075d710840f177ccb2a5907e61baba47740373d4c8e7007
7614dbf77e3acdbe338028b25898b225567b880fe92e8d21d36fe62029b19b49
9d4d6edce76becfb896641626e7e1e98f1cfb5076afadf46775cf8be33cd1066
5fe79826348735e062427617ce970b40ed985d3e9d53586376a4bbed3940a627
1c526c66fe660c8c631cdbb0b3db1b7f02061cd95348ffb1e85677fb1ffb4d30
403d33c818aa34e7ebeea6b50481a3c0404b2ae775771cd15bd4362efbaed775
aed4b29531f71e848f20cc2f1dabdfe1e866bbeacc02e6629a8b8e9f77338c77
d3dca31b0652b3a3b282b2f8e3507adb698744491f4392d5f048e9410f5aa86a
7996a9b5fc8cf11163b302e97d1a7fbb69ba8dee5196f7ee26f3dc066317d9e8
04e30b16947e0c2ace271c761ca6d11def9008851aaaa2e7390f65022e7450bc
f03756f93ebc162ef0ba38a4c06cb8f713fe354802f1af56f0b1b3cd02f4fcc2
207c3df93c379af71bea46b4610054078acdca268a2b986289f33148a9f912e2
5605599218ad3e90202cbacb502028bc076ec2869743cdf46bfa4fcedac1b11b
83f7ab3847f1184bb35e39841e1fb06308316feb55614c8ec6d4a8d926b55005
c717503a9f22e558c4e907bde2f2998cc4c830f3892348014652d4d0f9f9cdde
5078b300fa61c2884611484495c59db4673a981c5828d08b50b6ffd187d1a54b
8557c3f9232e06eff5ae4caaaa9c6019b06ec71b6d0a399a2493643c24af5235
0c906827130927a717ee98e5e457c36890a4aa440d10789d57a727258e6faa80

http://www.vincopoker.com/dWSx5bwE/
http://shantiniketangranthalay.technoexam.com/fsdVowy/
http://www.bh-mehregan.org/pHdS2az/
http://www.kheiriehsalehin.com/wp-includes/ZBYLzi6s/
http://prakritikkrishi.org/rGQkmu8i/


```
#### SHA256s for Epoch 1 Payload EXEs seen on 01/19-21/19 ####
```

