Emotet Malware IoCs 12/19-20/18

## Emotet Malware Document links/IOCs for 12/19-20/18 as of 12/20/18 23:59 EST ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.

#### Epoch 1 Document/Downloader links seen for 12/19-20/18 ####
```

http://159.65.107.159/Amazon/Details/2018-12/
http://35.242.233.97/AMAZON/Clients_transactions/12_18/
http://365shopdirect.com/Attachments/122018/
http://51.68.57.147/Clients_Messages/2018-12/
http://82.196.13.46/sTUH-kmtbAtWLZr9yVn_ymcdWEsX-Jp/
http://advantechnologies.com/lKmOG-J6dVfI5F26oHza_RFcslJHet-l21/
http://ahnnr.com/Amazon/EN_US/Orders_details/122018/
http://air-ductcleaning.ca/AMAZON/Documents/122018/
http://amg-contracts.co.uk/Documents/12_18/
http://arbey.com.tr/Amazon/En_us/Attachments/2018-12/
http://atelierl2.fr/AMAZON/Payments_details/122018/
http://austeenyaar.com/AMAZON/Orders_details/122018/
http://ayhanceylan.av.tr/AMAZON/Clients_Messages/12_18/
http://ayhanceylan.av.tr/Transaction_details/2018-12/
http://beard-companies.com/Amazon/En_us/Transactions/12_18/
http://bearinmindstrategies.com/Amazon/EN_US/Payments/2018-12/
http://benthanhdorm.com/wp-admin/Amazon/Transactions/12_18/
http://bingge168.com/Details/12_18/
http://blackgers.com/CPHm-tXjl0RF1CIxsoa_HCmPrfUA-Y1l/
http://blinfra.com.br/Amazon/En_us/Orders_details/122018/
http://bloodybits.com/Amazon/Payments_details/122018/
http://bodyonpurpose.com/Clients_information/12_18/
http://bunonartcrafts.com/FvkrI-dGaPIsJQqwSbW7_EptgWqnB-ZEX/
http://bursaguzelevdeneve.com/Amazon/En_us/Messages/12_18/
http://busferie.pl/pFEf-dZIOwMwAfDyK8l3_yXuvheJlH-g8q/
http://casanarducci.com.br/Amazon/Documents/12_18/
http://cedutica.com/Amazon/Details/122018/
http://celtes.com.br/Amazon/En_us/Attachments/12_18/
http://cewygdy.gq/wp-admin/Amazon/Transaction_details/122018/
http://chillazz.co.za/AMAZON/Orders_details/12_18/
http://clix.teamextreme.jp/Amazon/En_us/Payments_details/12_18/
http://comercialtech.cl/AMAZON/Messages/122018/
http://construjac.com.br/Amazon/En_us/Transaction_details/122018/
http://danceclubsydney.com/Attachments/12_18/
http://designplatform.in/Clients_transactions/122018/
http://djeffares.com/Payment_details/12_18/
http://dongjin.sk/Attachments/12_18/
http://dosabrazos.com/Amazon/Transactions-details/122018/
http://dosabrazos.com/Attachments/12_18/
http://durax.com.br/Amazon/Information/12_18/
http://ebpa.com.br/Amazon/Clients_information/122018/
http://egreenhomesusa.com/AMAZON/Details/122018/
http://elektrokrajina.com/Amazon/Attachments/2018-12/
http://energiemag.fr/Payments/2018-12/
http://envosis.com/cgi-bin/MBwGn-kFC4CCyFqH9FSub_TcexyjPu-A0/
http://eugroup.dk/Amazon/EN_US/Clients_Messages/122018/
http://fbs33.ru/Amazon/Clients_Messages/2018-12/
http://fotrans.me/AMAZON/Transactions-details/2018-12/
http://frog.cl/ckEJ-GRGtr5ll8vSmYa_kQegxClC-Ws/
http://gdtlzy.com/Amazon/Transaction_details/12_18/
http://gozdekins.com/Amazon/EN_US/Orders-details/122018/
http://grohipdx.com/Amazon/EN_US/Payments_details/122018/
http://hbk-phonet.eu/Details/12_18/
http://hbk-phonet.eu/qPdta-NIq1jfDHuGTXIzr_bdHkhzniE-ff/
http://heke.net/oQPJ-CouhRpqsGHmysfH_xcPUhmHzL-zFz/
http://hizmar.com/UVOb-JqH2DvYf7LeyOc_sBmjsVXm-oP/
http://hoabinhland.vn/Amazon/Messages/2018-12/
http://hubgeorgia.com/Amazon/Information/122018/
http://humpty-dumpty.ru/Amazon/EN_US/Clients_information/122018/
http://ibnkhaldun.edu.my/Amazon/Documents/122018/
http://innio.biz/Transactions/2018-12/
http://interciencia.es/hfdhJ-oXf916y6Q9UcCW5_NQqwIHjt-IoM/
http://inventec.com.hk/Transactions/122018/
http://ismandanismanlik.com/Amazon/Transactions/2018-12/
http://jaspinformatica.com/Amazon/Attachments/122018/
http://joe-cool.jp/IXWZH-nJQjYXJKgBn1oKB_TDzQpcpG-QH/
http://kahkow.com/Amazon/En_us/Transactions/2018-12/
http://kahkow.com/Clients_Messages/2018-12/
http://kristianskovbo.dk/AMAZON/Payments/2018-12/
http://leodruker.com/AMAZON/Information/122018/
http://lesamisdulyceeamiral.fr/Amazon/En_us/Clients_information/2018-12/
http://loveyourdress.co.za/Amazon/Payments/122018/
http://lutgerink.com/hhfl-RFkQQOMIaP1BeoV_iboQrfFT-tZw/
http://magdailha.com.br/Amazon/En_us/Transaction_details/12_18/
http://magiccomp.sk/lSaQN-ppXDNbFvXjfYkDf_IVIkFzyat-va/
http://marisel.com.ua/Attachments/12_18/
http://markemerybuilding.com/Clients/122018/
http://matildeberk.com/lnCY-nifiivOdQNBs8pV_iYeetRlfU-SA/
http://maxilink.com.br/Ialc-5tnhXx5540iLkG5_UySsONwy-Y8S/
http://mckeeverfineart.com/Amazon/Clients_transactions/12_18/
http://megascule.ro/AMAZON/Orders-details/122018/
http://meine-gartenstadt.at/Amazon/Clients_transactions/122018/
http://mentesdigitais.com.br/mNhM-1uEkEuXaYN3Fvg_dHEyiuRF-GW/
http://mirabaimusic.com/kyzPg-V163ASyExgk2DTF_mhNhGmeNN-sUr/
http://mnatura.com/RSjB-GDBe0Q5cHvSJcUp_pvYjbOEYH-kZ/
http://mofels.com.ng/Amazon/Clients_information/12_18/
http://mongduongtpc.vn/AMAZON/Messages/122018/
http://mpe.gr/szIZj-3T4Z64krdImqKq_JImbkwvBn-DqL/
http://mydesigncell.com/yoLI-7wjq2yJkXFbOWxv_cRSXIGVE-sWf/
http://mywebnerd.com/BHUwr-u5hPV9t1FXNv7O_VkbvMfTyh-bZ6/
http://mzkome.com/AMAZON/Documents/122018/
http://nar.mn/wp-content/cache/AMAZON/Messages/122018/
http://nfbio.com/img/upload_Image/edm/pic_2/UCeCb-xIWsNgQhiZ8NYS_oowntbDO-TxR/
http://ngayhoivieclam.uet.vnu.edu.vn/wp-content/Messages/12_18/
http://nhathep.xyz/fzFXa-5YQnFiy0UvwB1y_sviiMedP-CBH/
http://nhatnampaints.com/wp-admin/Amazon/Documents/12_18/
http://noi.nu/UwzQ-7jyPONALl5YjGl_gNWnHaCpd-ow/
http://odesagroup.com/wp-content/languages/Details/12_18/
http://oikosredambiental.org/Clients/2018-12/
http://ooohanks.ru/AMAZON/Clients_transactions/12_18/
http://osliving.com/VYOP-n8TAxexFIQIHCZ_tQpSRAXBY-HK/
http://pamka.tv/Amazon/Transactions/2018-12/
http://pasaogluticaret.com/Amazon/EN_US/Details/122018/
http://pcgestion.com/fysVQ-raiMYdBlHW6A2w_lNGjoEMC-qRx/
http://photopsd.com/Clients_information/12_18/
http://physio-bo.de/Amazon/Clients_information/2018-12/
http://pmhomeandgarden.co.uk/Amazon/Documents/12_18/
http://poolpumps-goldcoast.com.au/Amazon/En_us/Documents/122018/
http://psychologylibs.ru/layouts/AMAZON/Information/12_18/
http://pulsejobs.net/kgbF-bpNzhe4N4xPkK8_uxUIfQkAG-NOC/
http://ragamjayakonveksi.com/LVOI-ciiP2TrcvEri2zr_NkaRtevhO-Lx/
http://raggazine.com/Amazon/Orders-details/12_18/
http://real-websolutions.nl/Fxfwe-m0IkHEsjcT2Icy7_xXBVRPLi-cm/
http://reparaties-ipad.nl/AMAZON/Transactions-details/12_18/
http://reveocean.org/fRVI-mY3D8y8UMbCtygy_JSFrwTkjW-Se3/
http://revistadoconsultorio.com.br/Amazon/EN_US/Transactions/2018-12/
http://riskrock.com/Amazon/Clients_Messages/2018-12/
http://riskrock.net/Amazon/Clients_Messages/2018-12/
http://rospechati.su/Amazon/Transactions-details/12_18/
http://rosscan.info/Amazon/Payments_details/12_18/
http://rossiodontologia.com.br/Amazon/Information/122018/
http://sakh-domostroy.ru/Clients_information/2018-12/
http://salazars.me/Amazon/En_us/Transaction_details/2018-12/
http://sandau.biz/Amazon/Information/2018-12/
http://schlossmichel.de/OCDzf-nM8Zd1c5jhuVZp_dhwXyvDY-pw/
http://scottmazza.com/eTSjC-mjsW7mjADxImrF_SHQmwOWi-fns/
http://sentabi.com/ryoL-1vUOfYVsGquJHlS_ROCqxwzby-lT/
http://shadowdetectores.com.br/Amazon/Information/12_18/
http://shannonmolloy.com/lbzN-LI4J9wE0Etlbbc_OktEnYITY-H6R/
http://simplicitez.com/Amazon/Information/2018-12/
http://sinding.org/weQpj-n4hihI0coNxHe0_LlLdGxdkN-cx3/
http://snits.com/Transactions/122018/
http://sosbrasilsoberano.org.br/AMAZON/Clients_information/2018-12/
http://sportschuetzen-havixbeck.de/Amazon/Documents/122018/
http://sprayzee.com/chadholmescopywriting.com/AMAZON/Transactions/2018-12/
http://standart-uk.ru/Amazon/EN_US/Transactions-details/12_18/
http://standefer.com/AnEbL-iVZBJwxc2SdvJg_nUHsPEZx-nnA/
http://startbonfire.com/WJBSI-kyF2Ilc3IqFwy8_NgkgJdfEC-P5T/
http://stefanobaldini.net/qrqi-KTcsIuajPS1of4_LevrWsddC-ZO/
http://studio-t.net/ysPTA-RizRtuqm2arCCc_BfUoDDifs-tKK/
http://sugarhouseboudoir.com/Documents/12_18/
http://sulminaslaticinios.com.br/Amazon/EN_US/Orders-details/12_18/
http://superla.com.mx/Clients_information/122018/
http://take-one2.com/vHfIF-ma7ZksiJX8HBxt_OWwIhPAS-k6o/
http://teising.de/Transaction_details/12_18/
http://thebert.com/OYdF-m1cRYd5yUvCWKN_qkZjyewhd-wB/
http://thelivingstonfamily.net/TnJGt-zG3MnhHUZmzhsNF_ZHIdmYCN-Iq1/
http://theshowzone.com/Clients_Messages/2018-12/
http://thesmoketrip.pt/Clients_transactions/12_18/
http://thisismycat.com/MXDL-m3cod8jKiaJUYA_wKMFcnLo-UEn/
http://thumuaphelieuthanhdat.com/Amazon/EN_US/Clients_Messages/2018-12/
http://thungcartonvinatc.com/MxZhe-bBdwsbFVz36TAJH_YObpULtA-II/Attachments/12_18/
http://tinyfarmblog.com/Amazon/Documents/122018/
http://tomsnyder.net/ElxQF-3ZDT73iDXMrof4h_XsFfqhnE-xZ/
http://tongdaifpt.net/Amazon/EN_US/Payments_details/2018-12/
http://tongdaifpt.net/Details/2018-12/
http://topgas.co.th/lthJk-9l1PUQnCptcE7D_OXJdrcYg-yCU/
http://toshitakahashi.com/Amazon/EN_US/Clients_transactions/12_18/
http://tracychilders.com/Details/12_18/
http://tracychilders.com/Transaction_details/122018/
http://tunerg.com/Dbhsp-51jGH1QulItPy5m_MazjmwdXi-7H/
http://ulukantasarim.com/wp-admin/Amazon/Information/122018/
http://ulvsunda.net/OKpJ-fgnAKmELx4TW3B_hDcvSugBO-EG1/
http://vanmook.net/kOouj-BrYY6ZfTetuipaH_qBrYPVrn-ABD/
http://veslydecor.com/Amazon/En_us/Payments/2018-12/
http://wavemusicstore.com/AMAZON/Information/12_18/
http://welikeinc.com/Amazon/En_us/Orders_details/122018/
http://wolmedia.net/Amazon/Clients/2018-12/
http://wssports.msolsales3.com/Amazon/EN_US/Orders-details/12_18/
http://www.ahnnr.com/Amazon/EN_US/Orders_details/122018/
http://www.ahnnr.com/Messages/122018/
http://www.air-ductcleaning.ca/AMAZON/Documents/122018/
http://www.amg-contracts.co.uk/FbWPw-pPOyMLEx7RDnEXr_ndcZqZrCH-7oJ/
http://www.anubih.ba/tmpp/UJbt-RxXLhKptXV9yU30_DJAZuOqm-jk9/
http://www.arisun.com/Payment_details/122018/
http://www.asso-motsetmerveilles.fr/Amazon/EN_US/Clients_transactions/12_18/
http://www.asso-motsetmerveilles.fr/Documents/2018-12/
http://www.atelierl2.fr/AMAZON/Payments_details/122018/
http://www.avioncargoets.com/Amazon/Attachments/12_18/
http://www.beard-companies.com/Amazon/En_us/Transactions/12_18/
http://www.blackgers.com/CPHm-tXjl0RF1CIxsoa_HCmPrfUA-Y1l/
http://www.blinfra.com.br/Amazon/En_us/Orders_details/122018/
http://www.casademaria.org.br/KZTx-4JO5lER35M7omw_euJXbdszR-Sj/
http://www.casademaria.org.br/Transaction_details/12_18/
http://www.casanarducci.com.br/Amazon/Documents/12_18/
http://www.cbhrmf.com.br/Amazon/En_us/Payments/12_18/
http://www.cedutica.com/Amazon/Details/122018/
http://www.chaos-mediadesign.com/demo/administrator/Amazon/EN_US/Clients_information/122018/
http://www.construjac.com.br/Amazon/En_us/Transaction_details/122018/
http://www.craft-master.ru/Amazon/EN_US/Documents/12_18/
http://www.csbhaj.com.br/AMAZON/Documents/122018/
http://www.dolunaymetal.com.tr/Amazon/En_us/Clients_Messages/2018-12/
http://www.dosabrazos.com/Amazon/Transactions-details/122018/
http://www.ebpa.com.br/Amazon/Clients_information/122018/
http://www.egreenhomesusa.com/AMAZON/Details/122018/
http://www.farmasiteam.com/Amazon/En_us/Payments_details/2018-12/
http://www.fortifi.com/Clients/122018/
http://www.gdtlzy.com/Amazon/Transaction_details/12_18/
http://www.gozdekins.com/Amazon/EN_US/Orders-details/122018/
http://www.hellenic-fiu.gr/AMAZON/Details/2018-12/
http://www.hiilqaran.org/Amazon/Payments_details/12_18/
http://www.humpty-dumpty.ru/Amazon/EN_US/Clients_information/122018/
http://www.ireletro.com.br/yQof-EXnD7DOJLuCEQ2l_ZFCAYZyf-lnh/
http://www.kahkow.com/Clients_Messages/2018-12/
http://www.kaianyafoods.com/Messages/122018/
http://www.localfuneraldirectors.co.uk/kViwF-uZPMObHf3UkFr7_fQzXakFSN-GIm/
http://www.lsrighi.com/Amazon/En_us/Payments/122018/
http://www.maionline.co.uk/ZIujz-5mZq6fO8388CKuw_VEwGNMNL-va/
http://www.masterthoughts.com/Amazon/En_us/Clients_information/2018-12/
http://www.mzkome.com/AMAZON/Documents/122018/
http://www.not2b4gotten.com/bFbS-c2UOBVbGj24GnpT_oliJzxZGw-VrF/
http://www.odesagroup.com/wp-content/languages/Details/12_18/
http://www.paiju800.com/Amazon/Payments_details/122018/
http://www.pamka.tv/Amazon/Transactions/2018-12/
http://www.parentslacrosseguide.com/Amazon/EN_US/Payments/12_18/
http://www.physio-bo.de/Amazon/Clients_information/2018-12/
http://www.physio-bo.de/Attachments/2018-12/
http://www.poolpumps-goldcoast.com.au/Amazon/En_us/Documents/122018/
http://www.quicktryk.dk/CdlAs-Wej75ZUjTuCAKa_WjBhMpBt-dk/
http://www.ragamjayakonveksi.com/LVOI-ciiP2TrcvEri2zr_NkaRtevhO-Lx/
http://www.raggazine.com/Amazon/Orders-details/12_18/
http://www.reparaties-ipad.nl/AMAZON/Transactions-details/12_18/
http://www.riskrock.net/Amazon/Clients_Messages/2018-12/
http://www.rosscan.info/Amazon/En_us/Transactions/122018/
http://www.rosscan.info/Amazon/Payments_details/12_18/
http://www.rossiodontologia.com.br/Amazon/Information/122018/
http://www.rosznakproject.ru/LaCH-IAAlqmhPNqig0Qj_wwuwkJFeo-pL/
http://www.rta.hu/Amazon/Details/12_18/
http://www.sahinbakalit.com/Amazon/En_us/Transactions-details/2018-12/
http://www.sarangdhokevents.com/AMAZON/Transactions-details/12_18/
http://www.schlossmichel.de/OCDzf-nM8Zd1c5jhuVZp_dhwXyvDY-pw/
http://www.shadowdetectores.com.br/Amazon/Information/12_18/
http://www.simplicitez.com/Amazon/Information/2018-12/
http://www.somerset.com.ar/wp-content/uploads/Messages/2018-12/
http://www.sportschuetzen-havixbeck.de/Amazon/Documents/122018/
http://www.standart-uk.ru/Amazon/EN_US/Transactions-details/12_18/
http://www.sulminaslaticinios.com.br/Amazon/EN_US/Orders-details/12_18/
http://www.teising.de/Transaction_details/12_18/
http://www.tucostudio.com/AMAZON/Clients_information/12_18/
http://www.yolcuinsaatkesan.com/PqFKD-YfS2COvoO3tsRNB_jAyMJjSu-gov/
http://www.zavarukhina.ru/Amazon/Orders-details/122018/
http://www.zeltransauto.ru/Transactions/12_18/
http://yasarkemalplatformu.org/Transaction_details/122018/
http://zavarukhina.ru/Amazon/Orders-details/122018/
https://mandrillapp.com/track/click/30069226/lutgerink.com?p=eyJzIjoiUEFRellLNTh5eURsamszcjg1OUozN21sXzlrIiwidiI6MSwicCI6IntcInVcIjozMDA2OTIyNixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvbHV0Z2VyaW5rLmNvbVxcXC9oaGZsLVJGa1FRT01JYVAxQmVvVl9pYm9RcmZGVC10WndcIixcImlkXCI6XCI5NTAzMWU3NzNjMTM0Zjc0YmE2OWFlNjU1ZWQzZTAyMlwiLFwidXJsX2lkc1wiOltcIjc2NTVhNTQxODdjNDA0OWNjOWM5NTE5OWNjYjkwZGY3OThiYTA3NTNcIl19In0/
https://mandrillapp.com/track/click/30069226/mpe.gr?p=eyJzIjoiazlrR2xQVFlwOGhFczJzQkd2TnBUcjdNRkJBIiwidiI6MSwicCI6IntcInVcIjozMDA2OTIyNixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvbXBlLmdyXFxcL3N6SVpqLTNUNFo2NGtyZEltcUtxX0pJbWJrd3ZCbi1EcUxcIixcImlkXCI6XCIzOTkxM2IyMjBlMTE0ZTFlYTYzYjdlZDk0NGE1YmI3MVwiLFwidXJsX2lkc1wiOltcIjJjZDg5YjJlOWM1Y2QxMDBiMzdiNDNhNTYzMTBjNzRhMWExOGRjMzVcIl19In0/
https://mandrillapp.com/track/click/30069226/mywebnerd.com?p=eyJzIjoiTjRBdVZQdEdIVXJPWWJ4b2ZXVDVobjdmaVJJIiwidiI6MSwicCI6IntcInVcIjozMDA2OTIyNixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvbXl3ZWJuZXJkLmNvbVxcXC9CSFV3ci11NWhQVjl0MUZYTnY3T19Wa2J2TWZUeWgtYlo2XCIsXCJpZFwiOlwiYWRhYmFjZDNiOTY0NDM0ZWIwMzY5ZjllNWQ0YzFjMWRcIixcInVybF9pZHNcIjpbXCI2Y2QwN2NmNDliYjdhY2M0NTRkZWJjMDFjYzFhMTQyZTdiYjYwN2JkXCJdfSJ9/
https://mandrillapp.com/track/click/30069226/mywebnerd.com?p=eyJzIjoiUXN4eVNrWkU5RHNjTHJuSEx1UUN1OWdILUhVIiwidiI6MSwicCI6IntcInVcIjozMDA2OTIyNixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvbXl3ZWJuZXJkLmNvbVxcXC9CSFV3ci11NWhQVjl0MUZYTnY3T19Wa2J2TWZUeWgtYlo2XCIsXCJpZFwiOlwiMjIxNjQ1YzUzYzM3NGMzMThjZjM2NzI1ZmMzMTRkZDBcIixcInVybF9pZHNcIjpbXCI2Y2QwN2NmNDliYjdhY2M0NTRkZWJjMDFjYzFhMTQyZTdiYjYwN2JkXCJdfSJ9/
https://mandrillapp.com/track/click/30069226/nfbio.com?p=eyJzIjoiM285U3VLYVExMTRob2l6bTRiU1g1elJKN1k0IiwidiI6MSwicCI6IntcInVcIjozMDA2OTIyNixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvbmZiaW8uY29tXFxcL2ltZ1xcXC91cGxvYWRfSW1hZ2VcXFwvZWRtXFxcL3BpY18yXFxcL1VDZUNiLXhJV3NOZ1FoaVo4TllTX29vd250YkRPLVR4UlwiLFwiaWRcIjpcImUyYzBiZGI0YTMxZjQzNGZiMTgzZDI0NDZjMjE3ODY0XCIsXCJ1cmxfaWRzXCI6W1wiMWNmNmMyZDY1NTBhODE2ODIwMDk2NDlmMjk3YmVmZmI2Yjk2OTYzZFwiXX0ifQ/
https://mandrillapp.com/track/click/30069226/noi.nu?p=eyJzIjoiVUVzUjFlNlQ3eHpxZjZOWjFJRkJXLV94UW5VIiwidiI6MSwicCI6IntcInVcIjozMDA2OTIyNixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvbm9pLm51XFxcL1V3elEtN2p5UE9OQUxsNVlqR2xfZ05XbkhhQ3BkLW93XCIsXCJpZFwiOlwiZmE1MWMzNmU5YjljNDMwZWJjNWQyMTAxOGVkMWQ2NjlcIixcInVybF9pZHNcIjpbXCIzYWE5YzdkNmQ0ZDQ2YjA5NTU5ZThmMjE5ZTYxNGJkYTM2MTYzOTNiXCJdfSJ9/
https://mandrillapp.com/track/click/30069226/thisismycat.com?p=eyJzIjoiOERGcUw4cWpZaWFVbjNmVlBZaFlBUGNEcl8wIiwidiI6MSwicCI6IntcInVcIjozMDA2OTIyNixcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvdGhpc2lzbXljYXQuY29tXFxcL01YREwtbTNjb2Q4aktpYUpVWUFfd0tNRmNuTG8tVUVuXCIsXCJpZFwiOlwiNmQxYzFiNmYzNjUwNDg5MTkyYTBjZDkzN2JhZmRmZGVcIixcInVybF9pZHNcIjpbXCI4YWJlZTc0NmM3YjNmYTMwZDkxODNmNmViZGNmODA5MzNiZTJhYjMxXCJdfSJ9/
https://u6570127.ct.sendgrid.net/wf/click?upn=GYr15rV-2FDDkj70q5dMgtnUC1gdkVrtV5gxfz7eoyz3hBQRtRydD4ArxcLvocHK9zqh2wl3adgm7jFemgAxL9Ig-3D-3D_EOpstEwxYPZNS7zFupvnSPyMXgKJ9jMu3mqoZiJD-2BZ6v-2FH0kEnkQ68NH3jZeHkQ-2B2qsTJMKLvZE7Wt68es0ULhmNkZKkgw0gHCPNMb2yVbQhVpA7fZc57GipEiMblzEt3ysTmv-2Bi0SyHP2p14f65txDVyBnYG9RbajbrAZyNYi2XmuFEyq2Z6M2KcXiyxf5PGuMO-2FCRcGK5lwWMdDG08Hg-3D-3D/

