Emotet Malware IoCs 2019/01/31

## Emotet Malware Document links/IOCs for 01/31/19 as of 01/31/19 23:15 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 01/31/19 ####
```

http://%D0%B2%D0%BE%D0%B4%D0%B0.net/kE9_6iaxBF_WWLBR8Mxnu/
http://100alternance.fr/AT_T_Account/UeEVsThryD6_W4IZg8Cq_IJhG4/
http://103.254.86.219/rdfcrm/custom/history/Payments/012019/
http://4kopmarathon.in/mWYDKbCzTK0_bhOskI_yiKvnmdnAy/Organization/Account/
http://a1-incasso.nl/AT_T/9DPpMFtkJT_UrsN3j_xB2lZuMq/
http://addittech.nl/LSPfAyT_xi3lwcBC_IJWGe2nkb/
http://admininfotech.in/Ay7YroI8I_XkUuQFG_XBtSmwulJ/Company/Account/
http://alexxrvra.com/AT_T/zELRkI_Y2m5O6e_J9BMH3q/
http://alexxrvra.com/dKDWJ_bmd5E-RCRSAs/Ib0/Transactions/2019-01/
http://alkmaarculinairplaza.nl/TKuWw_0v-qNDDEkO/iir/Attachments/2019-01/
http://aolpunjab.org/AT_T_Online/nNpv_kAebNNbB_UF8t5XM/
http://aolpunjab.org/GRZZ_dBv-NKkr/SQM/Clients_information/2019-01/
http://aranda.su/ATT/iL5_ZIPg5v4_sJj5y/
http://asncustoms.ru/core/model/smarty/Information/012019/
http://authenticity.id/Nees_9to-FznivI/Pq/Payment_details/2019-01/
http://bachhoatrangia.com/IUwUK-Na_dTUBvQ-9g/Details/012019/
http://bahianet.ml/tD1TFFt1Ec_yaDzb1A_mw0AjWvvYy3/
http://bancakoi.net/NLjx_IPcrY-wobOo/glf/Clients/012019/
http://bangmang888.com/Cfsz_1VuMu-ArDdUVTmf/Nd/Payments/01_19/
http://basisonderwijs.sr/myATT/sSb_4JjrWVC_FhodD9/
http://bazee365.com/ATT/0pT8k_DJg9mzye_olNiIzR/
http://bcool.ir/ATTBusiness/UpX4bS9q_0QpMwKG3_1iBpY/
http://bcvolna.ru/AT_T/JO3JQAtDyHi_pxBR0EG_o2sg1/
http://be.thevoucherstop.com/suFJ_WqXu-jh/lx/Messages/01_19/
http://beginnenmetbitcoin.nl/ATTBusiness/IcKd_60HzUllW_zK06esFdCE5/
http://bizresilience.com/oxGLh_51t-FQE/xw/Payments/012019/
http://blogs.thule.su/Transactions/2019-01/
http://bucharest-independent-escort.com/cdXRd_GwP8A-XPyDc/v2K/Clients_information/012019/
http://budogalicia.com/AT_T_Account/0Qo_8C1aKs_16En8/
http://cambalacheando.com/jvgy_MG-ZoE/Lz/Information/012019/
http://capitalcutexecutivebarbershop.com/CtNK_3O128-Bw/6ZT/Documents/01_19/
http://cassie.magixcreative.io/AT_T_Account/oRdQm_Rmh1BJDH_nips85Z/
http://cild.edu.vn/AT_T_Online/OKgTRaASf_MniFkcs_YsVvq2fwnXe/
http://clipestan.com/AT_T_Account/LSRRjWhIv_5rWQKwktt_hZH5T/
http://compex-online.ru/ATTBusiness/Nu4CpOWT769_DptJiax9Y_mxVLmy3o/
http://cp.tayedi.com/AT_T_Account/m3GM3Qz_g6UyNu8_CDuuTn/
http://de.thevoucherstop.com/Clients/012019/
http://dienlanhlehai.com/hoviejdk/wtuds/Messages/2019-01/
http://dizinler.site/wp-admin/dxg2_RUt5WSBOT_5bRUzl/
http://doctoryadak.com/ATTBusiness/wlM4K9RrfEZ_4t1k3CF_ewrJ7ZK/
http://ehpadangegardien.fr/wp-content/plugins/TzqB_cnV-OTDeMV/8k/Transaction_details/2019-01/
http://epoxyfardad.ir/AT_T_Online/bBILb_gW4NEN1g_8W61LiE2l/
http://escorter.info/selT_aAQz2-TZdPVOr/hO/Clients/01_19/
http://etudeindia.in/myATT/DdK_YuXswle_MOQrAMP/
http://euniceolsenmedia.com/yEtb_uQD-nEJmmp/nnK/Transaction_details/2019-01/
http://exploringviews.com/Orders_details/01_19/
http://fansipanexpresssapabus.com/ATT/xNL3CSZ8cz_Kh3Fv0t_ivrRJiVDXrp/
http://farahoor.com/wp-includes/Uqm1GDDty_swSQlW_2Q1vxeW4AE9/
http://fcmelli.ir/docs/cache/AT_T/dtF_rFmvVA_toQRFFiie/
http://finalblogger.com/cBcCH_mL7-FSCLbEyFc/2q/Transaction_details/012019/
http://fitonutrient.com/AT_T_Online/Nxnhi67_elkHeezF_9Rf7dDcw5tg/
http://flexmec.com.br/AT_T_Account/7VxtFs_r5SOBs_Bp8QpeXt/
http://forum.icsa-life.ru/ATTBusiness/3RRsy_BiqoZE1AB_jhwm88Ci3C7/
http://fr.buzzimag.com/cDFKb_t4oAf-mrA/6B3/Information/2019-01/
http://frispa.usm.md/wp-content/uploads/AT_T_Online/nyC7w69EHH_RSZRvMfh_HE1cO5/
http://frispa.usm.md/wp-content/uploads/wIEnj_zyc-ZlYTf/52/Messages/012019/
http://funnyquizz.net/AT_T_Account/dFF_gn61UbIka_WQxdYdvDnPM/
http://gezondheidscentrumdemare.nl/qJyBRGI6k7v_Ui0x5p_UPGRQ4/Company/Accounts/
http://giancarloraso.com/E6Gjc_XHkqUW_xNEWy1/Secure/Accounts/
http://gjsdiscos.org.uk/ATTBusiness/j7GsMuNA_RyYf1jO_dVfApIr/
http://groznykh.tmweb.ru/AT_T/4RvfI_QAXIlzKr_7HWJR1wXh/
http://heizungsnotdienst-sofort.de/Clients_transactions/012019/
http://hitapradyo.com/TCsVI_Eo-XBomMnKK/xnR/Transactions/012019/
http://host1727451.hostland.pro/pSas_sgak3-pdNQ/n5/Payments/01_19/
http://ilo-drink.nl/AT_T_Online/XreJ0bTyu_cz7oV8_DdDNU3qczCA/
http://inconeltech.com/myATT/gUNEUc_AbS6EJ_KrUOja2H/
http://indonesiakompeten.com/URLMZzXjcAi_it4FexO_2Wx00/
http://insurservice.ru/AT_T_Online/qdFX9WJ9_Wk7mXWKo_R5Mzm/
http://invfactor.cnr.it/sites/files/Orders-details/012019/
http://itumelengsekhu.co.za/AT_T_Online/nH6fpR_5w3sxhc_nKugnjkv/
http://jaspinformatica.com/Transactions-details/01_19/
http://jmgo.com.hk/AT_T_Online/b9PpVCEo14_HfgMnxTXk_CpzdDdkOOr/
http://khoedepsang.vn/images/YkfnAU_FCeKN5X_yaC32crrijX/
http://khoedepsang.vn/rkXJX_DN-zDyYveZqq/xa/Transactions/2019-01/
http://kjndiagnosticcentre.com/AT_T_Online/Qne_joj0lC_7z3xh1DC/
http://kniedzielska.pl/ZNGmz_tWQ-puDdap/Quo/Clients/2019-01/
http://kolejmontlari.com/ATTBusiness/wg31qjOeLD_be5Gyo_n4rhvv2aJaR/
http://kurvita.com/AT_T_Account/kj82q_HK3JyqJ39_1djl9PwRAKG/
http://labroier.com/ATT/WIWHEy9OhgL_eeGv0STQ_QeLAiucjR/
http://landglobaltrip.com/wp-content/uploads/2019/AT_T_Account/L75dtIG_ZzWn0lMT_jbjPvyG/
http://lebas.dk/flyt/myATT/0aZdpbQJ9WG_BGg3jM4_UhGWGSm/
http://lesprivatzenith.com/AT_T_Account/3MnW5Wwq_Cn0aqkng_eJWxIO9PR6/
http://lifesciencez.com/ATTBusiness/rDuM1Z_vdqEg7rO_YJTgPw4/
http://lifesciencez.com/lfAV_GSE3L-vMhh/Oa/Clients/01_19/
http://likecoin.site/AT_T_Online/sR0oVcX7Ck8_9HbyrQ_ooQID/
http://limraonlineshopping.store/AT_T_Account/uH8DD_9yvZz1_iV8hyyZs4u/
http://looqq.co/AT_T/zVO5tED_WGRpRD_1X0DKg/
http://m.az.edu.vn/rss/myATT/C8NC4M_aNeoXTyC_712kx5s/
http://magikmag5.ru/ATT/iuwv5D6eM_MrB7pDIk_vlxNlUb/
http://majidshop.ir/myATT/CG7BV_FikTQmP_MCEVUHDJWk/
http://marasopel.com/AT_T_Online/Rtx_fexMPa_MtpZ2W4T/
http://marmorems.com.br/ATTBusiness/krIPP7D5wOr_dhaA0L5_UWNVD/
http://medicci.ru/myATT/tu8794_QcbkoEsv_Xw20pYh7ij/
http://meetbg.com/zinrpPj_ERE8pQrmr_QILyvMtE/Organization/Accounts/
http://mobyset-service.ru/myATT/qW0KJy_2XGKHSlF_fymNB/
http://modbu.xyz/AT_T_Account/LGloxrO_gb7726M5u_7EHHUvWiv71/
http://modbu.xyz/wp-admin/gPpF_Ducmx-N/EZN/Details/01_19/
http://monicagranitesandmarbles.com/AT_T_Online/xYnPizviH_AJBFrSDu4_FmjSWN/
http://mostkuafor.com/XIYq_tfI-iXr/Nr/Attachments/012019/
http://mostkuafor.com/XIYq_tfI-iXr/Nr/Attachments/012019\/
http://murderblacksuit.com/ATTBusiness/ENGul7O2T_6D9IV0Xh_BSrqsQwrHH/
http://noscan.us/Transactions-details/012019/
http://notes.egytag.com/wp-content/JJk_6KR5FU_uNfqhqWd/
http://omegakotlas.ru/AT_T/aLnH_U7Y63RZ_J11u2u/
http://online-printing.c.api-central.net/ATTBusiness/bi8_e0nMBsnnu_EOrfiV61/
http://osteklenie-balkonov.tomsk.ru/LjDAjjjX4_t0bvwnt_vfCGVyGGsli/Company/Online/
http://pay.hudavaqt.com/RBsmJ_Xh-VlNUvWFJF/Rg/Messages/01_19/
http://phatgiaovn.net/wp-content/Orders_details/012019/
http://portalpribram.cz/AT_T_Online/dBl_YISGoN_rqIzJs8tK5x/
http://prisma.fp.ub.ac.id/wp-content/Orders_details/012019/
http://profreestyle.nl/dOgelemxcdT_H2lbGbr9_mzmpAhH3Wrk/Organization/Online_billing/Billing/
http://psgkbv.org/AT_T/ToMUeLtn_tFi8HXb_QUDt8bSvvjH/
http://puanbe-skidki.ru/myATT/Xw5W72s_Ivu5ool_Waf8sJru/
http://puppy-dog-training-tips.com/Telekom/Transaktion/012019/
http://rielt911.ru/oev_pkYyOl1nN_Qn59poXrGF/Organization/Business/
http://rodaleitura.canoas.ifrs.edu.br/QAo4_YqNRQcE_KpLonDHgvFo/Organization/Account/
http://sadeghrahimi.ir/wp-includes/AT_T/7t4jPk_VccsAn_u5obv/
http://safekar.online/15XHKBqL9B9_xSn1fL_v41Kq/
http://saigonthinhvuong.net/wDfKY_MPY7jKYn_BScQX1c0NVt/Organization/Account/
http://salon-ezhik.ru/ATTBusiness/lKSFpbaz_HRfJfTUJ_Ac5RIv/
http://sassearch.net/BBwEr_5l2Ui4h_f2BFR64/Organization/Online/
http://shgrupo.com.br/AT_T_Account/HuC_SZAyE9_oKc7o9hDu9p/
http://sigelcorp.studiosigel.com.br/ATT/4uEJW5V_EDqdwN_Ebb1Zav66H/
http://smartphonexyz.com/AT_T/QZgQ_PnQnR6gk_YXvL5Fi3Rek/
http://smartsensedigital.com/ATT/DXaxUVhuN_aGXfmk_NE5YJsd/
http://socialinvestmentaustralia.com.au/SxG0Nf_Ac5Lgc_kISJtI/Company/Online/
http://spinnersar.ru/ojf8H7oRLU7_lQnUGEG_Vv9OJa/Secure/Business/
http://staffkabattle.ru/myATT/4hjYbVkhRo_452JUjB_nOn8bhKx/
http://summertour.com.br/Details/01_19/
http://supergct.com/Orders_details/2019-01/
http://svyyoursoft.com/Telekom/Rechnung/01_19/
http://tapchisuckhoengaynay.com/wp-admin/Attachments/012019/
http://taxtell.ru/AT_T_Online/spNaauTs_WOOi7Py2_SNDSyWmjAJ/
http://techboy.vn/AT_T/97temf33rH_xvOKlK_jitMmbr7XoH/
http://techprogress.com.ua/ATTBusiness/F6W0BUY_ziFjORGmR_ms8Ikw/
http://testcrowd.nl/AT_T_Online/vT4auNCz_Pdkkveuv_k72jH/
http://thebridge-franklincovey.com/AT_T_Online/xH7A2_OTzNwYQ_BoDY9/
http://thptngochoi.edu.vn/cO7_ic1EPeI8_rvuTMkBzIX/Secure/Online/
http://thuysinhlongthanh.com/wyVwP_zL-xNwRntaK/L0o/Attachments/012019/
http://tigasaudaraparcel.com/ATT/8XH_zxD5cHBc_uCK0MV/
http://tonyhealy.co.za/myATT/tk1dKiK_BO0w9wRu_YkwZ2/
http://traffic.wilmingtonbigtalker.com/PKAaWWW_wpUrXer_gF8AygHSS/Secure/Online_billing/Billing/
http://uflhome.com/qmJeY_7O5-mxxkAUFBm/7X/Transaction_details/012019/
http://uk.thevoucherstop.com/gzwl_lbWmG-COXHC/7DZ/Attachments/01_19/
http://up2m.politanisamarinda.ac.id/wp-content/lJEEOCPY1_iim5VOL_XNgsFX/Company/Accounts/
http://valkarm.ru/scripts_index/J8vVx_YeqRCr_KH4A2oU/Secure/Online/
http://vanana.co.kr/4L5D9di8Xs_nn4yiop9_EBQMOL/Company/Online_billing/Billing/
http://villalesmessugues.nl/EyHHV_zke2gQGqu_Tj22aVRD/
http://villaprinsenhonk.nl/AT_T/TUx4sK_ltkR6QZG_pkCF4/
http://viticomvietnam.com/ATTBusiness/QXuFO_ZwFhf4Fo_cy1UPGRiD/
http://wavecrestaoao.com/AT_T_Online/SgxN4A_XDpWrx4S_aIxyIaFwgII/
http://wiebe-sanitaer.de/ATTBusiness/2r5TJ6p_Mryr9Zatb_0WAqVWu0i/
http://wintendery.ru/8S8Pu_IDvbdAUZ_CBo2kG/
http://www.delphi.spb.ru/AT_T_Account/0MeMqDW_acPbxGS_lmqpX/
http://www.ehpadangegardien.fr/wp-content/plugins/TzqB_cnV-OTDeMV/8k/Transaction_details/2019-01/
http://www.jackservice.com.pl/Messages/2019-01/
http://www.medifastpeoriaaz.com/EEzhrqh1nWP_rkkyYI_FzxZpLY/Organization/Account/
http://www.pivmag02.ru/Rechnungs/012019/
http://www.tapchisuckhoengaynay.com/wp-admin/Attachments/012019/
http://www.traktorski-deli.si/Transactions/012019/
http://xn--22-xlchp9ao.xn--p1ai/JFZDZT8U5_nGJdjifl3_vax31h5VVUs/
http://xn--5--6kcli1co1a1g.xn--4-ctbbkbb9af1aqi5c.xn--p1ai/S8pdbpv_vWce03E8_eigmo/
http://xn--80adg3b.net/kE9_6iaxBF_WWLBR8Mxnu/
http://xn----8sbfbei3cieefbp6a.xn--p1ai/yPJo_ilQ11KNki_hpjth/
http://xn-----clcb5aki4ab6afi7g.xn--p1ai/ATTBusiness/iStJKD_X0yxHY_y5WpklUyh/
http://xqu01.xyz/v0JD_OTnC7Q_8nPd1pxzi9/Secure/Accounts/
http://yachtclubhotel.com.au/ATT/0UuPd_uoGEQz5_chp0Tj46y65/

