Emotet Malware IoCs 01/16/2019

## Emotet Malware Document links/IOCs for 01/16/19 as of 01/17/19 00:45 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 01/16/19 ####
```

http://7seotools.com/Amazon/En/Payments_details/01_19/
http://activistdibyajyotisaikia.com/Clients_information/2019-01/
http://aimypie.com/Messages/012019/
http://airmanship.nl/Payments/01_19/
http://alfa-des.pro/Amazon/EN/Information/012019/
http://alfemimoda.com/Rechnungs/012019/
http://alkonaft007.top/AMAZON/Details/01_19/
http://allinautomatic.allinautomatic.nl/Rechnungs/012019/
http://amberrussia.cn/Amazon/Clients_Messages/01_19/
http://amerigau.com/wp-content/uploads/Rechnungen/01_19/
http://amimakingmoneyonline.com/Clients_information/2019-01/
http://amritmachinerycorpn.com/AMAZON/Clients_information/012019/
http://angelayeedesign.strategysketchnotes.com/Clients_Messages/012019/
http://ann141.net/Clients_transactions/012019/
http://antigua.aguilarnoticias.com/Rechnung/012019/
http://armazem55.com/Rechnungen/01_19/
http://aserraderoelaleman.com.ar/Amazon/Attachments/01_19/
http://atlon.ml/Amazon/Transactions-details/2019-01/
http://audiocart.co.za/Amazon/EN/Clients/01_19/
http://auto-buro.com/Amazon/Orders_details/01_19/
http://ayumi.ishiura.org/Amazon/En/Documents/01_19/
http://azimut-volga.com/Amazon/Payments_details/2019-01/
http://bakerykervan.godohosting.com/wp-content/uploads/Amazon/En/Information/2019-01/
http://batdongsan3b.com/wp-content/uploads/Rechnungs/01_19/
http://batdongsanbamien24h.com/AMAZON/Attachments/2019-01/
http://becommerce.mx/Amazon/En/Orders-details/012019/
http://belovedmotherof13.com/Documents/012019/
http://binckvertelt.nl/AMAZON/Transaction_details/01_19/
http://binderdate.com/Transaktion/012019/
http://bluepalm.tech/Amazon/En/Payments_details/012019/
http://boiseconcretecontractors.com/Amazon/Payments/012019/
http://bootaly.com/pjuupfw/Amazon/En/Orders_details/012019/
http://bozziro.ir/Rechnungen/012019/
http://breakthebubble.nl/Amazon/Attachments/2019-01/
http://broadnepalnews.com/Rechnungen/01_19/
http://business-blueprint.top-startups.com/Information/01_19/
http://cardpremium.com.br/Documents/2019-01/
http://carmennel.co.za/Transaktion/012019/
http://casetime.org/Rechnungs/01_19/
http://cbsr.com.pk/wordpress/Amazon/En/Orders-details/01_19/
http://chalespaubrasil.com/Clients_Messages/01_19/
http://chenhungmu.com/Amazon/EN/Clients/01_19/
http://ciblage-spain.es/Transactions/01_19/
http://clindorbh.com.br/Amazon/Clients/2019-01/
http://cnywebservice.com/Amazon/Messages/01_19/
http://comidasdiferentes.com.br/Amazon/Transaction_details/01_19/
http://dekbedbedrukken.koffie-bekers.nl/Amazon/Clients/01_19/
http://dev.moleq.com/Amazon/En/Attachments/2019-01/
http://diffenfabrics.com/Amazon/Clients/01_19/
http://digen.com.br/Amazon/Clients_Messages/012019/
http://dijitalbaskicenter.com/Clients_information/012019/
http://directsnel.nl/Amazon/En/Information/2019-01/
http://distinctiveblog.ir/Amazon/En/Orders-details/01_19/
http://dominusrex.fr/Payment_details/01_19/
http://domswop.worldcupdeals.net/Amazon/En/Transaction_details/012019/
http://donidonggiay.net/Transaction_details/01_19/
http://drcarrico.com.br/AMAZON/Clients_information/2019-01/
http://drinkdirect.co.uk/AMAZON/Orders_details/01_19/
http://elcodrilling.com/Amazon/Clients/012019/
http://elsgroup.mk/Rechnung/01_19/
http://ema2-medea.com/Documents/01_19/
http://emiratesprefab.ae/Amazon/En/Orders-details/012019/
http://en.tag.ir/Amazon/Clients_transactions/012019/
http://eriklanger.it/Clients_information/2019-01/
http://ero4790k.com/ftwiofrm_ero4460/Amazon/Details/012019/
http://etihadkit.com/Rechnungs/01_19/
http://etsybizthai.com/Clients_information/2019-01/
http://expoluxo.com/Amazon/En/Clients_information/2019-01/
http://faszination3d.de/Documents/01_19/
http://francoisebon.fr/Clients_information/01_19/
http://ftp.barcelonahealthy.com/Rechnungs/012019/
http://gernetic.ca/wp-content/Amazon/En/Documents/012019/
http://ghayati.com/Transaktion/012019/
http://gmelfit.com/Amazon/Payments_details/2019-01/
http://guitare-start.fr/Amazon/Messages/2019-01/
http://healthsbouquet.com/Amazon/En/Transaction_details/012019/
http://helkar.pl/Transaction_details/2019-01/
http://hidrofire.greenstudio.co/Rechnungen/012019/
http://hjsanders.nl/Transactions/2019-01/
http://howtofx.worldcupdeals.net/Amazon/En/Clients/2019-01/
http://i2ml-evenements.fr/Amazon/En/Payments_details/2019-01/
http://improve-it.uy/Transaktion/012019/
http://infographiemt.com/Amazon/Messages/01_19/
http://innio.biz/Clients/01_19/
http://irsoradio.nl/Amazon/En/Clients_transactions/012019/
http://isofip.com/Amazon/EN/Transactions/01_19/
http://jameshunt.org/Rechnung/012019/
http://jasonpatzfahl.com/Transaktion/012019/
http://jhelt.net/Amazon/EN/Payments_details/012019/
http://jongewolf.nl/Rechnungs/012019/
http://katyremodelingpros.com/Rechnung/012019/
http://ketout.com/Attachments/01_19/
http://kiot.coop/Clients_information/01_19/
http://kisfino.com/Rechnungen/012019/
http://ktml.org/wp-snapshots/Amazon/En/Messages/01_19/
http://lagbag.it/Rechnung/01_19/
http://lanhodiepuytin.com/Amazon/En/Information/2019-01/
http://lanhodiepuytin.com/Information/2019-01/
http://lap-mang-vnpt.com/Rechnungs/01_19/
http://ldrautovation.co.za/Amazon/EN/Attachments/2019-01/
http://leodruker.com/Amazon/EN/Transactions/012019/
http://leonardokubrick.com/Amazon/Orders-details/012019/
http://lespetitsloupsmaraichers.fr/AMAZON/Orders-details/01_19/
http://lignumpolska.com/Amazon/Messages/2019-01/
http://liveloan.eu/Amazon/EN/Clients_Messages/01_19/
http://locksmithhollywoodweb.com/Rechnungs/012019/
http://logopediaromaeur.it/Clients/2019-01>/
http://lohacemos.mx/Amazon/Transactions/2019-01/
http://mahin-news.ir/Rechnung/01_19/
http://mahsew.com/AMAZON/Transaction_details/012019/
http://mail.bestonlinegames.xyz/Amazon/En/Transactions-details/2019-01/
http://mail.estysegal.co.il/Clients/01_19/
http://mail.gigan.id/cgi-bin/Amazon/En/Messages/2019-01/
http://mail.learntoberich.vn/Amazon/En/Details/01_19/
http://mail.mfj222.co.za/Documents/012019/
http://margatepanelbeaters.co.za/Amazon/EN/Transactions-details/01_19/
http://marinacity.com.vn/wp-admin/network/Details/012019/
http://mataukitaip.ekovalstybe.lt/Documents/01_19/
http://maverick-advisory.fr/AMAZON/Details/012019/
http://mdmshipping.org/wp-content/uploads/Clients_transactions/012019/
http://mingroups.vn/Transactions/012019/
http://moefelt.dk/Rechnungs/01_19/
http://mr-digitalmarketing.com/Transactions/2019-01/
http://mtsecret.mtcup.com.vn/wp-admin/Payments/2019-01/
http://mywebnerd.com/Rechnungen/01_19/
http://nbhgroup.in/Clients_transactions/012019/
http://newwayit.vn/admin/Clients_information/012019/
http://noplu.de/plesk-stat/Rechnung/01_19/
http://noviatour.com/8fotk26/Amazon/En/Documents/2019-01/
http://novo.cotia.sp.gov.br/Transaktion/012019/
http://nuagelab.com/Amazon/EN/Payments/01_19/
http://offblack.de/Amazon/Attachments/012019/
http://ojoquesecasan.com/wp-admin/Rechnungen/012019/
http://old.copyrightessentials.com/Amazon/Information/2019-01/
http://old.polskamasens.pl/Amazon/Transactions/2019-01/
http://orderout.nl/Amazon/Clients_transactions/012019/
http://ozawabag.shop/Amazon/Documents/012019/
http://pe-co.nl/AMAZON/Orders-details/2019-01/
http://pharmaesourcing.technoexam.com/Transaction_details/2019-01/
http://pmcorporation.fr/Amazon/Messages/012019/
http://polatlimatbaa.com/Payments/01_19/
http://ppengenharia.com.br/Rechnungs/012019/
http://projektuvaldymosistema.eu/Amazon/En/Payments/2019-01/
http://pugliachebonta.it/Amazon/EN/Orders_details/012019/
http://qigong-gironde.fr/AMAZON/Clients/2019-01/
http://quahandmade.org/docs/Amazon/En/Information/01_19/
http://qualitybeverages.co.za/Amazon/Clients_transactions/012019/
http://ragainesvaldos.ekovalstybe.lt/Payments/01_19/
http://rampp.ir/wp-content/Amazon/Information/01_19/
http://ra-services.fr/Messages/012019/
http://razmolana.ir/Amazon/En/Payments_details/01_19/
http://receive.winss.es/AMAZON/Orders-details/2019-01/
http://regenerationcongo.com/Transaktion/01_19/
http://register.srru.ac.th/Amazon/EN/Transactions-details/2019-01/
http://reinhardtengelbrecht.co.za/Transaktion/01_19/
http://rokiatraore.net/Transaction_details/2019-01/
http://sabugoventures.co.ke/Documents/012019/
http://sendgrid2.oicgulf.ae/wf/click?upn=AMiKyXv2mtzIwFVrksErJZCerHghnhK0s0EymPuEHUt-2FWMSFCsopdgHSY9Fdl6-2BvSJ8deEFwcvGlqbVVSs05MVdl3zK4-2FJzq-2BorjXuCKZDQ-3D_OFleGUAja-2BCLQfdPhYxNPP81vIpfqp882xgI-2FmcKpe1fQ-2BU2nG9v-2BclGZKa-2FiQ1GeJG8MXbtq1iJfKkEe-2BmB3-2BpKoZPYDoUa0kssnInt-2BNRE8xxvkauygwavSUVzAyOddb7lMonUAXgiPmXaqcHvedUEqoAGSpK8yN6wbKgOaXGXocZ1-2Fv7mlJDJYnQmv04JMzj0KzFLKxa4WpTxq4G5C8FoLDB9IaAeZwVPuDN5Qx0-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=FBXErEQYiWolIv6Nv7udtEz5PdgmXAcVPIrDGpW0OdqAm5B2IXlCoG8BbVldeyc0vgj5Pg09e0rPu3JmQXnpYw-3D-3D_l6HG3FW8n50aQtA4oQ21QaL5Fq-2BZzmKMGTJdvztZDph23Ya5auoshdORU1dhC702A5NcVPgL9ZNydHDAKMoGX6CB-2B1dD6VobR1LyUe81IQz2tTIHDXsecLWtCY1YWx75T4fyzd3S2qgLoo5lfOEfWAWrcJLFBegEnWDqWzZ8SFkVauRuz81YMtYnMdt6OcGD-2Bgc20TxYe3gcu19w5yb3jdSCawIRAWBeIeAAdYb-2Fcs0-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=GsSHusSf8SqmnjcxeBn6onr5c8CRbJgUhL3LQUsMhlNkowcKB1cL2TtcHWLkjyKR-2FWSSZ7Qlz-2BeVP-2FG5-2FH4FrQ-3D-3D_Felol2aPnvw-2F26iod3oKCkXHDEFKVyhP2SQyv-2FhWIYGeEwd-2FBjnZjexWfiM9NVCl9Hcb36AK68eUZBoNYfR0U2I4FdZUJh-2Fxa-2FE3CAyxSOjRSi9XCuxHFpJ0vRB2gpJxcwbmc4YFBhKnfmYJwZvi9bffKhMC-2FmwXrUJXcy29Of72xJ4HrVKXjHmBdsq8GYQNQqpjZG8Kr3Vj9XoON0BuvPXyQvyU8Rrb3Vh2SmzaMFQ-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=Ifs9ztBGmqH-2BjxL9ptnymNQrGddYBeMhSML9ly5ERr-2BT9Pg090dvQNl5b-2BecOZ-2FiG16nxHqz12C5QGNMArM0nA-3D-3D_i2GSObdlJnVAAu3Jd8D4HBX3iMWWoLo9thjz1Uoz-2B-2FhvbMqvBSp5Qcjk4u-2B54ZEnZQ1jLCjaOwYwCX4condfTq-2FO3GK5ixJfdl08KOejwVmN-2BYTdDYaXX-2Bi2UZG7jS2wFyi9pftYHTJYUfkYB3D41LF3gRuZ9HQmFB75tlzJGHb3-2F0s6jLPabZnzbCDF15g49JB-2FSiBXeRsET44n7R31UR7CEdslQfY6vjo7mDJqI-2Fc-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=Ifs9ztBGmqH-2BjxL9ptnymNQrGddYBeMhSML9ly5ERr-2BT9Pg090dvQNl5b-2BecOZ-2FiG16nxHqz12C5QGNMArM0nA-3D-3D_o5AVXp8blFgDP4X4xNGd2KYYzHSF-2F7HKlROIRMeSW-2Bh9Et29-2FpTwhIioTkpq-2FROgRE03rhRAL-2F-2BPJg7LYfdTKBTADRtz0qR1HPUm3aZX03bYsHwxra3U4O9jyG50A5DCom7DRM64bD7w1Ai0LMMwrbIQFxfIWAxYxdT6KflSDl0fqi1NCFMr4HJBzsXE-2BTlXWskBhBn68gArZgKHtHKc-2BggGhlP0bevdyIqX4RlTm7U-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=otiUwT24tWIVg7t4iJgYRrTynFGYKd-2Ff6IRPJG6zO-2FseMflUieiTZDPtuRRjhGh-2FgMqbI4llFhTwzc4tGl2eiw-3D-3D_noZZaTL5GjYhLgHXX205epVe5QyNYnpLwJEDAfiZLsUsSk1Rw1ymLChA1ljGdKUtegFToB-2FeRk-2FhEX0yaWMXST398tIkYf6KhG5-2BmxQnH2b4F2YOCyxaU6-2BhvFZP3M9sGqD-2ByL3bBhgcVnkdi38TOfKjbzLBSsOulebi3h-2F1D3iP8RJBPLXC0CcE7gRgHXXgnAtr-2BtMgdEIMfrq8dB1IEE-2BCz9cs-2BaioDAbUmlOt73U-3D/
http://sendgrid2.oicgulf.ae/wf/click?upn=VD95ITBgtKnZfMM-2Fzam2bBIASOPkYOMkETTDO9FXgJmmaFY7OZGAgcjchmyHE8YoloQEvmIDk3SgStgVHg94Fw-3D-3D_3u4p1Y-2B0wGhyOmLEmyjqlwR22D5iE9w0sMYOxHBqCDtXmMz9AoEgWJ89g6awstcXGjyleOuS0vtYn6O7Jl4qRiyGnJT60Y6ViBzJn-2F4cnu78gHQxpyoVVTXIVadHeHyrIfbjSF2j2DmwJ1x2XS4UE5VErRGQra30P6sFgm-2FThNmx-2Fj05jhWZGN9v4PofHUlw-2F5Ewx5XMaTJutCoyydbQr66hLio3ZZbo3fmdVzfcBvU-3D/
http://service.atlink.ir/Amazon/En/Transactions-details/01_19/
http://sevenempreenda.com.br/Amazon/En/Details/012019/
http://shootinstars.in/Amazon/En/Orders_details/01_19/
http://sizzlerexpress.co/Amazon/En/Clients_Messages/012019/
http://smkn.co.id/Amazon/En/Clients_transactions/01_19/
http://smsold401.smsold.com/Amazon/Orders_details/2019-01/
http://smtp.stepoutforsuccess.ca/Amazon/Attachments/012019/
http://sofathugian.vn/Amazon/EN/Payments/012019/
http://sophrologie-untempspourmoi.fr/Payment_details/012019/
http://stats.sitelemon.com/Amazon/EN/Transaction_details/012019/
http://statybosteise.lt/Rechnungs/01_19/
http://stionline.com.ve/Amazon/Clients/2019-01/
http://sugar.islandeccsites.com/Rechnung/01_19/
http://tacticalintelligence.org/Rechnungs/01_19/
http://temptest123.reveance.nl/Amazon/Clients_Messages/01_19/
http://test2.flyingsteel.com/Rechnungen/012019/
http://thebitcoinengine.crownmanagers.com/Amazon/Attachments/01_19/
http://thegablesofyorkcounty.com/AMAZON/Payments_details/01_19/
http://themanorcentralparknguyenxien.net/Amazon/Orders_details/012019/
http://themoonplease.com/Amazon/Clients/2019-01/
http://topablaze.com/Amazon/En/Clients_Messages/01_19/
http://toshitakahashi.com/Rechnung/012019/
http://towerchina.com.cn/Information/012019/
http://truongland.com/Amazon/Clients_Messages/2019-01/
http://tubiepornhub.com/Rechnungs/012019/
http://tunerg.com/Rechnungen/01_19/
http://turkishlanguagecourse.com/Amazon/Transaction_details/012019/
http://ufa.planetasvet.ru/Transaktion/012019/
http://ulco.tv/Details/2019-01/
http://undlab.com/wp-admin/Transaction_details/01_19/
http://valleyciaabogados.cl/Transactions/01_19/
http://vnxpress24h.com/Amazon/EN/Transactions-details/2019-01/
http://voldprotekt.com/Amazon/EN/Information/01_19/
http://web.pa-cirebon.go.id/Rechnung/012019/
http://webview.bvibus.com/Amazon/EN/Transactions-details/2019-01/
http://wellnessworkshop.ie/Amazon/EN/Clients_transactions/012019/
http://welna.com.au/Amazon/Payments/012019/
http://wp.corelooknung.com/Documents/2019-01/
http://www.2benerji.com/Amazon/Transaction_details/012019/
http://www.agentfox.io/Amazon/EN/Transactions/01_19/
http://www.aramanfood.com/Rechnungen/01_19/
http://www.ayokerja.org/AMAZON/Clients/012019/
http://www.belovedmotherof13.com/Documents/012019/
http://www.brasileiras.pt/Rechnung/01_19/
http://www.cbhrmf.com.br/AMAZON/Information/01_19/
http://www.comparto.com.br/Amazon/Clients/01_19/
http://www.cop-rudnik.pl/Amazon/En/Attachments/012019/
http://www.cqibt.com/Clients_information/2019-01/
http://www.drinkdirect.co.uk/AMAZON/Orders_details/01_19/
http://www.ema2-medea.com/AMAZON/Payments_details/01_19/
http://www.emmanuelboos.info/Documents/01_19/
http://www.ermaproduction.com/wp-content/Clients/01_19/
http://www.faszination3d.de/Documents/01_19/
http://www.iain-padangsidimpuan.ac.id/Payment_details/2019-01/
http://www.idgnet.nl/Amazon/En/Transaction_details/012019/
http://www.infocentertour.ru/Attachments/2019-01/
http://www.lagis.com.tw/ktPF-Fc8Pm_heXXiUK-HWE/Clients_Messages/012019/
http://www.leg4.ru/Amazon/Clients/012019/
http://www.logopediaromaeur.it/Clients/2019-01/
http://www.makemoneysource.com/Amazon/En/Transactions/012019/
http://www.markerom.ru/Amazon/En/Clients/2019-01/
http://www.matchapai.com/Amazon/Transactions/2019-01/
http://www.matm.uz/Amazon/Transactions/012019/
http://www.midts.com/Amazon/Payments_details/01_19/
http://www.motoruitjes.nl/Amazon/EN/Transactions-details/01_19/
http://www.ozawabag.shop/Amazon/Documents/012019/
http://www.polatlimatbaa.com/Payments/01_19/
http://www.pro-ind.ru/assets/Amazon/Documents/012019/
http://www.reparaties-ipad.nl/Rechnungen/01_19/
http://www.rokiatraore.net/Transaction_details/2019-01/
http://www.rossiodontologia.com.br/Rechnungen/01_19/
http://www.tbssmartcenter.tn/Amazon/EN/Clients/2019-01/
http://www.themoonplease.com/Amazon/Clients/2019-01/
http://www.ukmc.lt/Attachments/01_19/
http://www.ul-print.ru/Amazon/En/Information/012019/
http://www.web.pa-cirebon.go.id/Rechnung/012019/
http://www.wholehealthcrew.com/Amazon/Documents/01_19/
http://www.xn----7sbabof2ac4chjkhgcg5e1i.xn--p1ai/Amazon/Orders-details/01_19/
http://www.xn--d1albnc.xn--p1ai/Rechnung/01_19/
http://www.yarri-mebel.ru/Information/01_19/
http://www.zonnestroomtilburg.nl/Amazon/EN/Orders-details/012019/
http://xn--80apaabfhzk7a5ck.xn--p1ai/Rechnung/01_19/
http://yandexalfa.ru/Transaktion/012019/
http://yarri-mebel.ru/Information/01_19/
http://zeelearn.co/Transaktion/012019/
http://zentera93.de/Transaktion/01_19/
http://zhesa.ir/wp-snapshots/Amazon/Clients_transactions/01_19/
http://zidanmeubel.com/Amazon/EN/Payments_details/012019/
https://ketout.com/Attachments/01_19/
https://linkprotect.cudasvc.com/url?a=http://www.lagis.com.tw/ktPF-Fc8Pm_heXXiUK-HWE/Clients_Messages/012019&c=E1i65uF2KqLJNDm8HAElIklq0Ipvats29X7_ZplT3FTcWT7nmPwLNMyLWknhRH6r2cdw92sRjLZxpygJt37nor2tLVqPfRHWfnnl4fqGtE4RM&typo=1/
https://printhousebg.com/Amazon/En/Information/2019-01/
https://register.srru.ac.th/Amazon/EN/Transactions-details/2019-01/
https://u4124863.ct.sendgrid.net/wf/click?upn=eh9ClvIm7G7bZ30e4T0-2BXeBGvHmXfvV3h8tQ2zucmrIpE3T4dDxLPjk06TIvrVm4yS46xr0nhv-2BRjNcAij90tA-3D-3D_xctnYg84w5dxAEIqlKwfAPMaFcwX-2BvqrbGPc2AtERUBWzHqvIT6k-2Br-2F-2BrTFXH30SNualkInsFl4kpjXolz1pDKeYin09j-2FEubfJTzFhwOMu5oue5PkZ1ZFmH7rUIdUkez3mTRhDSR7LSdjzJe7kX1K2CA4LRWk-2FqB27r26sqioe3dlQep0gTtoPFvd9UDN-2FKyX1wGC8e76w2wvEwgP76sLkPurQN5-2BQFzDYYjtmDPZw-3D/
https://u5184431.ct.sendgrid.net/wf/click?upn=WPE4Fdem1KeYGRlXyJBsyJCessoFpRKsFM2NK6cmH1rEKxk5JgbBTBg7j0WDEQgBPixS5vaIaTpWWl9dIfz1DC8uX1S-2FXre9kQql4lAiBCU-3D_X0evSHGxGTwNysm1g6J8lT06e-2BoXkO14az5skvD7zf-2BZJtBghRAwT9gcHhZEdupg0pILOkyaNck2093dw43Tk-2FEBJgVnBEJzmLzWFFtaxgLU6ClVTuF0bl80zJpg1z6FgynXwBkq7DtgkJdt8HTmAJ7TnQ30MT0cqQGEfibrjcEcgfwZAIWjOS3NGzs2G5SNDaExwulxRO1icOeFU6cxYg-3D-3D/
https://www.activartcompany.it/Amazon/EN/Information/012019/
https://www.drinkdirect.co.uk/AMAZON/Orders_details/01_19/