f0078fe5de14fa2e41e40ac58e031dee49a766162b40386faaff8481aa2392d1
bdafdb490876aefa0d5a59af7593af22530766501c1b63238fc8dddba81ac369
1f3d7df44510245071be9d201752c9a522009c249d9facaa8df29c2c96efe475
e8ed0ed73e72a41a251ebcccbabcfb0e3411baae14bbf6caa0298c8cc2bdfed6
34e13f9871e7d4c3a2f5c7d22d400cd0ce5f45a5e5011759caf23d90b791e055
5a24b5c5e9aa5ae6720d1bf926c094b233ae534c01f23a4f3d199c2e061b663a
b2a5d277e43aac3b17d98894203d370b4676b129efbc1fd46228ec8e4ac929e5
cf87e455241d91bddf71f9aabefb71cfb8575053ba8ae93661776d3043344cf9
0929a21c00911153e0f607721b1dbe2b3352d145f83c2fe794ea1ea046acc590
90500531484583a30ee9a91335e611aa588ea4719c49a602aa772868b8dafc00
8fdaf4ddfdf28e241b9930601da663a94a7c5cf70545b1f30f32835830e05ab4
f89c4ec1c6431f35b1c58a2b0fc6b90c08453f545bad76c1402c2d8f99f9d97e
1058c90279709895ba493065491fae7401d99cf95b8bdf0c370ead8fc014445d
c93f3799d1a145ee1ea520cf0ad3f9f80ca1b6b3aace50c96d5ab9f282d6276d
ae5038936676ca8d780ce53eac0738d750756950c6f81f9d2d6ed48f833b19b0
d0b6e28b1e283a863925b59c370759e5e9551b1c1172b9ca9f54a94ec9ef32d3
099793e43867cfe9d1326a717f9940713733a68b5bae1c57476072ac5f765023
1c1c5076721c560da72b7a2d5875ad64bc5ee9035df0bc8daccf728433efdbd3
5086e6ae61dd13dffb304673008b270b2215ad10c47579c77ef8335ecce31848
9326f4dfff1e601648e9d81723dfe6a510181ae14c36040f8d21e3d4d2ed4b10
6d43bff8a3265f876793187b7f3875e03db443a0c07a762c7a1f4bde4439f7ae
517f61055115d0c9b9c6333232a198bf229de192e771173a71ffb1ae3c2c9ff8
478791206c5d20b95658abf23b9bd1577f5c2eaae9c8f43c203d26c7dc871409
19f8e1d967ae8ec328e50c229b85f3d5389325416c13b23b6c08106cbee191c0
ec746f6c9402d8d777abf2278e5404bb92ce36e093b24f233f476a631db1bd0b
9df725b1ff880adec8552c8d49fc894be57c21f07907d200528ca0e5aa352de1
062cc552f94e04f7eb5ee6a0d12f8b76f5602c3bc2f7e766028478c68d40a683
c3300f08667cb3cfa80040e367172ace300092071dbabb1a566766f905a41247
906ac447e19b1179a0c4a022c24f4f5b1b231c7b19164aea521aba7f685394f1
edddd32da3b63189eff93ac5763d654375ce7691adb34a1edd32f85d9602de77
eb45657666b8c47c425a39a1212d17b06510d992c7e0184f5f8899abadb9af4e
1bee34f0ae9df5b52fc56f8b2c6e6967c5415261c8e16f5272b1250e3f579e93
d98dbb956dc93b40168250c76d50fc3604ccaf0fb4655fcf5f2d954d5724d5ef
d821f0f6c5f95e725082abacdad5116e98ad0c0b8ca9284aa6fa0b6f1bd19c42
3eefaafe70d5b8aadfbc5d80d4a68623fc01773dc7c33db3ab01c0043aff52bd
d6dade4158d684ac9ea45b1ab058030351623534845a9e9cbd3fda5b1fd1e8ef
2e82539adc986892d87adfbf6273044b3e020ffb4ad4fd5bbec3ad2789ef410c
daf834b942a088fcbfbd0390f73c65184ba3571b494e1ebcc46f22036c8c9f16
0f763d68efbcd086f85ad92711d0f7ab84928c3eab3effc07ff94b9800425807
9f9b313b2ed3253359911356be08bba43d9998ba85496684078438c132ef120f
4f1485fe40ad2c4b2dbac87e895550baa915f10d56b5319d24377cb8b3fe4520
eb014062bc50a7ff980df1f5fccc34684f9872ef8be5d1c1a97df5d96ade2db8
d5234b16694921274896b63bf73b9675b7d3aa65618d9af749cefadbc04ed3f9
9437cf02415ba8c97e6c1d2b2a324b11cf4911b39017a44b0c0d232f92f62415
6a2c95674c2e0475e4662402af83347835313b0e321908cbdb11f5d0a2ed5f15
d230f590b86892fb2f6651f6667a28c4b8ca62bb10b159c0016ce88103afd9a7
1d73bc903d3c98a510bf580a62aca1514e8ca935180657de4c7403969d15283a
8b913f181402f5b26c5b0416abab30df55522ee3d8c18d1073d6600a65820b3c
4232a13c5dc8c821ea9a9805c92ad5a22c258ade1a74f018865f6f914cf4248b
f2a7f0fcb47c7fa17407317d502802745e0188ce0fee3ed176d6c5d2b4ba3e8f