```
#### Epoch 2 Document/Downloader links seen for 01/31/19 ####
```

http://%D1%81%D0%BA%D1%80%D1%83%D1%82%D0%B8%D1%82%D1%8C-%D0%BF%D1%80%D0%BE%D0%B1%D0%B5%D0%B3.com/corporation/Invoice/3136971110/oiil-5P_MWXcu-4U/
http://206.189.68.184/bPsL-q3Z_MQ-FCI/TK55/invoicing/EN_en/Companies-Invoice-4754491/
http://206.189.68.184/New_invoice/bXjOj-7sx_lAKL-2b9/
http://247dojrp.nl/xerox/ZRJfx-7ZJ_JgojTwe-6Q/
http://2647117-0.web-hosting.es/info/New_invoice/IPjmN-TRBdv_jmSHauoH-PE2/
http://4evernails.nl/tksE-ab_isovH-7u/PaymentStatus/US_us/Paid-Invoice/
http://55tupro.com/document/Copy_Invoice/88072393/PnYdv-3eKXZ_mW-kop/
http://72.52.243.16/pHSPU-bi0a_nsbUjtygy-HN/EXT/PaymentStatus/EN_en/Invoice/
http://alicecaracciolo.it/wp-content/uploads/En/file/Invoice_Notice/yAmc-KD5_cfLJZV-V96/
http://alirabv.nl/En_us/download/RgFNU-RP_ciSna-QbU/
http://alkmaarculinairplaza.nl/US_us/company/qQPoi-yDobl_Yd-kq/
http://allens.youcheckit.ca/En_us/Invoice/152191368084/rkxd-ELj_bpVeGgEg-d1/
http://alliance-vent.ru/En_us/scan/924481714002/kLXeZ-VG0D0_LXzmL-WG5/
http://aoxti.com.br/scan/Invoice_Notice/qfWx-h25eI_xIybXNj-75/
http://apartmagabriela.cz/HWTT-u0_uu-BL/ACH/PaymentAdvice/EN_en/Service-Report-07444/
http://api.kurulu.lk/maquc-4LTNz_Sp-wl/INVOICE/EN_en/Document-needed/
http://apotheek-vollenhove.nl/En_us/llc/Invoice_Notice/556745098/vMDme-GvLW2_zqOlxMVf-8aP/
http://arkan.cv.ua/document/Invoice/VkoJl-cD_i-S7/
http://aspire-zone.com/fsFne-HDfrh_b-MPV/invoices/33507/67268/US/Invoice-5368989/
http://audioproconnect.com/US_us/llc/Inv/mtiIJ-W6B2m_H-t7a/
http://autoshinemv.co.uk/corporation/Copy_Invoice/40332794884372/cPnpY-P5lu_Ne-DIx/
http://autovesty.ru/reTB-i3_VqRWqeBb-d7/invoices/0311/9186/En_us/Important-Please-Read/
http://b2grow.com/mOaad-jvlw_p-XKb/COMET/SIGNS/PAYMENT/NOTIFICATION/01/30/2019/En/8-Past-Due-Invoices/
http://babetrekkingtour.com/En_us/xerox/Invoice/oRbv-Su_OvA-hY/
http://backuptest.tomward.org.uk/US_us/info/Inv/24184421841/qLMA-99w_ErDTjVQ-8R/
http://bestprogrammingbooks.com/EN_en/Invoice/iuJQ-0VMN_KjsiN-6L/
http://bizzblog.nl/US_us/doc/Invoice_Notice/pswap-jguB6_jaZ-0Xi/
http://buzzplayz.info/tlv2k5j/En/xerox/aqrCT-u5z_KYLQoE-Md/
http://capitalcutexecutivebarbershop.com/En_us/Invoice/9050102/lQQN-sb72_NdIrvxbwS-0o/
http://cheaperlounge.com/nYIE-7WVH_ZZFjGYt-CsA/Ref/3824484485US_us/New-order/
http://chopoodlehanoi.com/GXANk-LG_ofrxefk-uh/INV/62826FORPO/3254590038/US_us/Invoice/
http://citizensportinstitute.org/US_us/cVFh-M5_E-eH/
http://claycrete.kz/pCaPM-fzfhm_fFcV-Zk/INV/02727FORPO/259584581835/En/308-41-691139-285-308-41-691139-678/
http://construtoragarrah.com.br/scan/0732423938014/SZxfQ-OQ_JlIrYwQeI-Nuh/
http://daftarmahasantri.uin-antasari.ac.id/En/info/Copy_Invoice/eePe-bGV_SmPigS-4Wm/
http://davidcizek.cz/Invoice/ifKgg-jrzA_PvC-a7/
http://debestedeals.nl/doc/Invoice_number/092659920000/PWUDS-69mwg_XIfD-b2/
http://dentalradiografias.com/ltdC-uedM9_WvnKrtOlM-ttL/Inv/03406958751/US/Paid-Invoice-Credit-Card-Receipt/
http://detroiteventrental.com/EN_en/doc/puewh-Ie7_dgaq-BZ/
http://dighveypankaj.com/XhxjF-sfIR_SFDva-XI/Southwire/BXH84438421/US_us/Companies-Invoice-87812441/
http://docs.web-x.com.my/yJoPP-GtDo_Wlvklkt-RN/062410/SurveyQuestionsEn_us/692-52-425970-830-692-52-425970-602/
http://dominiumtwo.com/EN_en/company/New_invoice/7493526056601/JEkX-cT_I-rD/
http://dpacorp.org/Inv/yNive-T8_biRK-BZA/
http://easilycompared.nl/US_us/corporation/vPEd-OWM_jt-Zb/
http://eaxo.info/En/doc/Invoice_number/kUNRf-FhEB_Qo-tC/
http://edenpayventures.co.ke/US/Invoice_Notice/Btqx-rV6I_UQGZgE-5pu/
http://edtecnologia.com.br/EN_en/New_invoice/FQgV-DTe1L_owWKwE-m5/
http://elekhlaas.com/En/corporation/Nkfe-Oe_FGumAKH-Ul/
http://elenamag.com/deliverstore.com/MvUA-UCLZq_PADCp-4QS/Ref/031313720US_us/Important-Please-Read/
http://engba.bru.ac.th/images/Inv/NhYTp-Di_jDBzfddOC-Lt/
http://ercanendustri.com/company/Copy_Invoice/QNzxO-wm_hbMSI-2Lc/
http://escorter.info/document/Invoice_number/waoK-BDHbD_pJFRw-WQg/
http://euniceolsenmedia.com/doc/Copy_Invoice/WfWul-PrX66_OaQobr-syG/
http://ezassist.nl/oENv-12FT_Uvc-Q9/PaymentStatus/EN_en/Scan/
http://fazartproducoes.com.br/EtUpx-6w_s-TG/2932330/SurveyQuestionsEN_en/Need-to-send-the-attachment/
http://frigotechniek.be/download/New_invoice/ZEZL-0oRce_GOfXPjKU-C8/
http://geoclean.cl/US_us/scan/53893290412263/nPPp-2wNH_TlIEsx-xw5/
http://gofy-tuinbouw.nl/En_us/xerox/AeeWz-Kw_Ir-Zju/
http://greenruby1.com/doc/Copy_Invoice/GPXCI-xt1_Chok-XYG/
http://greenupassessoria.com.br/36520103003/pcpV-Xo5L_ekLX-bdA/
http://greenvisioneg.com/file/Copy_Invoice/dIDn-8Urx_ifcQmYMh-YE/
http://gritcoworks.com/wp-content/themes/twentyfifteen/lqIjn-3tix_JGcVVHidJ-Vds/invoices/23850/6486/EN_en/Invoices-attached/
http://gritcoworks.com/wp-content/US/Invoice/yxNiC-Pn0E_TAVrgnV-GS/
http://groeigeneratie.nl/Invoice_number/rbcrx-nKK_v-bpx/
http://habibmodares.com/US_us/Inv/WKru-Ptt5_DGFJxMhCp-AuP/
http://haghshenas110.com/tSbl-QKW_lWmAkGvo-jFa/PaymentStatus/En/Important-Please-Read/
http://hiamini.com/US/company/Invoice_Notice/GErMg-TTY_Rayn-RrN/
http://host1727451.hostland.pro/New_invoice/cOlhG-kR_FgSMh-mmu/
http://hourofcode.cn/file/Invoice/2794872/UGiK-4ODJ_WUFxiSv-dW/
http://ifaro.net.br/xerox/Invoice/hqcr-fo_bzRtqz-fm/
http://ifsec.pe/US_us/xerox/Invoice/28866788/tvzYW-V5vYN_uTWwLQz-H8/
http://igsm.co/etep-3tF13_iy-6Ov/En_us/Past-Due-Invoices/
http://innoohvation.com/EN_en/Invoice_Notice/52908249/otNSq-vC_S-sGd/
http://itskillconsulting.com/MMovd-BZq_cAGVuxBIl-a9r/InvoiceCodeChanges/EN_en/Paid-Invoice/
http://itskillconsulting.com/US_us/download/2202146627436/EADV-We_PlFXfNP-5TK/
http://ittarh.com/zbyoB-se_WYJnq-9o/PaymentStatus/En_us/Invoice/
http://ittarh.com/zbyoB-se_WYJnq-9o/PaymentStatus/En_us/Invoice\/
http://kamni-sili.ru/llc/Invoice/bcXW-L7_ABThXD-ZM/
http://khaledlakmes.com/En/llc/Inv/hTIE-thoP_YOi-WPv/
http://kingdomrealityministries.org/iQQS-4VJA_gUbgZM-Sjp/invoices/37069/4218/En_us/Invoice-8777340/
http://kostromskoidom.ru/xerox/Inv/BMrF-SLqmg_wOeoYxb-H2/
http://kozaimarinsaat.com/TLEXF-tCM_IZCTG-m4/Ref/3480519939En_us/Paid-Invoice-Credit-Card-Receipt/
http://livelovereiki.co.uk/En/company/Invoice_number/eohKq-s9V_u-9Yy/
http://lola-salon.ru/EN_en/company/Invoice/Trasm-dpW_Sozd-NSQ/
http://lostri-o.com/bZTHj-DMh3P_eeaF-ew/M61/invoicing/En/Invoice-for-v/l-01/31/2019/
http://lucaalbrecht.nl/US_us/New_invoice/usRn-IxZ_ZEU-kEf/
http://mail.coralwood.in.cp-in-14.webhostbox.net/llc/94880653/TfnRl-uG_O-wLf/
http://maxi.poiz.me/corporation/Inv/722770976578/gqCHs-KW0E_Pwxf-cTH/
http://maximcom.in/dtVSy-Sxf3D_pgLCAR-01U/OQ33/invoicing/En_us/Inv-02056-PO-5Q971975/
http://mediarox.com/scan/Invoice/BEFNn-9zzs_SKu-fo/
http://mgmprofessionalmakeup.com/Invoice_number/xtyK-Qc_lwtHeur-YR/
http://mgmprofessionalmakeup.com/invoice_number/xtyk-qc_lwtheur-yr/
http://miamifloridainvestigator.com/info/Invoice_Notice/cFdL-TT2F_sT-2K1/
http://micnet.site/En/xerox/Invoice_number/07534977141/PNDwX-QolB_LfGZ-83r/
http://mind4heart.com/BpLQO-DopbJ_TMFl-2An/EXT/PaymentStatus/US/Outstanding-Invoices/
http://modamebel21.ru/En_us/Copy_Invoice/aOhLv-mz_H-NF/
http://models-blog.ru/En/info/4260377266/zUNX-46_XfZ-BQJ/
http://mohasebanaudit.ir/gTxE-mQJBP_AhEL-3XW/
http://moneylang.com/bZZpC-Rh_JPmUB-MVq/EXT/PaymentStatus/US_us/Overdue-payment/
http://moneylang.com/En/doc/Invoice_Notice/0374271/AknLI-mB1_u-4gP/
http://monsieur-cactus.com/US/xerox/Inv/bjHl-dq_fo-IR/
http://mostkuafor.com/wp-content/631320875/mufb-B1_qoBz-LR/
http://mp4download.nl/US_us/Invoice/GtoF-lP_gbtAv-USW/
http://mulkiyeisinsanlari.org/esrna-sZHTl_scayOEk-LS/NM735/invoicing/EN_en/Paid-Invoice/
http://mupsever.ru/llc/New_invoice/LMvh-tVI_gfaCpyV-4k/
http://nail-belyaevo.ru/En/corporation/Inv/zWxzd-UIK_OdaNHVP-v1h/
http://newdentspb.ru/US_us/89690158390/NlPD-WGqII_LOLI-pjt/
http://nkanyezikubheka.com/En/corporation/9344553/GHwzQ-C9DHn_azsOQ-sIW/
http://offerpics.com/US/JrukO-Tn_GmRy-OS1/
http://olgasavskaya.ru/EN_en/corporation/New_invoice/156947959466/egAb-Gw9Ca_NNwDV-m0/
http://omega-3-supplements.com/zJLqg-pTNCJPtefbtzmXe_MIWxxrjJZ-If0/
http://pay.hudavaqt.com/llc/Invoice_number/gCxF-bq_Rs-cu/
http://pcltechtest2.com/xerox/UbjC-lQ_hJZUg-ZOw/
http://pcltechtest2.com/zwBbb-8m9r_nWxFr-Xu3/0361297/SurveyQuestionsEn_us/Invoice/
http://peyzaj.site/wtRtG-cLFjV_OVgb-Qm/JP209/invoicing/EN_en/Invoice-receipt/
http://pishtazco.ir/download/New_invoice/hKrGE-CJ_SJrEKOBQ-6c/
http://plusvraiquenature.fr/En_us/corporation/Copy_Invoice/DxNvK-9f_bYIVLcSmI-wt/
http://printingphuket.com/company/Copy_Invoice/Hbqs-5K9_cM-gm/
http://prosaudevacinas.com.br/En_us/company/dkkZ-HWOw_RRSMlLqra-Blq/
http://psychologmv.ru/info/Invoice_number/899771097/BAqcv-t2_JFcfqzxoR-7Gg/
http://pwp7.ir/yFdd-XQHGS_WoOfGuH-TN/Invoice/769742842/En/Need-to-send-the-attachment/
http://qf.com.ve/NBOvm-NBJc_SVxzkjmw-svu/invoices/36473/57592/US/Invoices-Overdue/
http://raj-tandooriwidnes.co.uk/En_us/document/New_invoice/eUMxS-wRbj_ehll-nSO/
http://rehau48.ru/US/Ysoi-zOl_qqnyVs-bYJ/
http://rusko62.ru/US_us/corporation/8535188921/cXWu-HEUNI_Q-lc/
http://sekobec.com/corporation/Invoice/FCRAy-7KO2_SmMDkz-psg/
http://sekobec.com/Myjxs-eD_zyRrRSfG-hUI/Southwire/YYU9341560470/En/ACH-form/
http://sepehrjazz.com/En_us/scan/New_invoice/2172227669285/hCOBx-G3fCL_DcimrraEa-mP/
http://shopping.solarforthai.com/wp-content/cache/wpfc-minified/BWLh-8cC_YJbiO-gs/INV/371816FORPO/342128572843/En/Invoice-219079/
http://signalcomtwo.studiosigel.com.br/US/New_invoice/CQCf-6dX_fvlpV-TTY/
http://smemy.com/ufJVw-B7r_CX-ZHc/Southwire/PYY5327758262/EN_en/Invoices-Overdue/
http://socialhayat.ru/EN_en/Invoice_number/ZtZL-Z3_gA-hMj/
http://soheilfarzaneh.com/US/ONFqP-1Hwm_TAJBTdhX-ZJg/
http://space-camp.net/US_us/file/88936152577933/YPiG-4m_Z-wM/
http://stariran.com/info/Invoice_Notice/7923306556/HVhvT-vJi1_GfH-yq/
http://stroitelstvo495.ru/document/Invoice_Notice/3569330/NFnmL-I8Ugg_fDG-Z5/
http://succesvollekapper.nl/Uxhq-LMB_j-GL/EXT/PaymentStatus/US/Paid-Invoices/
http://taoweb3trieu.com/En/document/Invoice_number/zRzl-hgc_oxEbV-Rc/
http://tehranstanford.ir/En/file/Invoice_number/xhsG-wWCT_JIm-8s/
http://thebrickguys.co.uk/yYop-fA_ixv-6Kr/Southwire/RRG9568831059/En/Invoices-Overdue/
http://travel-advices.ru/uOGbU-WfrAT_qTVvZQyC-YG/Southwire/AAD588115110/US/Invoice-for-n/f-01/31/2019/
http://trehoadatoanthan.net/djcX-VdgTw_eIRicw-hR/PaymentStatus/En_us/Companies-Invoice-09134758/
http://tresfucinos.gal/Inv/39638630/DiNC-1u_gwjTNqrm-WJP/
http://tsdlold.ru/US_us/scan/sOsmW-7Z_gq-1j/
http://u31863p27156.web0101.zxcs.nl/UQmk-iTghr_YkTRwXH-AN/
http://uk.thevoucherstop.com/04606315258216/iDvO-bl_DQnrqpsy-reN/
http://vergnanoshop.ru/scan/Inv/oBur-V64f_M-uH/
http://verifybackground.us/info/43558716/rlfbu-qu_ZSbNnOEW-u2/
http://viralhunt.in/US/company/New_invoice/XHuq-kEPKD_PHRj-0q/
http://voimaintainanceconstruct.co.za/En/file/lbWM-z8Op_PpSryoi-ZEq/
http://vsochi-park-hotel.ru/HBZNy-7LTa_MhLC-VNN/En/Document-needed/
http://wiebe-sanitaer.de/XxNTd-zIYaB_wSpHU-kW/Ref/8600058563US/Need-to-send-the-attachment/
http://wiserbeing.com/En_us/New_invoice/FMYc-HPk_lVFjYO-dHY/
http://www.247dojrp.nl/xerox/ZRJfx-7ZJ_JgojTwe-6Q/
http://www.bxfwgc.com/US_us/download/Invoice_number/AWOa-qW7q_DhuhQDWKF-Qqp/
http://www.deadseaskulls.com/bADxu-uEFR_fhsNHeVZe-ha/InvoiceCodeChanges/En/Overdue-payment/
http://www.dighveypankaj.com/EN_en/document/kjcR-zfBjV_LMUd-tY/
http://www.egind.ru/file/KNRGU-eX_TeTkeh-Fvv/
http://www.fazartproducoes.com.br/En/file/Invoice_number/qqweB-BQYL_dOVcup-8XL/
http://www.fenismuratsitesi.com/EN_en/llc/ryquW-2xuK0_BiwhsP-3ay/
http://www.i-rate.ru/fdrv-WP_lcJulzOLT-4i/
http://www.kelaskayu.com/doc/Invoice_Notice/rGCS-N2Ql_Po-1QB/
http://www.mulkiyeisinsanlari.org/file/Invoice/109696281215901/dBrR-udCP_sfBmGL-4sA/