```
#### Epoch 2 Document/Downloader links seen for 01/16/19 ####
```

http://1348photo.com/LERESUZ7074814/Dokumente/Hilfestellung/
http://3dyazicimarket.com.tr/mJAog-5QA5_bMeo-wDQ/PaymentStatus/En_us/Companies-Invoice-3933304/
http://admaacademy.sk/DE/UCUORDYIJ7907481/Dokumente/DOC-Dokument/
http://alfa-design.pro/iVMUb-7u2tt_tBrIeWLTi-Dy/ACH/PaymentAdvice/US/Outstanding-Invoices/
http://alkamaria.net/OWyY-H3_dpfe-xpu/HS13/invoicing/EN_en/Service-Invoice/
http://altitudeevents.co.za/nTnm-z5T_iWwVZ-ALp/Southwire/OTB308513366/US_us/Outstanding-Invoices/
http://altovahealthcare.com/wp-content/uploads/LEbQl-QJBK_YBDiMYAI-Bqt/PaymentStatus/US_us/Past-Due-Invoices/
http://amlgroup.in/VYoh-zRD_IdvTAtLBi-aU/EXT/PaymentStatus/En/Paid-Invoice/
http://anthinhland.onlinenhadat.net/RzkLF-bYRdx_CERbZsF-dQq/EXT/PaymentStatus/En/Invoice-3947016/
http://antique-carpets.com/De/LDKQDUHSA3654559/Rech/Zahlungserinnerung/
http://ar.caginerhastanesi.com.tr/qYrM-Ld6_bZVB-u8Z/Inv/897231384/En/7-Past-Due-Invoices/
http://askhenry.co.uk/blog/upload/XXVi-M0_IFXlBAFq-eP/B59/invoicing/En/Inv-370016-PO-3V695093/
http://atkcgnew.evgeni7e.beget.tech/PbIZ-L6l_dFqg-wU/Inv/498883721/En_us/Open-Past-Due-Orders/
http://avasri.ir/ghjvx-xIHs_HJ-17Q/En_us/Overdue-payment/
http://avto4x4.ru/DE/HJSEEJTFA1293851/de/Rechnungszahlung/
http://b2b.supernova.com.tr/DNHKTRWBSR0640557/Dokumente/Zahlungserinnerung/
http://balancedmindus.org/FCLvq-kk_ybcgT-yl/En/Service-Report-76163/
http://bem.hukum.ub.ac.id/VDTDCC2636944/Scan/Rechnungszahlung/
http://bietthunghiduong24h.info/mGKr-ZRnV_Dg-OG/COMET/SIGNS/PAYMENT/NOTIFICATION/01/17/2019/En/Overdue-payment/
http://billfritzjr.com/DwrF-WNx8b_SbJm-ec/US_us/Outstanding-Invoices/
http://black-friday.uno/zMoE-Dr_aWjGv-fkG/INV/7473201FORPO/86689225664/US_us/Paid-Invoices/
http://bomedmobilya.com/UTKPNADYDA3279925/Rechnungs-Details/Hilfestellung/
http://buld.ru/yElYL-uCgY_nUfZeq-8d/848018/SurveyQuestionsUS/Important-Please-Read/
http://camisariaalianca.com.br/qTwM-FAVH_vjOSz-Xu/Southwire/KWP644293513/US/Scan/
http://cannabisenglish.com/Januar2019/RTWEKQO4171299/Rechnung/Fakturierung/
http://carolineredaction.fr/yFAst-RPio_lYsOD-775/Inv/19766194964/EN_en/Need-to-send-the-attachment/
http://cbc-platform.org/wp-admin/Januar2019/TADTTDKK5244246/de/Rechnungsanschrift/
http://cheapavia.ga/reyOG-iR_XOagihvFT-u3A/ACH/PaymentAdvice/US_us/Invoice-for-you/
http://chervinsky.ru/WSIBMHJNF2141241/Scan/Rechnungsanschrift/
http://citygroupkw.net/Januar2019/INFPPXH9980256/gescanntes-Dokument/Zahlungserinnerung/
http://client.ewc.com.ng/rYMib-pEPr_KS-OlR/Invoice/46818008/US/Invoice-Corrections-for-21/67/
http://clinic-1.gov.ua/DE_de/NDEAVSCIE4629249/Rechnungs-Details/Fakturierung/
http://como-consulting.be/dPZQ-t9Dxb_ENHWk-oC/InvoiceCodeChanges/EN_en/Invoice-for-c/u-01/16/2019/
http://condicioner-ufa.ru/DE/AUJSLFXO1452575/Bestellungen/FORM/
http://creationmakessense.com/DE/JWZWILOARB4701143/Rechnungs/Zahlungserinnerung/
http://dailylinhkien.com/QLIW-KbZR_sqFpDOo-uh/INVOICE/US/Service-Report-52060/
http://demo.aspenleafenergy.com/psZSe-nom_Fbiuf-8lB/047839/SurveyQuestionsUS_us/Question/
http://denleddplighting.com/oHQH-ww_S-utv/ACH/PaymentAdvice/US/New-order/
http://dev.umasterov.org/ignY-ki_SFuBIfSG-x3f/INVOICE/93695/OVERPAYMENT/EN_en/Outstanding-Invoices/
http://dichvuso.edu.vn/jWAAp-yT_uygp-iFj/ACH/PaymentInfo/EN_en/Overdue-payment/
http://djeffares.com/DE_de/ZXOAIDOW7376411/Bestellungen/Rechnungszahlung/
http://doctor.fpik.ub.ac.id/FBKvd-WZ4Nv_FQJTK-TC/SB82/invoicing/US/Scan/
http://doraya.eu/ApOC-sRx_LP-uEc/INVOICE/En/Invoice-for-you/
http://drapart.org/hofB-8tqH_dLCiRAN-DOS/INV/13307FORPO/5465530477/US/Outstanding-Invoices/
http://eirak.co/otIY-0Ux_dVLq-Z2/Invoice/65232159/En/Outstanding-Invoices/
http://eliteseamless.com/pSRt-k0A_nAGh-zA9/INVOICE/70959/OVERPAYMENT/En_us/Past-Due-Invoices/
http://emsivab.se/JgnPi-2NK_oT-vc/19835/SurveyQuestionsEn/Scan/
http://enlightivebm.com/xgOYG-1w1AQ_akNq-AC/InvoiceCodeChanges/En_us/Outstanding-Invoices/
http://estab.org.tr/DE/AZORVICMH7935587/DE/Zahlungserinnerung/
http://etihadinnovation.com/wJrin-EO73J_fORDhh-lOu/ACH/PaymentInfo/US_us/Service-Invoice/
http://etihadinnovationkit.com/Januar2019/OPPZMDQ7295655/Bestellungen/RECHNUNG/
http://etihadinnovationkit.com/Januar2019/ZSCZJSMFJR0996491/Rechnung/Zahlung/
http://etihadstartups.com/ylQm-Fl2_J-eO/0168853/SurveyQuestionsEN_en/Question/
http://etsybizthai.com/jdiZz-L86x_mPzcmNAF-TNJ/ACH/PaymentAdvice/US_us/Inv-12441-PO-8C586861/
http://euk.lt/DE/STYSLFYQKG0437773/de/DOC/
http://everythingfranklin.com/csaoN-un_xrIkgf-EO/invoices/3588/3696/EN_en/New-order/
http://excellenceconstructiongroup.com/HmmW-wPY_CSEtTDx-GRs/PaymentStatus/En/Companies-Invoice-31133887/
http://faauw6pbwze2.iepedacitodecielo.edu.co/aGVyD-t61_qbR-2A/InvoiceCodeChanges/En_us/Paid-Invoices/
http://favouritefashionhub.com/XbfNp-MMA_vCB-0l/INVOICE/39367/OVERPAYMENT/En/Past-Due-Invoices/
http://ferramentasubra.com.br/LTBiV-JzNNu_xHtPo-kC/INVOICE/US/Invoice-for-a/t-01/17/2019/
http://fidesconstantia.com/SxTDH-PxvK_Gsqdk-ge6/INVOICE/En/Past-Due-Invoices/
http://fira.org.za/rNTVM-Eb1_soYbTON-56/Southwire/GBY130159746/En/Scan/
http://firstoptionstrading.com/mDSN-CD_fuAJQ-7I/US89/invoicing/US/053-70-938322-852-053-70-938322-913/
http://fissionmailed.com/ogbpT-G5RN_FSWV-upg/ACH/PaymentInfo/US_us/Need-to-send-the-attachment/
http://ganic.be/LLkI-dX6EN_oeSmUxQ-ai/COMET/SIGNS/PAYMENT/NOTIFICATION/01/15/2019/En/Invoices-attached/
http://gephesf.pontocritico.org/De/BADMKD6453501/Rechnungs/Rechnungsanschrift/
http://glazastiks.ru/BAMXJ-YK_aGuzKvH-8XR/En_us/Companies-Invoice-7729809/
http://grantkulinar.ru/IkVs-kVdot_Yg-TB/PaymentStatus/US_us/Invoice-for-r/m-01/16/2019/
http://greenplastic.com/IlKI-qNW_GeAqCj-L7Q/En/Inv-35271-PO-2G659605/
http://gunk.insol.be/drupal-6.15/sites/default/files/De_de/WUILSXVJV9707369/Rechnungs/Rechnungszahlung/
http://hitechlink.com.vn/tmp/yUdX-ooV1T_REegxoY-vkh/Inv/305874329/En_us/Past-Due-Invoice/
http://hjsanders.nl/FuXs-mD_bEJ-tK/InvoiceCodeChanges/En/Companies-Invoice-96944979/
http://hmao.planetasvet.ru/DE_de/JTDVKBXWVK9581104/Rechnungs-Details/Zahlung/
http://homeafrica.co.tz/PVAZYRR9694081/de/DOC/
http://house.testmonday.com/Januar2019/WDADHUUPG7241677/Rechnungs-docs/Hilfestellung/
http://i-deti.ru/zVkVS-mOO_NGlD-qK/EXT/PaymentStatus/En_us/Overdue-payment/
http://immo-en-israel.com/gekYf-6B_vTnVAh-y6X/EXT/PaymentStatus/En/Need-to-send-the-attachment/
http://insecovietnam.com/UilE-lVBCO_XIZd-cNb/INV/037768FORPO/0253487417/EN_en/Scan/
http://inventivesports.net/tBbFo-HL6VB_ysaPDw-kSq/Southwire/ZOE24822138/EN_en/Invoice-for-v/d-01/16/2019/
http://ipeople.vn/DE_de/OYAGWVN8100931/Scan/DOC/
http://ipf-isol.pt/Januar2019/PKYWAY5135149/de/DETAILS/
http://ip-tes.com/Dmyh-mMBJE_NVtzfbHtL-7N/455929/SurveyQuestionsUS/Invoice/
http://irsoradio.nl/Ayjd-Q1BIF_CdgjH-FG/INVOICE/16523/OVERPAYMENT/US/Past-Due-Invoice/
http://isikbahce.com/sHKfq-PQ_iSVlaWS-b3h/08335/SurveyQuestionsEN_en/Invoice-42509324/
http://itp25.com/de_DE/DRIZICTI7514162/Rechnungs-docs/RECH/
http://iw.com.br/vGHcn-Ms13_EoDObV-APX/ACH/PaymentInfo/US/Open-Past-Due-Orders/
http://jaspinformatica.com/LFcf-6Ih_UVlhKQzMn-68/invoices/6298/50669/En_us/Invoice-for-d/e-01/16/2019/
http://jenfu.net/de_DE/PHPVQLJJ5927086/Rechnungs-Details/Hilfestellung/
http://johnnycrap.com/wIBs-K3SSq_ZZuRIQXdl-sTp/Invoice/71459672/En/Invoice-receipt/
http://k.iepedacitodecielo.edu.co/EbgYI-AR21z_La-O5r/INVOICE/7541/OVERPAYMENT/En_us/Paid-Invoice-Credit-Card-Receipt/
http://kamdhenu.technoexam.com/VAjLO-ptA9c_OBHskw-Wz/INV/0546376FORPO/0793060258/EN_en/Sales-Invoice/
http://kamprotect.ru/LADYAAXA7639399/Dokumente/Rechnungsanschrift/
http://kcespolska.pl/De/IYBFFEJT3289859/Rechnungs/Zahlung/
http://korbi-studio.com/bsFe-kLt_lUWpexA-M6/Ref/3786979734US/Invoices-attached/
http://kuhniviva.ru/SDVn-8B_M-Mjo/282349/SurveyQuestionsEN_en/Service-Invoice/
http://lapontelloise.fr/OmCL-PyU_IuFoY-Vc4/INVOICE/7487/OVERPAYMENT/En_us/Invoice-receipt/
http://lapsoinmobiliaria.com/mQRFa-LKCJC_sl-tGj/US/753-43-672323-659-753-43-672323-244/
http://lassmeder-service.com/BYTVPDJGYA8152756/Bestellungen/RECH/
http://leg4.ru/sRQAC-4Nj_Jzr-6N/ACH/PaymentInfo/EN_en/New-order/
http://liarla.com/xoozT-AEUvv_lMHMJuaT-4Sk/ACH/PaymentInfo/US/Invoice-Number-919134/
http://life-and-spice.com/UQVVCLISH1323826/Rechnungs-docs/FORM/
http://livechallenge.fr/jmjcC-fQB_py-P6A/COMET/SIGNS/PAYMENT/NOTIFICATION/01/16/2019/EN_en/Invoice-7465831/
http://lokanou.webinview.com/deCxr-jH5_cCmSmiG-xr/INVOICE/US/Service-Report-0658/
http://lokeronline.net/jaoR-MhPV3_VpV-4H/PaymentStatus/En/Open-Past-Due-Orders/
http://maf-orleans.fr/XJWI-432_EN-vF/Inv/866847583/US_us/Open-invoices/
http://mail.be-mup.com/WvaQ-SmW_GAkfjGyE-no/ACH/PaymentAdvice/En/Invoice-for-v/a-01/17/2019/
http://mail.komunalservice.am/lISss-KwD2A_vzGvIRzZv-Sbh/Southwire/GXW3822620926/En/New-order/
http://mail.mtcc858.ca/AUPdJ-2Ed_zvCHEsG-tU7/INV/95995FORPO/81050853735/En_us/Sales-Invoice/
http://mail.stupidhead.tk/ryWl-g1Z_BqOPbk-Eo/Ref/6404039609En_us/Invoices-attached/
http://makeupbyolivia.co.uk/wSgC-LMgP_b-k0n/invoices/04514/99848/EN_en/Open-Past-Due-Orders/
http://mandalafest.com/JgvE-JcrP_Xl-BU8/Southwire/WPL02170711/US_us/Invoice/
http://mange-gode-blogs.dk/Rpav-scj_mp-LrB/INVOICE/US/Open-Past-Due-Orders/
http://marisel.com.ua/De/FULYJPW9172244/GER/Zahlungserinnerung/
http://marsandbarzini.com/FBFd-8nMwX_LkGU-rm/Ref/9728954851US_us/Need-to-send-the-attachment/
http://mauriciogomezjaramillo.com/bnGWE-7URZ7_eRwkBvByF-62/ACH/PaymentInfo/En/New-order/
http://megascule.ro/BwGE-JO_kiM-qq/Invoice/7478991/En/Service-Invoice/
http://michelinlearninginstitute.co.za/VtXAX-FUy_P-8H/CG234/invoicing/EN_en/Paid-Invoices/
http://miketec.com.hk/OOkz-skFh_sZHMMFygO-fp4/ACH/PaymentInfo/En_us/Paid-Invoices/
http://millennialsberkarya.com/wp-admin/js/widgets/Ecdb-pbH_lgrKq-nj1/8479439/SurveyQuestionsUS_us/Invoice-Corrections-for-98/45/
http://modalook.com.tr/cSsTJ-U4uG_oRVOUK-ACD/Ref/6260533274En_us/Invoice/
http://modelgenesis.com/De/MLAXWYUOMW8123967/de/FORM/
http://modern-autoparts.com/Januar2019/MOOOHAI9601427/gescanntes-Dokument/DOC/
http://molloconsulting.co.za/UxgjI-5m_NTOBSlTBU-FkV/EN_en/6-Past-Due-Invoices/
http://monrottweiler.fr/hcMwq-8qZzz_MItp-YG/Southwire/UTD940213930/US_us/Outstanding-Invoices/
http://mozaland.vn/jptd-7Qea_j-F5/Ref/1062871160US_us/Past-Due-Invoice/
http://mufakkir.com/HvfI-F8Qxb_pTMhJMLJA-hG/Ref/249401426US/Invoice-24326442/
http://needrelax.ru/ZyNJL-DY0Pu_dLhK-vTp/ACH/PaymentInfo/US/Open-Past-Due-Orders/
http://nghiataman.com/fXxkV-bTXQS_pOhYM-7ee/EXT/PaymentStatus/EN_en/Paid-Invoice-Credit-Card-Receipt/
http://ng-tech.ru/xVhG-gt7a_LB-E8/Invoice/619377086/US/Question/
http://nhakhoavieta.com/iFWJ-bO_buV-aB0/En/New-order/
http://nsktech.fr/cvvWO-7T_Dpa-52/60131/SurveyQuestionsEn_us/Invoice-for-you/
http://oceangate.parkhomes.vn/DE_de/PDYIKWOT9286173/Rechnung/RECHNUNG/
http://oculista.com.br/ukVR-MQCGo_EhieG-Ids/Ref/4814411604En/ACH-form/
http://oculista.com.br/XTrf-wwKF_YilnCf-ZO2/US/Overdue-payment/
http://odina-logistic.com/DE_de/ZVIKEWOQ1512050/Rechnungskorrektur/DETAILS/
http://old.tsn-shato.ru/de_DE/VEEVGMO4349541/GER/RECH/
http://ontamada.ru/Januar2019/KGFJIA2987254/Dokumente/Rechnungsanschrift/
http://or-iraq.org/adeZG-NvIbd_EStHii-BSb/INVOICE/66893/OVERPAYMENT/US_us/Invoice-for-s/h-01/17/2019/