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```


Creation Time	2019-01-21 22:41:00 	(XML Based - ENG - Indigo/White)
SHA256:
08419179014ef78aa1c4855dc6bcb74f7a0bd1cfb211b2331abcc4dceaf407f8
7a6a4c973297a9ec6e3d9e954f6ec3d633789f8329ea6bbe99b8de797dad860a
2344a2314a993067010b966999fd8ae066681a26fe149c371e3f156d92f14c98
8ab1e6ce22ba7019f53668f768ceea1d4237b0e3a5c7e23da3b7ba267a6bd0da
2ea56488bc4567c4c76c90390505250f28ea743059ae37c50f1b16bb420a5764
388d7f0d2dba838f12ed0d506aef6f8ebac671dfbc5721d175f11033446dde15
bc16aca12f2f0ab845ac47cc587ce7d9f412c7f58df688b7b6478d74ffab8c09
05283181630005ead06db43c367775ad998271cd08c52080b68567c261c81b8f
5a7d95c9fc33f824fac539af4bcb9f614c3fc8c3e525dbbd295bb3d96a4b584a
9087be195e65b51ecc177e533ead8454102709e93c3dcd7251f031c8e6677a98
9fdabd2e606975d2c3a5e88fa923fc14198ce6ccb6ef76fd63125f68844b7fef
0409980eddb5a19d5691ef5349609a7efaf435380e24f9a6329301349709006b
d371985e67f50f2042529a8c98d3830ed22d31944f29596765bc73ad01fc9e27
1510f064572ebb8ef977c542a5360e4ef5364195126d6a597193026d9ea2a8f8
3e988cfb71aa79022e1d6952535ad790ba69d7b2af6a98eb22855054bd623edd

http://artemvqe.beget.tech/XrG1F6F2N_6yHn/
http://bellevega.com/5kHlMGxAbssU_i3YAv/
http://iplb.ir/LXXmnXsEIzp62Vu/
http://web113.s152.goserver.host/oDTCp1bNQ42L/
http://askhenry.co.uk/blog/upload/aIUdTJvohVXmZEI_wTOWYwde/


Creation Time	2019-01-21 12:17:00 	(XML Based - ENG - Indigo/White)
SHA256:
67f30628215a3c338cdec81b8ad879e28c5a1064594a02bb09f33cd61e6e268c
21f35c33e08380fe61fa00f929592bf1f3d2a075e4306a2676f0db2264829d8c
7df0c35a097ec6327c37d31b55e889181fb8ad1ce3216245badee7c1423856f0
889a21e03e2105e84990a6ac39eba5806631faa7464f2f40d62b166c2a2cc243
f33e832b248552409b69865625fc75bd5cf0acad96ccccffe8d1435fccb5ecfd
14568828ac798f30dabfe132e80e3a54b8142782e085c2fa4080a3a48404a0f5
0e621eabe7d92b71799191d95bd188905523b28fe9d3bf6d456a8a0c88b2a871
0844b4a3f0e8a11860a5fbf2c76af3906c92c7f81252c5909b7467c6324afa93
cb3fdf1645756405335488c6a4e4ec707e4272eb74d55339a8d18400caa5f254
b5c990d27dc019a8fc40476b3c98d96a72928ade2530b34ab1d3f8e408188d77
40bdb04ce962c7df40e7c1ee7d56b8acb8e5344753f6df78be91cc01ff833f42
3d701c120e6603c4aa4881a52a44c682a869cd544645d8f618a3dea92178b5a0
416f51d9daa55849eedfd6635fe4db923d6e1b92bd585c45be37c9423dfcdb15
3d1c5991c8ce10ce193e1033a68dded885efdeddc5ff4fb68db8a7f1603b00b3
0986f8859f54eb267ce167c57471e670845e37858a0982a04a5ffca4cb7af0c2
422ef7dc279e12a6008c30df7b5034f8da229b55ad05959b5b2fdd9874d1edcc
ce7296306f992847e6c3e41d7f42ae4eda9866666f9c47a91ab056f51d795d01
6eac5a509b2838d8f193339b7e11aa8ab4d024c7b58ac706bf6597c7ba182fb8
9ab593a45d0a2a38249fb3e96fe8b1b251ebd2c4a24ed421a4d8eb821369b418
321f8d35e85aa787157f1cc4a2245a02518284a0076343b83e61590ca8273a65
2290f805024ac94afdc6ec1ee56bc21ff5923e4ed8f59137b7dfa7ac57e1dab8
ef9b71d394560f1d44c68c623a0b9b79b20bb83452cf98a0052b84e7b548fd04
6f73da92d0d64acd5dbe30d0da25a6b5365cb0cbd28af25522a73056da53fd43
ff5d4940cbf462075855093221eedaa8da436d3fad78c49af3d6db2f251bb9ec
1a73585dc90551822b772e3bab61a856a3ed8377b2e71326ce1b946a43cfa1f2
5c6ad9c23712aa13d2e6c61571309ee0ea3f609e370c9dbed2c48bbb04ad6032
9778db924453374e4a5de437d47ad0fc72f8be302f868fb3c954e4c6f5e426aa
1e850bf654475c8ddae200fed22429bab48ae730e126fb9755100fe4aea0698b
2911115d2d8f2a2c43b8aa76efe14e5e38bce03b25afb132ab98309837412537
64cae69689ef89780645467d5c53eb309881406fc6f18d69f19e710241ff6163
e6c6ffbb938af0ccc0f924ced9f9c74488095e60a9c8e72cdf28df474d9fcfe6
33f057b21e0e440f30d622d84b664c5decf5f429e9944de24f247560c0996bda
0b1ea945c157d8db47f1788c7fb1613ef2ce31c032ae0bf7623cd79bdb2abca8
c7ffa19fd6185b93bdc20551c304ff764632cb19e3dee84a5f0a35da4305c91b