http://www.novacasanova.band/rWomS-lyE_onFgxAVf-us0/D096/invoicing/US/Companies-Invoice-72334918/
http://www.olgasavskaya.ru/EN_en/corporation/New_invoice/156947959466/egAb-Gw9Ca_NNwDV-m0/
http://www.pabloteixeira.com/download/Invoice/ucNzO-FNqc6_nkH-TQ/
http://www.peyzaj.site/En_us/xerox/Invoice_Notice/fqWGI-0kI_eGOAHLdr-5md/
http://www.smartcommworld.com/site/kazania/En_us/file/Inv/SKTH-6VRH1_tPQEV-vI/
http://www.snickarsnack.se/wp-content/uploads/En/joYB-fy_jnW-GVp/
http://xizanglvyou.org/uomisj2l/US_us/TdeM-x7_II-wh/
http://xn--22-xlchp9ao.xn--p1ai/US/doc/HEFI-CBR_mGsPgefX-ZL/
http://xn----8sbfbei3cieefbp6a.xn--p1ai/OdTu-04_vlKa-kQR/EXT/PaymentStatus/EN_en/Document-needed/
http://xn----btbghml4ahgdfobl2l.com/corporation/Invoice/3136971110/oiil-5P_MWXcu-4U/
http://zemelniy-yurist.ru/hbWv-f3iNd_ynC-MXc/En_us/Service-Invoice/
https://citizensportinstitute.org/US_us/cVFh-M5_E-eH/
https://nikait.co/wp-content/plugins/all-in-one-wp-migration/storage/uzFm-OZSNK_OJLDx-Fl/COMET/SIGNS/PAYMENT/NOTIFICATION/01/31/
https://sparks.ntustudents.org/US_us/company/OUqsy-ZlZ_D-r9n/
https://wiserbeing.com/En_us/New_invoice/FMYc-HPk_lVFjYO-dHY/
https://www.xizanglvyou.org/uomisj2l/US_us/TdeM-x7_II-wh/
https://xizanglvyou.org/uomisj2l/US_us/TdeM-x7_II-wh/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time 	2019-01-31 22:34:00  (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
c2b4f2fa1177c98fc2bec664cc40b45996e6a279b44ebfe53ae6b4811a274de6
beed8418c04af5514436e9eb4d884ac04120cb20674af8cb267462312ae5fa6f
713e3430c50a7a9f5f81fc2a9c8c28d7e2cfc5bd7d088c496f7558f33fc9c0a7
cb50a37f3c74ba159dfcf334562c59a2a55e75563cdd1852e6f634b5612dca8b
ac8c4b5e1d58b5b66535e0ee3a297259a6d2907c0c8fbcde04259a70960a5689
1ca522099559479c794b9623b0f361e3e3660e8bb4fe7f8956a9153f84058d2a
5f987496ab9ac737d1943f6ef374789ea0a847d7995cb5699c89545f49b72c6c
dfa04deeabdd9a613d73029d79098ae6cb9a0a6dc98299b8d57d4517ff0b0f32
47ee7e5da39e6493316bbc10bcadfd9029a2103fb45dcc4eec1495cfaaab8483
d04626dfa8cca7db841370b072cb648baff8e67c552d6ce2f54abacbc66fd4fd
38538755dac7ec18276126db5bf3c69427f065da094b9d1b97731645b823c79d
94783ca10babfa71834a87db91735b2566656ebe8a9b6b43f86460433642ba96
caf6812adb5f64fbe4fd4dfffb6aef539ebd4d93f8918eebc4b284f6eb781df6
011c22ccda68e333b61ef7d81eb9ff3eb48bf43e8d6b487e85a4242b377471fc
43b3dcee455b379b2f25f1136dd18b4c86d9b94fc71ed60791cd77cb6a55fdac
4f706ce9c252cc6f452b5b796bd9f56965ef4205075c9d9e09ad774c01068778
3929773cb3392d35716ee6a4da350645078bbdb4dd7fc186832212b9cd346e97
7e6330b5f989442ca7a7882164d6d1b191a40fd64367614a30ee62578bfcb4a5
c6872523c8f83e7d876cb500f8110d8776d2c206a5d5110d37f6b48846b2e9d1
53d8bacdabccc0f5bb4e866f956eed32acc24e01b8ce634f443922a2c73c1d34
7388522d799c39abbec59ac13e71f06f9b8b0b95d77324eeb6b738b7145405e3
1cb08e1339bd49b5c46ffad70b6497e76a3bdf06b7bf967df6670bb589ee4b84
50b6061f9a4b06efaa9c39424d4250bc879d2163ec86a7f38d96807de5d5a2c0
16859a9ed9e2f5e12a7f26e219b4bb65f055a0060501ac487dcb8e4c73d108c6
9dd1a0787b8dc36b830bab54d542b436c72fcbfa92c85423e566aea9e602054f

http://www.lesprivatzenith.com/5TwfiKgZzV/
http://efhum.com/HiUT2Pz/
http://dogmencyapi.com/HNE7oHjL/
http://dsuc.cl/wp/wp-content/uploads/hILRunEIdV/
http://sunshinemarinabay-nhatrang.net/oQS6tJP2/

Creation Time 	2019-01-31 19:52:00  (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
11507b2ad3e4840afb1abb031b732754c82a08777c1373a2c5be621b81b3b594
d0dbc87d1ddcf408a8f4b1176fe8060806ec81b6781c76c972f410f09e1febea
6d7170b803c58f373cda5a47a9fde1ced782dfe9340ae311672022aa09b52a27
5c4fadd6b0d5c38b1dc2e11cd89356e8de189a3b3d64157628a66f4cc193fece
ad342aeaac1ab8de1ab0cb3b6ca48839f8529c8e59db41eb77991b09775f6435
e564b27bd03cd2040412621c5e0837db00a7909a10673e66e5d0cfad4d75a476
f04a89d756a564783dba99f151de01f477a6b4d9f028266ada76691fd2465147
8eb52469da7d4dc8474ae2088a8bd5040022f0632403d6d4753ff231adca923e
572a4d419a8102e6806894e9ec15dddaf6cb9a39f7f88681d36b1ab2ab5ebb69
699fbd89ba57a1488f577563709f75fe112a264e46b01bfc1472880d751815b5
4b3a65558583be1b2c9df1a00afa83d555a7268782ac13bbf29c4d122a057b47
2282d124d98aed2642dd6cf893878e49d906512335b88ac030c84a93d9061864
458a4c3c511adde2a284a248c4586930b1f9dc2013d990f7b5eceda306488aea
e325822b03084dda6beb7011da00204ee22a1c586fc996b81437df09c54bb2c9
051fe55b5b66c87cabe83bc033ef8343a98d717b398425d88f0700443a1fa9de

http://esmobleman.com/jJCTMXV/
http://be.thevoucherstop.com/6MSBhcX13V/
http://vacature-net.nl/yXvrQlpziJ/
http://hamshoe.com/F7kXFWTiF9/
http://otpkabinet.ru/3qP6Yu1F/

Creation Time 	2019-01-31 15:05:00  (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
abee21aa2d8fd454f7a795feed4d28019acbb40f7ecfb33f6862a4e0717a7cc8
8e165a48ebf9c2c37b835fdd270ac820c345d5a603e78c423374a75b2422538b
0d66f69ed8a78b7bf78b4fad40f025fe8d95633f9dbc74468373dda5e33c9dee
507644a16369d63ce2e49cfa7bfff8670e9b03bf761b9bd61fc6144009487e6f
67aaeac05447b9c7c0c25dcb309eb4b88701219dedbfd6fd845ac90cce4286fa
104fc544546972fa4817c01a5b2aac6c2b368263c94f38e0f51002c2e7a4261c
815a61401c36cea05b359eb4b57309f0e6406604dbc426fa44afe451734ca208
714118062f8f326f0d9643bba49120e7164e71ba8187eb1ac056f9c7f38c7332
78dca34f8a1a8a4c5cef81fb0169e93050992826d9a2fae01d107a7fb1d978dc
f7090329fa701d5038f32f68a286ae9c98fb73df6aae9ff6cd1c7bbbc40ca8a5
e62a5b45944a94e5a487a22e1d2da1360add8d47a21460d70e89235166f1ef8e
1e753aa7cae5d355e16773b9d832f865ab1564c0da8a9f5e31b43a154d00e54c
f8a7135496fd6168df5f0ea21c745db89ecea9accc29c5cf281cdf3145865092
d673d1c4ab41035dbf1128a5bb6a35b9924f034f7b610944b69dae679ab82653
bd73b87aa2cb2aff45f3e6ff08ef1a7c785b2cde2c2fd4549b0a05ba1c4ec205
a2d87f7ce3a557f9df17c3fb8f7ff08ed4c54ea87fc5a2f399932afdd6e595f4
c4056963c2cba9063438ce30dfcd7cf63f223fa7b83c1ec3de4f3112adc1f61b
c3d9d33f5a42b568c66214edae4d7b6e1fb3e46aa410cdf919fa1e28a93d7b3b
f0f901d95927312d6545462c0cb3b188603728df79d56e395fc79a59398803e9
5023d8bd8a16ea77546b90ab2d2d0270227d00672b1ccd57b36cbfb34224a84f
ccd93a0d72b0441d44ec0f941afe33a5ed5ae0d2130f7aa5d2e2df4a4adf4851
e062b3dedecfdda2aa68c4c95251f40779824428126efd0aed6d93c05eb1189d
e810a0987b383c35344ad7d638be84dd5efac4170358aab4f29dfc258449df67
8af0165afdb47c04e93b4c9c8f740ba4a0e24cb06f352859bfffc3beded30a18

http://regionconsultdom.ru/m6CQV5ShCN/
http://debestesneakerdeals.nl/rfpcbEHsL/
http://37daystocleancredit.com/cutSMIcwk/
http://royal-granito.com/zCDBnxo/
http://salmaawan.com/g1YNf28pQm

Creation Time 	2019-01-31 12:53:00  (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
fc07800ebaa101f5694ee7ed0023bb5db130f4adc8c48600d1e3b7fc5d3483ca
654c7b79f51329ea5e5f7224d58db67cf9451855996f1639761a318874dbb830
85a96e158f4341921049fe7c994a57ae68f5bfd64eeba44ad2c7316f225a77d4
fc1d015ed3878d580aae8f5f706de4bc31b14f596c6184e1ce0e2d8f359fa4fb
86dae0db073ac12ce171b7aa754269950f6a780b2edbbe2eb8512946fbbf16f5
a13c36c4e726315b3364535db3dfbcab38075bc6950fcdbdb17b6825613c36a8
f9472f92c5044c3e35c37b74875a27a8c5ebb0452ca846368933a2959c67feeb
4b77a6f2073d20c20f1e98c1449e475db79f2bd37090e41a22f18c16078dc1b1
75d28f67bf5adbb1a2e0df516dedb1603babd304a6bdef2700439c4cff3df1d8
d75e5354aae85449f3565dfc33871abdb72955d5d1f5b10c5839a39c190f771f

http://ngkidshop.com/gmkvhyX/
http://teknikakuten.com/ifJAkRECo/
http://liker.website/od6HWRTR3/
http://billfritzjr.com/3Vg36tn/
http://symbisystems.com/9HlYMyZJ/

Creation Time 	2019-01-31 08:03:00 (XML Based - ENG - Off-Center Light Blue White)
SHA256:
dec0c07ac149f6b9c973e05579b5dcd077bb611a984faff4ff8496b1d3e89cff
63c2544665faf6ee418f989217f273b3c9b8645f48b062066d7605c7ef14a3ad
0e80ab8a274675a3ba2685c878781cd5283f35e2f8933236db5911fd4c19f510
5f857a083e2cdd617a96e21618be88e2842cb1febe9e5366ecc259b786abbdbc
e9158081d690f1ed0e53238a0c1078b313e01ec1d03bacd3004087debe1439d8
bbe97f4b06519f4273fd6197b69debbe8394adbebc2756248b5f61f592583883
e8ff5b391c99f2f9e6a69538adf08bad96128a13cfdeea021063641988c7de61
3659989719d28756f97c1c4387b45e12b9b564d417436724744de2e6bd0632ea
4d162a96e57a02059de49c34e59dd1bf74d27b87769f63a230ef04c6952b1c27
a1bba0fa00c8854507055ca39a759ef795d3146234e875fe9610daf74ee06274
2758b3e548422b249ed10b7243bc6a20b644ec059492707c4513a5fd308a1a44
12737420610b6ec1b0e464cb8e4e325e7386f4a063d388f98c45dcd9d73e8576
9c4848d575ed869761a29a569954d725916080993a78186a66624a5acf8823ad
417ea395f8b131f3fea7b29e4ba9c793a153392b43711041aa2f7e17bfb6e7a4
956e3ea365c941a59821395727ea3c86bdcc6d6cab1ee33aebf6fb65088261d5
3f461e5ed15c22ba62a1315957fd448ad3a1ce3bd4b38b9881e8b632a4431c49
ce0d34d5d684b1f9763872133bf139ef21adf30d9710fa93225b9f60d187f0ad
6f2e194c4b14b7c08ea5cecd17dada96b88e28449fe77959114fec25b820df09
e3bb03715536799f467b1fa3760f23055c8ecaf1db8dd4c07d8dcbcc2786f64a
30dc7ec6e046906331760d90f8f9aed2f9e600e0b61baabfefeb995f2ba53a54
acbf347be42b7ab38124acc6d19bc2a673e4e97d4115f56581e62d72de984966

http://salonrocket.com/I3OPEcSBT/
http://thinhphatstore.com/hXXTRwBt7/
http://www.caribbean360.com/bu40BVNZ/
http://huurwoningdirect.nl/jY6oOGy1/
http://stonerholidays.com/FC2ik3OP0/

Creation Time 	2019-01-30 18:54:00 (XML Based - ENG - Orange/White)
SHA256:
c34aa79dcff0915a6a679ce1d87fd0d877e6ce8f75d12502c6bd47165a9b2b77
d6ecadc6002a6255b9e0ed21d3ed5c7894f4bdb9c1d9a827e0148dfb43e7d2e4
ad2a75ff1e47b27e746670b33bbe2f22532cabe5b3125a7b4c4a655f8b0c3cb6
98f88513c210cb5dc57a6f10cb05bbeda98c7d21137c07376e0dad0e38b512d8
b00995aa6ffe0169e2ef278bf7f034d8a2f9f3021b0d816358f8de25e030d6f0
13cf7daa7afb8c0e1e8985150d528cca08018b67259ef0e2a6fb848b41452f8e
39e6cd8e5d6579de3430cf01176fc8158d1dc8d0e66c3679ba4a4c1883416b44
621268e453649c84a367b29268e42c06b93267eb8ec5c0a5011db4a52f982f59
ad7c44e4bc63f9b195c013b1f6700515fb3428156cff63fa5b9a30beab6093be
bd94815720caa1443df82d6e55e6896940ee077126cfb50887f513451124d6d1
eadc032e11e30492e6181f5cb81af3b993629a9542da6f49cdce3e2819c8090e
5d3a7232270ee6aa7ba966f4ee0b15ba3e8e7085ff0bcb08ab6bb87f7f63f6c2
5cc39a41581960187717b2608e2a8e612a66ec6545d258eb5bc5d03cd8e2b1a5
107a73176f4328cc3882383b1abfc8db03ffc32fddc777ecafa420e1d5f94a11
7ae10c62f83cb24e7d7e0ad2184acc51edbbeb19958e7be86eaced9de225e25e
8b0e1e8f4a9f2755f08b6b671ec0ad5faff7d29ed52ab52be01f42ace9e3226f
33565c6d0e03ba05f24f29ee6ee48273da32f3109c22c022359670084ddfb3b2
9a1df1452aeb821365b7a63f38898cad5fd40bd77b0f9cf1bdca6600f00a653a
0c545fe15ce7d31ea0e93f2a55627c0896716a98e6fa2f65b5a43432b4357166
5439498f077ff6170501387ce2bbdb69ce28938a7f9cd3b8bce7a5ff2818f52f
e0578cc01f2fd922e8da325ef565db2347813425ca5a29eaaeffe8b3dab26a65
53678f222c13299d974520b91ee003bf17ae52c07b52f7ffbaa213d7c112d0f5
6b3cc56cdcbe0116426298229e508139f9a38d7b599dc3675cec3353b217e21c
66f6f8c1c4e5b39534f39831b6fa1c368273b06abfe66e4ac94061282e5ffac2
a656b2591896c2a863d0b0432ab4e7580959a3167e592624fce5522b2078e481
dec67cc071e9fde6da31a40308330bd5743db283d46d6655da6e3f14114d0554
fcb02aa7c4b2aa49db81fa4259518fa19b25dec27e7f5f0e2ca9205bbb8fc26e
fc6d2db3704998fc9b7c2230478d6a4283e7f3fe4e52601762aef5511d5bf4c2
6ba7d85a1c2e1d08f0d563740d6f6e09b2a6dec41dee1973bfd8010b9052c432
425b2528f40e14abb0e666eec28229cd1e862f015a9900e8f28c829d8d2bd32f
54439b84a773c1d09b58a6387e59d9f30c97d85beebc741db9535c35139b70ca
6fa44fd5a0d199e993ae442fa8e0a3095632ef8f1efd35f56450b63ed3e4e93f
a22bad901da9af8b01cf63c4b041792ad0e99d6d06577626172d4bb5062321df
8a7d3bceabe5d7de620d9b3052314b546cf567bf55cefc329cd4ed6ac0353fdd
a536df75dad1c8489e77e638add2e5c1ea4c6b1e3681d16971a9b596baf8be1b
c81bb445c4a03a6a6be6624794edb9981d1e0e289e21c5acbfb676683272f391
b7a2aee510cc094c3aa68ab2f7acb8b54a82174af6f68096dbf7592dffdbb591
52f4ec50cae7d7ac8bc2a2c5049da2905b64f7e3a506e90178cad3cbc614bfd6
c915dde471e29b86b297823eb49beafaebffdc609d04922fe1e21c66b33d4e47

http://labtcompany.com/kixeNn1wNu/
http://africabootcampacademy.influencetec.net/gP2jFvH5te/
http://fixi.mobi/wp-content/plugins/tMp49efcr/
http://accountamatic.net/BmHU4GA/
http://palmspringsresorts.net/ta8ettuU/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 01/31/19 ####
```