http://outdoorhikingtrek.com/cWdE-rEcET_FNJnRpLj-39G/3612847/SurveyQuestionsUS_us/Past-Due-Invoices/
http://pastorsimeon.com/ZXVKI-X4e3P_t-97L/Invoice/8479740/EN_en/Past-Due-Invoices/
http://pcengine.ru/zVpXy-rxw_TcJA-1F/Z913/invoicing/US/Invoice/
http://phelieuasia.com/iUWD-AY_EIfZ-afg/Inv/35896259620/US_us/Invoice-Number-448033/
http://phihungmobile.net/Januar2019/MXSVAX4507556/DE/Rechnungsanschrift/
http://pinaster.pl/de_DE/RMRQXUBU0844374/DE_de/Rechnungszahlung/
http://pivmag02.ru/PDLQi-9H7za_LGB-oc/Ref/59544797US_us/Need-to-send-the-attachment/
http://pojbez31.ru/De_de/HLZWYP1604214/de/RECHNUNG/
http://privatetoursriodejaneiro.com/rIZMn-hhvu_x-z7/PaymentStatus/US_us/Open-invoices/
http://proserempresarial.com.mx/UVDCL-sEqb_z-fn/INV/46137FORPO/5825406314/US_us/Invoice-23324505-January/
http://provillus.biz/beta/De_de/FWYWXO4725041/Rechnung/RECH/
http://purifiq.co.za/tSOD-ta1W_cTJN-9aH/INVOICE/US_us/Invoice-0326887/
http://pwpami.pl/myUlP-pr_SxfpDKR-zL/Southwire/QBX924743500/US_us/Paid-Invoices/
http://rahkarinoo.com/whpEb-4sO_udvFbMgMr-jAT/INV/76841FORPO/40533191131/En_us/Outstanding-Invoices/
http://rapport-de-stage-tevai-sallaberry.fr/JhJNV-XU1_TLkwwer-W8s/Inv/065743170/US_us/Invoice-receipt/
http://rastkultur.de/PxHnN-t0yC_fTwGCXIrk-v5/COMET/SIGNS/PAYMENT/NOTIFICATION/01/16/2019/En_us/3-Past-Due-Invoices/
http://rccgregion15juniorchurch.org/ZBlPX-Wtc_BRf-i7/Ref/85034926US_us/Question/
http://realistickeportrety.sk/de_DE/HRJFTKZNHQ4922711/gescanntes-Dokument/Zahlung/
http://rosimpex.net/OQURYVU5178922/Rechnungs/Fakturierung/
http://rossiodontologia.com.br/fJaR-zFFpoSItWDqtueL_DUQUyDEv-sF1/
http://routetomarketsolutions.co.uk/wZUlb-RFYxk_hJFlpgCig-MF/InvoiceCodeChanges/En_us/Paid-Invoices/
http://runtah.com/De_de/LTRUAFMY3068566/DE/Fakturierung/
http://sahlkaran.com/JztlU-mv_PNWYyahoK-Mk/InvoiceCodeChanges/En_us/Paid-Invoice/
http://saintjohnscba.com.ar/Januar2019/DFTPHAQLL6932712/de/RECH/
http://sathachlaixebinhthuan.com/sitefiles/yfNKvSgfi/NCpNo-ft8Ip_Ql-Arq/EXT/PaymentStatus/EN_en/Invoice-for-j/g-01/16/2019/
http://seomood.swhost.pl/OtxkU-v7vw_k-HT/Invoice/369532344/En/New-order/
http://shlifovka.by/de_DE/VJDCNOIN0671082/Dokumente/RECHNUNG/
http://shot-life.ru/DE/LGVGPU5328119/Rechnungs-Details/Hilfestellung/
http://snkpk.fkip.uns.ac.id/zGmR-NK_ZgaPeVmg-er/COMET/SIGNS/PAYMENT/NOTIFICATION/01/15/2019/US/Service-Invoice/
http://soloftp.com/HDIFV-71Q_qV-YR/I352/invoicing/US_us/Service-Invoice/
http://solusiobatherbal.com/De/LTCYKBNJE5969176/Rechnungs-Details/Rechnungsanschrift/
http://solverpropaganda.com.br/de_DE/FYOICVFXR4196590/GER/Rechnungszahlung/
http://songlinhtran.vn/XCGWN-wc1H_pwyJ-Wu/EXT/PaymentStatus/EN_en/Overdue-payment/
http://sosh47.citycheb.ru/De/HJCIFKKG7114659/Rechnungs-Details/Fakturierung/
http://souqaziz.com/nQXXR-yM0C_ehMzsVJUs-Nu/ACH/PaymentAdvice/EN_en/Invoice/
http://southernthatch.co.za/hooxI-o2_oOQrN-vl/Southwire/MJN77267539/EN_en/Document-needed/
http://squawkcoffeehouse.com/Ecdn-0duqc_hkW-ZK3/EXT/PaymentStatus/En_us/Paid-Invoices/
http://stal48.ru/DE_de/IMFCLKMPFT0728555/Dokumente/Zahlungserinnerung/
http://standart-uk.ru/rRNb-SmEXz_c-b0F/40041/SurveyQuestionsUS_us/Scan/
http://standart-uk.ru/ZWLxq-Vw_YkYLrI-K6/Ref/3246030544US/Invoice-for-you/
http://stats.emalaya.org/KDPfP-vYc_VbAktoyl-2e/476308/SurveyQuestionsUS_us/Open-invoices/
http://storylife4you.com/AUQfG-1J_nI-pG/INV/191542FORPO/159688852097/US_us/Past-Due-Invoices/
http://stoutarc.com/De_de/VTVKAUWC3556017/Rechnung/RECH/
http://swanpark.dothidongsaigon.com/kJcGo-4x_YOOprAfa-Oo/ACH/PaymentAdvice/US/Outstanding-Invoices/
http://symbisystems.com/fzCwM-0s_bzzNowj-HL/Inv/02980941852/US/Paid-Invoice-Credit-Card-Receipt/
http://tajiner.com/ZWqP-zWr_rPDfhbnq-lD/ACH/PaymentInfo/US/New-order/
http://take-one2.com/De_de/TBTFWHXEXU1672337/GER/Rechnungsanschrift/
http://tc-jaureguiberry.fr/hJYqJ-xUD4g_ylVrS-SH1/EXT/PaymentStatus/En/Important-Please-Read/
http://teacherinnovator.com/wp-includes/hRTCH-0R_jlZQcD-mQ8/O788/invoicing/En/Paid-Invoice/
http://teamphgermany.org/WAtXg-ELk6b_qxGS-Wx/J36/invoicing/En/Open-invoices/
http://tec-auto.org/lbypS-tQ_ZnLTk-yT/Inv/64718210754/US_us/Outstanding-Invoices/
http://thamtuquocte.com.vn/De/MWTDJB6346155/gescanntes-Dokument/Rechnungsanschrift/
http://thebitcoinengine.com/DE_de/POZHZUX7044772/gescanntes-Dokument/Rechnungsanschrift/
http://thelivingstonfamily.net/DE/EFFLWCZ2157103/DE_de/Fakturierung/
http://therxreview.com/DE_de/YVAMIGFXT1441342/Rechnungs-Details/DETAILS/
http://thorntonmanor.org/BMWW-OzMqZ_tl-GRQ/INV/633151FORPO/754870642714/En_us/Open-Past-Due-Orders/
http://tomopreis.nl/zaDye-atX_ECrToA-X8W/ACH/PaymentInfo/US_us/Invoices-Overdue/
http://torfsgebroeders.eu/jxvcW-5j7_FfHbDoyE-Zb/INVOICE/En/Document-needed/
http://translampung.com/Januar2019/KEBIGTLVY6527523/DE/Zahlung/
http://tritonwoodworkers.org.au/tbpDh-5E6X_ktcPl-1j/Inv/5972604980/En_us/Invoice-receipt/
http://tumbleweedlabs.com/DE_de/ONRMQGD6150428/Rechnungskorrektur/Rechnungsanschrift/
http://tver.planetasvet.ru/DE_de/OJLFHP4792745/Rechnungs-Details/RECHNUNG/
http://ukmc.lt/TcoSf-he9Pp_DpTzC-Ivu/Inv/7785759609/US_us/Paid-Invoices/
http://universobolao.com.br/HpZjv-4CQ_LXBEP-SmH/8246620/SurveyQuestionsEn_us/Invoice/
http://urbanaturefilmes.com/Hxee-xi7U_JtCz-X2/invoices/95240/15265/US/Invoice-for-i/g-01/16/2019/
http://vakschoenmakerijbolle.nl/De/OBSMQO8348602/Dokumente/Zahlung/
http://vansutrading.co.za/De/HJOYPWCG0150375/Rechnung/DETAILS/
http://waggrouponline.org/ApgMh-p5_TVgsoS-t2/En_us/Invoice-33755029/
http://web.pa-cirebon.go.id/De/NUIQFYX6511712/Bestellungen/Rechnungszahlung/
http://web63.s150.goserver.host/IuYWK-GT_y-jL7/EXT/PaymentStatus/US/Companies-Invoice-1236003/
http://welovecreative.co.nz/cIpE-slT_SsAsD-c9s/COMET/SIGNS/PAYMENT/NOTIFICATION/01/16/2019/En/Paid-Invoices/
http://weresolve.ca/gQce-5d_fcmkOlhM-IJw/U970/invoicing/US/Need-to-send-the-attachment/
http://wordpress-147603-423492.cloudwaysapps.com/bRXkQ-R2rsj_pbQikMBy-fD/PaymentStatus/En/Invoice-for-you/
http://www.3dyazicimarket.com.tr/mJAog-5QA5_bMeo-wDQ/PaymentStatus/En_us/Companies-Invoice-3933304/
http://www.abmtrust.org/QOSBH-T9_Xw-2f6/Inv/966600392/US_us/Invoice-for-p/i-01/16/2019/
http://www.antique-carpets.com/De/LDKQDUHSA3654559/Rech/Zahlungserinnerung/
http://www.avtotest-taxi.ru/esZlv-bgQ_jeUEA-ok/Southwire/QJT491798084/En_us/Companies-Invoice-1859353/
http://www.balancedmindus.org/FCLvq-kk_ybcgT-yl/En/Service-Report-76163/
http://www.caspiantourist.ir/DE/XHPJOE3790416/Rech/FORM/
http://www.citygroupkw.net/Januar2019/INFPPXH9980256/gescanntes-Dokument/Zahlungserinnerung/
http://www.droobedu.com/YTIyQ-4pgm_VtO-ilA/EXT/PaymentStatus/En_us/Past-Due-Invoices/
http://www.eclecticelectronics.net/de_DE/VTQJZEKWT6556816/Scan/Zahlungserinnerung/
http://www.etsybizthai.com/jdiZz-L86x_mPzcmNAF-TNJ/ACH/PaymentAdvice/US_us/Inv-12441-PO-8C586861/
http://www.euk.lt/DE/STYSLFYQKG0437773/de/DOC/
http://www.festivaldescons.fr/XKKtt-8k_YRYOoQpWv-Sw/INVOICE/01359/OVERPAYMENT/En/Overdue-payment/
http://www.fissionmailed.com/ogbpT-G5RN_FSWV-upg/ACH/PaymentInfo/US_us/Need-to-send-the-attachment/
http://www.ganache.com.br/cArwR-cZUml_RB-olM/ACH/PaymentAdvice/US_us/Companies-Invoice-7507672/
http://www.grantkulinar.ru/IkVs-kVdot_Yg-TB/PaymentStatus/US_us/Invoice-for-r/m-01/16/2019/
http://www.hjsanders.nl/FuXs-mD_bEJ-tK/InvoiceCodeChanges/En/Companies-Invoice-96944979/
http://www.immo-en-israel.com/gekYf-6B_vTnVAh-y6X/EXT/PaymentStatus/En/Need-to-send-the-attachment/
http://www.ip-tes.com/Dmyh-mMBJE_NVtzfbHtL-7N/455929/SurveyQuestionsUS/Invoice/
http://www.ip-tes.com/hpp52ibi/kkPew-BvwoX_jDLmqsDmF-0Su/Southwire/NEN2883833917/EN_en/Need-to-send-the-attachment/
http://www.irsoradio.nl/Ayjd-Q1BIF_CdgjH-FG/INVOICE/16523/OVERPAYMENT/US/Past-Due-Invoice/
http://www.islandeccsites.com/iFPUj-M9_fmmiR-mTb/EXT/PaymentStatus/EN_en/Invoices-Overdue/
http://www.kiber-soft.net/HBIVS-wLe_bcgq-GN/invoices/0343/79616/EN_en/Invoice-2574066-January/
http://www.lapontelloise.fr/OmCL-PyU_IuFoY-Vc4/INVOICE/7487/OVERPAYMENT/En_us/Invoice-receipt/
http://www.lassmeder-service.com/BYTVPDJGYA8152756/Bestellungen/RECH/
http://www.leg4.ru/sRQAC-4Nj_Jzr-6N/ACH/PaymentInfo/EN_en/New-order/
http://www.life-and-spice.com/UQVVCLISH1323826/Rechnungs-docs/FORM/
http://www.makemoneyonline0.com/DE_de/ZQUBDQBRF4046755/de/Hilfestellung/
http://www.mother-earth.net/SlHp-fmGN_mRr-xC/INV/084073FORPO/57754571425/US/Document-needed/
http://www.needrelax.ru/ZyNJL-DY0Pu_dLhK-vTp/ACH/PaymentInfo/US/Open-Past-Due-Orders/
http://www.oculista.com.br/XTrf-wwKF_YilnCf-ZO2/US/Overdue-payment/
http://www.ongeveergratis.nl/FDUTNYOQJZ5768806/Scan/Zahlungserinnerung/
http://www.pinskcmm.com/FUOU-Bhk_zeDBlVL-6hE/Southwire/WQL43140957/US/Open-Past-Due-Orders/
http://www.pojbez31.ru/De_de/HLZWYP1604214/de/RECHNUNG/
http://www.pugliachebonta.it/DfXp-XIlA_vLnRIp-Y3/En/Service-Report-41623/
http://www.purifiq.co.za/Ygnpo-xf_MsYdHz-8J/ACH/PaymentInfo/En/Companies-Invoice-8031185/
http://www.pwpami.pl/myUlP-pr_SxfpDKR-zL/Southwire/QBX924743500/US_us/Paid-Invoices/
http://www.seslibiri.com/ujTD-spb15_yKXq-tc/INVOICE/6943/OVERPAYMENT/En/Invoice-79269863-January/
http://www.shengen.ru/sites/default/files/DE/RQTPJZ3882750/gescanntes-Dokument/Rechnungsanschrift/
http://www.soloftp.com/HDIFV-71Q_qV-YR/I352/invoicing/US_us/Service-Invoice/
http://www.solusiobatherbal.com/De/LTCYKBNJE5969176/Rechnungs-Details/Rechnungsanschrift/
http://www.somerset.com.ar/wp-content/uploads/rwfHa-qjoL_jiYLYXfo-Pv/INV/3765841FORPO/8505566790/EN_en/Invoice/
http://www.sos-secretariat.be/IALrl-yO_a-CP/ACH/PaymentInfo/En_us/New-order/
http://www.standart-uk.ru/rRNb-SmEXz_c-b0F/40041/SurveyQuestionsUS_us/Scan/
http://www.standart-uk.ru/ZWLxq-Vw_YkYLrI-K6/Ref/3246030544US/Invoice-for-you/
http://www.straipsniukatalogas.lt/de_DE/BAJCRK5576717/Dokumente/Hilfestellung/
http://www.suvenir-maykop.ru/Nzydl-DRa_kGNBYX-5Qq/Southwire/QIT9760639977/En_us/Invoice-3852200-January/
http://www.tag.ir/rMTu-te1DJ_bfmkKC-tF9/Ref/25027654En/Inv-373736-PO-7Q385560/
http://www.wins-power.com/xwMxP-QIdi_svovMFFa-n8/EN_en/Invoice-Number-293599/
http://www.xn--dh-fka.at/kDrgh-niwT_emq-WY/Southwire/HLC97630028/EN_en/Important-Please-Read/
http://www.yourroofer.co.uk/lhqBW-xBf_rjfKGVK-7d/Ref/40745794US/Overdue-payment/
http://yjwan77.dothome.co.kr/DE/RXAIJF6696778/Scan/RECHNUNG/
https://gtp.usgtf.com/BpSK-eVob_SYUodc-fW/Southwire/FKS561573287/EN_en/Need-to-send-the-attachment/
https://itp25.com/de_DE/DRIZICTI7514162/Rechnungs-docs/RECH/
https://lapsoinmobiliaria.com/mQRFa-LKCJC_sl-tGj/US/753-43-672323-659-753-43-672323-244/
https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fsahlkaran.com%2fJztlU-mv_PNWYyahoK-Mk%2fInvoiceCodeChanges%2fEn_us%2fPaid-Invoice&c=E15BuRuU0mTeP5YfrkEsnAhzwa54ZP1ZYbQUAt8w7IrO4Fheu7D8bRrd8I_8Lqvtc7EmuC6uihZWN_WVN5AqQ4CGuNG46Y1lr15eTBmcMFll25&typo=0/
https://mandrillapp.com/track/click/30927887/firstoptionstrading.com?p=eyJzIjoieUxwd0FWZG9kTDF6cFJPRWtnLUthRk5SZFB3IiwidiI6MSwicCI6IntcInVcIjozMDkyNzg4NyxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZmlyc3RvcHRpb25zdHJhZGluZy5jb21cXFwvbURTTi1DRF9mdUFKUS03SVxcXC9VUzg5XFxcL2ludm9pY2luZ1xcXC9VU1xcXC8wNTMtNzAtOTM4MzIyLTg1Mi0wNTMtNzAtOTM4MzIyLTkxM1wiLFwiaWRcIjpcImZkZWQwMTc3ZmYzZjQwZWRiZGJmY2I2NjM1ZWE0ZjNkXCIsXCJ1cmxfaWRzXCI6W1wiN2RhMmM4MTIwNjkyMDEyMmYzNzU1MGQ4YzE1Y2YwZjYzMDBkM2E0YVwiXX0ifQ/