http://www.animoderne.com/kcrod7Kciuarbik_lZO/
http://ftp.spbv.org/yV6CuadvZ3v7G_60Tk/
http://wijdoenbeter.be/kZ1ywr7u_rQL/
http://animoderne.com/6H7bU7fDVegZsDf_jmA/
http://realgen-marketing.nl/06yF2OmyV8/

Creation Time	2019-01-21 07:39:00	(XML Based - ENG - Indigo/White)
SHA256:
489eda91e8ccf56c738509d37f0270a7c58c7ccdb7921e296175f3b37a69b9a8


http://johnnycrap.com/g9KtsYZJdOpIz_WxvL7/
http://weresolve.ca/ZLqX781311yxXcTFO/
http://www.reparaties-ipad.nl/qAifGyKggabPl8/
http://hembacka.fi/N4Vjj3Erm/
http://bspb.info/E1uWIX7DXLQ/



Creation Time	2019-01-20 23:14:00		(XML Based - ENG - Indigo/White)
SHA256:
ae3f3da8e5059df17c0461d4a067528d842abf6c717191260e25ed91292579f9

http://brosstayhype.co.za/Qci_w6cOra0a_f/
http://bootaly.com/pjuupfw/4TPwjbiu_LtgB6bz_RNnEodsL/
http://clubmestre.com/Ms7KVXg_mEQ6PCOf/
http://www.hjsanders.nl/AllpF3u_jyYj9Xx/
http://condosbysmdc.ph/ZS28_2396jq8/

Creation Time	2019-01-18 19:43:00		(XML based - ENG - Orange/White)
SHA25:

7a6a4c973297a9ec6e3d9e954f6ec3d633789f8329ea6bbe99b8de797dad860a
5f443cc0cd8d8f74013da962bc62ee9a7341a7a48b8be16786ab360883df3740
a9528d9919af1280dee1b33906fcda215bbbd5f65311f38c2686cf4d50a62c76
5f5e64ee0afcffa8f6652cca0e431061b941c9ed60004a8426c737cfbd64899e
2d6981bf3ee1968fdac23cf5272f1a5e0e85964e06ce9513f98f406d317ef04b
9971f5551e64c99b7c661b38f235b9408bd8ddaf827e10a0aba96ba614ac6777
f5b5ce720bab6ff982b397826d54a6d6945d1c18bd031b38fc734c187f0d8ba1
72820698de9b69166ab226b99ccf70f3f58345b88246f7d5e4e589c21dd44435
4bc615ac52a503ac0faeee93aba55397313ad30373c6bb6cff2313b538a94e30
52f7d04f9b7c433f3bc6b4c105826a0a7cd472d06786d82693e150afaa3e2e23
da51282bc4d252af6257fc0f942cd142067b16183478d51b92b66c934e7c6f03
dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403
af8339ddd8824d10de064a524337ca4341858d060615e1f596fde93b97c68a2d
25660ef5003ba5285daa6d60b278ba803ad3d809fd6584c33e48f6fc23565ae0
36461711ac165efc8b331949c105ffdd51518f7054e3025f8243d512b797140f
386a9ee6a1d804f760f8ebe38d8d89d4608cc186532570b0a69391b0022468fc
8247646a0b168bf9e843ad7ff37575c80d8231ae9dcf6128c574208e1bf0f509
4da50fea4d1e772283fbfee09dfe0a5a02562773f669b93cf4ef0d034c27be60
535558eaa31d2768d10a58b74d29231ecd06abc127a79c2d9e12d62120871b17
708ae9bc5ab9fe9adf5a8e58d628c4aff8a354e4e00b696d4e7773e8f19394d5
fb23ad717efe161a8769351b6c2cfeb9039847f3875e0ad3942ca388d43f4785
01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00
0de620338216a3c13ea8a4d29f48ec20723321277d41c14f17c94fd8282dc32a
9d0920e4fcb8181de8df9857388c89a494b1ea3d777ddc3575d68acfd1833b0e
bfdf59b16ec6d0529c2a193988918fd66b54adaeb482b213628a882f76e941d1
6675bfa39e9829ccda4bbd754352708e6928676f2996572b82ededcb723bb748
5b9e1371b0d9e4663c143855f7d61060daef7d2a8eafe5c2de90d1646eb08bf2
c3ce32cb9a6a0f98f9c2a61ca852cc8a45cca829f56b47f5a726b4dfbd8f112e
ce4564d2250be08cb8cce3ac6eccc0579b977d12c63c9af84656217798521131
948954e93959e2c9e53ac2b0b53510283d25205a30266550e24bf382c9fba7f9
e352a557538ac5c707c4cd2dcf36ff98d499bf3af52ee95c29a417e466546300
9e6d3b058656aee10b2d30a63bda5583b2561acbd6bc497a4957dbd1e0c02295
769d6eab2b0e43ea89639bd921116051a40722f0d0e98962ebe91527679c127a
0d92a178a755e38ffe0e2552b089d3f1d462255595accca0347a7090167ab25f
6e90caf97a61ceb264726623abb025d1d0641279f8a05095dfade8ec2be884bc
fc8a12a675ba0e24a64d2e5fdd63f154753472be2c9a1046050545b53d0e7ace
f243109cfcabd5f4ec8eebcbf094f2e1c11b8b6a8db36c081751eea2416fe826
bf2629b1a6d2538fd7151633871fdc0e3107e3d89f08d20f40bff712d89d7b01
4413443cbfaf011c3e0ea3ba799a46484e7adc021b6959b6ba33b1045e8e63d7
f658ad0fe40067f684f6e7b0ff0685e82ad84af6056d7ebd4c70d194bbd86991
a21932664409ae2bc2ebf846452ea11d7f7ff9a4df68468e6628068caf3378ef
9d4d011096217e4102b187470576e13b58b67b23b61dbbd5be59b05270e0b339
75bcdca7e3b2309bf9ba032298fd8d6c9087803c9175a46f53eac4d172cfcc40
a0ccb310c7ec618ab516be8b95923254a6724b1a03696ec6dbb6e47c60321391
0d614d15d1f0e26054e06e19cf82856bafc2ce7f67d6c58defde8d437b6cb4c8
f793f983e7f6d60e462613722b467b6cbca6f2cb0102f950023200e7dd0563dc
c46813b4916e7731cbaf679dc3dd5267f94b62e21413faa2f45949e6f228eb33
78dc9c309d15b9221ea8128cdc7b549794c6e3b7a2015e3452defd723fd218bb
2f81bdd918649038dadb81293cb00bd5387a3403a43f619357d84037a8f060b2

http://salah.mobiilat.com/e24sv6_38Ihrh_nVYqny/
http://panlierhu.com/XMy9MFv1_pDQsD/
http://salecar2.muasam360.com/wp-content/9z7_MFL011/
http://afordioretails.com/D4Rm_Eugj/
http://thanhlapdoanhnghiephnh.com/kbCg0oh0_rNNj4TLtq_K/


```
#### SHA256s for Epoch 2 Payload EXEs seen on 01/19-21/19 ####
```