20399f98069d9f1f5226dafffd477f448030718c789fda33ad397b5789b8cce1
fa674ee12a393da4b2dfe68bc669acb28cf84838cf4b5167f504ee5df3dbc881
05f6754c27cc71ad9d3e0b8362a74382a9131f303a6e188a23a9bed53a6379ba
483c0177f3e6c77c96f85ffcf3120df1310f539e24458da582d25decd8286115
371ae524a4cd11eeda3cd3806038c73b07b106c2ce58b4f431dd337d974cc73a
48edaf993fba3510d77097aba3c5edcb7df434160d42494d2da71a8cec8366ee
922891a7a8486408e55e1f4bde9e73e6baf5c04258839d7f4a591860d3370978
8c4f7c9c483db45e67653de4e0fdd0350d1470bb1132bba0edb3e8b9f7f834b5
3a5ee78090bfffc91855cafc958a02497da0798942d05e736adb11e06447e879
892963b00bbfc86b75d37e8f333916b1f724dd7776af3725a4c29628be88b09c
deef2372496cd0475ff7c4f731bf12429971b2b8eeff5b3e46d4327a7c7179a4
aebc8c2300766765a0b82c50104a4b89ca0b7a6b64d9990998b33ee54d69fe09
1d1d9a7e2e39630302ccbbcc9a24b9ad6071ccf2078f6225b7f572661a58613e
7d33cb401085bec1e466d6f94a37f78896d8a52841c6b74bf3db71210f99bf57
76bd1238945e47a256657be51df0f5d2ec7553494d11bde9765aac6a5f0a53a0
a5bf246ca26ff59f819f9b4dde432dd754dc9906deecc0f72d13ccba5274d1b2
3eb774a3dd820abe4709f2d684409cac9be194fcc0e9bd5c7ae939e7e75e7470
55a47194e0e7426d41e31a734f43f6d57aee1b64d95c08e33933b6b697d84f89
ff1c98155a0090e0015bf1cf6ad15f6432db2e08358505851d3f52839f61a469
c7f131d8977977d40ba94d85cf8ced0e8a7e644f01284884a4c89bf9e95e9f14
f48f348855d4c3e257415bf463cdae6a5f5c5a3900b2557f5b3e6505b0a1bf39
a3f8f0f0229d7c0907a6e4c47a9f4b47ef3d9d1097a71796cbb6517ede83b4d2
bc6765f2d75080c746618811ebab4a9616522f1fb55234c4427896163b5630c5
c6d6f1403a1cd2360bd706df8c63c41b60c92a26e1005e7d2f4643ef4e21a6a6
b3a135c7a5aea3f9c0f1f4f881af568cf38c5a5ffd733943b7ce153681e75cf2
f64b7dd506cc0d640829434b6603148670255cf8b8aa86a5da1700dd02353f00
143348f8ef59ad56b90e4e941f2de18aa644aee5e8a3396e3680e13d823275e2
896eb2d5dcdca3aec0d50de72fd3d2723c71fbfe30def616c442b1a9c2645e51
97d335173949f4d3703efb06f9a62b36067e88c86afd60d79e640ebd2da0ea54
986a11071e69d63c3b9ccb445a03b4c1d491dbabdb7b70262582257a20c75c3a
34d64e9c001ce4a5dd42ee52921992f04541b277b5c97a2ec514ee07d6dfaf2b
04bc2f297863c48b713c308bd94f5da12139bec9b3e715d826e0627b8ced026b
4d90a16a14085b855092be5e8478c40244015d3b7b43d6207870b78938d44f5d
4808bc72e4e8c264f320a5254244d4ab7c0e3ab8eaa25e33cfbd0e537bd0e4ed
e6302fb691da3cc7d4b441fdcbece5e77a09f9abc2d3b0744c5ac27169686f90
fa8588e93cac483248b9aec5a7fa955b65d07296518ef3977c52f1fc2e550c7c