```
#### Epoch 2 Document/Downloader links seen for 12/19-20/18 ####
```

http://162.243.7.179/wp-content/themes/alveophase3/msf-files/myATT/u8Y_dDmcoer_1BhI9/
http://2d73.ru/EtiEO-eac8_khel-I4/COMET/SIGNS/PAYMENT/NOTIFICATION/12/20/2018/En_us/Invoices-attached/
http://35.227.184.106/MxavR-uwZRl2KvgUwcwk_YLEHKnpE-RuL/
http://abiauto2.hospedagemdesites.ws/DE/FJALBOMYA8679199/Rechnungs/Fakturierung/
http://agentsdirect.com/AT_T_Online/AbwtfwGT_FDgfEh_VGw6V6/
http://agile.org.il/kNpGc-vz_TmpRuA-Wu/Invoice/084347605/En/5-Past-Due-Invoices/
http://aiwaviagens.com/YsEg-gfOmfrmlz5cIdX_rPhWhNmX-3r/
http://alcos-schweiz.ch/SNKCKYK5519077/DE_de/Zahlung/
http://almahsiri.ps/CyarD-DFc_dVtIv-Bg5/INVOICE/US_us/Invoice-receipt/
http://angullar.com.br/dsKqO-hp_BzIkI-BD/INVOICE/US/Invoices-attached/
http://antigua.aguilarnoticias.com/de_DE/HKNVGYPUF3346875/Bestellungen/Rechnungszahlung/
http://apcngassociation.com/uxtQ-UFzDY_bb-Fm/INVOICE/US_us/Invoice-Number-07697/
http://arina.jsin.ru/AT_T_Account/VyHcE19_uuiuS9z_ga3VrH/
http://arisun.com/PjLYo-78KitaAOqgZBkV_WeBsuRmWc-8F/
http://arrowsinteredproducts.com/ukvO-k39rP4zNg_fypydxypC-Ok/INVOICE/DOC/En_us/Paid-Invoices/
http://atso.pt/QXqAb-hNvW_I-5D/INVOICE/US_us/ACH-form/
http://atso.pt/VjEt-sXXjoBK3G_wzFpI-QjI/EXT/PaymentStatus/FILE/En_us/Past-Due-Invoices/
http://aulist.com/GvHr-MMJ5U8ZN2kc5aoq_NkxhpRvvh-t9/
http://aural6.net/ATT/ehULRT_N4ixiH_ThZucMG8VB/
http://aural6.net/yelD-7T9A_LPFA-H3/INVOICE/97220/OVERPAYMENT/US/Outstanding-Invoices/
http://azimed.nl/BNGj-likKFCNbmgzcGd_XeKZxNTxx-Te/
http://azimed.nl/shYAb-hoi_kKPhU-XX/ACH/PaymentInfo/US/Inv-362867-PO-0V796120/
http://babykamerstore.nl/sites/LkMgW-Q6wZkLswqpTm0b5_LIDkDVbr-Mz7/
http://baovetnt.com.vn/OwZQo-vr_era-k5/INVOICE/En/Inv-061010-PO-5C900513/
http://barjudo.com/AT_T_Account/4PioI5_NAXwca_qKGtX12m/
http://basariburada.net/De/GWRHICO3976558/gescanntes-Dokument/FORM/
http://beardelect.com/mdzSt-m8tmNbsG_lR-4v/PaymentStatus/default/En/Past-Due-Invoice/
http://billfritzjr.com/EWALZQNJBH8849894/Dokumente/Fakturierung/
http://bingge168.com/AT_T_Online/C9gFa_QwWTAZR_OdTV6gnYdsB/
http://bio-rost.com/LCAI-TLPod_BegxwagpB-9Md/Southwire/WSK738024175/En/Invoice/
http://blacknred.ma/jnBa-FEe3_eWmVAtF-pI/INVOICE/2706/OVERPAYMENT/En/654-98-446466-848-654-98-446466-456/
http://casacolibriecolodge.com/de_DE/FFTKIBOLMG2207674/Bestellungen/RECHNUNG/
http://cesut.com/images/QtjZ-wwb1Jd2QiHCQrjr_taZmGcblD-eM/SS043/invoicing/FILE/US_us/Paid-Invoice-Credit-Card-Receipt/
http://chillazz.co.za/LStD-lZ_tn-9x/Invoice/07914580/En_us/Invoice/
http://cinehomedigital.com/FvEd-f7vu7Jc2tO1VBcQ_kpsuEAwP-PUI/
http://cmdez.ir/Dezember2018/QRXYEK9490805/GER/Rechnungszahlung/
http://committedexperts.com/DE/LHXQBUBZ8152803/GER/DETAILS/
http://congtydulichtrongnuoc.com/FGaOE-PDhboPsvlGjM8wm_tABwhpkm-2Dz/
http://cvetisbazi.ru/bZuj-kYyDZ3AO2vifRN_sGjsWtYCw-Ktj/
http://cym.pe/De/GDLNRUYUOS7423895/Rech/Zahlungserinnerung/
http://danieladessi.com/De/UTQYSHSRA6678988/Rechnungs-Details/DOC-Dokument/
http://denis-99bg.com/Dezember2018/MUUXKC0006879/de/Zahlungserinnerung/
http://deposayim.ml/DE_de/HEGTXFAW8585168/Rechnungs/RECH/
http://digicontrol.info/EUYMP-utLdElFXJuvHW3_rxowqhRM-2pb/
http://distribucionesvega.com/YuvD-Irg_LTWVNZXn-tw/054307/SurveyQuestionsEn/Sales-Invoice/
http://ditec.com.my/SOzLT-UsBhcWNYgzkG1Ot_KIezIRfC-DKm/
http://dogooccho.com.vn/cMuaI-Yqa_HVon-1Bd/Ref/45412446En/Important-Please-Read/
http://dpn-school.ru/ATTBusiness/a89Xd2WBy_eD8InR_NWZemrG/
http://drcarrico.com.br/5n0_FxfeSekn_8Zaetr2/
http://drmarotta.com.br/pdXA-THT_InKy-Uj/COMET/SIGNS/PAYMENT/NOTIFICATION/12/19/2018/US/Paid-Invoice-Credit-Card-Receipt/
http://dukecityprocess.com/hunjH-xLRYqNMSoZcFdT4_tXvaBJVtZ-eN/
http://ebtecgulf.com/Dezember2018/BGXYLEU8612393/GER/RECH/
http://ellajanelane.com/dINH-Fi3e_nxsQ-XR/COMET/SIGNS/PAYMENT/NOTIFICATION/12/19/2018/En_us/Paid-Invoice/
http://erhansarac.com/rywr-mVV7OeMmPTPnde_tHrBDLJW-x5J/
http://espaytakht.com/de_DE/BPNBGIJ3132876/GER/RECHNUNG/
http://estab.org.tr/AT_T/efTnvDa_xYHBoNOm_QcweCDjZw/
http://estomedic.com/Dlt_gE5pEMSy_qdvlZ3/
http://evihdaf.com/AT_T_Account/upkC1Xpt69_ri2A3P_Jt8fn/
http://feaservice.com/GXoZA-os_hCmiCUO-Wn7/CD62/invoicing/En_us/Important-Please-Read/
http://feitoamao.com/De/BOMYWFIZ0584076/Rech/Fakturierung/
http://firstchicago.net/Dezember2018/UCTJXGO7152450/Rechnung/DOC-Dokument/
http://genf20pluscoupons.com/IVLPOY3374582/DE_de/RECHNUNG/
http://germafrica.co.za/AT_T/jug0jGq_WXyD3sbs1_qudMnnuOV/
http://ghoulash.com/ATT/5TkiNGyyqlY_fTJqfKy_sL2f5X26/
http://ghoulash.com/Dezember2018/HPPTQM0357883/DE_de/Zahlungserinnerung/
http://gozdekins.com/xxJEt-Klt_LBDOl-wG/En/Invoice-9602047-December/
http://greenplastic.com/DE/GXEUWQQXB8180141/Rechnungs-docs/Fakturierung/
http://guiler.net/ETee-URJj_lXBbf-VDu/INVOICE/2807/OVERPAYMENT/US_us/Outstanding-Invoices/
http://hajiwonacademy.vn/kTrWb-od9L8_uXwV-KG5/InvoiceCodeChanges/En_us/Invoices-attached/
http://health-hq.info/jacmY-pG_yBGLBpFL-wdK/Inv/314207865/US_us/Invoices-attached/
http://hlxmzsyzx.com/AT_T_Online/PzkzwPYd5C1_L0W2ab_a6M88f5o/
http://holidayhotels.top/DpJaE-Yz3uI_gv-GN/ACH/PaymentAdvice/US/Outstanding-Invoices/
http://ibnkhaldun.edu.my/zzBz-dp6R_ZqueoAeIi-P4a/ACH/PaymentInfo/En_us/Sales-Invoice/
http://ideieno.com/zglfm-xR3_o-rg/InvoiceCodeChanges/EN_en/New-order/
http://income-spin-off.co.uk/SzLN-7tlH_UQUss-CR/675556/SurveyQuestionsEN_en/New-order/
http://ingeniamarcasypatentes.com/de_DE/XEFWTJCOVK5380167/Rechnungs-Details/DOC-Dokument/
http://interciencia.es/SfEf-KF7_S-G5/EXT/PaymentStatus/En/Invoice-Number-253480/
http://ismandanismanlik.com.tr/RlqR-hvzwr_Nz-Af/COMET/SIGNS/PAYMENT/NOTIFICATION/12/19/2018/En/Inv-187348-PO-1E730035/
http://ita-trans.com.vn/CJUUOEMG3928133/Dokumente/Rechnungszahlung/
http://iw.com.br/HHPqW-Xy_adIFBooXr-LFH/Southwire/CTO29238388/En/New-order/
http://jambino.us/xXuri-yvc9r723L_IxhS-Bju/M39/invoicing/Download/EN_en/Invoice/
http://j-d-i.co.jp/Cfbv-rYaMVa0rPPfZhV_IZsYIdOsY-Ao/
http://j-d-i.co.jp/lpqL-YEXLC_iOnBg-49/invoices/32720/8366/US/Open-invoices/
http://jobspatrika.com/XZOW-2NUWf9mLU_X-Pn/default/US_us/Sales-Invoice/
http://johnsonlam.com/mYHMa-ag8tKx2e2UOI73_BtAOpqQqV-21/
http://karakushafriyat.com/Afrbv-RCNWwn5YuZL6O4n_RvzcZVPPc-BP/
http://kdecoventures.com/SqEY-rWdXLHgX4yA57D_JnquQvquU-7u/
http://kineziolog.si/De_de/XIGXADMR6148624/Rechnungskorrektur/DOC-Dokument/
http://kingpinmedia.co.uk/Vrax-bP65l2RR_sWfTtXmdP-aWn/PaymentStatus/Dec2018/En_us/Invoice/
http://kniedzielska.pl/KZuwV-FcNTjxoKvrpTVPs_IxXlroBv-5O/
http://kodubets.ru/oTisB-WYWze_LuUXGR-2kq/Inv/494803448/En_us/Invoice/
http://krasnobrodsky.ru/AT_T_Online/7eFxSb_is2z3F25h_ce6fUcO/
http://kutahyaesnaflari.com/de_DE/TGUXIOGQXE4739678/Rechnungs/RECHNUNG/
http://lacasadelpc.it/mEijn-HV_ZaF-gL/H62/invoicing/US_us/Paid-Invoice/
http://l-adviser.ru/DE/OUHJEUB4551911/Bestellungen/Zahlungserinnerung/
http://lakewoods.net/izAER-mFwi4rB5O3TPLWF_dmStPVBE-rv/
http://lancang.desa.id/aACzS-SiJWodCeFf7UWOe_GweDpwAb-sCr/Ref/170522652INFO/En/Scan/
http://lancang.desa.id/xnnDh-YR_uPOKMgjfP-s7F/Inv/58505440713/En/Outstanding-Invoices/
http://landingo.ir/arto-Oj4_QeLNwM-8lD/311593/SurveyQuestionsUS_us/Invoice-for-n/m-12/20/2018/
http://languagelife.it/SjAi-0g4P_WRpEYku-HY/Southwire/HTM3354255570/En_us/Invoice-receipt/index.php.suspected/
http://lczyp.com/yUsr-xERHhO4x_P-ZAP/ACH/PaymentAdvice/Dec2018/En/Companies-Invoice-36300211/
http://ledyroz.ru/De/ECZEUHDTX2212341/Rechnung/Zahlungserinnerung/
http://leesonphoto.com/AT_T/UPoww2_Tx3pYDBjm_QVzUi/
http://leneng.ru/UHEC-aaeXIYOp7_CAPh-XPD/EXT/PaymentStatus/Dec2018/En_us/New-order/
http://leonardokubrick.com/pBgq-8C43KGtH_odPHHSfE-zt/INVOICE/default/US_us/Invoice-receipt/
http://leptokurtosis.com/aIjC-9qac2E7Vf_xQk-Tb/InvoiceCodeChanges/FILE/US_us/Need-to-send-the-attachment/
http://lesamisdulyceeamiral.fr/kznm-xckf_vAm-Bn/Invoice/6160077/US/404-83-772851-747-404-83-772851-680/
http://lifecycleeng.com/OYfe-Twnil_I-KB/Invoice/96412923/EN_en/Invoice-5987295/
http://liguebretagnebillard.fr/images/JXEj-BaRAEbFJ_lEVVL-pA/ACH/PaymentInfo/INFO/US/Scan/
http://liliandiniz.com.br/2dUC_F1HDlXair_dDydT1SVGn/
http://llen.co.nz/HYkOt-32HWouqGu_ZnxSCuWA-Vm/ACH/PaymentInfo/scan/US/Past-Due-Invoices/
http://lotustrends.com/lqYAx-Uk9Ca_sfvJQDi-m2/COMET/SIGNS/PAYMENT/NOTIFICATION/12/20/2018/US_us/Need-to-send-the-attachment/
http://macaderi.com.tr/De/BERUBR6922348/Rechnungskorrektur/Rechnungszahlung/
http://mahertech.com.au/qJZD-mZsNHkfz6_WxLuhUx-s2C/Ref/693164921files/US_us/Inv-014360-PO-5H830573/
http://mangchongtham.vn/Jkcz-Ee2UWDvlR_s-XD/InvoiceCodeChanges/DOC/En/Open-invoices/
http://manoratha.org/Lgao-uFJMCp4HYAvNssk_YjNwBIsbM-QA/
http://manukadesign.co.uk/tKhr-bW73a0a8_ee-nAy/invoices/65748/4528/Document/EN_en/Past-Due-Invoices/
http://maravilhapremoldados.com.br/zaTKz-ClwGrYM2c_rYPqYHu-f9p/Invoice/2498891/FILE/US/Inv-204239-PO-0T726962/
http://mastercontrol.co.za/AIqx-LsRFkCEQ_hzQwZh-mmx/ACH/PaymentInfo/default/EN_en/Invoice/
http://mateada.com.br/nhlr-sXvqNv4nl_dQwBL-9b/Southwire/BQZ9792131687/default/En_us/Need-to-send-the-attachment/
http://mattayom31.go.th/AT_T_Online/YFwwdY_ir1HJA_S6TXCPIvfq/
http://mavitec.es/OFedC-BfAqML2s_ldexUx-KKE/newsletter/US/9-Past-Due-Invoices/
http://mgupta.me/myATT/URagdEtNBa0_gjaCdAnv_qTyb5WTyO/
http://minet.nl/De_de/FXPRHI0793978/Rechnungs-Details/Zahlungserinnerung/
http://mint05.ph/mdIo-Mi_JjDUu-8c/Inv/1161965202/US/Service-Invoice/
http://mireiatorrent.com/AT_T_Online/QEEbgZ_sUa0JF3_RedL6K/
http://mistore.com.au/Owd_mKYAQ5X_ZiOnflAOts/
http://mobe13.com/OeWB-3TSYPrGH_lVNoYRo-aoL/EXT/PaymentStatus/default/En/Sales-Invoice/
http://moefelt.dk/tiqsP_72aJNG_AurrU3v/
http://mofables.com/ATTBusiness/r3xO_VvgwrEyH_Jo6RB3fmmb/
http://mofels.com.ng/yKgJN-OQeJP_Z-cho/INV/1375144FORPO/3728314838/US/Invoice/
http://mustgroupplc.com/de_DE/HOFTYQE1190926/Rechnungs-docs/Zahlung/
http://myyoungfashion.com/DE_de/UDZCIEXLQ3892082/Scan/Hilfestellung/
http://nar.mn/wp-content/cache/HWGn-FB0_pBSSRTy-MSg/invoices/2472/33043/En_us/Open-invoices/
http://nathandale.com/fDyXy_Q9RFTLO3Y_2PjJQC/
http://nattybumpercar.com/AT_T_Account/IHC_uZhoQeL2k_xxME1/
http://nchs.net.au/De_de/VJFPODH9882475/Rechnungskorrektur/Zahlungserinnerung/
http://net96.it/ismmE-gYm_PVM-d3/Ref/45234762US_us/Invoice/
http://networkdriving.co.uk/AT_T/wJxNkMRK_kgiuC4qF7_fasWtsb/
http://newcanadianmedia.ca/templates/beez_20/de_DE/TTVIHZRKKO0118633/Rechnungs/Zahlung/
http://nexpltd.com/bungw-rl_yFqm-4O/En/2-Past-Due-Invoices/
http://ninepenguins.com/AT_T/3PFEl_aNTsgcHU_jYXUWe/
http://noi.nu/UwzQ-7jyPONALl5YjGl_gNWnHaCpd-ow/
http://norcham.com/cgi-bin/IUODAFAK9504049/Rechnungs-Details/Hilfestellung/
http://novo.cotia.sp.gov.br/MTNXFAB3727167/Bestellungen/FORM/
http://nowoo.by/SAULDP8534532/Bestellungen/DOC/
http://ofmirmebel.ru/tmp/hsfJW-M3CByP16_MirEmv-lE/COMET/SIGNS/PAYMENT/NOTIFICATION/12/18/2018/files/En/Scan/
http://okna-remont.moscow/RrPA-8Rei7_JTAlGkAo-c6/ACH/PaymentInfo/EN_en/Paid-Invoices/
http://oldmemoriescc.com/AT_T_Online/XeLZhRG0Mxb_PSWBv8qn_1Sue0/
http://omegaserbia.com/Ycdx-yl4xHiF7HTtNhj_KvQoZTLS-vEj/
http://pagan.es/DE/CRSEYUR8473228/Rechnung/Fakturierung/
http://paiian.com/web/site/WBENSHYCS0986408/Rechnungs/Rechnungsanschrift/
http://papaleguaspneus.com.br/mrra-UYZFhvvC_izPg-H4/ACH/PaymentAdvice/Download/US/ACH-form/
http://parenting.ilmci.com/De_de/IYOQGAI2839478/Rech/DOC/
http://partizan-nn.ru/waIi-8q_kcQA-Xh/Invoice/06968829/US/Invoice-Corrections-for-95/74/
http://paulfloresarquitecto.com.mx/iOMs-zpJDGk4js_FTxfCm-hS7/INV/35886FORPO/4429333303/FILE/US_us/Invoice-Corrections-for-99/98/
http://pclite.cl/cltnP-ABE_Y-GMU/Southwire/QZV195726968/En/Invoice-96654447/
http://peredelkino-atelie.ru/UDPQT-oz551_MKBGMHe-3Gh/Southwire/YIY4119497871/EN_en/Outstanding-Invoices/
http://piaskowy.net/vMnP-e2TZbKUh_aGrTWAdM-Co/Inv/75636268563/xerox/En_us/Invoice-Corrections-for-38/54/
http://plagading.edufa.id/wJqE-tOspIfR9BCrRuY_KZNYwjSPK-9Q/
http://pm-obraz.com/Ihwn-FCETFee2kLBnRf_dhFGVTlq-gU9/
http://pm-obraz.com/QKEs-PKuju_x-7Vt/invoices/8804/6313/US/Open-invoices/
http://pntsite.ir/de_DE/ODTFME8868196/Bestellungen/RECH/
http://popovart.com/lYArT-Txawj8YHiek55R_UATMtuGU-Ob/
http://prosolutionplusdiscount.com/De/SKJDCL3063902/Rech/Zahlung/
http://puregoldintlventures.com.ng/DE_de/SPFZZKS0734644/Rechnungskorrektur/Zahlungserinnerung/
http://pusong.id/aYze-w5EPt_UTWrDZQm-XOm/InvoiceCodeChanges/En_us/Outstanding-Invoices/
http://radiospach.cl/Pbtm-H2lYzRtw_LFJkN-he/ACH/PaymentInfo/LLC/US/Paid-Invoices/
http://rajascreations.in/SOpj-rX8_uQJxCN-wEJ/8014308/SurveyQuestionsEN_en/Document-needed/
http://raminajmi.dk/De/LURVDVH6568359/Rechnungs/DETAILS/
http://rashmielectricals.com/JUGTb-HAr4DUTA_CUZtryC-Lu/ACH/PaymentAdvice/LLC/US/Invoice-Number-385661/
http://realestatesdakota.com/cYkZW-y6ujkXDfwMMox2U_HOLeAWKIO-Got/
http://redrhinofilms.com/gZGg-7Q0PFihJX_gIOK-gk/Inv/300086577/default/US/Past-Due-Invoice/
http://refineryproductions.com/ywypu-Wv2f8Aw2v_bhbY-2Ah/INVOICE/sites/En/Question/
http://reparaties-ipad.nl/eSIc-3JbU_x-PJ/INVOICE/5661/OVERPAYMENT/En_us/Paid-Invoices/
http://rk.net.ua/De/SFHLYCU1692892/GER/FORM/
http://rowlandtractors.co.uk/mLKV-jVxfVvN0_XEg-Ty/Invoice/24108650/doc/En_us/0-Past-Due-Invoices/
http://rtkmedia.com/tHQe-4M9_pyDmJvh-x0/EXT/PaymentStatus/EN_en/Invoice/
http://salamouna.cz/cache/DrmA-BznczbBsR8oE5yy_tZuDehWUP-u9E/
http://sambasoccertraining.com/PRYwC-kLd6QNVKBUWY9Cn_EyfVxBUR-47/
http://sandbox.leadseven.com/fATY-zaC_H-Tyt/ACH/PaymentAdvice/US_us/Inv-915367-PO-6N585048/
http://sarahpardini.com.br/backup_ver_atual/de_DE/AARBWHOXO8604288/DE_de/RECH/
http://savoycolor.com/upload/cp/VWWYk-Rr2nw8yV_LBnjMvTZ-Yc3/Ref/0106232950files/EN_en/Need-to-send-the-attachment/
http://savoycolor.com/upload/cp/XMkW-vK_lXhojBxp-evn/34796/SurveyQuestionsEN_en/Paid-Invoice-Credit-Card-Receipt/
http://score-group.com/aims/files/arIx-wbq_wTt-K7/INVOICE/En/Paid-Invoice-Credit-Card-Receipt/
http://seanstuart.co.uk/XMlzA-XsLn88gJu_puMxs-N2/Inv/33710636258/FILE/US_us/Service-Invoice/
http://segmentsolutions.com/tjnDE-FuBQhD6b_my-P6N/INVOICE/xerox/En_us/Past-Due-Invoices/
http://sentabi.com/vyygo-wSvVs_fKX-cpk/Southwire/PLO1730359624/En_us/Invoice-Corrections-for-57/55/
http://setblok.com/XzEvX-gRg_ZSAKT-tz/Southwire/ISE7275221528/US/Paid-Invoice-Credit-Card-Receipt/
http://sevensites.es/OFZL-eatiSSjl5_y-IMz/invoices/0302/2508/default/En/ACH-form/
http://shawpromotion.com/lQcxj-hIm1TsaI_Gmgh-tJc/ACH/PaymentAdvice/sites/En/Question/
http://shimono.ymie.org/OXOi-2aW_nTbXYF-Bu/InvoiceCodeChanges/En_us/Past-Due-Invoice/
http://shlifovka.by/FcJr-HeLVgC9Vy_pzaQ-Y3M/invoices/24664/22208/LLC/US_us/Invoice-Number-94276/
http://siamnatural.com/DqmtJ-3jkDqpBZr_WpCiKuHH-K8/EXT/PaymentStatus/default/En/Invoice-Number-560542/
http://siamnatural.com/uvuwQ-w7Vb_KNurw-GT/EN_en/Invoice/
http://side.ac.uk/de_DE/OZMWCQ5423562/gescanntes-Dokument/RECHNUNG/
http://sigi.com.au/kyap-9U2kahh9T4aoow_mksFafHys-V9k/
http://sinhquyen.com/VHTy-An_gWnfE-kC/VE354/invoicing/En_us/Invoice-receipt/
http://slfeed.net/ZHrZa-QXr8pwDb_CHgUbA-NR/PE16/invoicing/files/EN_en/Service-Report-09200/
http://smartmoneylife.com/Dezember2018/NBECPBME9543598/Scan/Hilfestellung/
http://sorigaming.com/myATT/Mw7_wcULcElak_u9m8OLT5Aj/
http://sorigaming.com/rLKj-Q6_jmaV-qwH/INVOICE/US_us/Outstanding-Invoices/
http://sosh47.citycheb.ru/DE_de/NNXSNNL8323484/Rechnungskorrektur/DETAILS/
http://soundofhabib.com/nxJM-GC0jBHLtX_QQarzbZU-bvh/Ref/4437401892Download/EN_en/Invoices-attached/
http://soundofhabib.com/XYog-8k_mS-au1/US_us/Past-Due-Invoices/
http://spiritv2.com/iVmHF-idq_C-o9o/INVOICE/25251/OVERPAYMENT/EN_en/Companies-Invoice-2454615/
http://spiritv2.com/WUXB-BXPjlcWWk_iUPz-qx/INVOICE/sites/En/Open-invoices/
http://srle.net/lfID-UXb0IH1KP_Hh-ymh/ACH/PaymentAdvice/doc/US/Paid-Invoice-Credit-Card-Receipt/
http://srle.net/OVLZ-B0DU_EZbqr-dQQ/INVOICE/En_us/Invoice/
http://starstonesoftware.com/DE/UPAVIJQIJ0609969/Rechnungs/DOC-Dokument/
http://stickerzone.eu/Rlri-PEWts_D-AMd/EXT/PaymentStatus/US_us/New-order/
http://stolfactory-era.ru/NAGs-n4BUn_tsQmQW-DL/ACH/PaymentInfo/En/Past-Due-Invoices/
http://stoutarc.com/SAYs-K54vaMNeu_iWI-2n/9404844/SurveyQuestionsDec2018/En/ACH-form/
http://street-fashion-guide.ru/De/XFBMFU6227781/Rechnung/Hilfestellung/
http://streetstore.co.jp/dWcg-b2GE_RLEYJgH-pC/ACH/PaymentAdvice/En/Invoice/
http://sugandhachejara.com/JIpNj-IhvD_RGKXew-34/X375/invoicing/En/Overdue-payment/
http://superla.com.mx/HwPN-kON8rJAhI25G6w_iMFmBpiVP-VzO/
http://supremeenergie.com/wtJtP-vXcQ8_Mm-Uyo/Inv/85082555510/En/Past-Due-Invoice/
http://tallerderotulacion.com/logs/NlvzF-b4B_KGurhYW-vG/Southwire/DYA2242233824/En/Outstanding-Invoices/
http://tasha9503.com/ATTBusiness/ECshzhHcu_1gYr0Gob_GWx2YqFHkY/
http://tconline.trescolumnae.com/EZWgk-b9mH_Vwn-Gb6/US_us/Paid-Invoice-Credit-Card-Receipt/
http://tdi.com.mx/ATTBusiness/gZiVFCYl7b_oVgGCjpL_AbPoQtN0Wx/
http://tdi.com.mx/DSwIH-Pzw3t_FAYqw-8Y/Ref/56645073En/Service-Invoice/
http://tfullerton.com/rHVQJ-N5rxjl24F_tmbaEgFT-fQz/doc/En/9-Past-Due-Invoices/
http://tgpinversiones.cl/beJP-06dxza9Y_tn-1GI/9340830/SurveyQuestionsdefault/EN_en/Open-invoices/
http://thanhphamlogistics.com/MTiQ-s2J_NiBvoGl-XTa/COMET/SIGNS/PAYMENT/NOTIFICATION/12/20/2018/US/2-Past-Due-Invoices/
http://thefanembassy.com/CrnCb-7a6PAiKE2_DYSD-gpq/COMET/SIGNS/PAYMENT/NOTIFICATION/12/19/2018/FILE/En_us/Invoices-attached/
http://theraystore.com/xXbd-twNF0dA0j_cjHtzs-cy/Inv/709440452/doc/US_us/Document-needed/
http://thisismycat.com/ujbnj-8mW_KcOA-u13/Southwire/YOY1544354941/US/Document-needed/
http://tomasabad.es/PJGf-DdxnIfy1_ilTitu-Rc/Invoice/49916837/default/EN_en/Outstanding-Invoices/
http://tomasabad.es/qFscs-XX1K_apDxzsM-rD/ACH/PaymentAdvice/US/New-order/
http://tonyleme.com.br/vVFZ-Hr6by7PEE_IGHgRqA-nR/Southwire/BVG726649543/default/En_us/Invoice-Corrections-for-72/86/
http://totalcommunicationinc.com/wp-content/uploads/2016/De_de/DBATYGF1305567/Bestellungen/RECHNUNG/
http://track.smtpsendemail.com/6039663/c?p=nmYzgpvjfxvbxINlhD74pSXXT6reJPgoLBdNZH7pPqqUMw-ev9kRLBYi59B2oPhGUZYLZm8GDg98RyBNIKgS5Tp427xBaIu_AaYea5ImoiygfkTk7kzusb5pXTFi8LFKQXykI-ZGVO0ysLmuV_Mao5BKLmqtSxXR8Yp_qqaovs8GKoC5Pg8cOx5V1pBcLg8v/
http://track.wizkidhosting.com/track/click/30927887/billfritzjr.com?p=eyJzIjoiVHczRGlkN0Y3dERfZEswbU0yd0QxaHd3V2JvIiwidiI6MSwicCI6IntcInVcIjozMDkyNzg4NyxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvYmlsbGZyaXR6anIuY29tXFxcL0VXQUxaUU5KQkg4ODQ5ODk0XFxcL0Rva3VtZW50ZVxcXC9GYWt0dXJpZXJ1bmdcIixcImlkXCI6XCJjOGU2YmNiMDJlZmY0NDIzODk3NGY0NmZmMjI3ZjRjOFwiLFwidXJsX2lkc1wiOltcImVhZTE5YTFjZjdhY2VjZDdiYzAwYzFjZmZhZTM4Mjg2NWI5OWNkMzFcIl19In0/
http://track.wizkidhosting.com/track/click/30927887/johnsonlam.com?p=eyJzIjoibUhTTmF3SGdobEd1V1U0OHE2NmdOY2YxTW1RIiwidiI6MSwicCI6IntcInVcIjozMDkyNzg4NyxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvam9obnNvbmxhbS5jb21cXFwvbVlITWEtYWc4dEt4MmUyVU9JNzNfQnRBT3BxUXFWLTIxXCIsXCJpZFwiOlwiMGUyYzEyYzExNmVmNDdhZWJmNDVhNzM4YzFlNDZlODlcIixcInVybF9pZHNcIjpbXCI1M2FiZmY4YTFiMjVjNzJhYWIwOGE4OWMzMTM4ODU0YmIwNThmYjViXCJdfSJ9/
http://trakyatarhana.com.tr/ifHE-XZ_g-Gw/INVOICE/EN_en/Invoice-for-r/t-12/19/2018/
http://triton.fi/KRkU-qE3YGYMR7zDYVv_phxwzxDe-hg/
http://turkexportline.com/ATT/RJoZT_Jf6b8DCJ_ludqf/
http://turkexportline.com/ATT/RJoZT_Jf6b8DCJ_ludqf\/
http://typtotaal.nl/wQum-omqRAMX3_mSMileE-gk/InvoiceCodeChanges/sites/En_us/3-Past-Due-Invoices/
http://ultimatehoteldeals.com/de_DE/RVDFZW2613173/DE_de/DOC-Dokument/
http://umankuyen.com.ar/vFfb-KbkeXosr_x-h8n/M01/invoicing/DOC/En_us/Invoice-4856721-December/
http://uocmonho.com/oHno-Dc1orvj3ZxXXjd_cdOssUFx-VPM/
http://url.emailprotection.link/?aGmQLItz4ajoMEkt5Z_P3gtrfPXUFC3dM_qmuboW6TQ-kC7qNlN37BR_eD8YQ3c1KORYOSFpRXilgqhUuh7aOx-yxhBy9pjj9BeqehIfV_7vKmXhQnQZS1BQq67v2XHHQf9DJ4lpzxa51HTntCDzGUuAU8jQ3km-v9xh3iCFm1ok~/
http://usa1services.com/Dezember2018/HBKBCRHNO1039044/Bestellungen/DOC/
http://usjack.com/zLfNB-oorGrGiTG_ZZWHqL-mw/Inv/70797064484/newsletter/En_us/New-order/
http://utafitifoundation.org/De/NMXIVFWUQ3345605/Rechnungs-docs/DOC-Dokument/
http://van-stratum.co.uk/GGzn-nRHDoo2jd_RCGRIg-Oo/INV/1491099FORPO/40277132273/Dec2018/EN_en/Document-needed/
http://velvetpromotions.com/ZJUsL-yPK_YjcOR-beU/PaymentStatus/US/Invoice-0538855/
http://venteypunto.com/DE/KBKNICAUTU3174725/Rechnung/DETAILS/
http://venusindexsystems.com/de_DE/BJVHRUXOU7201057/Rech/Rechnungszahlung/
http://vernonins.com/TPDbv-ncxkhWYnl_pWltczC-fhz/InvoiceCodeChanges/xerox/US/Sales-Invoice/
http://voapros.com/isPGE-e8cp4EJMV_YOwHSrSvT-i3U/ACH/PaymentInfo/newsletter/US/Invoices-attached/
http://vong.info/TranquilContinuum.com/wvvccw/pcvtV-qySgU2Ft_kxHjvJyDr-ujW/EXT/PaymentStatus/Dec2018/En_us/Question/
http://waus.net/kBUc-iQce2ceu_pSasMC-EXV/InvoiceCodeChanges/INFO/US/Paid-Invoices/
http://web.pa-cirebon.go.id/gBLA-YDq_Kx-1Pz/ACH/PaymentAdvice/US_us/Invoice-1142986/
http://weisbergweb.com/lxPU-3j60nDONL_Sy-66/Southwire/MXJ5841225541/files/US/Important-Please-Read/
http://weisbergweb.com/vWAM-3Tvu_Q-kA/Southwire/GXJ7148109212/EN_en/Paid-Invoice/
http://welikeinc.com/ucdi-A84_MF-jt/invoices/5684/92894/US_us/New-order/
http://wellrohr-dn20.de/oaeYx-nM0cBi9O_zxA-niG/InvoiceCodeChanges/scan/En/Question/
http://weparent.com/Nvkw-l0KvgNKA_rqPx-YbU/Invoice/45845541/Download/US/Inv-58798-PO-5B987232/
http://weplayacademia.com.br/DE_de/GLMRTOKTT7452161/de/Zahlung/
http://westickit.be/Cptn-g8smlJluv_x-mB/6671395/SurveyQuestionsDec2018/US_us/Invoice/
http://wheretheroadgoes.com/gvJaF-GxTmzSdZ_ZarBGI-xVl/invoices/77502/96571/files/En/Service-Report-3981/
http://widitec.com/qMeub-fXFnS_RAZIBa-2kn/Inv/3858719245/US/Invoice/
http://wilsonfreitas.com/tHnz-KvedPJ3P_xlpwZ-2NI/InvoiceCodeChanges/sites/EN_en/Document-needed/
http://woolove.co/vOumX-9dl_v-iA/En/ACH-form/
http://wowter.com/UDiim-h5BVNLFD4_d-GnH/PaymentStatus/FILE/En/Service-Invoice/
http://www.actld.org.tw/wp-content/upload/ATTBusiness/WQkuqwZoFU_7ZIS95J_7aLQp/
http://www.anubih.ba/tmpp/Igpd-osf_LJM-p9/Ref/39376072EN_en/Invoice/
http://www.arrowsinteredproducts.com/jILk-LlV_ctqRlDiU-UbP/invoices/9929/46879/En/6-Past-Due-Invoices/
http://www.arrowsinteredproducts.com/ukvO-k39rP4zNg_fypydxypC-Ok/INVOICE/DOC/En_us/Paid-Invoices/
http://www.atso.pt/QXqAb-hNvW_I-5D/INVOICE/US_us/ACH-form/
http://www.atso.pt/VjEt-sXXjoBK3G_wzFpI-QjI/EXT/PaymentStatus/FILE/En_us/Past-Due-Invoices/
http://www.azimed.nl/BNGj-likKFCNbmgzcGd_XeKZxNTxx-Te/
http://www.azimed.nl/shYAb-hoi_kKPhU-XX/ACH/PaymentInfo/US/Inv-362867-PO-0V796120/
http://www.azuraccessoires83.fr/QrZlN-oqN_e-SZb/InvoiceCodeChanges/US_us/Open-invoices/
http://www.bahl.com.au/nPvow-2mhCc9Cq_EENAS-9KS/ACH/PaymentInfo/doc/EN_en/Invoice/
http://www.baodong.vn/myATT/HwtTm2qi6r_Athpd0dD_ZSjrf/
http://www.barjudo.com/AT_T_Account/4PioI5_NAXwca_qKGtX12m/
http://www.barjudo.com/Sdue-1FLW_LjpYuBwG-hy/INV/3384553FORPO/6151546130/En/ACH-form/
http://www.basariburada.net/De/GWRHICO3976558/gescanntes-Dokument/FORM/
http://www.beardelect.com/mdzSt-m8tmNbsG_lR-4v/PaymentStatus/default/En/Past-Due-Invoice/
http://www.blueorangegroup.pl/testerrorpage/hkuR-icC_NjoedM-BV/ACH/PaymentInfo/En_us/Document-needed/
http://www.bokningskontoret.se/De_de/ZMMIQQDQY1491223/Bestellungen/RECHNUNG/
http://www.calan.se/Tibia/WtYAg-9W_jpyjv-OP/Ref/8452113931US_us/Paid-Invoices/
http://www.cebuflorists.com/ushpP-YSMwxEKgb_ylCUKh-WUa/EXT/PaymentStatus/doc/En/Question/
http://www.cesut.com/KjbBy-i0_CwNeIhJT-io/Invoice/0733771/En_us/Invoice-receipt/
http://www.cfmoto.lt/media/AOHup-FP_mFXm-z0/61420/SurveyQuestionsEn/Paid-Invoice-Credit-Card-Receipt/
http://www.chaos-mediadesign.com/demo/administrator/zcpJR-mbddTfnk_KAvGcz-6o/invoices/8386/01415/FILE/En_us/Invoice-5033545-Dece/
http://www.christ-przyczepy.pl/flgQ-sY3vjz2Q_KQXVNwdb-4C/INVOICE/DOC/US_us/Invoice-Corrections-for-45/66/
http://www.cinehomedigital.com/FvEd-f7vu7Jc2tO1VBcQ_kpsuEAwP-PUI/
http://www.congtydulichtrongnuoc.com/FGaOE-PDhboPsvlGjM8wm_tABwhpkm-2Dz/
http://www.consultor100.es/nnZPf-KDgJK8Ht7XadKqe_KojPPsMi-fu/
http://www.deposayim.ml/DE_de/HEGTXFAW8585168/Rechnungs/RECH/
http://www.devadigaunited.org/AT_T_Account/pig_S97z1V_h6KxO4x/
http://www.digicontrol.info/EUYMP-utLdElFXJuvHW3_rxowqhRM-2pb/
http://www.drquiropractico.com/Hcjw-3VkzP8lGJJA5UW_gUqtFAptm-98/