3ea9dd0cbbc982bc21abdd0d2f5032cfe7c9c7cff0f0324ae917cf85e55ca486
bb7f35ab9dd5f0497f7b5616a071ca584fa8069dba1ead56c27da284a5b5b756
a8af204fa33caedf85217eb7e74966cdb21ba08e899ca71e168939690a25ed19
6354399ab29e6f6bd00aa47b2d54c678c82cbe08b3726e7bbe827b64acb8a611
5848b0be4f37ae89067c68f83b6c4ef95f2f70762547914b7bd73e662adc430b
ea5d3395f985a340428357cfa874cec6625df60e0250edefd7b02b38e2bc53bc
2f3c17970e33b6b98846445de7399eda8404cc54ecceb3974b3431d40f1c68d7
9fd817ae483159bcba370913737b9074630389796cbaac38a4007880f11a6204
a0358ecc13e85e4ce49597bbe5deb337fc6da01f38468f8de186ba5c9c992da8
98e832e8d670daed18a0449113b7ae909cfce32c49f6a2a048893c95cad2bbe8
c5874637f68620e2833a715818ad7e2f1669bf878fbf129b5b23a52df52ebd92
587a721aa4a0bcda71d2db713a189813e8c72e444fcc3e1198f3af0896490890
aa643c7015e6756d6ecd40516e6ad89421c700b79ce73f025f85dd8bc5b403e7
3f141ae196076a865ad731eb8dedfee31ea459ec742a738ecd9fc8560920fdec
1d3b4f7c7b1d86a2980d6cba47f38f0e562f5ddaf6f566815ee69a8c5cb36388
4121f7b014e355cc57f67f9154787c798a8c98ee592baf13dc96a2369db35db6
eeb7bd8c9d8e693050bcfd522a9a385682e8d1a7d8a65794be9818330eaa0159
b6b81bc2129d1f359b942f35ff90ac586338a521f46f60298b401ea3dd3d4b81
d89a5697a766979e6a6e6d19e9347cc77b1da11341bc1146f230bbd4a2564da6
79deb3cece524a285706af386c1483ca4352344f30a224420a8ded9c1f8e7b42
19d0e5a72fce27c00251780678bbdf5e58ef13c06b20d1f0c9398e7cb4a56f11
698039ab95abdd8c095dfcbfb419a861ba8b59638009df41b01efd66d2916ed4
8e90849828e8cb02de7dcf741290e2633a55bcea22703853088bc20f561889a0
2c2e724f6a8ae8bbc798cf9a0eaec88a15d4c9e081a3ab98f12ef6d6acdef6dc
586b33401735d6755dfd5c521ccd2ea3d4d57781c777a0fef1cf0e3b3c1b8ae5
6869db6e8305e2e655838554bd86eb2a9eeab0ef5a93ea5a3f9dbdb84c8de7c9
6c98f2b2f2ec05830ab90ec2d32d2b4229eefc27a5c8de8a7b8471ea90807d01
3b4cd170f82efa8a532541bad69bcee991169c8f90b7f87554b98087f0b066ad
da155cde69149ba3ba02fbc42e14e4b5b026c138b7d7372c5dbae04c1ffb3afd
053e30092604ddc50fd7d95f99ee8987652f3b88ff60b6ee74856cabca262cff
ce864ad710f8e2c25e78acfa8d10d0599e572a67d0e3f42169a6a653b667975b
cb2373be57aada5bf81b3d64abdc209cec37eb8c50c02a0914627386fb20ae41
5f7a1909ccbcb8a41d9aaa454fe257e14f48fa6fbf3b8663c540b6d195b28363
a59b358dbb99bc0e0b3b9c77bbe5c8af59f81765f52434aabff36f9d2fc4e6b2
ed1e5c2718fbd5de3773f61fd4b3b10df4783ce7643abf20906b9eae6d429441
069537774c7f02c0a526bfa29b008e4f5224b2877d29fa925e6876eefa32dcf2
16f9900edfa75cd13d852908d655b4292cfe9c4b34925d9962150dc80f6114d6
2fd12a96a382dddb38145818aaaae93eb26829a974bf03244a9af79af177f23b
b5ea53213251eb2d992a88010b2ce44f3509998db066ef58ec4b195bc601fb60