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time 	2019-01-31 22:57:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
7c45eb206a28c7a4ec00c7df85768ecbb4f06198f3c524035062c66a02b54802
32e397f0162c954c215c60f4801cbaaa7d615a0ccede24a467466dfa2903dbf5
dac4ea5b990a9a9bd6bf2a57072a3abfefa2b4767f117f2daaabdc1a2e462ba1
8191c0a71dfcee1860c9bfc1346cca2154fe76aa8c8ef3a59680359cc42f6929
0c661e5988f7e1e17759c3a4bb73aafccfbfe9ab27509d3b68e7c8ba0fbe1460
caa788e21addf383dc7d26280693a3903251354d18c0cc011a5c6bb40ea66949
72a6405f7d902fa9cdec66709f35bfeeccc894e541329b8b7710c0a1caa6fa6c
0d29961633b0b6301ca1ffdb3988052c55dc7241ae5fe743fbf10fd84021cbe1
37811b82997059a85f6064f8a5663b1f4af739d238816147d46058c375b4ae7a
2cd82a8bf5d021f6f57cbbe4646b1db3afc463cd4a3f261c511bd5ff362ff757
135a1b0278442e31d559f770713d98d3a5f0e04db76a65ec23e01c1ef7eadc52
44dbd00929ab84c7e5324d5f671e59710e32cd17ffa8f4b143a860ac890653c4
cc01472276c1d32a5e7bd1f737174fb0707c2613ad738c36a4be1c677043dfd4
91130b1b6859b4394f2a14bf09b500000758188bdadb50719fbd20ce55a346f4
3eae2a5524e15bfcc8427fe700b413f8a4d0c32a07c790bc83bd25f1c1699f57
f989d2aefbda20268089ce551567d98b4887ac504b17cb3e2768ee96d3b8a2db
fa7a1db6fd5b5012df922dc035d668901d74f740bd6f58296b35b47ce26cb1a0
c40bea614380796f1479c21e4640c9d8df76efe044fddcc49b8cf1f3dc16a990
d08f26201494e7674b68b80ab70e2e51c6824a1ee164239b2d7dc95906fea519
984ec4af5760fed18d559200b356fe49b4af32ab979d129f775ef143425dadb3
8a31a5b38738b287ed94cc9dc1cde98765ed496e8994bc82b3cfa954be4b2c67