```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-01-16 21:24:00		(ENG - Light Blue/White)
SHA256:
c63b801b73ffc4397fcd7f78b2c3658ef29751e6dc84ff1468dc9068cf237a42
b5bf06fae173a18e200d6f62b55afc01d5719fed8daddedeec10d4a4b64f730b
3a39fb46a23ac953978510542c4ae8e2ad5adacf5fad91c5c0798936afff610e
9e91a755801befbafb21e9cf856ceac1c30efc4f388fa206d27fc5802ee30f18
0c6a36a40072fb7c19dc4bbfc52213683f3e84352ced38913c7c68671d636b3b
c8c377ef7ef9ea6942670a70c1d67036154cae97c744101067098063273fbccd
ee708209dc15f97f290e490bcc1bd29a1c3e5bd8474763e710bf7c32d780495f
81cb2e76a9e8122160afa0b6e7808e8a4027082707d6c748ec3381388af93e20
70ccf66a0e2b6c511f288a5aedb709debfcd5c3284c5985ae97652c80864d1ce
6a40d10ae0de295821136f7b68a3b50b0b0a21549e3c0a4c08105d200855779a
70fa77ffc64959f501bb8222a513294c53be954e854786fc136e38e5c16bd0aa
8f508f76ea66c35d67025c9f47701774cf7636431071f11bbf6ad89773397676
f490c06863cdadb5d2355ca8207b1ce58f04c6e5b537ad365c9f8596702eea1a
351defa63a0cdf2185222d7b909e7d5eb3ee4589a003773fcd1e2be896c46b70
59713b550f8c9dd92f03b83ed65318494064520fbc5b3a8137819b24f665117e
ee1ec78af15b765bd7f51aef2bbd42b4f82f0270fc1eca08f7c7225d30152911
3cfcbd443d75c7462d7a8fe19b98782e7d857991732ba7797233b9c7bf9f2b37
530e71f81673350630319346fe5828f2178bc51c6eafebf1a7c0a4e65016b4cd
058b080d6bebadccd475d28755250ad1eacb76f4cd272d8ca0de32d1fb08e2e0
75833f71ae2bb2a65c298a127cae4825ead3937ea30fccb243083352be678094
9a8300e977e7198fd9ed2679f16420c4d0b1dac2f16d3d74825289a4580757f0
254dfb21f1f3dbfd25545b97ca78aa839027dcb4214a131765c77ab57dcbd285
98b0aa071c0db90f5301c024e69e852ceb959b1739d9df685e254d22317f5b05
1f5e0f8451c56dc7195e78962d0c53bf7f81640118652313cd546a0d7dce2183
8e8e679ca81f4edc61e1389c2c5896ea54e322f4c43c901c961b38297a313e6d
1695f99f49247ad1de56df3b848dfd142ca30c5755a6cd05b799abf5212a665f
356f81da93971113ef694fe45b1cd40bd6c6cb74b2be7a60868a9e305fc57c4e