http://www.dukecityprocess.com/hunjH-xLRYqNMSoZcFdT4_tXvaBJVtZ-eN/
http://www.ebpa.com.br/DE_de/XGOCRBONDB2292018/gescanntes-Dokument/DETAILS/
http://www.fasiladanser.com/DTFG-tOj_PInjRufFx-BJu/PaymentStatus/En/2-Past-Due-Invoices/
http://www.fiftyonewaregem.be/DE/UGUQDG5423584/GER/Zahlung/
http://www.firstchicago.net/Dezember2018/UCTJXGO7152450/Rechnung/DOC-Dokument/
http://www.focusyouronlinemarketing.com/uUUV-ib7F4TTG_mejfnX-QLA/Ref/57883772newsletter/EN_en/Companies-Invoice-8075936/
http://www.futurambiental.com/yjtC-QcLlw_xbHDT-EoK/COMET/SIGNS/PAYMENT/NOTIFICATION/12/20/2018/EN_en/Paid-Invoice/
http://www.gocarloans.com.au/pJlNY-Guo_cTakiDpow-xfJ/InvoiceCodeChanges/US_us/Service-Invoice/
http://www.gozdekins.com/xxJEt-Klt_LBDOl-wG/En/Invoice-9602047-December/
http://www.haspeel.be/UEtJU-5A32n_rocRqRi-K3/INV/16498FORPO/68997862458/US/Inv-49121-PO-0O658866/
http://www.hlxmzsyzx.com/AT_T_Online/PzkzwPYd5C1_L0W2ab_a6M88f5o/
http://www.hochwertige-markise.com/YfbU-m9Kcm_rnyX-vZ/PaymentStatus/EN_en/Invoice-76081840/
http://www.ireletro.com.br/qBsz-lQuo_jicxd-aYJ/Ref/28004492US/Paid-Invoice-Credit-Card-Receipt/
http://www.karakushafriyat.com/Afrbv-RCNWwn5YuZL6O4n_RvzcZVPPc-BP/
http://www.karakushafriyat.com/zuPE-tM2qq_hddtpve-Ne/V443/invoicing/US_us/Paid-Invoice-Credit-Card-Receipt/
http://www.krasnobrodsky.ru/AT_T_Online/7eFxSb_is2z3F25h_ce6fUcO/
http://www.lagis.com.tw/blogsbbs/OIkt-St9854nX_bgIRBNRm-BH/INV/0639870FORPO/30021793691/newsletter/En_us/Past-Due-Invoices/
http://www.lagis.com.tw/ktPF-Fc8Pm_heXXiUK-HWE/OO15/invoicing/En_us/Document-needed/
http://www.lagis.com.tw/nezBj-kinR_cWV-qdu/EN_en/Invoice-for-w/m-12/20/2018/
http://www.lainocosmetics.ru/AIjz-vyY_axUKW-PJB/InvoiceCodeChanges/EN_en/ACH-form/
http://www.lsrighi.com/RpaJ-Us_RXdX-0U/PaymentStatus/US_us/Paid-Invoices/
http://www.mangchongtham.vn/Jkcz-Ee2UWDvlR_s-XD/InvoiceCodeChanges/DOC/En/Open-invoices/
http://www.manoratha.org/Lgao-uFJMCp4HYAvNssk_YjNwBIsbM-QA/
http://www.mercedes-club-bg.com/wzpLJ-Yj1_VjCVxlBhd-xxJ/EXT/PaymentStatus/US/Invoice/
http://www.mydevtech.com/UvLz-znguW8PcA_MogRH-oFy/invoices/6374/1842/newsletter/En_us/Past-Due-Invoices/
http://www.natex-biotech.com/EDXj-amB_QgnPsRJ-ic6/InvoiceCodeChanges/EN_en/Overdue-payment/
http://www.natex-biotech.com/fbry-QEaBTBE1QQOval_DAboazXyT-asi/
http://www.nhp-i.com/HPlgW-3lbp7WBO_JQmmf-19/Ref/0259605305xerox/En_us/5-Past-Due-Invoices/
http://www.ofmirmebel.ru/tmp/fUoDD-h8Qw_ZuMMMZTUX-BML/H412/invoicing/US_us/Need-to-send-the-attachment/
http://www.paiju800.com/xGEa-Se_B-dGL/YC95/invoicing/US_us/Outstanding-Invoices/
http://www.papaleguaspneus.com.br/mrra-UYZFhvvC_izPg-H4/ACH/PaymentAdvice/Download/US/ACH-form/
http://www.pmhomeandgarden.co.uk/VDKPVM8682855/gescanntes-Dokument/Fakturierung/
http://www.pnhcenter.com/mKck-X92E_Wt-zf/INVOICE/En/Scan/
http://www.popovart.com/lYArT-Txawj8YHiek55R_UATMtuGU-Ob/
http://www.pronic.com.tr/uDUT-aU_UExbQFAm-sjx/ACH/PaymentAdvice/En/Invoice-9190868/
http://www.quicktryk.dk/eUvB-5wdp_FZSBXOJv-p5g/6832291/SurveyQuestionsEN_en/Paid-Invoice/
http://www.rashmielectricals.com/JUGTb-HAr4DUTA_CUZtryC-Lu/ACH/PaymentAdvice/LLC/US/Invoice-Number-385661/
http://www.realitycomputers.nl/gadne-mJqRXki6OpFP2GJ_xZfGthaR-Si/
http://www.reparaties-ipad.nl/eSIc-3JbU_x-PJ/INVOICE/5661/OVERPAYMENT/En_us/Paid-Invoices/
http://www.riskrock.net/Rskyh-jd9dT_mOVlmI-fCW/En/Past-Due-Invoices/
http://www.salamouna.cz/cache/niNIE-awk_uIjdCfidW-dl/InvoiceCodeChanges/US_us/9-Past-Due-Invoices/
http://www.sambasoccertraining.com/PRYwC-kLd6QNVKBUWY9Cn_EyfVxBUR-47/
http://www.sambasoccertraining.com/ZfrWP-jzvn_lVm-ZA/COMET/SIGNS/PAYMENT/NOTIFICATION/12/20/2018/EN_en/Scan/
http://www.servicesaiguablava.com/ytXL-Dv_puxFmyAR-VuV/INVOICE/44249/OVERPAYMENT/En/Invoice-for-v/s-12/20/2018/
http://www.shadowdetectores.com.br/Yqxi-BGo_HHdgJx-Zy4/G756/invoicing/En/Companies-Invoice-58739333/
http://www.slimes.com.au/qrbjR-07c02mko_hKqiCeS-BLi/4103779/SurveyQuestionsfiles/EN_en/Overdue-payment/
http://www.sorigaming.com/myATT/Mw7_wcULcElak_u9m8OLT5Aj/
http://www.sorigaming.com/rLKj-Q6_jmaV-qwH/INVOICE/US_us/Outstanding-Invoices/
http://www.steffiepadmos.com/axCvT-Qdx8PEflI_qq-tQ9/Inv/891139602/Document/EN_en/Invoice/
http://www.steveparker.co.uk/YAQg-yJuF_WRdzGVIcP-Az6/PaymentStatus/US/Scan/
http://www.sv-bieberbach.de/files/ZePFY-Is6p_Hf-20/Ref/0816703485EN_en/Past-Due-Invoices/
http://www.tdi.com.mx/ATTBusiness/gZiVFCYl7b_oVgGCjpL_AbPoQtN0Wx/
http://www.tdi.com.mx/DSwIH-Pzw3t_FAYqw-8Y/Ref/56645073En/Service-Invoice/
http://www.trakyatarhana.com.tr/ifHE-XZ_g-Gw/INVOICE/EN_en/Invoice-for-r/t-12/19/2018/
http://www.ultimatehoteldeals.com/de_DE/RVDFZW2613173/DE_de/DOC-Dokument/
http://www.uocmonho.com/ALWYh-Zw7tm_WA-bw/INVOICE/2159/OVERPAYMENT/US_us/Invoice-for-r/d-12/20/2018/
http://www.uocmonho.com/oHno-Dc1orvj3ZxXXjd_cdOssUFx-VPM/
http://www.venusindexsystems.com/de_DE/BJVHRUXOU7201057/Rech/Rechnungszahlung/
http://www.wagnersystemen.nl/RAPQ-eR_QzTfluue-3X/INVOICE/US_us/Paid-Invoice/
http://www.widitec.com/qMeub-fXFnS_RAZIBa-2kn/Inv/3858719245/US/Invoice/
http://www.ykmkq.com/GUrh-f1L75KRQScF8sH_LjXOtIJf-Pf/
http://xn----7sbba6bh3becic4iua.xn--p1ai/de_DE/IVDVZAQVRD5154015/DE/Zahlungserinnerung/
http://xn--80akackgdchp7bcf0au.xn--p1ai/Dezember2018/DXWVZFX5308370/de/DOC/
http://xn--d1ahebikdfcgr7jsa.xn--p1ai/oLwpB-108_w-NA/INVOICE/US_us/Sales-Invoice/
http://xn--e1aceh5b.xn--p1acf/JyFzg-Yr_IvrUbx-3eN/US_us/Outstanding-Invoices/
http://xuatbangiadinh.vn/obuu-03Bf_qjZE-nn/Inv/55346489050/EN_en/Invoice-for-you/
http://xuatbangiadinh.vn/OGqC-Tj3OwlsN_zrOznAK-Z7/INVOICE/files/US_us/Invoice-03167583-December/
http://yearbooktech.com/xEUvM-tpRnGLyv_K-4zg/ACH/PaymentInfo/INFO/En/Invoice-Corrections-for-81/98/
http://ykmkq.com/GUrh-f1L75KRQScF8sH_LjXOtIJf-Pf/
http://ykmkq.com/gurh-f1l75krqscf8sh_ljxotijf-pf/
http://yomieh.com/DE/NIDHKCBTBA6918693/Rechnung/DOC/
http://yonli.com.tw/DE/SHCWAXCD7052947/Scan/RECH/
http://yusufsayi.com/NKnz-6TqQn22VS_QJSSRg-NT/invoices/1417/25172/scan/US_us/New-order/
http://zentera93.de/pXgZ-62XaJ2dbJ_ySOCxcg-gc/EXT/PaymentStatus/INFO/En/Past-Due-Invoice/
http://zurawiewynajem.pl/De_de/YDFVQONZFX3297478/Rechnung/Fakturierung/
https://linkprotect.cudasvc.com/url?a=http%3a%2f%2ftasha9503.com%2fATTBusiness%2fECshzhHcu_1gYr0Gob_GWx2YqFHkY&c=E/
https://linkprotect.cudasvc.com/url?a=http://srle.net/lfID-UXb0IH1KP_Hh-ymh/ACH/PaymentAdvice/doc/US/Paid-Invoice-Credit-Card-Receipt&c=E/
https://siamnatural.com/uvuwQ-w7Vb_KNurw-GT/EN_en/Invoice/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2018-12-20 21:11:00
SHA256:
9211a77dd37798e12f65e2f756636771d2760e2cced9b5fade11d3757163406f
d0af2fd3d62e4aa670362627ac41e480edc0c60526272ad7bdc86003afc82edf
a9eb9429255f9bc08a42d9338cac1a0f7b39080d3ea71601e5e4f9dfabf0f0db
9673e78c25f462a3c4340b91a52d110c3d0d8156ae9af190a3c02f4eebc7faf6
b2992cbcc3cacf6879aa1a9bcc9fe8c0d62b5326d8b4f40bd5f2979a261e12ef
cfdc83712416cc863020d02d6bc376d84b37d633c189d9cc2de0ce56ac272b78
a2afeea69b4512f2b36bb04ecb5d9ef6596080658b241878ca308c6f170ea8b7
12b8759f5de691c764682703c684931e7cf48ee7be91963ede1421fe604b91b7
129ee00c04a6b2e6231b9919178841242df101184be88afba0441c5bb0b8c39c
cfd51380b31b90b97dfaf68c7e1273190a2660538f659ea0d6dc1ef8099cca7f
084ee3a04abaaf15cbdec12f7f74ae8e4670db840f24e8a3335ce1a9f6d07cb7
fda7c4bf9f6053900b268a13d7d089f4dc91ad53bdf90fd7c183c7fb5ac647ca
9c36dcd976f7167af5b0a197114cb824f6e09b2770e4f7a643bc368d709e13fd
ffcfab023c2e4bc0e8f73abbe10671c6e1b7c1f96f4c64c87cbbdf819086ff37
b261d4912b35aec439dde627bb74a93b5fc9c5609616af27eb5a4d788244517f
8a45b84314bf4b90f4698c52e12e3b13898aa6b71f7675c9a340994e80986baf
84b2b8a7808685f8ace5993465b893c81a056d4b0088de6864df7bdc8d472374
1626546d6d1339b0c1ceef2bc4bc5c0d7b25c920e74cb2f32b8acbc7dbc054ca
e9e6e5ed891e794a600a883c825e34c88906edd919b3718791607459a25c722b
12958b7c4df703e4b97f42cf70e953b571319072fede31af366e60dc5dfc4c5d

http://www.jamimpressions.com/jkcsJpq/
http://www.drquiropractico.com/iKGPMCf/
http://leptokurtosis.com/NE1a7l8aSX/
http://jongewolf.nl/LWhD42m/
http://www.digicontrol.info/PIjj96R/

Creation Time	2018-12-20 19:45:00
SHA256:
368b7ec0c6f5e308b177e5a8bf9221eec58724b68801007152a3b1b0d00bcb67
52ffcf2ee03350f1fbe1b09dd519cc9afe980a5435cf9c4ef6d9de75f4de6d61
b49c04797d876efb6becdfd12217251bb6cf52f0512ddbe5ebaaf4983e983c64
3b395d9ae5e2c474eb56bc5b28c90f114305a18da11977ccd80f3b2864cf1732
5055a9160b5345fca10baeaf45510dff476c0918322c935af87dbf8b88ff511d
08e5ddf49bd7033c1bdf0b422a3c510293f6c2bd68bac7aaf9656f1421253295
f3424738fe17bfb9f179667bbd4597ee64b1e31ed9528fd87af71b68b9c3e63b

http://www.beard-companies.com/0I8TiQ88/
http://www.mayfairissexy.com/nsfd4tG/
http://fraternidadecristoredentor.org/nqynm0a/
http://sjddv.ru/AKyIIQBMap/
http://www.alishacoils.com/VOf4kQN/

Creation Time	2018-12-20 14:35:00
SHA256:
6e94090940d5457cfc9da5421da8a96d008f7b8a2c70e0c33047cd93e26746b1
0a8a833dabf198d88f86498bdfda18efd7a33fe9379862d91235503685cc76c2
b0d5409738c7340d7b7be4e39a2fb57bb8ac07dd7ffb51ac5f3878f5654cf17e
a9fa51d20780234ca13f0c4534002c852b9ff14fd030dba9b32d1de3de13140d
6503aad83f05ee9c495852baeff4537871eafec7c37066db2d086cd108ffd6f8
bf0d01d08d9ef9677f697e2e574429a72003319335616274510556c80c9a0a80
516255d422fb5d3dc1191c964c57cec2d7207344a9fe4fc58b414aae76271de9
c829a5adea730a03784788f481d177e25a1a2d4d91cfa3f975a5caa0e1ac4e8e
7081e6d6803dfacfa22aa60a2c520f2c2ba11a8d58645e80272dbbf7b2b0a347
30a46262f3e903a0696ff2836332a055196867e77c9e3ea5f0dadcdd1c279dd9
85e19a6e2b1ab96f920634e5f99ba0a6c6e905ef6b0b655d7e6fd6084ae71fc4
9213b06240aabfda0aea7865a275c5c4dda892e37ba0848eb773106548974f4b
117f73ac9cb118ea3cb15e12828cd1230ed32ca9f5dff32d37329cf3be0e2639
7ecdf9b93d2ac88d1eff2c859f7a1051b09d88bdf2e0057c099fba72e962c88f
b7a376c01f14765a00a27fdede2c809e22f754acbebd5e914633cc81ca8b8345
e0a32c200e279334cd4303c0ba0a793c949228c9f8258743b552cbbc5d3952ff
ca92ab5f27c770cb030a1a9cfbd192b62abdcb6b0bed4c1a3e4c937162979732
539b86e6bbfe0eeea3198709f97c5d82d2a407e52e7a6ab4babd34f32826de42
1a866243f492e5bf2d88ccf1056345222d296c404d46a4583ed836794e26b6ac
697153bc9d678f8be35c9408f215693e0063eb03095c613519ed5fd0aa7c05dd
2dda9bc53538f361948d64aab5fba43b6446b8f8e1d6b21530bc5ad037dea410
6a682417951d814c957bea0e701222a05dd77331dcd4b6481cfd40ac6600075f
b76e20536a3e5990bb0712a4ad0f113b7443d8025f53f6ad7c4eef42210562fe
60884aca63a5f27ad52d6188d1fca233fac51a30d802018867d70c705c030663
8424d5945b0c3307861490cb14a0410c615b4c2e69c0a388017425611b9f5f10
a4b446f682a12514c73f5456aa19a69ef95bb5f438e09e743efe0f0c173aa23b
f714f685116eba11ca090a58c1ae61a84e6cc9b43e85bf8566cdc82061e170b9
337c3648e38df3f5383b0b6cd053aa3b7a5b90a543a45a171dfd3ddb763ca2f8
a5a7179b804377829b6bd377ae3752020dd98586c26a71386b11cbf43d3cabb3
301c836640b0bd278f52a6ee214f6a982e85d66df3cd424f98b39c6794ab9908

http://opewinsng.com/bOiANyEc/
http://chamanga.org.uy/eE9DiHE6/
http://ideagold.by/rzb6hSlC3/
http://onetechblog.tek1.top/MyZztFl/
http://maxclean.srv.br/QVtDDcAZ/


Creation Time	2018-12-20 11:53:00		(ENG - Orange/White)
SHA256:
20efc84a7e968fb0490cb811c202426acd0c78c6481743c7621bd43a6ec277f6
db8ce99f1e9f425a579f2b9c5e23484392080d1e1888fe888bd848ebc7136add
e3c2eb2dd321eda7aa43fd3636d9b78fdbce21f4820338cb1b8b7b893c4cb936
2905f37d36a166f19bc9093f272557e6f160021f739abb7ee45b03cca626d09c
296d7c632807f236935c7fc717fcaa4ed2b36e0417a5235b5b2213d4403dfc2b
f45796612870147e0d8b7131cda3bced4dcb6f2c97026561778e438f57717d9d
abf52bb66da28da3ec30e56875cb59fe40d710982854806ca0580c2e7d55a7f0
cdf37a101fceeca4a3eb083942a23c24944a668fbce5e5e9e943235acd8a6ac9
358002adb1ceb8832cf6c42cbfd40cd309c2f8c32f3d346d44eca2c6076660d1
eb52a84ddad63318b182303819bae6e2500c49257f9000f7cd6ea585bfa62c89
fe3f1c9e4d762e0181289f689dea23083b47575e1fdde2f72b1757180c87aa2d
23914ae7db6072f3cf5b8631b013c92f03405ef271686adbb0b6d27009a62c98
2712993960c42973099f082898aba678ac03a2b399fad6d6a4712bb80a970729
82905846bf2d58fb27723453132458047a90acd8a5dc54e61361dd08f323b62a
9a19b1c04a7d4cf5a7fbf4df72d2bd6a4d3413c061cddf2171a0dea42f1d7433
14b85ab78cf79fb43aed01381205b188a35c1ff38358c25ea61dc68ebecd0e13
cca12bee701a4114a82e079d8cd4b2f4810a225c4de555d44ef118336b0d8943

http://www.omegaserbia.com/1rDAPTYEgE/
http://bod-karonconsulting.com/ZhsjepZP/
http://www.viaduc-chine.com/D0oNVCCPY/
http://pjby.pro/fQ7XwN34/
http://www.brandywinematerials.com/acCdN5IUIq/

Creation Time	2018-12-19 20:55:00		(ENG - Orange/White)
SHA256:
efbaf95e866de9191477e491d4092c3aaeeb66eeb8aace893e9ad7141ba633cc
49a44cd152ae054e86482da2fe6223495a6f6af45455c6cae3e61ab58d7cb8d5
d2389d42f8481753d3957d7cb2150406ef67e563a438e52f7bb31f6109594441
41f19cb3e19d8ff1d5cf5a006ca95877667ef1a36b72cc9debeca54b37053bf0
430ff4d90db9bad4fb0927d47b9de3f6bb08808eb55161e429bb00a27381b97e
f5638f5bef1ddd70ee6acc5b9fbbbbdb7b85285b09c051021845a73eb32608ef
69632aa3d4831d3d9a21419fab6241e3e13daed5448007090b2360cfd901da93
ad5138080caf4cc5a72e6788e40530a30d12ae16a17f4af5470ed01cfd169a1c
ebdbf009fbb4491c743dd5e2b47493038818a4468a7d6a4005dbc914317e9e09
e25dd88a0cc86f5665834d97385d8042005298cafe5e426ebc82f4fe30cb67e0
70d6d9d6186ac21e46f154fab7e899b6c342a467f2eaf4212299224e860fcfeb
6e438c6f191ae7692eae099e0f80f0282f258b0afbd606efc7e1c40c60d9f9e9
e4b6fe33ad7e15e86a0a9b6d72348170e8c6096b7b5e09d795635c5935c5642e
7213b10919b2455b67ed5759498e7f177db260994492d1b0157c4305957c42a2
0e3557958155fd7a0824a2eea5f5e3732798371d08b116015c7e36ede0475980
110832be2faf57b513de8aef11421cdcd180efc1892752300dfa345848308def
e464868e34cc98dfd3b0af2635e27cc31dc7e77579b3bcd37599383b1a5e374b
246d97c8562adcbea01d6a6942e361699ce5583297259194da8e03e5a8b73a2d
c6a82a19e8de3ec40378c8dcc17f2ba9ca788420cadf783c124893756d80d87c
519cfa25fec32dea23510fb72f4265b8ccfb20a733ba038f3a8e422bdf27f5f6
5e83f7a7bb3cb2fdfdf9dbe30d59c3bce7447b6a99042cb0dde1397033df963b
43818efd1722e68ff8437840b1078786b9dc873a39d5f7d26c86f5596d9bc132
9e8225e586deb0f8aad14649cd5ffec0c304743df210a5acfb098726f9425a9e
d166a1b1581ef798c74414c6e0968d3569cfcb6d4589c3b7f5f053b7d6d0e9e9
af7fbaa891bfbf0323709e49b9bce7b094b089208179f6320c7bc8d55685e3f0
5ee242735fe10acca155609223ffeaaf3a6c7c5e8dfd47564a47ae65363a1d9e
a2a809f39e442f484a6ab6129a4c2b0c55f2e08bf581f86a361e84899705301d
548c16c18e2a5a7be1006f9e11ff656595a9af744ebf54ae345c5545f5326ecb
f09bd77924f7558a2c70efdb4acd4ebd16b33a8636433778c01b6247c2e0d395
d2ee93bd47a48f400878981efa9129601ca82f688ef3a5e61b8a5490c6285578
59c5a6ad8827d90b094dc45f8d12a6b6bdad58597daa38c251622555ca851081
bd5df7e6cb61646a4b3bdadfb4b04427cdc578a3d6c01bcba6782d3a74579550
e18d59b2fc58b3f43864de07abcf6a72f4ab9c2e2901e79a01fa9f672af6e08b
c3c84d803fcc85e564e95e2bbc4a7417c26716cda11251b4194fb7b963e71bca
9dade916742bc7c8a1270f4187e443a983bcc00af2ea0c4ea25cbe3d2b6a89d5
6e6a2c47aafa8c967018831173e45b3e37d53b6bda1207825757d2e4b9737099
7ae2e5a4d52b6d13dffd5de06d9efec26041791cc9c5e96a46a359b716ddda99
80f397c4057064edb5cd2e305c595a9a1d8144a68bc579c2d1438953e6c43210

http://mysmsdirect.com/jfnQmpae1/
http://www.cinehomedigital.com/Zm9NwEw/
http://sourceterm.com/kZhwN9eYR8/
http://minhphatstone.com/8Bf4BphM/
http://www.mehmettolgaakdogan.com/wp-includes/BhYPvO5kiF/

Creation Time	2018-12-19 16:42:00		(ENG - Orange/White - Macros on Close)
SHA256:
ff1bf824a5f91dc121624a451101c172e8d7fa135fcef03a8a9a1cb6f23ba3e9
41c412bebbc2f99e2d1a4eb80bce9bc9346be10df7b004bfbba67fc0199ae19b
dc132aed4bddb62413af5b5ea9aeab5564666e384f42fcba0b5f52090a012e97
74f99474cbd773796849c10d3f71c7d5ffb3d6670445a086c7a59f368a7ecf7d
e4506660954d4b70edb0bc1173d60ae4e8316ae31555c7161000cbb243eaf8ee
0c3ede6cad456c624193f245706dfe1d1ad9c0277efb0f474eef1e5fe71d12d1
a9dcad525ec70b77afaaf959ce0ffe2b1ae9be291af209dc76f4ed8404642bcc
667e866ba6c82700e3a56226b862aad3c84892ba017b60226e775d42000f8549
7df5f022cd98c38c22353fc2cc32ee3ad96827383d7fdd174d8f5a20cb94c5c0
ae106183d29ecc79bd1867d0e955bb0842d40ff17cbcd84ab634951cd7e59c41
773699408f9e8dccc446105dd63faf83e9264f6730b269852f8be1b10f82a5ee
56c8be4f32af373b10859e7993e4fedf0205cbd6f56e14762648098e460f4258
0d0eafb214b52e09ce7a141c7d25bb211fc788fc3b65073c83d77a94ad30dd8d
1c9e5f3985a182c46ea7ad00eaad78cf0e0b13d51f5ff1b9745b517f04fd1b01
25df937a2387b13d5c6c7a2ffa7d61c9e94d205e20137ab098d67708f9a88136
26ac5141e1f25dc3125bbd126deabd383a72139b96fbb02795ef27ae6beabe84
24b72b319b56976cc7712986af539f06fe63caeca539f181a486d0d1bd195795
b7bad016ded3246d9e2ac71e40e360dc4e1862978336a30f21581752ebdec148
d3fb72cece6d3a580bbf0b6e8a258f619564046d7ba3242c95a56b581c423d35
a9d217e23d0a3fc01b857b3df99bcc2053750916ad5d8d819f01f7d361a86648
794cce0df1a506a886abf16c2776d90717c958ecaf359dd84e0fe8ebb5867979
15b2d8b7c59bb1346961fc2398bb2cf18b5c074fa865952bfbf407b5e56055a5
73af58c47946460d79d03c021526c923388f5f704ee98f14e72dadbd62d31bc1

http://proxectomascaras.com/KMTqPBW0m/
http://oldmemoriescc.com/h3gikgCl/
http://agentsdirect.com/u8JB2rER/
http://johnsonlam.com/EoTO7LvsB/
http://wssports.msolsales3.com/HprfxymZWz/

Creation Time	2018-12-19 14:03:00		(ENG - Orange/White)
SHA256:
e78bf71719ae8c374c1b64198362873b9a37d5c05b108c0611178cec545d2a06
a3ede90ae5fc65fda1dd1ee6bd6e0cc8ff9f6c2f976c9de8d1fe2c670e99fbc2
a24c21b5b32feb6a6ac11275a21d0ab224ee8df7ac286b5aeb2fd53fe9255934
abd52f07b1a7086c8857a4912e000c6118a5d7d76409169ffdb5d4e8a5eec6f1
32ce9e2aff3d741b6824223ab4df58e540d5358fcb16dba761c8202a02c33e60
bcc42b280d5395698a8483b5fcb39199fe03f1924ef3cf8c24308c42bf0a83c9
8d2ad53e74f3df6409c262041a431c7facd90e0a4c29fcae9ef35eea58fbe7c8
56529ccb72c80f7221c36c3450b8bb93ea7f2225819626a46b029e5bbf558ed9
dc70019c2daa7ade6086921bdda76a6f9fc38793c4685648068bb44b1b3d6d42
b73966a4e80b0ba8e7a8eff489b4f25c2546d8043e718ce07f2834fe85c5f6ac
c7c55bae4a7232c8d716421cc63b673f5c3b413588750142daaf70aa1bb47936
19396d75f839402f4329b6c3aa4641c6e1cba160f8720661ee9ea2f25e7a2ae3
9c089e3927a7b03ea9af4a95269f607d26118340a073509c296e82f2bb8573d7
2cf8514fca5d4e399fbb7359383b0850f20f9f59859448c29b407b3989e87b19
a3a0d88ed2ace5d01596a99bc20f8f5de1bf9b08681a47dcdca95c7198f20f70
635595b0b1f97af94086d1a2c1879ea1559ee829197c8a71eb7d5b504cd5d0d9
10bf87fe94ece02b5267a5c38e0b9c3c715efb39e201e12ef7629cc984091482
967cf2da9c1823ae48dea1d89435b66c7fe01119db88318d5497225134c0005b

http://haitiexpressnews.com/axVVsl8C/
http://dentalimplantslondon.info/7MlH3wX/
http://duanguavietnam.com/flag/nRo9nop/
http://kowsarpipe.com/XrdcZl5H7Z/
http://www.acilevarkadasi.com/oNHf5D1hZB/

Creation Time	2018-12-19 10:32:00		(ENG - Orange/White)
SHA256:
d44f3dfa51571a9780e8b2e7fac919b501365240a1c4e566b08bd94653416b82
016f18453dc201021a0d3b020f8a796749c7cb79f2796d264347a28c02de2320
bbc301b501a05b85ecdbcfdbe6d199ff9c2754471a2cc8ccf2864866ca6a7fc5
f8e1e91eada05ac21a0440db0d9f0292df663f595f1cb7f92666faca37a4996d
80cf64323e7461a11e6352f79af8c9343c551ebb4aa081e71e3b58dc6abffbd3
edf6af7d4943e6b14a166bf5edb4976a9d181ea2da1a6a8735a54424eacc97cf
e4aafbe990a5f1dd3595b1232512dc565af317b39bc607d73c4cadcba734d51f
6fd40e6b7d7b1f0a8faf1e880d91da6e6ece01efd1824dfebd2467ad6d77ed2d
78628beb4a5bb96d49e21db8222c67456dcafa41ec30ee66b3097aae520313e9
4f57eee40e82b59d696aaea61758c1c23150d1f43d4cdfb989375791f322eb67
0ddfec71e75e47c35aa4bc386628f8cde14541a059d384bf04a12c8b98713e0c
200d98df68631efabbb6a8cf4f6f00b4d000c0f02afb874186f9aa7134a00b45
2bd6d4277ddf9b1ea0ee8fb0288fbdc0d915a25a6017193b9644d0ffe15548fe
192fb652718fdab987b424cc7280c8aaea3af9bae2f9b245b797ca451e560b8a
7678783514f037f783823dfaa6b5f6d4f627283e955cc5fdbf74b90ec886ff9b
b74a4f98e4304677e37f34d2baa74581093f66a8b6d40e5f29933e5441340553
3ff49569c57f384131a4ba90f9a4fd6036527ad6ffb1926ee3a54763c9cb38c4
1769e1efc48035d38eb3282fa0fa01b029a01039d2121d42f265e02b81816943
51f2ca52d34d84c1219905690286bca9769bca5a78b5e9b5019edbf93866d23f
15174de6bc71ed7595c066a85b11b8ce7d9e0fc21e5d97f22df7b7999c50bede

http://sanctamariacollege.com/4YSJkQyGZ/
http://therxreview.com/GlXxSlMg/
http://lawsonmusicco.com/bFjHHpYRZE/
http://kblast.com/0JDhMHSy/
http://justclickmedia.com/pEOzh8cHUn

Creation Time	2018-12-19 05:58:00		(ENG - Light Blue)
SHA256:
3b061ec7809a80abfbea303c2721224a73a31f5a0823ca5eebc5a24b5fd61d71
c2163d51aa2e33ec573f7a77780064f99edd6622e2b130d29812945526e976b1
245f11f0125b1abc10e6383636e6e165297b973547aed7e8a84729fb867ad2d0
05eb7f0bb617ce84e26192f529e4ceff87ad07f9bdd340f8439c2321bae6ee5a
8b3d1f114272adae8789a669555a7e1ad3fa3ac5feaec52cdcd00d21a47cfe89
b3befdd66b4c10721d277f4a6f77e779f85e49cd0d28a5507af96fab31459420
d9a4db640bfd81d7d86b15593afff0b6df8312956839a54afe8f38012c587ab4
8c0c8a18ed3d80ae5b69579e5c963df5480e3b7e5def991f9e36106fe3ee27bc
0011f100633bd595dd9a21849fb9e6b52fb1594c41c4eceebb8f33da4fb74150
d557a07694ce990ecaf21f81bc514d890df1870008e2ef6817ffd0057d8d44a9
66285eba00c10b3d32daee7c79c0f6305cf3699e1f48a72b3b692b642e661e15
fd86839fce0dbda6ad4972202cad03d546e0920d8c1af13a6baf6ef48700b78e
286d0c26d85d4b04dad55bf55a8fbf6d4c38bfca679395567f8bec09f2a91bbc
e25511c17b6dd2b86a98ebe83c7419b87e3aab4455c886f882714667ef5b263e
e01e1a9af412a7ba1015af9fdb2b50431e40eaf38e3d59bef7a98ee3b6c6f287
e0f8f0ae3022336f8a3eaeda88ef97297af862b86fef2c91310d55b631915169
e8796bf34544175bc510413d6ef3c81e2027b37046fedfe1a7da883b015a17ea
11149d8877f89d9d1bb6545dbbcb4d090b0428146e692d8374aa9780b964242f
d17017dd6b262beede4a9e3ec41877ee1efcd27f7dff1a50fc1e7de2d45c1783
99d7de1ae23a34061406dcee8be1730f2d93bdcf6aba027d2aa51ba5fef37d53
4354e84a9af3ec83ee865b631d4c37bc6095927e0d11144aa9b38f83c91be5ae
f423180efb1f647d609c4bd89ed7efd85923a5ee5f06460079393880f78002cd
64871bcfa6b36a9268d69bb510ad865cd5f72c72f68b8e5c2cdf9a25d7ea9da6
db2fc3ab7e15832a44fa886ff7abc6aea3670cb1f15500d0c111ed92fa6de586

http://patrickhouston.com/yGW2p6bq/
http://parii.com/piwik/tmp/4KfmNmAnm1/
http://psyberhawk.com/kDjKJgkew1/
http://panjabi.net/79yH0YT/
http://pcmindustries.com/FsABdpKjM/


Creation Time	2018-12-18 20:15:00		(ENG - Orange/White)
SHA256:
fc311a823a1cfa0f63d289484ff01576fe22084403c6cd7a648cb51626abd10c
e0111e942eedc70e3ea3578ed4cdc8ad563b0bd1ece937eb2b75d95053dc3af0
2a3b0f9088cdfe396cfa3be8ecfabcf0ea3b43fea6b81b05492ef56c3d81635e
0f0612efd3712fd8caf9ec7d24cdb8b4b027bf6c9a53c0da71b9c99b66a105c0
1f938d30b0d19fed023a592048efe18bb8c0f1879781d21ab8eea8617a5eb22b
772332e13f0cd6b0e90599f43a5586b1a215fee79d032dcbcbb033901e6d0b72
e2fcea79cb0b574244caa83c6dedf0b2cf74a833d2e3906f1f9bea38b889e7a3
153e113c9bf26921d594c90e59715255b804c490625a6136b3ffb588be7d0588
7acc8cac73fd7fcba6d30f17757e72058df3ee66d57740c596f92d72f9c52fff
cb8d836596a8adf98ac6450ce6d8bea8ced34f49970205814e85fc00adfb25bc
57ec938b6da6d1ffd234d92482d02e850f56ba154dc2affc18f7cfe50d663383
78d82920f15766edc699ca42a6362e4680e07a3b68992cd21a16cbfbdd2a988b
5f446c1e2feda05c1fddbaf61cd8d79d1285eb3b07ce05ff588ec66be5270739
fcf9b0e523eed78c157725bc02703cf177763e736763b277cd1cae028e447020
a3ca7101e02f1dea7fdd3b0c3bad3feb7f58dff5cdbc15ea4f8996a652662a7f
d213b4bbc5b533ff60371cca5823ffadb7c13ad8b421fe60051e8440b0f70b76
3c18597017ef58fee97f8b28879dabeec6dae7a968a56a891d07d1dc52ddc3af
d72b3b8a283eea17f4c620870090cebfdd0fa152904927c792f2c2f5238c172d
2c758c5ea20263efd1908094dfdfc7b68b71af7dd7e18ca59fa552315fd271e9
cd32e32608d3ba85c9fc1b0bb009ba8e25f1410cc910d319d98f5af7d2931adc
1fd8e6326b6c9a5cb932d48001f2efbeb050f2aac529c37327adc58babdb476d
e5648a535e65cc93a5620fd743b5e2049b79661d1869294f48e8bfa528a41eda
b433fd2d1547ac6b88f2f0020f9c65deb9e5de926746e55c8ecac1972e6e2c82
4aa3b6636422eebe2c9085adda114f6a626b9d9677870067ba7d2b82ccd8e97c
9465e185342f9dbe9c178c57b3ad78199d6feeb0812997ad198addd4415c5002
646438bdc8e4dd4f69617fe9e2cd1f2072bee49e9ce3a9f772c872bc138fb4c3
6817d20657d018fca61d26900012052d7ebf9d24d9ae5a5669c07e4ccc13735d
d45a1604a43eec9c7ff1dc1a449861d7f3fedf99c92d8a95508ce3cda129d4ee
7e8d76c01529141c3f4a02bc57b3f3e65608d765735372c2a9252c5238f53a91
ea4644d47c4ce13ffcf2925b8d9b6f00a2410405ec90869894985b15b3b4f113
4668ea18f83e0895291819c7ef59d7d370e817c3d90e1c7359ce29406c695192
6547eac2b7640da0d1e5dc7694f407e7e8d50909ccdde45edd8b640f20fc56f7
59833c15e2765c00ba08898456b6ab4ec0e44e86872b43a3ce5ce5c361580012
7cd0b30961091835a6a51ed3b7d4539ad1973ce7c4958302c9df4c2ae840389a
799e2adf680fb7228644a108a1c410160e69208a8f18616b741b4e42d9fb6fc6
2c186da7fc8bf8453066fea1dca964b93ce006b962e8a2618e02a87062c240fe

http://kliksys.com/yuZ6yAFq/
http://pancholopez.com/aG8qBiaxx/
http://madebyjoanne.com/5yb2ejvctt/
http://lacydesign.net/2hcDql44/
http://justcruising.com/homecontrol/images/wpThumbnails/vwVGYlSIH/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 12/19-20/18 ####
```