http://localfreelancersng.com/JJ5na9IyL/
http://pobedastaff.ru/6iYWKl5I_MG/
http://wellbeinghomecareservices.co.uk/A9Y90usX88aRT/
http://vkckd.kultkam.ru/QUxQZUG_9i/
http://beautyandbrainsmagazine.site/cfmGNuDVbnc50bks/

Creation Time 	2019-01-31 19:57:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
c9fc91ab64bebc66fcce5bf0e2a5104e6edb7f5e277af40fb629075adc10ab8d
03cadc62cf49c9398d3850d978ce7d7d9a1ff99f9951b9ff6a06c8bbccad7afe
1c14c9e7c77f22bbbdeb8ff7d2b2af7ca3a55dd2291b5a1bf7d92efafd34499f
a1160525bf3915fd4f2dd1537d1b7f66ab9123ab7f34d41970f9e15e97f5a44f
d7ecd092013bd187c9b10bba8c1bddc3fdf743612d04238f1ffec431468104b9
395399d5fe4e61fbf00715715ac602a1c148ccb68003a3c165d386f8141c1a94
9af7777057c7236d94485d28ab958944324abd9b0aaf0ebc795083d715425da8
c07a61a5b1ee83de86af92efba849440b6bce01e494c2bd7e7c7909fad309b5e
4c56a9814da81a0f35e9d74cc83828bf4a7f6e50ece537f91a2fe4331dcebfb9
de8f2dbf5b2410f660c79d4030adb79403ae1fda61e5eb9cdfcf2b14f311a889
7bff57b9e2b7c0281c441af7d2f0127cb98cf7f958f779ef0a76d1ca397775f4
ec0d2d376429f70b9e67e34fdd4d12f41b9e146b5685be0c8d6d33484dd2bdb3
d96d4fb243f59002d998ea7a0e917b9843ef8515d59efa2644cfe2abd0864903
1d7672dcab573499dc8c40dc79abcb3b918ccd2608b10db1e9284fa4db273a6c
1dc7f39a6bede1294afb1047e4deb436fffb193c94534267d85a9b82c546a28c
c5d7768903dc00438f5f0829cd74c3e70b2db10853c6f889f2c960dab11d3eca
387254ca65994c016873acea3b51f8bd875c40ce69cc5b18e3f8bfd6842de171
92a56b0192bbd2e4f12645b7759bffaa1047f6d3aaa24a66fb5cbb9316efd370

http://lipo-lytic.net/YsyUPPLp7_kNtfY3gta/
http://pokos.su/Rei7MfvAffl/
http://abiaram.com/eVLGwzc801WCwk_LVs3vJCTR/
http://tmtdistribution.nl/PyvDEzvQmPYzW/
http://domikivlesu.ru/PG2NHd4qRjsw_wvrg2/