http://samix-num.com/BcFUhvDr/
http://economiadigital.biz/NKq5eOZ/
http://ftp.dailyignite.club/YNB95t2/
http://migoshen.org/FNE1TVJjI/
http://vanoostrom.org/w8yXb69h5/

Creation Time	2019-01-16 18:53:00		(ENG - Light Blue/White)
SHA256:
aad9de8455f68c334712f34963d5cdf6eac9b69d7551a4fd65d846f2848f5808
a39bd381240ffd808819d18391c240889f6bed804c7be12b64804b71bc528e3c
70cec61e434ca3ae4b62ae008512a4e9a3e88e909b121e5612d1ec8cfe1718ef
8c06cea5268701167af170e864be0b7925a8200ecadd4079ad1067bf0873d1d3
e8f6fab27c8eba3c65433ccaab81ce48275a83538add0de346065c20af276b39
ee16ca881002c72e7d6df51bd757faa358d411b798dc4a1ab0d0e9360ba5177c
ed460a6be43aafdd964fc75159f4b43ac7dfeaf9b33eb9ebc2efd5f7f00f2096
1d3946baa51dcf47be73747530c8044f86d958b279b64a686f444617e5e65436

http://waliwalo.com/Y6o7VhuKPU/
http://advantechnologies.com/fTkdPAD/
http://www.emmanuelboos.info/7uQz6s6uq/
http://affinity7.com/SM93gJVMw/
http://titheringtons.com/85qJTUNyL/

Creation Time	2019-01-16 16:46:00		(ENG - Light Blue/White)
SHA256:
7dd16131c2957fa5eb210f1b4de42e6d4cdd37bf0f783d56fb4f995214767743
157ed6528400612ce534b91a4e164b80e0dfa1cd868f98590d0b8b52a55e2136
2e0aa06a02c3eb0040f1e8cbe7f3146ed3f9c237909a16d33163fe0dbce5ec32
f5a3c7c73bcf3833808d643a9c9644c360aff6f64b9e68d2ed01f6273d2a681e
993ab200c47ec328795227f68cd6d2268c196e24a77047e72ac6ee455bde5861
394e5cb1ad0f367c0efe9d13ea082c0f332bcadcbc332a200e4df024b597d0f5
e6cdbf53407ae8abc5460a0bbbb62c79062c934e867adf9e8d9ccb3934a7e70c
5eab2dfc935e594c0d233893ad7f91d2e6c88543400d3bc394f6ccb96293334f
da085c78dfcd999c1ef8e5b2690b8c40ff47a2ed4a806f718c5e6675e6cfad3b
b7fca84768b87804f9ec01ca78693c5ebf134c321f901bcae1936af997ac5d5b
8d6b14b8a045a925543cda9588fe8f88ce80746393eb2c7968465d82b35ac9cf

http://www.vincopoker.com/01xNpqw/
http://matadorlovol.com/NRY3KXHi4v/
http://suglafish.com/fC0W6qf/
http://prakritikkrishi.org/83FMJzuWm/
http://almazart.ru/wzSetZjEe/