b26b582a41d4b3b371c9e39d39b00169e6d41347f85e156b7b1a7ba14517b7d4
fd8d18817f4298a812ad130428f36ce72cba966aef7b7740a04f63ff47c21ac6
e2dbb8d13d74fabe46f8804ae7bd45d3a79fd8508e617862a264ed73914fa6cb
6004f2183403208f57777fc7395f0d08d46674af649fb1227b542e68873657b9
824276295b11929e02d13af1cea747463df25daf1b196e1f6d98f91b07c3c6c6
a59aa27c6f49cd75b02b44c3ab1158e995cdc8b33f9fbbb4476a18121a49db0a
b7760d9aa9885f981833f3b7ca1cdb508cc8fa01959332bbb33461680f122176
99d39f0e4f04e9b3055690fac2aa46750ae5917719666574dbe421a4fb027b30
a3d4d9a2df36f089571f0179b7dee3182c687c0b72e717899935ca12baa0b6f4
9303534fdb789536fcce1a194e20a32d0ea173fe0044e2e8a1d05a39466f285b
a83f0010de9c68a44a3d0325293ca8bd4233a7579e384bcf2050980575bf7f23
35e304d10d53834e3e41035d12122773c9a4d183a24e03f980ad3e6b2ecde7fa
95be8ccfa583b9c7d002c2d22419cb5ba624662500b9366f9c602129b720939c
85e94d65e976d56a6dc438a1904d62f1d885ee1d8ba216da4b80d72cd08c293a
2f5a18a1b2fe94b2d2a5d931997907802ab4f293e19defc4f10a3c913de0c80a
40a2935c67a1ce1ad4eeb8cdc9d19a524538961eba302d8968f455e1a0b49214
8c35ebddb4e2da8f42f59e5a549e71285db177f05886ab3960addb64f7a7cbd3
b0650d08f43bc36d7c3c7870b680e7271879fcaea224af0c15810aafce81bec7
ec4b53ebf943d0fed01ef5a1073f9ab8e4464f8f1be634cbc1d7a60ed7dd08cb
d1cdbad38ad8e497d026618600c97e6b29b54b72c30e6dbe96ad6c4e18859c92
de602d8aea4c1e085c073fbdafa31d9a471510eb3fc19da1d912f6a06ad803a8
f18bb0fcedbc2ca2653b1621899e36a596bad07bbfef78b9874659cc09af454d
f564bb1bf45a41ba47904c9d0cfd7f0556545af0adaff0c0b63f33be3a225d66

```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
116.240.3.27:443
133.242.208.183:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
178.201.186.245:143
181.167.49.76:80
181.211.11.171:443
181.45.45.132:8443
181.54.202.80:443
185.38.216.84:80
185.86.148.222:8080
186.129.174.150:8080
186.190.192.84:143
186.90.155.228:21
187.137.111.0:21
187.192.133.210:53
189.159.119.242:22
189.163.44.44:143
189.173.4.161:995
189.190.40.163:990
189.208.126.53:143
189.250.100.248:465
190.146.158.142:993
190.190.101.38:443
190.195.169.170:20
190.226.34.8:21
190.245.10.162:143
190.25.255.98:465
190.55.123.250:80
192.155.90.90:7080
200.43.114.10:8080
200.83.21.5:80
200.86.246.50:20
201.103.81.129:80
201.200.3.74:21
201.231.70.72:80
210.19.41.87:50000
210.2.86.72:8080
212.81.22.231:143
216.252.83.23:20
219.94.254.93:8080
23.254.203.51:8080
24.222.22.58:990
31.193.130.187:443
31.53.229.122:8090
45.73.27.218:80
49.212.135.76:443
5.9.128.163:8080
69.158.10.125:50000
69.163.33.82:8080
72.47.248.48:8080
79.98.31.206:443
80.12.84.86:8080
92.48.118.27:8080
95.9.248.89:80