Creation Time 	2019-01-31 14:53:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
030f63d90d94dd6e7d2aded4541d4fc228714b7c09105e951bff50ffbce037bd
477191029ce893b384f44f7f5eeddfdff2224e5095dd888b741585de604248d9
d98f213fb4802c2a0443ec4bac831c3d727ab699fd6858316ee89afda8849042
7c31beea54fef1cbbfc8b174e7214198d6157fe6ddc0567be96654a9f5b0781b
d70b41929f2d61205adb2c1c577336f7465b81024a7b89511a95b941d2b2eba3
032afefd8fd0d5e5aa09bfe27582264098174a0a6ae6b93a9630d12e79e43616
6c936704246a44ff7b499d7fa8e8108712e2964268302144e9c7d5ed3e3cf64d
f641c9cb6cf447ba1c325898f9b7c263ed0490ee959d413c1e5dd193138880cd
2db02a9231f5ba816a8000c1689c7013a15dcbd219697ced7cfe93c3dded0f59
4576b34b831f5135da7a96c29b44b254d89618a0e2aa5c67f164d9b8eef82b99
591e6d89dd90769ea3e93d25de2187915d36014ef8b7655eb24f5a1ca762f5ec
f0584b17dbcd91b2481d9eddb0b7746adae17cfe306ef67c6f00c9fcfd4e60fa
5c4e58f9329e8beaa892a14c481e0571de8afc93376cce5ec415dbbd46b2060f
640289b41b2a890307dba5ef5e1cb7a0c75ff44dd3905d522409c9bcfff2b42f
b90428da8ec155380015412d589a09eb81e12c4219177de37afc0b79c8305b64
a2a9425f8e5a8e8d5760bf89454c6fca461558dfbe531b45b00423877c48db9b
b00e113543fbd6e270320d1733d0019300821edf2d505eb226c77ff95eea85e0
b7acc9715cfaa9fcb2b6a2e37ae12bed502ce690031e34dd123f57098e6e90c7
e528fa1e2373661df7846af13424a22c427955c6775933e151c9fa3ddadd5941
87dffaca0750d1d1d577db88e2b4124a3c444c496dd0d07d57e0f025f4ac2923
c79449c3e97af2d2d5b702c3eef28aa081ecefabfc35e5059d73a11715cdedab
883a63441957cf9e15317462bd17531f866c7ba11f25a4e0c66714e5b609d427
42635bd77ce436be6b894d9723ac348070d325e4b129d0b9e1a4be02882f6f57
ccce9fb71198b22e350abd5899f110f55e57d8d42a8c3a60303d4ac197fa75bb
c4367008302b07c8ca8fc9e4aedfe8499b8629f05f616451942cfd69884821c9

http://cardiologiarocco.com.br/hcr62qm03s5k_Cxz5E0/
http://etnoselostavna.me/04WMQVc0GT_KTIgh7/
http://www.kvona.com/60URNkr5/
http://dansavanh.in.th/wp-includes/xxZl0ALBp7f/
http://747big.com/WmSGWESw5CpppE/

Creation Time 	2019-01-31 12:34:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
d78a0f301dbd1cc249bfa9bcae6f93138501e59034476ba4672787a8c0749276
46cc3315804f8863df2dd76c3d329f8773bbb9eb4ed97537120d37186a9c7949
b66d06a689e185c90ba7d702cb7019eb99c8c750c4b42a603d705d01b3155c6d
c72a755aad9a6229159c5154bdc47e7eff05716ba7ce3eda10b9d686278a1c74
82b1c26929ba1795797c953f2276590668ce8b4f4fa1f0d2e7bcaf2bc350f8ed
26f1e39b5a74c612188e89df283338e0ba3ec1cd39398aaa1e9ea22bfca52fb5
bed793e3172500c4ecedc5acd888e6cc6e76ac207cecbbf0603c968f6b0f8102
5e119f35ba8d10eb520b46852a99036ad0c2c67b797f8fc68e9219f5bf67961f
b10f8e5a4b4f7a0d27d2e7d27890301b23a41d7e484d43bd7831ba5dbc12a979
fd2922fbaf1b31365d59c00d65ac763fd6bdf3a1575f84710a64b798c7054a20
6d12719045c143536b2e04309fe197964aea1392ecac9e132ee64394a759a238
7714cb5e5b95866fab355fce1509330f2ba511cc352f7d13e1445baac0cc3a83
296caff543bdf15d441e133b8f6918dffdf3aa9f2b71d6a0dedaac8efbd1e236
8444778e447f56eacd614b88d99965400f6adad419c418968f8bdb2dba6e5b9b
b4b2fb09b27157a53d8e840e71f8b46f0a7be970ff91b0cf3937ec425c4b3f15
6556cf135b5c39f91c8b87adce91a2f7698548cdad8e7344927516c59d3ca7e7

http://phoenixevents.ch/BMGpSzzoMh6sw/
http://franchise-atom.ru/zpXn3WBpl/
http://successonthespectrum.com/wp-admin/Ad257xD/
http://new-standart-outsourcing.com.ua/9EXmLER4jWqED_P1kz/
http://clubmestre.com/BQgHXCngNDO/

Creation Time 	2019-01-30 18:37:00 (XML Based - ENG - Unzoomed Indigo/White)
SHA256:
674eedafe9d7bfc4841ff621464fcde9eb0c47e41a22fe130c1cf2735b064509
474f9a25cff4fda517024fcdd94c5d90509b5f36f325e2c20afe36b323fc4b1b
9d29ae7e81065a81b4cfa12b32965142ba776c659db91cbfb4eedf4ac6d95c56
ddca9ff437e18755accc9f61b8686ad5693ee39b778afb649e5b29975696ad1a
9eb78e6b48d0f91480a4f3723c3530db1e22d824fa5dc720205c9ddc2a5d82a2
9afb2c2d5caa4d39663fb64d8e8371ff13c4469cb667ce7f1b8d9dfb27bdb254
9a6454c92844e42cb1a8b149c1cbf723c25751e9eb287e4077b29fe2f9f1ad62
42cb23478fd54e8111bc91f8be1fba1ce11cc0504d534f554e7b46ce002a5fd9
559a6d5145b4f24b9a33627f87c1b64d5bc153f2f96286aeb03bbfa4619bbf1f
9caadda4a663ff9dff4f6b0503746473a171293704e61d2bdfe223c7298e82fb
ba510aad6def980e77a030e6dab5c83f71c1b4388da1424b28cda5a6ae3149ad
9dbeafc84b5a2b5a262a08c9c365a3d26edb90c875de8006235c61afcf208cf0
fc00eaf93295016c6fac01fe485ddb87b2a8b4e866e04fb63fe0d965ad8ee73f
8dde7fa1339b2aa72a9995ab4dbb2293f10be6bfe8bab5162548654b9fbe9540
5209a1905e5b83df26dfb36c227d9dd744112feefbe5fc4b4b68884854cb012c
ca82082e6a2757fd152cdde0621122164e3330374e6697bc270b5157b7f2e342
d42fb654b64cd3d76d78b04a4c32b147edb3a6cc1f296cb286e726f7aef3db18
6224fb1d7476f463c2e1ed90b9d9b4da864e18517f330c1cdceec357401b027f
c07b23ea915aca4ea5edbed36578fe96d1354e7529c2dc4b37a7267a6f6a3c1a
1f8a542470e1968c7886fe62ddb2a0f6af7c69f88e5a3cd4b9556e05f7617748
b2bdf9af46eac373ba1e7c6e60d12dd7c82eb5bcf47a5dcea71892011ae4fe6d
3cb3552bb26b314269483c2b8aa39473488b3547c238133384f90df3ba67f4c2
9ad127e1917aeae3691e93d0cb4a2333ea377c63f256058b78c5e89cbb6e17d3
707cd0ed199b176a1b73b60588bee0896783e396335b437d3f29a5bc02dca1bb
bba9095afb990e28af96cc7cf22a05844b9620fe586b8b7230d4cd2c07976139
0a686292de88b8ebac38b31e54c3887067f9d10e70bb56d282797bdc20b26905
232aa81b4293f5f18e8f663f42b37060876239414463bc612f19874f5c818fed
6c8831ce656d03fe5adde8eef57622c2dc7c401aa804b25f483a166caf197940
083a8bdc82e1d79e4b10e4f4516d89614d2ddcc28ca64ffc430d80f4dd678893
2eb524409809b748ceb917586e7512e5239b5e369209e9e1464388c15ecf70a2
190669134a9642e0e7a7bc472c4564d6bbab48bec10de5d741c8245108756c7b
56347f3d0690ae4645fb1512c04390fb32620c2436bbc65b0f57f0acbf39778f
51c68e82ccebcfae419172d560a7f28630caf66e61d921afbe35b6fb87fbb071
3a2f50c5d5bdc945b62d6adddac479a03d36b79543f832f4c8b0264b10c6cd2f
dbefb92b3f59360edf9b4ffcb6f1d8150fbe27c79e5f66e4b60d21f4d951952a
910421113fe773c9729f79544f9979e87214424630dd8d8e76ea01e63d6b980c
f1a73d58aff86fa004a526f234989bbe9afe10b2da413f1584fa948a6f8cae75
89f264011de7ca61a7d4c2bf38d3d65825b9e76f9fdc1623ab4ba307d92d3740
362591ed5603ad8b8583e6fde15ae264a17f2d092ed4ecab685f276722d908db
e3f783c9f1daf48c11b7fd7e4e8930cde1d312557dd766bc562caa2dcf390ab2
fd04f5c1374406949b28682eecadfa0143104414a085753d5037d9a9770bd82a
cfc67fdacc8ea81a9b4929f97d83f63c1c1548a46ae55ddddc96438950cf7c5c
073899d574c21bda764ba7be189ed93c41d6436d420e3f244bed383a2fd07dba
65d6c0121e3c4408683265227e1fa6e8ed21c77430ef887af6a352c26e5e160b
66a21db6c1a95ef502ab6f90171491108e3e37aae7be4b313c25abdd65299943
9bf3d96297f69aabeb798428a08903a7abfab7095e8cd085fd500111e1feab24
195f1fbba17a9da3993520a1748c5f4ce30c4c16ebd0e2c0ad5742b6ec8a9df7
0c6e7a30a94ffda86d9b7013d7db1522486e4beff0b1eb8dce7adf17d1060424
6426bffd1479ee4537a40727f71befc167f3b050faf62176c478d4a0be467d33
0226d6881fa956c32a26ab9bdcab39da697d1f79c3932899125226915826210d
33e1e78e49bd1fa566d255ace76a7c772ffc3cf1bff75bcdb0cf036bab89229e
9efe884921894b1adf5a0be1be99b7f73fff9405867865e8049bcb98c349b28f
62cb368a378e8bbe83f56f92ef50cd8be313e46d05d1b15ea8d7ce87cadafed9
2661379c6fa6990cdb022af554f9ea5831f0f65229bdc337d1da1b24db21f7ea
c52a8eca6e15dc6f5d7324c0db8747be215ee517b41c544119411f41b8029391
c227ef9328f69463b6cf932617a632fa24247304d1cf4eb55e3d1158d4225eba
2d609f11283eca68c3bedb5ec68e5f84205b45e0226111a32c523ba577b38700
fc079387b815d1bc77849f962d696d527dc074c7e30ffc8cc25558a5116122bb