Creation Time	2019-01-16 11:40:00		(ENG - Light Blue/White)
SHA256:
be3b808db8d19be71e9b9d2109b65b7e48d1891c86813280851e5be7c50d60c0
24b035e1db6b53be081385b1c68d75c1d540f15df2cbc24a8dec21a7bac0df91
a6476aeb66f14121612f00bfed8004cc1bb236463e3f854c7128a9fcf3001e6b
f2d9dd503f6f96ebe5e0cd82b1f035e3321a2a8efd1eddeb126386dc73071312
b786a35504d7478115e8e9f04b9dd2e663ad22a25aa78b9b8c6c780640a3a5ca
8b6ca4cce9f7ac50ab370273c29e5057c4202a2be930aac43d87995157c8f318
e5fdfb17d2b72ae4e8853face57b4cf43c3c1060ec49db55e137fbee13ca7d4b
7dcb7f8c653d3f2787a11a1d88c0960e441f5e86b986e8d0b848d28ef7402509
cae227f92a8ffd799a4037239854cfcc22b2fb9c592da511674d310c7752f257
ffe1eab5fba3de0241b6ed61201773458f38adfc7703b5b79a717336fecaf129
14d519013033261cd44d7743c4cade46f437bcc49bf7de2e900d2dc00e0ba9ce
4b15a2278f84e1ab301de00a1eb5715cb861a004a5c71a564b1d941be263c67c
c5ab3988752d04b3c483bad60a407e386987790716aed72cf50d04a01d10bc47
bbf97afef49ea07292b158a7d94a639db9a4ebbbec4336326cd4eceb4ebe5f40
cd6cd7134a31917b06c189e824da71df48936fd1563bc2772ef509d29e55c722
ad968871ecade1d9343fd2cd7ccb3ff245c337504a231e5beeaa2361e3d263ec
12f8564cfb7cb36a6986d9d5995a654613e9340b3eb69c3c027567e8a43d6f7a
ab29f7b1300129c07b8adb1402df8cc0af71c98da7cc4238d944f9f8fba903ac
89c07254cff2e622466f10e24cd829676cc4680b8355378df3830e9769667eeb
956d0e98f74e0d31f0451d0ce5a43a1f6e7df070d3a0f2d8bedf73b604986eb9
f946d2a7a5d6cd5a43d2596ccd28910f6038eca876158e2d4687e34d63d0b106
6cc677d1ac4b9cfe4a5c39da0555abf73b47f5831781da5184962e3ffe988f5f
76e3e8f34a93821413e02e948deffa25ff2c1a69a34aa0bcc22bc9467ea7ff38
fce499a679daab4202a09972465acaf3b4a2df82a6efbe9d3972c0d043b70c01
a1354d935fb23f40247eb4aee683302e1c6ca94f576ece3a63427ba7a4562240
e0c22e92718393a61de5509fa87de35c847d6b82e06242088cda3cb6971283df
d0ff3c8744cca6edb4017bfda5d589a29496aad145a34e7d7969899c493bda43
1eabda3dbef1c184385e4d583f87eb1a125a1ca036aee86f55c360017f06c31b
5fa4e47a7c6ee9631ac151bafb0feeef27408946f72ba34283504c1a3af6cd92
723cf4d5bbaca812865807e3d5df3fdd3f542385b75194f6296cef027639fb35
3a2941d6f9916c76d2e9c021d956a1f788f503a6e2c2513baa82ca37bb7b9970
3bf0794e0e240c851263f0e4ef1cf0d12eb59da67bb2652c131fd5b1c0e8d7ee
755b2c8758588a17498cc24d3774524805bfde89b1dae61269e82278f2ae4327
ef1852bcd45aa4f08467b29ab6c2ba4ff074effce30f608ceafa105c84bda7d0
a30584744a54becd2635b3b45f24c31614ae22f676b14f9a5a98a381fa4b4ea3
2a15dc7ead64bf49b476de5ff8a3443aa691e0cbd5da49081013762ad9869eba
9572e16a30a6c9d210530d0252ba4ee6ce4dee44b54956b5b6dbc35743b575a1

http://www.odesagroup.com/cJf6hPN7/
http://evoqueart.com/Wk0MdRvGzW/
http://leptokurtosis.com/wmK5XminG/
http://mimiabner.com/tvprRKdT/
http://kids-education-support.com/XzlOlfNSSF/

Creation Time	2019-01-16 06:12:00		(ENG - Light Blue/White)
SHA256:
d9902661f479cf45db2051b19a675a67071144861ea0899834be52e553d96328
5bd95338a305798a5464ef8dce045f322de26007e9ca5ba93575ca03a2541311
86fd9984136f01f7585abe3facbeb015e1ae2e28d67f07db491c30cd5c9d46bc
1854f83b50f64767656014da0a62ca885234ceb2b63eb9f19c67fe1581d55920
e04715506ce481916ba49b2073e06ed003973cba97414b91cf4420d45158080f
a142865e0f99ebf97181f085ef589e7e92a3ff22f5205daab819c698aa7b9935
a4d118f3c96e5d33cfa1904f4f30f8fa1052dd2b3233d16ef88a26e1ffc2e966
a1dcba5a073cc41bec89054b2de16c1dd241e51d3c9f56f0d8da8ef56e364c07
adaff6c38e50565fbabf7f1d5540302417b84a9499d93d7440e897b88ab3e9cd
1a57a4cddaa773e0192c361011cd27aa66436b400193da3ce51b09931e2ee5fc
795c9318c69774ff47ac2f0ed628bac45cdcce8b35af2da581ac6acadf2fb153
ed6643008ee4b537e78f05f475b5b3b9db28547547d7156df322c2634a56141b
2c4b555376bdb355ebc53cc0a48cfafaffea7054a4b0dbc48d17f192032a207d
56d0151b15a4e5b96b0e1aceab99addf0ca2543c1602ea419175bbe178445eeb
f432c030a99ce3359ddd68468000429777c271cf71db6e60c024c5c7b3e662fe
534f411906e62e4f91c17044e334364efe3465612165515039a849f638d60349
6c49079f7eebde4474b071e271d7d6aaba87f00656fd3a413614d529fb3c2933
624fe5096f11e58d90eba4baf56fc28ba6e68ec7c3252a69536143d4879a775d
454a6b857017504870fc2602ea994303e76fd9b461148b766446f4052dd67144
76f3802b4ad5976e989e3c3e3870df43887fbcb935f730db3ce1d3b708494619
fe67d7385a0543f5cb8c4d69713d4571ffb737b58ea2d8bc1810e1087bc158e5
08a8469304bdab9e7d748e4a2e748d6f047c2bca26bd0d7d56f3e5d051313f58
8c77d6c03b135f98821365e79ffa0dc98d6de0b80281d06ece40c1d76e8076b6
f3fe50b9a47b620e8b5fc2cb2f337fbead1eadd12a32206c4acc92d84f6f3311
3708fbea71c64188ba781fd05d8ba4f1c55c02f72f8278678963f894cb400a5b
34bb1eadfed104b56044f701c665b6af6f80c38c1ad6589eb8956641220d0580
a58b1cd465ab3b197b63e4a55acfd718c7a7d3a893e2f46128359ec374303ca7
1351e4126d39dd0cb57d1cf4a60a6ef95a4e2c12e7541d6664693e4847694c67
e04eda44a6b3ef412e9c168d1a0416cea57d981d32e302983a853f617d37532e

http://www.automatizatupyme.com/Del4A8f/
http://pos.rumen8.com/wp-content/cache/GVV9yia7/
http://trietlongtangoc.info/m1BRuY5QJj/
http://theryangroup.solutions/1U5rfD7X/
http://ongeveergratis.nl/9vjJUBV/

Creation Time	2019-01-15 21:45:00		(ENG - Orange/White)
SHA256:
a9392d480ea03ee01310608addbe55c648d1eaadfde448e201d1597038e97423
29515c29ed9b9f73d348fc180d44b492ad18b0025fa232ff2f0728b53cbfdad7
6086ec49ed32b9ea5439b1407c09e1f316740cca7d249d41d0f811d91079bd6a
2f74b83257ce3c713014a8b0e3d7dac661007237c02350d968bdf0b01299cbfd
3c85d0c92c86fd083232291af98557a3bd811e5454dbd28f6259e935c776f849
e424f136c6214969f0b43512b61557f68885fb2f32e333a722b690149922d8ac
7acd6c28ab69e2266a7dd86ff153f74204f0a76dcaac47f8a6ce26528b931d1f
7a9781aa5b00f1eeffceb26a584573e6a9b0f3a659254d424eb1b6e0c96913f0
7b8a37fe981f65c846a575e64e770bfe3f32a0b19f2bac129501c9442bbba884
3d4986b995e5fe4d1b9d5440ca8a1592cfdd6f5c751e5f09bfd81b8fb3368cf1
c109d3c4e28ff454f699952760d5388253dae0aa648ae4b3eff9bc485d37642f
76da13ee8cee96abc0a956014dc5b95d7d7cb24e43a7c6949116e32816c0f026
26997f953dcfedaff8954a8d45b3712e09e8b8ddcdeffda5c190cab075dc82e7
785881763255cf55e6769eb0dd4024f50ce09b9e6734444cc836f6501b89f6c3
572fceab9490d2455243a170f4eddf89282b71a3b0938ded332256b914d0ef15
e64bb24fd65c491e36b8d85c6491c724b329ad4a3771efe21ccad28411be5abc
24c89e3e8457f265c62b30c1b4674fb036e86f1d2be96f510e6af2bd9dc0d8b2
a0bca1bd2f69df26423b6a82f64030866558d7b6b87c5893d13ae43b55dd84de
e028da98726d90389828d6509bd5b6170957eca4b434d82a729fdb320c5ce858
e315f17dc7c7607f3348b6815d99e1bf24196368caac8469558a0c4efd9fb8d8
17140cc39de7818884c54821add39defb1e8130589430dd637abaf00e27dce7f
f550c8a6436cc551fbb7af96cd828f57d2d0dd9b3b4b44bd656bd3b46d7b39b7
6096c1a77c7be003cbdec427e74c59b4d7670b6f0e766d7651fe5c335155b6dd
fe7d9cabbc9a0e8405420dcaa94fab2f69524b7cf93b04c455c7c2aade461193
be417e4a40e5590aa1173f506c595c6bc528d2e443e855c8bde642dd39ba5ec8
ae69854c877338ccb35bf1d272f0b93f66657e2d722edcda7edcece25cb396d9
fd456a86043c25634f431e85566fa93a360c2a70a8b375582443b2ed567e7d70
5fb50152198395069e3f62f7f8b9d7afccfd710e23596ddc1eebb2bb7b0d596c
92bfb1ddc764f1e3d3dc5ef3208e27c2f8c7f69c28c8a00e762255931fb39769
5c9283eec7b8fd2320671da85cfb56f0f8e66c76ab377d3d75cb7f856dcde1b6
92f82e65cf7687e36dab1b5ba2ac3141d2618d8af114009092af9d044818ea44
acb59cfe52d0fbd5a55e4a109ecf4ffb9abe4826759a1eb85997d1724abfbe55
175c4eed9606f98de1311173b4f87e8dc6294c27b2a9a5fb5efc18c86a0398bb
e527ebcabd8e3cd026fb69b02cd2cd0ff8b480a5cce835eaea120f01db2bd527
c827ba44a0fa545a17580e006f41f02287d33863ac2ddb198d016acd57f77767
adcf907d6469f25eab6da2aa03f3f04dd8b81daec6ac7eaef5996d216469fd5d
208e7277486ca18541ed21593963869516f3c7fce5ae0b8b034ac7adaa9bc33f
364186c825db05a46fd2d1ac54e54d827b5bfadb0998fbb3d7fc81dc0cfef055
2577108d9cd57fe4b2a494a6e19bc9db18c860091e9f54ea22943f9fab7fe6a7
9b20724ee187fd68e94cb02c5ea249c6d4e7780e687492d644efbaa2ed0bb02a
9b2cf8b3a7ab720c2fd938f2a5b631f3b5ce9c9145136f45b38bd4b499cedfd3