35a94428fb8536debd31cd1bf1bcfa9044ba8188507db8149e17778d18aac7b5
8b9aa32fdf6be7ccc03c9d805e186226480836bdac5b674a27cfbc1693788ce6
ea6214e9d84fd4b33306a94568fedffecceb8cfb60022a8985202c60b5764fd0
f020910684e6b806586131e30692ffe070442a0288d67ff85e6506b97b86b6ab
be622a49886fab2bd8c55c7be33147bee3b83e66fbeaa073d2941cef312d3a18
da8ffab74d15825de746523a6a858d33699a4b7b604de6488bab37c5e26280a0
07dc477cc8106253d0d6d39de833d6a7292df81f858a67ff38b87f282d6c6d2b
fb56fc94c4c072d69f9f261224d39afdd14baa81fb54ec3f539f79066806664c
779e7633ed111a8a6e4466b1048985d4412ee66ae6e6f418dbe3c4d2a8dbeb78
9eeeac4da29b18dd3dcd5d236d28fbdb5a920e12a0fad93ffe8988846dd1b6ae
c33efa41e2f66e9db6f448643f4445a1dfb7333b3219b46d96d25922dad74a9c
fc74d514e392a291f513a734fd86e9a0321564e83fd09307fb855333aea1d002
bb6ac9c9f27bc5f7365f969dd806c0c2b946267b078a43ead8def20635c05b32
e4cb17285c4008c22f011448481edf0d894d014993abd9b5947b1806f049c750
5a0a79cd9120360fb22d787f097ff291d0b449c50569dad1d6bd33029b2888b7
95627dbc1c55f97cd0505b2c51861e7d27b0d3c86f21dfad6da37dab3c37d868
18aa90ba66eed47fbe199d3ef6d07860998021ab24fe0eaebb95b3f2c8f92e3e
63b4bd4e5ce53b4a5cdb38981e16e2d51538b81d3c33b5aa2a89796e13f387dc
f29d717abda676f132406f0a4819c164c1eb5db751d4545300c41adae0189e9d
4a2371808dcab75970318ffd01264a665bd34ce52c7e6c28b496763b35f4a268
9308a7cb6d9b2301bf53c5ac97a96920dec8b86d74fe6a7f0a94aec55457ed9b
77be91afd89d3d7279bc73ef4efcb5a8b7c78ccbdc180589f3dd430a480a2bd8
e6fca03ca6b1ac224c42801297423db452f01f9e297f75d35ff679df1a2c4e48
d8e376abb6cf20695d81c8b09209f09030bd746fe38288b10fe2c69ae6a5f0f9
4e158bedbb3bc5fdbb0ae78f5980f5da960f86189015cb2551091d4d856b112b
85b849693d2a7cd35dd4b7813f9998ca4abf5e9a0ffe437b2a00b196094a9fca
101e5523e389d843350d3a42ef5bb74b2510e73c55b7522d84874c6c50086b16
772e1ede515817fc0b1df6efb9a47e35b124b09515a092bb5659bb5255e77d89
29cf5c72869eef959ef081eb98b4a4bfce534683c01ec4ca6fb67223cedaf732
dd04014ef9e2bc6abc7f4bb76d995c6cf4774b73c8103d38fe6eefec8961be36
e7de533ed3b62c4d309466a7ba456a253020d6af70184019cf83d808b034a30a
635f9b195c3ac823faa88e422e03c318d2014c22cc2447ffd690d56146451459
2be5ef82b3a242c2ae6cfaf44c59a74e208d3b4d28b3ff6533208655e6316a67
45046e646662a30dcf884a8806218717ac52c7589dcc9a98de82c6085180f096
e7e8f71311d434585a27ef77f73ebe51b7d9d5bdbdcedde5ae7588e32bd35251
d0cd71bba1e7427231954de8d028f92f00a41c666aad808bd0aa2082ddfe4613
642dc3199ede79d2d1006f7ee96e70e88cea8f23fbeb2657c2e263c87c85b6b7
5f3f81c4f6c7520952b8326d8b21c21895a5b300a605edfdc48401e7e8aa1e5b
cceb60aaf53a1226f52f043c8f8fc8a841d56a7aca6ef9ffdb431625a6d5aa28
8e4eace428bed8db888330f51d208180e1fd088c08298cfccec18f9604af0a3e
99c4ad4151a9411fef4115eb622a4b763647cc136e4e1af034c61e8b8740d334
18e86a1e31f49a00eb563aecd71eae8e7ad5aa981d7c87572d045b7ccd9bec8b
40583fafdb858bef8aace8ae91febbbc98eded8c0590e01fb4fafe269fdf002c
82554562f70e108118209abb8fcbe5f23684735e1dff2fd880c0abb72ed00b36
5584f1c848ef2dec37638a9dce81235238941fab44ed259a547cb69c7bf8a230
ead31e78b0eb2d410202b44266d50c8da063a7345ba39850b9ad19932315f0a3
f71a6b471ed1c00ece4b842e081c0e2eeba7c58f0b6b18ee995d2babc9e08a92
d94ec25425c50a5e291d8d7687ed0fa87373b8e21592c64179f9e886c4cd373c
6553150d09bb9a8334f9b339f26a9057744a114221191cca5f8a68dbedab4ab7
be3b17bcfabb7dbbaff7ecd8a4bea82f97fea703a5a7a83607d5dc646b8561b1
eff98c96723a58abafe99bc8ac042299f9c0875d791b7317c4f6aaf117a646c8
3c7240cc89f49b9d59e45a426089dd2e8d42ee2f443b363cf76bd0538d549680
30239f6fabe160e6d1e8dca5539717990b3116fd1f59c4104d24f21bf4ca3606
e81a189849b3b9fe1ccfef7fd59d47b3a684217cc6571f090edab66b762e5f8f
2b2bdbed393b96a301d0042a05a356721c9f95333e166d4a51d32bebc33e81d5
bf105afda4cac281e0ebaeb58ebb4f9592571d9f2b2670955cbf8219db30af22
3bc894121e39fe93b83fc6085a6dd52ef3b1a7747a9a4cae6d75bda6570f72a2
de2475a1b71a00f1e4f41fc61bb953ec6b27bc92e1d99e5db41ac6a4e504709c
5456471b260e664e9485d2cb8321d8e3b3033f700a5bdaafc94e4ba8046fb87d
6cd1689b9229b22f3bb49e4e47c2d3db703b4a103f3c458a6a3859b777fe440e
8981bae4b8d8c671226ca81ebd549a0c40a8ef0dff3f1c1415c518cc0a2e4a5f
ee7e2013f8c2b3267445c7efa46c89aaf89395acb5799076bbb284a5215fa3b4
7b08cead05a1d0d77946adcd868973aa9e18803e4dc0872e2bf7b6858b9de0ff
d14b3f7966857bccb6139dfdd77bf67e5964932d0645b25f3eac7280639fbbf2
1bc6cd63e9d0ef68207ebf8ba39f168cd988afb3d7b4d32c833c3f3e7e462b48

```
#### Epoch 2 Payloads by Document SHA256 - All Times ####
```