```
#### Spam/Stealer C2s ####
```

187.147.153.225:990
216.98.148.157:8080

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQA

```
#### Epoch 2 C2s ####
```

100.42.20.148:53
101.229.131.245:22
103.108.204.93:8080
105.174.6.174:465
106.51.0.205:995
111.235.148.46:465
113.193.254.82:53
114.79.134.49:80
115.71.233.127:443
14.192.144.194:993
173.255.196.209:8080
175.101.89.66:443
175.32.123.78:143
176.74.89.66:80
178.254.31.162:8080
178.62.37.188:443
179.13.73.220:80
179.53.156.88:443
180.232.133.50:8080
182.176.106.43:995
182.184.108.234:993
185.129.92.210:22
187.192.58.207:143
187.199.129.111:443
189.252.174.81:20
190.147.44.151:53
197.243.230.45:20
197.83.236.18:20
198.74.58.47:443
203.213.236.70:143
203.99.177.144:53
208.78.100.202:8080
211.115.111.19:443
211.138.24.144:143
217.13.106.160:7080
27.0.180.40:8080
27.96.91.73:53
41.216.165.122:80
45.123.3.54:443
45.63.17.206:8080
5.128.151.213:143
5.230.147.179:8080
5.239.240.88:20
50.31.0.160:8080
50.99.132.7:465
58.239.33.5:20
62.75.191.231:8080
67.205.149.117:443
69.195.223.154:7080
69.198.17.7:8080
70.81.33.80:50000
74.58.188.22:8080
75.99.13.124:7080
83.110.108.213:20
83.110.212.100:443
83.222.124.62:8080
85.99.124.9:465
93.107.126.157:143
95.141.175.240:443
98.142.208.27:443

```
#### Epoch 2 - Spam/Stealer C2s ####
```

120.150.92.75:50000

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now.
Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version
of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change
payloads every 3-6 hours now and payload hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100%
sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the
other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the
other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch
as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/BymYgCx2 - @pollo290987

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42
Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic,
@abuse_ch/urlhaus.abuse.ch and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

New templates today as previously reported. New indigo colors and wording but the same old crap inside for the most part. Also still XMLs.

Seeing a breakdown of distro as of about 08:00 EST or 13:00UTC. Spamming stopped at this time and also seems like no new docs or payloads. They may be having a case of the mondays over at the Emotet Malware factory.

E2 C2s updated again and both botnets are now at 60ish T1 C2s. Latest for both are above.

More updates to follow.

Spamming never recovered. We did get a few new payload sets but I never saw another piece of malspam today. I give up for today and will pick it up tomorrow.

```
#### Sandbox 01/21/2019 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run on 01/21/2019 as of 02:00 UTC https://cape.contextis.com/analysis/31271/
Epoch 1 C2 run on 01/21/2019 as of 18:30 UTC https://cape.contextis.com/analysis/31402/
Epoch 1 C2 run on 01/22/2019 as of 01:45 UTC https://cape.contextis.com/analysis/31445/
```

```
Epoch 2 C2 run on 01/21/2019 as of 02:00 UTC https://cape.contextis.com/analysis/31272/
Epoch 2 C2 run on 01/21/2019 as of 18:30 UTC https://cape.contextis.com/analysis/31403/
Epoch 2 C2 run on 01/22/2019 as of 01:45 UTC https://cape.contextis.com/analysis/31446/
```