http://radintrader.com/NAOvd1X/
http://mypuppysitter.com/WcUDi4YdbH/
http://demos.technoexam.com/ehRw1bmlo/
http://timgiamgia.site/P7p4eo54QB/
http://garopin-r-01.com/aUUf1TKh/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 01/16/19 ####
```

2878c84b2005b984722a83b4ecdae53b43e9957bcafb2e2feeac57f1346a2f49
e4805890dddf581ee730d76040441e4ac00ecbdae3ddc948c77805508732ba83
e88798e1eb0cc95c7109eda62ad6e6e831b7d5893fe39c6cf4e9cba4ae02410a
d8001ff6acbab6fc0b20b81ec52b3c2ca21095b1feede3e6dd5a318b374eab4a
41b1a49731523e11cd4d6e78abb199eddce868e87d7a3f28b13718e86fabd13c
23c6ba1b0bc7064eee5c4fbb1026f524a9fae9df15aed8eea13f24cf65ebcfa5
3c146d408b8040bc93afcbb09fbc47d2ae82b4f5b24664d3d513403d8aecfe39
472792a65e7a6e6b5f1848b72f0d5179fbe7b45843f549533865583b1aadb485
d87372c775e883b550d1a2a52a27e28f714d6468702eca437b55e3bc8fe8cd0b
b01d9904dee63cf3deaaad69211f86ec6cf35be0cf03c88bcb26dfb392339f3b
a57434205a202287296cf69ff002bda31870ad30c2c2cd714dee3169a5ec9d1b
b7707501905bec2c24b64a3527816674f81eaf7603acab84139af45c279ab735
846bbcd3e9e765aef4144a7f3bee5e4e2fd5a7c4e1eaa76f48e4c69485091e42
a4936610797cbf003be21509f5e79d1090936f3e6b5f191824832569d38f610a
ae1ee57b23ea7ec82db4918ab74835b450db4eedec234881ac21ed5ead8cc4fb
a0396db5db5d2fb47e4d368dab79d345e07e7d3bac1cfac902b8a309ab03a6d1
f2c8580963b6c71d0daaab6b5021534633b6df620961b38846d23b89829fd88c
a939061bdca3890698e991761fc8ac99f2d8b24085e24ea2dfb495a78e67555b
58428260e1468fcd11e67d0af19d61e8438e6efd69a61b0bfdf523df834ebf53
698f326333fccb0050edabef63c386b6bb3ef2917460d9d2cd01466aca931410
a319549effeb2c44d63019777706c53a6b038da5b4efa31699e7c5e9e99c17a4
f73c25c63b439c44243a0d09c2c2fdf8a2c1ea61b32c845d6d0b8ad93212697a
2d5d62cab188cad55a810fe57e99488240ec9fdb4acc00ace03d992ab9e1c065
afdb75fc1f73f756c79e7e52de0183aabe25f0187b21236ffed6af25bcb678d6
cfe44e02356c5d2e847221a283f2753fcad75b531bf4aff30855c9a0c9dcf615
6d6edd4cc60ff43fa996cbd9e70978298af91013c34b57408b3855545a42b13c
0fa6b0e76af42631cff9df02c989c92b6a2f4e15beb042607f4b427b73de83bb
cb73952647171544fde64356caa153b0fbe5f3f7b23fd24ddab6d74a3854a0a8
3c2937d9a54d66068917fc25c2ed11e36b2c7894637d0f5a81f722ed6f830e6f
b3eb40865a7bbf708dad012a168aae4003b455d90891d92a340b2087e1b96ea7
c98efeb1b23ef4c0e2cf94d797b7746ac429c9ef901ffc5f757614b36bb48034
d4887d768124e61ac4312bb4e52050d12587c82c655dd745e64014281bce9d50
f4c0e00fea1452985660f928e1cf60cd550859b5576f65b5d79377fe3fe40710
d0ddb2c62b85789cf8c0cca1796697a9fef254af4c2e49339fcd23a1a2186dd6
4bb9fa27eb0041db9319b6970cc4df88b0e103febd39c3ddb5df5c32b30be0c0
dfa4e333fea40574d41f4d5e2a9f5851320b05492107802f71bcfcca4dbb3e7d
2b54a22a082e1f11bf5894d3595c04a20f50464b7381731c224943ce77a605f6
db8dc16655235e0e2ab746a731371990725799d3e51747a0d53a85d06ba9725e
044b90ae2c5d7cfef284d86d420d2fecc0b3921238ca4ca98d887c7c3d36cc34
6389d2e1a565fb0d659e619f156eaee437e4223d04e50c8c50b484e5ea17645d
d28615e6feb6e545c014e7f752fef74d135afa2e022b6b66ca208654de0b5120
32f425cfbcc7ca76057c6ccc0ea5e0f27a59f7d276213036e72f8b614b360027

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-01-16 22:56:00		(ENG - Orange/White)
SHA256:
374b171a47de4945687318c1a778cf7a3bf851ffc51ed96a255563e33c1f4c61
08d2f41450b5c87d2194cf2f5e663de31020640b1903616fd9f23911c40e5872
5aea4f670711c2c08df3cea6f7076d75eec7fb3c2c12a0e6e71e18e6ac21b042
350d310084f14f6e88a8acb6adbcbd248b89e77c200a03b45db2276ae59fdebc
51b37a4b8922c1129f45567a2164dbd26787bfc99a37bec0423ccdc825ae238a
ebc6c9724653bef31d1f477cfefed711624b82c38565e810f0a0343778ee0724
6be0a309c16ebf5e537128242233e96090d329541b80994a3ec9711286169b32
ebdf5f0225e32c80eb88cf53652a0d92fa855b612fa8044e586d304fc8010bc7
b2c03cb3a03c45030fbf8fd69589f0ccd8ba1f025093432e73b1d7a2a0dd4261
f703b68a03a30b32bff6dbef96665f960871d69ea6c0b9a9fc2f43dde061cbf7
1e6ab5f1a8b354b0f871584f37d679097ce3ee839bc64e534ad8b3508e8abfae
fc43f4587ff09376034aa7a38d17bf49cc9d3238d61463ccd596cac003bcdc5f
ca805254ac49b9c4f36fd9c13ea6f053614c7f7c5227d40e2e7d5ca529873297
7463cfdd3562d9f950c1ff9c7d60f5a1cd87be03b16b7ea120d4a945b1bf147d
ac1799f9b3a672cdbf5d43c8a2d5c83c07069d2404e6a95c6e21a1abce0c3040
4769752d4529fb52228b01b130d8f56e5f2cbd18db9b5a5e3d03856ff58bc3a5
30afdd7bb8e1599ed650397fee21197abb47a871fa4c5dbe58c2ba977ff1cc3c
9e029e7e84abd91bc4045b2e94be71a178b07a91a8ac0745f1b3d520816ca256
141b85270a591157af1369b2729034eb5cec87445b3fb604ac5df6118ad77a2b
5263d5b52ab1270adb432db5bdab2adf613c65c07adc8c71d505f737cd6d61e6
7af0310a3b108e72739535916ef251b916f3cdf56478e460d230f28f6edf59bd
c36d7096ef6b23ad823450baf8544a5a1337363b370ca54c971ff69c2f0629c4
1d5eed4a3aa857613a58fa816a187e18b1a9ca1c2460a3814fd20c6ad220ab30

https://anhle.art/t2ZZ_zOxsnfkSJ_ClUxs/
http://www.binsuloomgroup.com/wp-content/uploads/TyUg_qOsCOz4O_5uPw9YSbO/
http://bonnyprint.com/wp-content/PCT_0H8S_L9zVHlYSF/
http://ftp.spbv.org/worem_2o27v_d/
http://flowersgalleryevents.ayansaha.com/2Z4fO_YmAY_BqDF1wD/

Creation Time	2019-01-16 19:23:00		(ENG - Light Blue/White)
SHA256:
0be992cf0ec92ada0f3428723f9bf54697d9a70484f040a77eac7f4b692d2e9d
677f3d9d5d0f6c4722eb9b595a53d40434c1f98b3f374031a1fa3c3164aa7bf0
312f54b6b90612eadcd9e6786b3f773ab42181cab474245f05cc5289fb654353
9b61ed22df0d5944d9a010b769fc238434495b727a207514b3f853227ff3ff30
2726b6cc1bc68f26375b54c619658e1f20accb8573d4952e878baeb05fd24d04
fa8f549e578fb12cfeeb2c72bb19148c3e71add3b1d4f7de7297a62e85f06174
d890f2319d290366dc67d7ae02bca217ca67c99962de05a0f3f6fef9e51d4b4b
ff39f56367da2a3cb309ed45e5243aa474f3e9937ab3d20758b9e24a9355e13f
e1e2f66cee0e652e0decfbe57562ec0b7956306a0663a6da0562acb1e8c9ee69
326bf3bbc582b97e7beac70fac7ef9af383fb7c8f4c8bd4067ce4bc931f40dd6
33868d985d0751c5b2850beca90f23502600245203cb8ff210ea08b52dfa87e1
fa59df0ed78b6bb35a62c62cf8a6b2047830349133f7c3feb2a359c7640d1b1f
aa45e32651af4fbe9065dc15e2567c44cc8f531270f8dcb201a5df7a4b21f03a
0e294a0be287f267941778d5e165f0b6286026bf1e6d095b01bccfc0e7cc9ce8

http://binsuloomgroup.com/wp-content/uploads/NefRZe_crlN072r_S/
http://jcpersonaliza.com.br/g0i_4UcIJs/
http://medicspoint.pk/5RKX6Ot_r3wyO/
http://lailarahman.com/NLwq7z5_VIN4p7AR_00KDII/
http://aryahospitalksh.com/h1rAZ_HEFn0J_E/

Creation Time	2019-01-16 16:39:00		(ENG - Light Blue/White)
SHA256:
3ec774623b6beb04a3c8e935a169e0257cfd30929abb973795b20f1a7f0b5fec
d00ea82048586132558cad674d9094f495527202fccddcc84d30b365699839b3
144ed374a219a0aca02308a22b1e5a7deeb1b50b941f20f62df14a154c917339
4f034492bc4d152f98c083ba3d9a1c24b3062a2917c89551857c4d310e481c9c
74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682
01410e94e39c764aa99b933ac899a04eba0a77b25ecd1345f99253f37e9dabfa
8c7ad104327dc5bdf1164a8ff374cb55a32b8a55a96fd282b9510e52424a95b4
0b7553fbe2886d6989024b9e3f2b17696442f543065c5a12e0b901e339fbcf05
bd5d297c6e80ab3112e2f036fa94f69b78b12ffe846e1241641b5cae1b817225
0c77c98412d30765b2d8c8bdd38f503927770c0a08b45cbf812b1a2cc1240b28
0de7aec904c9368df76e8115a8b381d99f6fd482717c2fa52b26a5ba5c630694
ee5583eae1e0bd0df20ed0b53900bdb750e24e741b575e33593c94c311cab871
8264951fece26c1068d84de8b18ea3adef89a93e476d02d46a31b8739baacd94
dc36ba3238a3f4761e54cc6f9bc4b43420cdb2b00705574d61898b7c5acf003d

http://intraelectronics.com/9CBQqGip_YBdeLeOmn/
http://linkingphase.com/Ye09uJm_1TJzK_0/
http://radwomenbusinessowners.com/pnKAX_FAi9jc/
http://www.motoruitjes.nl/BrG_4Tb3uEk0N/
http://kantova.com/xRVVM3r_gsFZOEnE/

Creation Time	2019-01-16 15:09:00		(ENG - Orange/White)
SHA256:
8a3af6bff6a0a4ca4f906b3695e470fb18a0da7989a96c02204ba500c0c1a2c1
116e6f63bd00606d7861a22bd786633c7d7d1e99c61fa2827429ce8c8a53499e
1f772e71f20ec786d7fc2c92f8eed6a11308fc9cabc021a5cb828f09b3dc0583
3d43a8519da43cc84fae470dc9e90301b1aeb9acbca4a7390711c9ab4c5c5438
22221150a875fd5e24ee0a554b2cdead6543e35b6899641a3f21425c632b0201
1b648318e9ce3b8d8cd0e334446100c5972f74af736d093f0fe3b62597708b5c
b1ed504b77cb03d7387f7cb22a98b12b661281d8983cf21fd702c7bf95129c7c
a4df9b13e77c4cc1e7242b62723061be88f1a963cb4795df6ccb86d91d82073d

https://cardealersforbadcredit.net/jYxxcV_82ibrAvt_k7NWL2nu/
http://rdweb.ir/jKo_vKZlyC_V1P6JEV59/
http://mercedeslangha.vn/TRo6Fqd4_epBFymYjz/
http://kosolve.com/GGV_EjWpCN/
http://denis-99bg.com/iti_0vUy_F13/

Creation Time	2019-01-16 12:11:00		(ENG - Orange/White)
SHA256:
e7c1d077cbd3dd185b7e7ecd6ed2f0195b2ea098e571c78ba60da5cff90c897b
90113ff1e4b8bb81a5f9eab309f7fa4eb349ccf741a13ed040787e3399d6eec4
dfdbc3d210ce4c6bf12603e227f2312e8b24baffa18959d65f2e7f548a52275d
eb6f43d211af30b46724e72e2c9ad9b363f3c9e012ce5fc389c997ec16c5b122
8eae2ed2491c609398b61e288147d6071fd51ab08ab785c6fe770f83dc0152b4
74b9305b76f521916b8c989d7e650c8f5a5bd9bd93700ec6f8de7e3093e34b20
3b9a7c349e11691d37a46faf39540618edd314a0c97739c112a08305ac95f68f
a026dbb89466729bfeda373e5ad9f1cd976fd945c203ef8ccb76cc718e8085aa
d889f9026c11807d7c5eb44b27475d33b7960398bf2abf7acba35b381de99380
a9c7a0f67f42b38ebf241592e97b3e08f75b78d6fbb746508fc5993cadf433ad
fc3047318d92da05133c410c2b7847da7e9beed33d7d294265d90f50eca8bc3f
48dd1160092ba8e7cc912bb35066032fdefa9b2a0385f55b8e0bdddd0a9560a6
a54aee546321a9f8cce4b3f90fe12e293f606221472287b8939eaf74d18f2a9b
dd23bb0569b6a1f3960229b92aafd0100f13d1ca949a5d8cd961e94397f698a0
1209a346d7a0910677c17501cf403fcdf0c2d747fa6f4c8e19309490581437f9
f840a19d13ffa79af18029f409cc5cf9c6511fb7a97344d8c0ce9e1d4bf88f27

http://www.modern-autoparts.com/mfn6gSx_fcDqwb8/
http://lakewoods.net/djxu_Xhq4ET9B_KDS/
http://www.elcodrilling.com/C32vyd0_2LRb_qPeTS/
http://mail.m2-sac.com/hHtb_gynux2NW/
http://tariu.gogloba.com/1Fz_1D4Et_XlEEO1AaO/

Creation Time	2019-01-16 06:54:00		(ENG - Orange/White)
SHA256:
703bb961a600f69e6084b19ae9a88663539667160d6caebe2e96c0a03f4affd8
9890c5f1c9bd2bdd1cd1994eb824a3578639fab9915352433d414862ec8d2c90
64221fc97450e3aaead99f762fd84fbe1ac02be9f11ec22ad49eddde23eb034e
45a1488212de6bb015b47f1cebe3c9060af7fdb41f5f52ea951c444731c83d5b
e7eee8a7e5fe6af13bef3edeb4f0dbe988c8b4613ebff9cbe462a5d32cac8a88
03edcabef5dd2d66c7490c0ccac33462f9c138ea087d7572ae0fe26b76cb8051
4e956fadcd623971562214f47bfada881bb9a4e222d45a57c28c285dbb8f8369
ad19964733761607dfa3e86a27be17de79bf6580e62588cc90a2c1a9a9bc8f53
f31d0bc4ba078569f6c37f4966d9eaee9ecf36f4af3eef6c70c5116470a4fe79
6c6cde186a8b11112384e7e53ecff759d36b1e28463cbc63b1822875ae5119a4
bf34cdbfc143baf710e25dbbb29c52a557bbb0485e5325f085f926f32507ba63
9a0fab73fda1d3c9827b120a02bc7af2ba3ba3bc4f3812c59d3af6e22b77a1e7
12aadbd5b565bc0fbb49e9b677df6eca87ff5c1b4513c72e33e4ee4afbaee8a2
ba42bd3156b959557c225c8b8eebcc02394c935b8178902835924d1a150325ea
409a3d725202a5f66385fa3dec70b0311ded3871f8f0528c631cad1d2a3eca39
9b8d80b18ce7849e7be22615a192ca30f4cd2bafee6adb7b26ffb78a6ae548f5
512ec5b03376581c8ee4c65e21e9b2e9966017551c28a76310729ff44d661a52
11d3a960368ceea3387f2b25f5c488f84835ea9d04c01a9e8fe043e49bd02496
b3531a06af9b2cd766b368fce3e06c5f95b24888651ccb41511bf6666a06cd61
f6d3c9abc6ddb2a5b0b88f1b0737f4c2d25febbea2822c411ab8fdcda2e0734e
b01700c2715b92973f8a54a9f478d269c98f065cfe14e43f3cdb6eeda77e504f
b10ed9a23031da797f62b59324bfe1b7a018452a219f38f64f757011891ad5ec
9b2a3d826b621706a832ca9b8c8cfecbcaa0f182565faf46b5fb6c137e223e01

http://qwatmos.com/2Bc_1AhP6FKBd/
http://otohondavungtau.com/vzZMi_cPjZ/
http://aramanfood.com/wnfYAsyS_Mslz/
http://igloo-formation.fr/tSlCBpPP_ywVhz7_wqMR/
http://www.sp11dzm.ru/XhDjpb_0sihee1v_uALFk2/

Creation Time	2019-01-15 18:14:00		(ENG - Orange/White)
SHA256:
851f42b2bc5cd34e97fcd6f72e11a58b49cb66e3482ac0cd4faae086d530be5f
13f1cfc8b58ac4d9b8f02df492eaae39d09318798eda093ef6954bf2788c10fe



c62f02ac392d005e396bf0bdf4d7eed9c2ce49183d1fe4c694c13cbe7201eaa0
c7a47f70ab25e7230fc67c23c8c6c7c1fb1d48fe82566709b60723fb55b7f8b8
a94114b72f6a0810444bf597d8f9cf02048b395be3255a2cb5370fd0376c16fd
86ce9f043dc105b24bd5f89bbdf867449fe1991b7b16fab3a156444c0a9b0fbe
5586eb3632edd9c5a2976cd1d8266caa3d4279235d8e1381f1d3e3c6bf0ec725
7a78ce7c03365d06f718e2a2b52080d2d996412d6ea16b9f6ccf66e85677a23d
23298fc98b790d4b24444d2edbf0233c16d56b7d9519bcf9f9e320c798292673
fa12e8e59f2152cb3435882d7b039e961fd54789603b0cb47e1d5f5131f4ab3a
21333317d7f05db126188b4ca3be0973f19b3db1dfbe5ae03e6ea858f9b14e54
9e2df12a882dec091626f97192f98f27e565b2ea141d9245f1991edb881b6c45
4a4f4e41bd279f91c55e3656b73065b93cfb48cda18309782731d942ef299f17
d0b5126b634f66c07b00a44ce7c0ea06e342e5354b275ed247aee67836b4b36c
a9dbb143b522baa5ec096605f6a83287a8e83c74a81c86e80b28b6fea72f32d3
b04cc6ff3c8cd2f5cbc1fb7c11a92ab0fd6d2a1e5ce3a3af751b41ab98f2ef40
1abdb7044de2d11edf413a4e3a8b661d4fccabefd7b6e82334b6be08686a59b0
a38828d94c38717c5b6c9c0ab04d792a7770e3737a1a8951259844e0d50990aa
d10be6e5a5cd1b04b0e1faae92ba4e29f6aae6c55877a8ca9c21a52bb24b653e
a9960b744b8f8a9c986d0394fa8c45af582c56dad78476cd88b9ff02ea6dd0a9
449e1c3c24a918b1b1ece85fe541330bc522b91d13b73280bc4774367f7c1895
dadfe9c8cf19b0f55b98147b72ba7e0849bae74e74cf4445830636027819729c
c4e9a55d7216e9cc61f60eb936609b2bdcfa62cea320f9577008ab3c43f126b5
e23f4d9bccca4aeeba5d0fe21ecdbfe35c733e182e93bd5d19a83f50d8d1d364
f9da355e1b1d67d942ca779d8dea13f69aef6d24b53bdc59df1985ddb5006d77
c6bb5b80feae0cb8669f710efb1799e37fc24bcf6fac4c98735f1062cd32cab8
784f5ff294989088c4d13237fb0f14cdcfb3394387250d645e40ec57af05be31
71916eb78ce88fc298f25df2ebd8bdc253af4188e7f38e69d1b419f79102151b
18919d6d26913abe27d00c1e64b701c2ead8cf34855863910389828388ae23d9
c84d790a70c401e4495ba92b136d9eba9245387b71f96c43242d74c30226ecdf
98081b4049e02b007390f7f3d833d1ba526812f966828d0972dfb8e1faeeaf6c

http://www.forma-31.ru/x9w0Q_aJ9eUDi_0/
http://codienlanhnme.vn/wmfuxxu_bf8c_ccJhM/
http://www.viajesdelbosque.com/oJmICLR_SF1qjTc9v/
http://www.kiber-soft.ru/Heq3CDGN_tvvO3Ae1q/
http://www.yogaspaceme.com/QCPdiT_LN2iP6fHd/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 01/16/19 ####
```