Creation Time	2018-12-20 21:01:00		(ENG - Orange/White)
SHA256:
539304f5371e263c73240dafd270fc82baf06b3fa02d8bff6b7f46bc67daee69
29cfa5450e654f50e4c77ee77d7d78d0e508b6446f3a6ff77098ab2eee4384f7
7effac6ad5b903509394be751e664a3145e5a5138da06d1786782a72be25a5eb
94bc64c71cbade3ef7e0e54fb6315de33b0e69f80919c6e1b3bb2b5e6dd9a520
5cad192a789f67750bc61c85746ffefacd9a1084e64e877b19761d8af3e01417
e75eabba5ecd2843cb70935d7d6ad7045e031f57b52f4bdf5fe04f136d91ea8d
55e27dcdc88b4893ae66fede8c55ddd8f08bf8e88aa94d1b0deb24ec0dc725a2
4a848d3552f9e5c102a5beb770d727704969dc2049b7ffa2714c03106148a4f4
1169f807bf0cbe61c389f603b23fb24a73ef5a6cf0330bae86f5a7864fab9009
b3a07fe6e8deec0a4bb72cd33320cd3e22f13d46fe4d2928dd439adcdebea3c7
35d69c999becbfbaf3563c934a851c9e90e1850e07506dc011f851447aa3dce1
d9e32bb26bff81b53df36f9f48345895b2e2c06c30fd467f2c0c964243e5c3f9
bccddf643a7199aa666fae5d914cba3c86f31be9ed7828966d5d855b9e0ef104
d4098a04301f6d45aeabed3dec3d069765696d91c213b2854a01a1cf9a77b37c
0e2a18b41184c5fe2f6d9e5205303252c7ae9dad15b1e50774f2e384eb527682
d45f9ddfbbc675327f076622560f042b8494e35b2dfb1dd2a4371fca28541149
8f568a553084056ba2d6c4458f6f81cca2ce02de0d02cbb36a82056b6d895d5b
13843568dc3110ae29d47b8be9617e00947ec81223863635e5056432062bbe1c
b735583152efdced23807557da718b60e97ab851b7624cf3c56ae57d86d0c81f
0d7ce957161761ac2c9701e881d7a959ecec0780a87562fa72c83d2f84ad2d51
90c8b32c4a85e61c97e87cf9387459ccf7061f3f6ecfc37fc003ef2650fe335e
577645fca0ef79af624a81df5cdae08b09a469695219331361a3afd54c0f2d7e
39223a9cee974527c8538ff76f9df28d50218c4b080cde7249d2b3fee7e6710b
2d7b47002f9f7efc12d19365812e0f6d24cf855e63e1a08112126048711706e2
2dc727a19af157fddc015a1a4ea42abfc09dd7a70040a1da7965a4ce6b3baedf
2ac3a26272f2af4119c21f5ea362f26d3fd59d64e822b05a8ab816c352287da8
4d1a0829f456f4be6c5cf565ddd53106275453946eaedd061d83c7f082121742
38dcc5d86e63914b92409e6d8600220df667fedfdc7edac19dd9ef0bcd3648fa
0b7b3a60bb3152fd226cee774f56e7ace901916ecd8ec25065d65ac52ee05cf4
b25ecf33d6b74d68aa611b9b7371ae4a9a2179c9c91851b7d7a9e293cc3b6df7
9ed11279e4650bc7f72b554339510c611fe59003caf9ca90071bb82afa12341d
3eca7c19d9dce371da73440abaa0b049673097cf6dd9450cf827c0866e97b888
ce2ff6082923aebde2294e0a3996d0048a61a637720f573af55bc192b0b28702
2bc19f1a55b61ebc203dbda2b2aab16e0b47508db2f868532c9b44e1555a9019
906665d6af42fb730c729a933d75ccc250858151217c4fced238e6024c6ccea2
ef8cd8c96f4ce08a00b941b4fe9406f82e3f8cd086095b8dfb422ec882e14262