http://www.bizilocator.com/demo/includes/font_awesome/xzqPtpJUI0E/
http://fastindia.org.in/6KZnrJdxYBmOVx/
http://internationalamateurgames.com/l0SUE1sXqNZS_iNq1E9Ox/
http://mzeeholidays.com/NzlOnJC15j56z/
http://tidyhome.in/hAqGtqVkIYbhiN_x3H/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 01/31/19 ####
```

4f5641e7f9c595f14933d521cec57ae7ee3bb3fd533cd6534c7c2e4115df6707
0a4ce6893f6464cec43a7abb13d9ba4b4d5c40220b446512672e9b9c711d91b3
73231c6f9d9d64f28f82ab5b9ace571dcea717c2ddb3c563e7921a69499fbf00
101f2e29c3b8c43b8076731fccc975c57e61a8bc759748d35f3dc3a422470b58
45193ecb61aac0c8b3af875101e6f6e9db571b547923037a64568d0be1d7eac7
6df292449d813e61110a8f647ef8720c2d2c4fd8ac7af10c37bce9033b91460f
81d9e69682065a36473553b78fc4de348ec02996eaf42ab0804355945298d9f8
0125e13772bad1063dc9fba5510b66418e0cebeeef5f5faf2ca8163ad8160b8f
f0be736102324c7c54f6954e133f8f3a0d038e5ee76ebf3430d7dd141f2f1c08
b86a3aa5f09b802f750a1b0aff1874b0f71e0b95b149be69319b1d19aef63650
7cd48b6e9a5cb35e8551292573ef7b293496aa7beed1e7e68a948cfd254b8492
5dd93601aa306c8622115fc1ad07bc2c1215fa7c9dbbf8ad833300fe2ba0a1bd
7447c7180b2223129759c3dc361ffcd7f1c4fdd346917b6d0aed7a050e5380d8
ebfd9502b37bef9de967ce3cc380cf62b3d75d46dbdad3d6f737fa038c74de73
d76f7a56c0757cb98466b4f4b0a02205a1c71dc731b44dd1d3439f03e4c5e49a
558fa999592ddab44ae7ee9f524c7d09761192d18977ce1fc9f683d6b015a31c
c2106b9b0fade21cd361ce8f99613dd1ce36f9afc4df9413e9b0ee1db18a3f32
f75441017e27a49360f136042746c93e5e19f27e8213eaf04bf6f73dec0977a4
807fe6566c08fcadc1067fe97acd33f86042f68795b4390280ef582bc8c6eda1
8edc5709b1450d15b6cfd85dd4ef6eef011a673d8a88132058e13dcf084b7ffd
11206b0cae5f9a9d3a8fbbd30aacf6055993b250f15b10e274baa5bc8cf708f5
0d78ee45682cc5ed1acece55c5ff1197b417dbfa190681a3db55dcf510478b54
7902241525a3c9d39b61175e364d46180bc6f3bbc56988c68d993c2812a5fe4c
a58b1bb92c9a4b9a7a3f088e9b668d36c4a50dd39f8625951e41a713b2338ec3
d70d4de7aa5c67ee78e7ac904c44ee4c77597e16d175081881c68e7bf4e8fde4
f5c71eb82e8fcb2cc376cb00b0201a97e02b82a59f35ba84d963acdbe3a5b6da
ba9096795df871c4502d2fb7db3b8a946dcc84c8cdf4ff6f63313887571e35ec
511969e25d6adcbc8b787222906dc10d39677a7a5b8748e03073a86899c30cd0
60d35515bc3911a63f8cd9f67b7479c16dfbebe0bc1b4474593917a2a2a46b90
45a9a81e73c157df566b804b019fe9129196c0578d252089bfbe01f542c67d17
23afe48b45b97d7acb0cd69ecfeef03676974c1b7485c8551f53a81fd4730cc2
f5243e91e42fb6df6216cdc3026e15580a03ceb241e7aba88cd92a75e911b26a
23c9f15c4f387ea1b9d80ffd7db1774457e2e7c35720627e64610f20e423db6a
df609f1ce3866c0aab35f469b4b30656bf574d2e529e6e394cec437e467d8b34
b7838adc6f24af95fb71b70e7b560330a692aafb1c4c03b7ef49b67a853df63a
f480173fe3fa405782747b7e9f33b81de362cdaba40007306edb96e603cf5ca6
750d8bede7d32885229286f81441b787204cc67bec734868aef5f66decea137e
126f95e4ae3a4bebe4d2870e80f7f2320270d7d96f440b3a1b9b72434f208c6c
d0d560ad62fa5db51fbc9d81c25ae250741f5bf5ed8b4416c03dc13af0e38424

```
#### Epoch 1 C2s ####
```

1.9.150.93:80
101.187.168.2:443
101.187.168.2:465
105.227.228.7:22
109.104.79.48:8080
132.248.18.45:8080
133.242.208.183:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
181.126.84.70:80
181.164.241.251:443
181.30.61.163:22
181.39.66.29:443
185.86.148.222:8080
186.71.54.74:20
187.146.243.126:22
187.147.145.48:143
187.153.217.39:50000
187.153.217.39:7080
187.208.214.53:20
187.209.66.50:7080
187.232.31.68:7080
189.131.162.36:80
189.135.82.225:8080
189.236.96.21:993
190.110.239.130:465
190.110.239.130:995
190.159.143.96:20
190.162.189.46:80
190.17.128.149:21
190.190.100.185:80
190.246.193.16:443
190.47.153.46:8080
190.97.32.17:80
192.155.90.90:7080
197.232.52.70:20
200.80.163.11:7080
201.142.199.76:465
210.2.86.72:8080
216.81.19.67:22
219.94.254.93:8080
23.254.203.51:8080
24.53.231.96:50000
5.9.128.163:8080
63.143.67.107:20
68.149.151.102:22
69.163.33.82:8080
70.24.147.203:443
70.45.30.28:8080
72.47.248.48:8080
78.186.175.183:21
79.98.31.206:443
84.45.230.228:443
92.48.118.27:8080


```
#### Spam/Stealer C2s ####
```

104.236.185.25:8080
187.162.64.241
189.210.118.95:443

```
#### Current Epoch 1 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

104.129.188.170:21
104.220.134.222:443
104.58.17.163:80
108.183.160.57:8080
108.51.109.34:443
115.71.233.127:443
148.103.9.108:53
153.121.36.202:7080
172.78.170.109:80
173.162.110.1:53
173.164.202.129:143
173.255.196.209:8080
173.67.158.100:7080
178.254.31.162:8080
178.62.37.188:443
181.61.253.171:21
187.188.148.16:143
198.74.58.47:443
206.15.68.84:20
208.78.100.202:8080
211.115.111.19:443
217.13.106.160:7080
24.180.7.155:80
24.209.31.102:22
24.209.31.102:8090
32.215.44.214:8090
39.61.49.128:22
45.123.3.54:443
45.63.17.206:8080
47.180.177.96:80
47.33.113.20:20
5.230.147.179:8080
50.107.8.203:8090
50.192.4.161:8080
50.31.0.160:8080
62.75.187.192:8080
62.75.191.231:8080
64.53.242.181:8080
66.214.30.150:8080
67.205.149.117:443
67.42.71.66:20
69.195.223.154:7080
69.198.17.7:8080
69.2.176.134:20
69.2.176.134:22
69.2.176.134:443
69.2.176.134:8080
69.23.232.239:143
70.100.118.224:80
70.119.159.214:443
70.91.215.57:22
71.215.247.43:8080
72.28.237.18:443
72.91.227.119:143
74.195.15.29:53
75.109.110.102:8080
75.99.13.124:7080
83.222.124.62:8080
94.76.200.114:8080
95.141.175.240:443
96.56.159.107:993
98.142.208.27:443
98.174.202.154:21

```
#### Epoch 2 - Spam/Stealer C2s ####
```

189.210.118.95:443
198.58.114.91:4143
201.171.48.28:443

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 01/29/2019)It has been awhile since I refreshed this section so I wanted to update it and bring it up to date.

I have been tracking Epoch 1 and Epoch 2 since May of 2018. Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for
communications. Epoch 2 is currently the larger of the two botnets and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing
version of Emotet at one point in May/June of 2018. Now Epoch 1 seems to be the smaller of the two since this time period. Despite having unique unshared
C2 infrastructures, these two botnets have been seen to move bots from one to the other and show similar behavoirs seemingly controlled by a single
entity/group. Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an Epoch 2
document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those being delivered
in maldocs on Epoch 2 at any time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and Epoch 2 may
have a document hosted on host.tld/B.
- The RSA keys will change every month or so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours to stay ahead
of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from is to find the payload and then check the C2s/RSA Key.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://otx.alienvault.com/pulse/5c538987b54f7c228740fc77 - @SecSome
https://pastebin.com/pq3QP18F - @pollo290987

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial
@shotgunner101

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie, @devnullnoop,
@gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987,
@malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey, @Jan0fficial

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic,
@abuse_ch/urlhaus.abuse.ch and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log ####
```

Malspam was slow to come in today until about 15:30 when I was hit with a bunch of French Invoice spam from E1. Almost all malspam was attachment based
today but a lot of the attachments were without extensions inside of the email and thus impotent for most people to get them open. EX:

------=_Part_28191_252699991.23325436311225758301
Content-Type: application/xml; name="77226_2K3520206"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="77226_2K3520206"

You know something is wrong when users have to work very hard to infect themselves with malware. Additionally, I think the Emotet guys need to work
on the matching algorithm for templates because this is not Quebec and most people would not be able to read French here! Luckily all of the malspam
was blocked from ever reaching the end users email so even the most determined end user was not able to click on the attachment and wonder why
it doesnt open.  I got about 300 malspams like this French Invoice broken attachment stuff as well as another dozen link based ATT bills again
with a couple bank/invoice ones. It was all done as of 18:00.

C2 changed again today with more new C2 IP/port combos being swapped into each botnet. Something that is happening a lot lately is certain C2 IPs
will have multiple active ports listed for C2 communications. This used to be very rare but it is now seemingly more commonplace. One C2 IP on E2 has
4 ports open and listed in the EXE.

69.2.176.134:20
69.2.176.134:22
69.2.176.134:443
69.2.176.134:8080

I am going to start treating the counts as combos because they are not really just IPs anymore with this many to 1 port to IP ratio.
This being said, E1 actually went down to 56 combos and E2 went up combos 63.

Nothing much else to mention today and no major events like QBot direct deployments from payload URLs or anything.

TT for more fun and excitement from the Emotet Files.

```
#### Sandbox 01/31/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-01-31 at 03:00 UTC https://cape.contextis.com/analysis/34190/

```

```

Epoch 2 C2 run on 2019-01-31 at 03:00 UTC https://cape.contextis.com/analysis/34186/

```