a8b1aef66f6cd121842106e36dc9087c5b5a3accc945f2b8ebed6acae35b5796
811c104a25b6d90d6fb65e400cf07b9e000cf2624f71087eaa61d495278d32db
e57d43345ccb75812eda6b648bc7a20c2182d20eb98846859f1cc868daf8a676
f348c874efc36b9408b0c1bb25190eb8e896a1967b9218f2519ab476c6563ec0
73f6f28c3a6c405792a8be19ccf6d78527e63f3b867d5c98d13c444b754e3f72
f586351b2086d813f9d298786eebc8db56a74145854466346922dcb45cb55e6e
f18efa92a0b87a133bebaecd224a3c19461d8517cfc6cf35435537fdaaf38627
f369e850279df07d57257871460186bb20b389fe88087b5750400d66ab11d6e8
4fd151ff20bb02f9aed4ce9b021d0683eb1bc93f339fe612d960781a9880a661
ccb5c4cf237c15467ff344d3c679251f0db26e4d139989e9ceb255726b3ec4f4
d06289e80809dcc3a056e7f3dd055b060b7ea98ec7cae0ea3fe2fcef2f5eb9df
096e1cca4006f4c5cb050ba25b7f637cb498b80f3ed05895d0735ea75255823f
1e0c6f39332e4a9565c496aa4a8d57e520673df6a4632cbf741732e9b0de1c54
0a358944ddd9733c1bd5170ab60a388b73002dd26c6e4dd53056c3e426f956fe
3a369922533886c5f57e7e6b5839c8ffb01a1f2834acb6d5b259d9d48fd74dfd
f63dd0228576e0fc1f635db6860c5ccb3c71103a7556bcae9127569af03d123a
23663a7a2f1363be12a07c4fb44ce7cfbc917876e193ff0b4b9cb985af34142a
cc820ae6d106761cad4bdaebcd8d906fcfe83941e9212cdbae961dd0ebae8a12
7915377614b05f1fd17931245b8d7840c9c90b6a6d300a731175203da59d66b1
b15354040a94bcbaa0422c35b2ee534263f7a2fad082d842bd5e6e4e5d841fa8
dadf0048150098d45bb5af13d9cf8525aea036a02a9cc18c61d5f49e5f6689f4
a4b1d74f4a813afe4f10bd4862fad261a61c50483b80690306a37d9c2cea24cf
16e77b0fd076d197dfc94884f8e8dc4deb2e16f9b9fedf7e9aaa9fbf738f0f04
6906641341fb34ca5abefb40bdb6b83f294ce2762ae3e4eafc2dd7253f8240b1
ebdcff157458f41541420a4af0a91686c92d768f5a9ed5da9ec03c34660d4da8
090387b22f297a01b435bdd5d3e9450bad6b701c6f0529661ac9e91672f77017
abbac11bd253b4004a264f656e1a8bc0361daa48867e932f26f8debc5f70cb8d
cfe2b0a27476d52590d361905c1be2f2877cbdc89ce307b36302c8226bb76821
da1bf167e333e5a40fa978095352e6eb6fc6be6f2da602c372f6562b384bf1b9
5afe22ee02ddaf11bae6337b0f6ab1cfc8990aa89c4b55e606d0f58e65bec94d
255cbc580e58129977f183021d7bf0200d85238577297d46bdacf2f11b5a27c3
04d02c7253d9bd35c6db9d6ba50bf96015f4e7e0af2b32bcdb007cfe7bc52c69
c8eaa2ba2870dc7a7885709968e456ccd5c18e91ca770667bd98b419a95f4ca3
c9f3a20fc0131d56cf661531b971fffd311dff96b542795c23d94c9cbb874ca7
053614a758bedf57fb7507b73bf3519eedcb7f7a3c957e21ca1b45987c572032
ebb6340db54a85d4494e7d2cadbdb4317950f42ddbe0f34bd1223089b37ca01d
46caa7981fe209cec319f5e3ea240e3d494fe4489edc66dce8eceb0a4cd340cb

```
#### Epoch 1 C2s ####
```

109.104.79.48:8080
116.240.3.27:443
125.130.72.105:80
133.242.208.183:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
181.164.8.8:22
181.167.49.76:80
181.211.11.171:443
181.31.246.152:443
181.45.45.132:8443
181.46.46.49:80
185.86.148.222:8080
186.15.66.98:443
186.150.202.242:80
186.190.192.84:143
187.163.177.194:22
189.129.134.124:20
189.154.188.33:143
189.163.44.44:143
189.225.146.180:8443
190.190.101.38:443
190.226.34.8:21
192.155.90.90:7080
200.54.18.162:21
200.83.21.5:80
201.200.3.74:21
201.231.70.72:80
201.248.14.67:443
210.19.41.87:50000
210.2.86.72:8080
219.94.254.93:8080
23.254.203.51:8080
24.222.22.58:990
24.53.3.10:8090
31.53.229.122:8090
45.73.27.218:80
49.212.135.76:443
5.9.128.163:8080
66.50.57.73:8080
69.158.10.125:50000
69.163.33.82:8080
79.98.31.206:443
80.12.84.86:8080
92.48.118.27:8080
95.9.248.89:80

```
#### Spam/Stealer C2s ####
```

181.167.49.76:80
187.147.153.225:990
187.163.213.124:443
45.70.90.134:8443
50.116.63.9:7080
69.163.33.82:8080
79.66.242.43:8080

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ
Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

109.129.2.50:20
115.71.233.127:443
115.93.16.173:80
117.247.233.82:80
118.69.35.66:20
121.74.198.58:8080
122.176.109.10:80
123.136.174.52:8080
147.83.156.162:80
148.243.206.110:465
173.255.196.209:8080
178.254.31.162:8080
178.62.37.188:443
181.119.30.25:8080
183.82.112.154:80
183.82.120.85:465
186.4.165.50:20
186.90.227.239:20
187.144.76.174:143
189.149.3.197:143
189.194.250.74:22
189.230.124.74:993
190.0.1.30:443
190.109.223.50:20
190.147.100.8:50000
190.228.72.180:53
190.94.79.239:21
196.209.233.234:80
198.74.58.47:443
2.50.183.165:53
203.99.177.144:443
211.115.111.19:443
211.248.17.209:443
217.13.106.160:7080
217.165.2.29:7080
218.90.156.188:465
27.147.163.188:7080
27.96.91.73:22
45.123.3.54:443
5.230.147.179:8080
58.65.178.100:143
62.75.191.231:8080
67.205.149.117:443
69.195.223.154:7080
69.198.17.7:8080
75.99.13.124:7080
83.222.124.62:8080
93.109.229.250:143
93.109.229.250:20
95.141.175.240:443
98.142.208.27:443

```
#### Epoch 2 - Spam/Stealer C2s ####
```

187.178.233.96:8443
190.112.228.47:443
216.154.222.52:7080
95.78.115.115:50000

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc
hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now.
Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version
of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change
payloads every 3-6 hours now and payload hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100%
sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the
other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the
other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch
as far as I have seen.

```
#### Community Lists ####
```
https://pastebin.com/raw/fgTBbVvd  - @JayTHL
https://pastebin.com/7FXZZSP8 - @pollo290987

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @JayTHL,
@Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @capesandbox, @digitalocean, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic,
@abuse_ch/urlhaus.abuse.ch and @Virustotal for providing services with at no charge to this cause!

```
#### Daily Log ####
```

Today was a very heavy spam day for me and more URLs than I can remember seeing. I barely got done with this list. Even at midday, @JayTHL had found
we were already reporting another 400 URLs on both Epochs: https://twitter.com/JayTHL/status/1085625547701538816

As @ps66uk mentioned this morning, there was a large push of the Amazon template we saw last month. https://twitter.com/ps66uk/status/1085529543480434690

Most of the malspam received today was functional. The total received was about 400 malspams. The URLs seemed more varied today compared to yesterday
or perhaps just additive.

Have you tried the latest CAPE Emotet Extraction Task yet? https://twitter.com/CapeSandbox/status/1085115586550603776
It is based on work from @sysopfb, @pollo290987 and @CapeSandbox to extract the RSA KEY and C2s from any EXEs.
This is how I am providing the RSA keys above and you owe it to yourself to give this a shot!


```
#### Sandbox 01/16/2019 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run at 05:10 UTC - https://cape.contextis.com/analysis/30419/
```

```
Epoch 2 C2 run at 05:20 UTC - https://cape.contextis.com/analysis/30421/
```