http://mateada.com.br/QhfFhFQ_zNExADgg5_Mu/
http://maravilhapremoldados.com.br/2uWA_hP27E_Lw/
http://mirabaimusic.com/WOB7_WHSHgQ2R/
http://matildeberk.com/tsUM_qYOdl_u/
http://www.liguebretagnebillard.fr/images/I8pMpF_UxLT0e/

Creation Time	2018-12-20 19:53:00		(ENG - Orange/White)
SHA256:
2cae7098baf7ba6b8ca1b9ec37e5a1391a1867b8ecd20cf47065cf40d1125c0d
2c41c11939836650f6a6d52e16c40d5b29094e59f34e4f81ff06c6f193335f59
877bfaeafabb1bedc7a0f4dce28722349f8c11eefa1c0c82db31321e149176bc
67e7724ea81c96f3ff14f62231507c7ac3da8b7f54485a3cf6c43e0d02d0db6e
82c8667d9a8fc1e0b2e6544334f8783861edae4444125797edb1ca7c9d9b239c
e3e493400fff719f8831c7033b4de84a8fe71ff72c40990c412b0ff80710ae44
5d68420ba798296797f1d96fbb7ab7ccd16a519d04887b7c554ab9f030bf323a
ff0bd259761812d0f4df0e2454e5cb6bd076fbf6d52a7896fc7d9224b12a610a
2d4e3189de630a5c8e28a9f42e2d9559d2e82923b1a2aa8013e3659466186b7f
4234effa686b742473b6d7eb5b9c733be481e0645ed96a44106726a7dac794ff

http://unigrendal.org.uk/lZY_7FQoQS/
http://www.rossiodontologia.com.br/woy_VVTqD0esy_nfBbVxYOQ/
http://www.cebuflorists.com/fo8pT9_HShd/
http://www.gaatu.info/XASypEb_ZYGOaPJi/
http://differently.co.in/Nicd2v6t_Znhy_KcdGXQwK5/

Creation Time	2018-12-20 17:16:00		(ENG - Orange/White)
SHA256:
b98143e9cddef8410389d6e051f04290e049af16e616ad87b5174b9ad61ce7c4
c6de5288225ac30baba84c4c3445ca03099d316627376977c4afec367f0b1a81
4d2ca7e989e7d083bdafae14d16c54e24ac5f2ffed365cd19520c67decf01e32
a85098067d589fcadb9f184403b99ba2e4c078734bfd330669ac322a95ea6ca2
f403b2e655b34c03cd33f3302d98c38f2a755aca008c4c14c29211920829d26b
200e9f0ffaa1c07ee596212059e01280bbaccfa6c22d54414068c28d30a81160
c27ba5b140ae7e7478b34ac78768c38ae157d7de33bc715a6213989471b309c9
92e39ac764a910ffc06acf41e43187003fcdc10d4076faa2640a4ac79e924cce
03a85e11c44190d01ca2a7123195e82cfd67353d0763218abb349bd7024b6509
867930f654e2761ee1433ca2effffaaf1e24adc57bd8faa9ba5a9fb1b54ebed5
56a37928d0549592fe5cb4b33066c442ef2b37ec15612d5777cde3f44ab7fa2e
cb6cf978c042342d394d8e705ba911d35650262696b327c0c883d5727cd6b6ef
d64cae7e0840e557ce0d4bd8f0b043ac1831d4c963dbffb4dbb494874296b91a
3d3ae994ce171c27ea1e7bc8e50b5647c4640c6f4c35a739924182d9a99e3443

http://www.capbangkok.com/6wr5_JD4CS/
http://gundemhaber.org/KOAykan5_344RelSR/
http://ipekkirpik.com.tr/4Dh_7S44y/
http://inhresidence.com.br/0Chd1V_7l1Vw4p_DgVM63/
http://darren.galactictechnologies.in/pEcV7pK_7FEmA_UN/

Creation Time	2018-12-20 12:01:00		(ENG - Orange/White)
SHA256:
85386588dc3f29e5f3bbde3ab9fc6cba826c293bbfce11b6c3f1a4403f9e2ae8
60789ac1566d544709e82f2a88ab7a739de2215ef724af6a449d9f9899c7dfc9
4395acd17c017d2fea93612e75e28ce1466b2e5f3528f532bcd75dba7d6ac787
bbf2376308ed348e7543317867312e7b37f738a4ebbf53d388892eca6a2bc4a3
622758f212cc724f8223469c85f5883ef21aea22e6ec4a59a2b6ef0fd70fea93
22dc44bc26173f44e8e9ac5176e4402972602f340880133033ac827c3842066f
e99f31b33a793d5c9b994a23f5776001a4b920341fa3d54ba290914c3c63bb10
2106263a53a0a2ca1e2da3b797ae286175c91e362177bf64b549d54839813083
eb3611367b8b5c6346013c0f23c8d1bb4a7234391e5c72e6013a2586fe7873e0
d282285f7bd67062b6f63558d98ac97ddcbc3937b9918bb62d5ffc53baae094e
4707fd9eeb863dc4880da21f222d55acf0cd0284fed8e2d37d739bd66ba6b710
2e5b8609eb9d015478e8f587dfd24af32f8688666e12492f7653cdf5ab4c3c37
dd5d21a8451686dbb99d458ba82a867e5fb4ed8178e4d67db7a63c85b776d42d
05d52783b6abc37fdc0090e6ffe1a54bf55a51c6b1ce53fcb15a03e0da3f424a
2e17f55f612347ee8c5ef3cd49b1c461b7e2086639473e48be0b73ed9127b616
7f10e2b1f3e0e4b3e3a72085479c6c397f4af8ab917c554f6357edee9b62cb20
5870b1ae1b85af2a4229541d7baba9e679c7c308ef388fa7aff0674c4656ed04
39cf05ae23047c8e27e403e7d00f48501055782ae9207faac7bb72416be8dad8
cfa2c34646508f0f6ee5941cf7052bd5cff2a13f3e300f01f1b136cdb2d66432
a26f660ca616dc12f094261b02be1b4d70dff1fa2c1d15eb3f7b8b590e1b3754
0ccbe0962ac238438a0c37e5a05496bf83247aebf15da73976e0882680169a02
967287f1d11f69ee6592e7ec727052a4b2a43854ec5183f3c23ce8108911b760
833aadd1a0ce3e003d6a104c126e7e47704195898abf247449b500f3f0003883
74d5fd8d413e3c39eb60c51081255b3a39b97829ac65402e057e8e2ca0816680
8ed63bc00f3942b1403786bf39952bc56863ca52611ab56645c1c73cb7da004e
3784d9ca2ad2a8e9de322edddca0f153ceef2207337001383d276646b6f75136
ee309f6d55e3e93fdf281fa7ffdbd39e1771926efd773c27b0a2b773f01a0ad0
53013324cdd243ccf09ccb2a73153fbd5d46e22469daf6159109007fe8dcfaf6
60789ac1566d544709e82f2a88ab7a739de2215ef724af6a449d9f9899c7dfc9
8a117a8dfa6f66d1796bfa7b7cda9d433647b01430e60646799a7c31de64cbab
c60162540de63711e4949e0b07ac3f8b1741f7d31280c79a37e19a9fee1fa14f
a5fd98a875cadb20c281ce6fe36a8c84f9b286feb4583fe6ff35a52245bef6e9
d1f700d393ae77462452e80890147f6874d75fbdc83874d2c2dc7a686062c1e3
4cb8f0d8cd3349a25bc8fd6703b8d7d2092e2354dd71d04f6cce46033902f3f3
329494a7e736cae4357c67b7af90547c56028a5f47df6d90fb5b577f33e01caf
4b980be36fd3227dde92fa9793da100159b14b7568158bb3cc172496a10bbc5c
5e8f2518fe598022240d7a1c92176c86689a7fb1b05f557e43bcbe66a20abd8b
ce04fba3f5fe9ce231b6ca7e96d1c9e290c60baf433d01c6b7a96d2134743bff

http://mrsmakeup.co.uk/ewp_JIDMz_PkNDrCqqS/
http://mobilehousepiky.com/wp-includes/dV2e_eZDUbbz/
http://stonestruestory.org/QFiVff_c30QDh_qhlxDFb/
http://info-prosol.ch/dY0G3k7_j7MMM/
http://www.domauvolgi.ru/Xmq1_4iXm_V51/

Creation Time	2018-12-20 07:50:00		(GER - Orange/White)
SHA256:
2d563b2b755324cad78b6093974105941cb8298187b7ecdb617725082fc18527
42c80327d4d2079c8e9abe6dc5d871dbecb8a22ad8ab3499f97f212526a71589
eb1c8850042c713a29b109bb4ba7be36690a0aef15393799706b27c48e3ca0da
50bfc1fa82b892d663fe87bb2c1dc16c1d87cf443a5d458b42d2efba50edac0f
9200c9c9f350648a846de9bb8a8e63d229860f2664258f0d25ebdfc03ffe74e0
9f91b74e68fa4222446d7ce3a72bcfc0367c06cfb439510cd1aa0906b0194111
672a4e168e358ff14adce79fdeb0981e6f79d3a32e978640f5e83c84bc017479
825248e7ea1b22f577f411d2e55509b5058b80d3ce2f1f2753d4c04c3c5102fa
dc45b137089f90187a88a7641684dbbdbd1b2de0d5747add8dfa62dd5fc06121
737bca9d7d5914f2bf1f937406c6eaad4a773ee4392c1dfa2addfbbc9990c8be
e0a93d961496c54592b7b6241d9d19349497de17e0bc7b081476e8f97bd07fbc
84e795af8e1588f99c7018c79ea0b68ade787902e1f01a76efc82b44fce98d35
9017f5ac76175af2dc87a227afad84e97c505bbaebecedc52bdf208c0feeee31
3948c088d657361bba3aaedfb40c1a476bfebe216ebb26381d877d34fa5e6ea3
e6e7ce59799aea47d200a4ed3f5447a46029192b92d4fabeb0b5cf981e9e60a9

http://herbalife24h.com/CqsbPe4v_wVMLY0C/
http://www.squad.be/Tirk_vfaQLs_rfospFNg/
http://cybercoretechnologies.com/i7o5mI_ceTH8_etJKI/
http://www.dukecityprocess.com/yyOcSp_Gr9LrH8vL_i4NCo/
http://www.realestatesdakota.com/XFFZs_ylxwL/

Creation Time	2018-12-19 23:11:00		(ENG - Orange/White - Macros On Close)
SHA256:
96c616f321105d84ccd07c68d46b436cb0dd38d34174846b9d06c548dc5df076
54ac7a1f7883dafa447da786e2515e3d38899c36c8ee1771b3cad28362e17f31
c1f6092805c75d956bc46360f7a83c1a7e09775f36670a7a59acf5d229c45de7
28559b64089e5e96cbb2df9281d93f6d1e296b808809d466d021b143ea134cde
f60a83c0d7504d45fb2a142be3cee2168c5580e0dc1cf4f25a18f98c5b76792a
cf3e6b63eb28e0d27a0413652187e37fbb5665b746f1274cf339fdcf83b2bd8c
048c88143ab1f2be57af3ae1e83e72ac5187402554a2a4205c471879dfb4dc89
fe896506eb409a3343fffe7b00f5ff5c42afca140540915dd6b67798b7affbd2
5f6eff346646d2ad172fb1d20c1158a281c6fc8f17bde2262f00eccd1fc9e165
05dca131f7d022bcd7ee96dac9676204e904f2383f413e8a28ea27367a73374c
473afedf9a265f8a21780c8171a9a6376b69e9be0e458a5c5ec1e557960519a8
47310dc01f6fb5cdf655865736dd7d388fad4291bff6e2fb4754ae8272fcd6ca
5594b73b32bebda903345e250167ac3e8da681ccef3230cf47600754cc9329c7
94726ed51592aaf587f40abfef7e4ead765f288df247dd5aa364673759d7c256
1f35933dddd94297f1d5950c56cfe7721980e6852bfa7cb5bfcc89db67fbce90
aede80e93a8005b57501e6e9d23c1fbe64489735fe39b8e3d812f28b2d1ac323
25d978be43da4852e2e30be4695aa979756b648e79ff1abd5ece05c023fb3935
c7a4bf3536da5c9f2824a1588e697d9186428d283b1ee14c43e1d3caac6dfe93
145bf18922378c9e92dca30b5087c4594981b16629d5fe42570171c217a620dd
2c7f66896be89629ec812b27ce7e2a37320d04b9c6669ec2b11fa63ac1615ed9
b8b260a555302e890c6ccc7bc6ccbc5d1bbe0a060a7f3376aae627024d6b7e2d
5422fcd6587573adfe722f31846969096eb819cd64197cd6e3eb1164ab4edfa6
f170a4cb0f7f8bde8084cde3a538b54b1f5e497a60c192b3b03eecd6a7f468d6
425c16d8003b958182caa78421c43816b6e8c3d7cf222e619e206cb47cb5149b
3c03e769486f2c79eaa7e599df900015ffb18587a8dc596a933313034bb8cbff
346dcbc99820690fc0665a0c4076dab8df55b3c1e2430820353a2e87b0c38fd8
5c60c9d4ab9858803ab3b147c7cd3bd32bd2d878f03f34b742ddf209030a714f
e7a99c7b9c6a764f83caa0718be1204a08b7db72034da5c046bf9b16e0ba21c6
58ceb5f7fd6f71eef8b8aeb0b226a91f49041d1ad67025a8d5083facb55bbd7f
a91e306d84280e03bd13a213f980a6c6d55501206a19f5fbb2a0a7b500f0c535
cd456d61ba26409fcdbc5e3d06bdcc35e2e2346deced0e3ede1530d04cd5fdb0
de7871ad870e48f1dbbb8caf1396ff568f9a9f21b56940255279ef004c3dc747
c1cda9cb11db99f07e8a6a8df679c586b3104c7a3ebe7c162270f83c10f19bd1
a99b84469cc4f9c76eabd80ac0985f6b4c9cf898a91d5538fd43223d24f7c699
538d5b36438f90d1c6d7537b81ef9bfd133aad05c17827d42532658f2be03758
a5b7bb8e5fed53fe2f1f96d8f8e36caf7a5611852e55209bc54a43287222f075
3df3aaf67968a58379944bf9dff7ce3674aa701d95ee21808ff0ea641eaae798
1474dd2a5c6daf45632610463a0f6f78b693413c8b83b88a0a404ec9f88e2cb7
602f0166f2978578fe63709018464d5d04f1c87cf852b7dbe17616ee839190bf
5d77b6df8263d897d6dd63bf933751726d9db16cd3b157275edb15e844bfeb88
1d79af859a391823a797f6da301a4b6ce7dad9af0c906ed2bd98d259bcf27012

http://www.naposnapok.hu/bR6_aYPbHPl_B6z8E4AFz/
http://vocaciondefuturo.cl/1icD_7OTl_F3/
http://www.sn-ispa.com/zR7Y_NyARxV/
http://162.243.7.179/wp-content/themes/alveophase3/msf-files/qgWaUD_oQdNph3E6_FzbiXf/
http://lakewoods.net/XG00tAN3_q2odyp4/

Creation Time	2018-12-19 20:01:00 	(ENG - Orange/White - Macros on Close)
SHA256:
8000394132ee8d79a999b283dc9e67f790048d89e817685bb181b75e99f0cad1
403d678ab1dcd204ecb79b9d7f5350a05866d1078e64ff357573320685d4d3c1
3a9037168a2fb85124dc05cf766dcceb8afc4a13f96a2751ffaf0d1c56ba2023
da5c501dfabbe9997e15cad7ebb4f680f6cb50116d02ff00ff7c2d2ea927623a
769eff69e55f94c409330a4365b802fa1a589515d318d938ebe1f451eb865609
2991a0069fac7acd2653ea38f215f45b80109fcea485ad7b4eb403c2910cef65
91ca63acf98acf0f3a9cbbc6ad3d88eb48b4be48369a550598cc55899c494894
97a8bbc96f1008fafa19b6b236584efe2eb83468572ed8d57f4d51827e98364b
3b8e206a410ff373c77d5370defb08fe6ad2ee77378fa6f26d24d5a1cf94779f
1b4a3dc52d69a4ad565f61c91ab2170fe4433d5a573c6b29dca5286ced933832
1051269affcb0d5ca293014b667d7ed47648d76e5ba9b504777ce98ea487ff34
0129de4caebd4c7d1b8ba3f4f63330b1b17fe2154eaacd9aa76845d181586748
6435d84de7495b23f2cdcfdb1f281dcb43fcf0ee72668b0f07c6aec41cbe1674
be7c77050fb3a5b864ca5c3b329934866b0023b50970095d8859ffc11ab95e24
3c30d85ddeb3b7789813bf0cb26694c8a3ca67510dde9006c6156d746ae3038d
9c490b82184bdcf76a7086ab78f0a265ae77fa01ffbb01fd16bf75261eae3688
7bae3bf3e301a26b138aab9742eba05f2a36bae866ab0a27ad7d06879ce56c4a
2d9bb33772f7e121c8f674beb52a36297870bd2389f7247efcf01750a9763a8d
248ca0fedf868de5e654e46ac320c53d4e1a993cf5eee9555487f9b090826eb5
4bfbf3b0d163fcd4661005747e14870e67aca2f563153516aed99424a259c2b1
7d6a8299b739b0adab7f7a7de68546f85d342c8d74bf600cdc5ba74cb23c6c78
65c0c34e7ba46166fcf179605b50546d1e571ec625abe4c7c4a7eb231eb9ba2f
a005d0663551e2ed4490992fb23b12a075ce6582d49b2c012916986d30783d02
146a9c6bd988da0c52af9e1713460d8cdb4d6d8381436dc07a40cc575d35f901
4c5a5f7c46aa52d27f0d9a0b591980e8a34ffc2b1df7d09ba7438bec933e7975
206b2fde87b92849b17aa1256f8c7bdc107e8c92aff92f51f68f8d29c837a2af
bfb699dc670a0ce6fa051372c61e116d4299585686c39783bf1299c690eae2ca
25d9d38ded915b595643930ec205abd72fe6e5ba3db2b72669bdbdb1a66f3920
d7dad079c927b2a813afb05a8ed63c96bd1fc51493211a333353190bd17364e3

http://www.evanshomeimprovement.com/WVz_RbN7PQa/
http://smartlync.pk/r1EvnEw_1Xd9wnxJ_vMp/
http://preambula.hr/dBE2_EZA3F_5/
http://lindumsystems.co.ke/XIJv9Z_duyr_6is0Q/
http://leodruker.com/RREvxAt_5Iq3A788L/

Creation Time	2018-12-19 16:27:00		(ENG - Orange/Black/White - Macros on Close)
SHA256:
669754b26a03dba48ad77b90af7ea9aa1719cbf19a5e1d393509f70e043cd4e9
28e57977dce308dbc4cd0ad1798a0e474fa6799ffaeb08552c0007f11db2a076
0dc91b26666df78bb955dd7994b1beeb657c5a7b26bae3b7187e49cd8adaa467
516db393013bdc1b7ac784a6af6a237e55cac5256a7e1df530ff3661aae5362c
9efdbd1634ef495f3ab7c4ec375a63561229cd525fad6c77de215151073b9d33
2af279f52f2b305b9d67788b3a8c9139c17ae671db2b241de09a8c7b669739e4
e7aab61d0b14783852d75ba3ca2c2ec3e492b9ea6d7690a4790a973c4cb605cd
e6b0ea2e18b4ab25d64e6f7e619b4ef0c8a08efd19f0c5563f91eb93fae2ced4
1b340a9aa9c8790300ed47b2276889e940e455a0fb137c96d9eead64ff2485c1
c951972178be25b76fed269d3031033cbb5a2e071c63f92728b555c50200436a
04d007044c60d5b7844a703192b99f300be05bb33f3990fe9c24e0f362f3e153
970f3800c8033db65bc99d6a3e549a208f15113838306cf310a447007629279a
c26c7ef9d7de5ada787b256590200c8880d37fd624918005a9cd5413b18d70c1
6f8e2c81421657e0eedd39f41560dd1ba25cc9a71a60f4b29b20f4f4407324ae
addab27f33edfb45cc2a8ace462420df86d61ae90429c2a31ee09c740b138d30
067ecee2043f00f9fb808345b1011e2ae27bc93819eec5a6b3cfc62ff7e22cf4
4c06a18f5a509d12df0121d7c461009c00d8a9b6bca5e67f8541c57ca0f5e50c
febf7acef2c382493b17876c764161df9c9607b3cd4ae1ffd78b975d6f6432a3
0836a1c11fef76fd1729c5ba84871e3a52a2646f020a37e29a28bb3be9172911
45aba1f73b444db6f902da25e15f1242e9709c6fed8c62dca8b3df9ccc1d0026
d455431dcf2611aa094ec11abb74e456d9beeb0a43e15d9882de14df69affb0c
af08045d36e35240a30df61ef15d005fa89d9913dc13dc107522da4a388190a1
b83c0865858bccbce5c01b0742388e42a0488eb30fcee7721976c5cdfed00d7b
5925f8449bed16752d446d03c4a5c9fb4a3b5c8213c36911023b57b79bb05382
9f2d35cf3f882eac45b6859bd076e25e9a7f0ac202d32c0818c485caf48bb431
76697ffc14e4c6c1d7e3f010836fd9221414f29a3e7619091076e501dee20d31
a1ff2879fd1afa085b10c39e213c55c3534ce0f2b828eab3bff611fac0e38bd4

http://159.65.107.159/5Enu_0Qiz_Fz/
http://www.maskglobal.com/9hR5o_E6u5DS_tn9g3E/
http://webdesign2010.hu/DQY23zE_stRbRoqGy_qDsWBeJyE/
http://dev.umasterov.org/vF9JECd_J9RDEi_WUQR/
http://weresolve.ca/cAGWGR8_z6m2_ZLZ/

Creation Time	2018-12-19 13:24:00		(ENG - Orange/White)
SHA256:
12a94b39c4078b5eae317a2de582fa83f1826ef147f818b555d18c7cacbd2cae
8a62f53c8470e1a9963ee07a193a47608683828bed77630a87db3116f018f026
c8f6ba6b9e47131d1541a0f169ef1633d91e13bc14fdb57235dcba559d8f523b
496ce2697cd55557a8aff83e217e25b29c8ee4fdf0244840b8bd47e966338417
b1860aea8f9db8d2b56563cc583ff86d1614e9f0833630a6f66f71b01b4e99db
0aaf85dc89203908fe46acb4c437cc40a27042707eb5b126bc74f65a14503091
2b5afc3da2be254935cdd5e68a9f4930869eec5f6c22cc5c9eef3bb083da5a60
538fd239dd0485e51a7bd8b9514de94afb039071d48d11fe5e53cec9578d4903
ac17f5bd46ca6bfa6459703b1cb3a425fffb75f70ad5ca614271e1324660a6ce
248b503e7c2ac680d046e3924e0848da7b97de1f2e7fb9b19d6c2c71988aff3b
dca9c9feb8709cbcdf94268b37d61be3390aedbc64898830bcebc513c84e59ed
3ae8a2899f8102a3914eefad28028a5002fe568fd7e02f1816145f4064b65666
84aafbf9d47a7a0ae083e19095bd77adbe89cbac7654a1b2e06287149630017c
2c058c3073e635a11612eb6d27fef735b649045adad61ad29bd40b8ab180d2c0
b5f541fbb40c0d640d12be78d3216ee304eeef771284634835a1274ae0c01f89
39f98e51bcd3696766ee8f0e7c7f7b5d87d75ed730a19ef63cbf88b74cf8f0cd
f183ad6fb5030527b7fe456b3385a6e394938184ea78158535e8c3f4a48460f5
4d60330c016279d3f7828f1be0511e9d28c53d91dbe08c57507a4b447338d593
36d6a6067e53a10b165e5398760fb62b14ebcd952d03eaf76750b8758d68160f
7f46994c46c6bb7e3fc1db32374ece7c4b995e862dc0c77519bb60f39892f71b
14076c9e56136873a1e774ce709a56ab9775629b74eacb4c46829a7014e1812a

http://johnnycrap.com/d83eZ_hNyVj3JnT/
http://bunonartcrafts.com/Qp5j51_GZPK/
http://ppengenharia.com.br/6sk7tYPE_vMdL7A2/
http://vitalacessorios.com.br/dVYmu_fO43/
http://utorrentpro.com/s02i_CaWYziZFn

Creation Time	2018-12-19 07:12:00		(ENG - Orange/White)
SHA256:
f9279fb4dd983b2d7384284774bcf5f31f853275aadf124fd235dad382b594fd
a49659834b434c6d7c056a9b23b1ae424f6057c9c558f575c44e2c77f03c0be2
4c4ea03c1b30cdf630aeae93eb1abf0a6fc6e5ce103cba65c12d4290b91ecdcc
b28e8f562bda44771dea997e5faac39f0dc9a0130297ac78f0da2d7186e7cb7a
7f6e6b81e6ef353cdb4fa2fdb301217967423523198023d84f02e1065f926547
38765ee52f16c51b63d15552d0ed10cef2bff4c7040453c8f59897b142db1793
b84b260a78815d9c6d73901cfa8eafc168fb84731b58490aad3eada28d1f7075
55dc3904dd389970bb84c2a83ca781b036a170319a111c010ef22d8322323f39
8e0237b45c3642ba9e5a6ebd6ec3e98d28bf2e247b652289e617c0eeac1c70b7
f2022eaa8c36cb188404c2451f0e16743daea73936d884a7603443031069ed33
7b2fc161d785a30c22f537fc9f08a7cd3af7b852e8e67864252122631be2522c
d053a828911fa34141e6e19cb13d989a3c96932d7d348a3a6d9c94f6b1dcc06e
51d70396555367fa60f678873ebc8023bab8833c37eab4770a38b830fcea6360
c8dcc90e3dafa9333a74350466330a04337a522598076e97fc54a07b62e31d8e
cc645ebb62686fc96f3eb51faad6ae2a44b25f6ff41b8776f92d3b43a5a554d9
c8a054e8d0e85dddc5dd88e2bc48fc855f7768d4f8aa1983f7b024382c6ef1ba
f7e47025a754e21ce1327a92011ce944bf63ddc12e0b36105b5b3cd9f190a0c2
c2245d89df0a0f4fdd164a942fcc25c93de8b71e0bedbe3ad75d80fa43b85c69
fffa3c5424648aae383e3b6b6824c99a4229a821f9b84bd223a01c4a2d402da6
823a53be0ed235f64f026f94cac492096b7662e410947903a0b9691b5a3b64ea
aceaca2a5b483f991c93162935025122fc98d3063e213cf95d8d218f4d8c273e
251e8c7c06c21841c3b174482db51a9735f7f7e7f3300afc24a2d0fa5f2e68ac
7157db494c843e62935afdde0486c81d0b55f828f512a4d805e9bc4172d46e65

http://www.novadfl.com.br/FAIVj_y6Iv/
http://pureadventure.ie/sXw4k_SEAqkqyI4/
http://www.afchygienesecurite.fr/administrator/cache/0gMXzu_MdGNY/
http://rabinovicionline.com/EpkDeeJ_0q5glSO5/
http://lomidze.info/gnh_enS4q/

Creation Time	2018-12-18 20:23:00  (ENG - Orange/White)
SHA256:
7451e72acc2be9a15554c739c75845fd88f5e484de2f84ba09d1a937c1e9be39
83e9bf77efa7437aa2d7821b02f49bc4efe12a6a68173c380b0b3d918e59c4d5
a88964a1cd4867bb0244a14346b8023387c36549abf3ae4fbf50855b5a0d1f95
3c1c5e78e6ecd5cccc12e6872fd335d5c5c9a44a801f842842a3523e8f4ddd8a
a81d070138ba07882a7fb238d41976f46602582b17a62fa08042047550f2f80b
82e61bbae719c090584c7a568b8d49248f79aff6ef67b5495d66cfecc8eb1dc6
acdeab363ac573e2bd0db272d61945d469917607ffe3249cc53182dfa0dae563
4ec1d9765616c8c812d000d2d05e392c9578293a2576af872f4307c292df46b2
a183fc48db06f2330e167bc583adc17138fdb0bb45ea5493892f7194183c00ac
9cacd208be4d3ba697fdd3d9bb2856f0e5b106f5cbb1c99fa1c2389e927d30d4
50cf1ef9f8da00e6a0995622f45617a9d5d284bd268a84c0a59957768ecd666a
617f28f180dc166312faa9dea50eeb7b08a5c5ffe4fc1afad089ef7633d293a2
a81d070138ba07882a7fb238d41976f46602582b17a62fa08042047550f2f80b
82e61bbae719c090584c7a568b8d49248f79aff6ef67b5495d66cfecc8eb1dc6
acdeab363ac573e2bd0db272d61945d469917607ffe3249cc53182dfa0dae563
4ec1d9765616c8c812d000d2d05e392c9578293a2576af872f4307c292df46b2
a183fc48db06f2330e167bc583adc17138fdb0bb45ea5493892f7194183c00ac
9cacd208be4d3ba697fdd3d9bb2856f0e5b106f5cbb1c99fa1c2389e927d30d4
50cf1ef9f8da00e6a0995622f45617a9d5d284bd268a84c0a59957768ecd666a
617f28f180dc166312faa9dea50eeb7b08a5c5ffe4fc1afad089ef7633d293a2
81c6231ee29113425702115b6e5398c0b7b006af6b5553b1bf3fb15b7654b066
49c717226498a5d4aff932809ec1fbff1c7c9e0459a5e44eb4cdcc94037b672a
45a40a01a182e4ffa9e4326f49b96e644ceb6fa2320be6f39243eacfda9e1cae
6bf3b6b40fd11a76aaec9e12ac0e09d04fc135b4458a6d89e282764badaff11f
3c4452f0b9d8c8bd65a67637c4600a8fab0846f7b553c11512ef2399e023b7a0
86653018e34742ac7e3a957d011a8c55797fa2f9fa7864cd0a0ef96e161466cd
967333bb17a0d52ae5b6245adfb9705c6ee844d82257f1ca4f725a4f1dbd9beb
88ed01578e8474da348320d72560bfcd1aced3be52d7e2e2f20594cd7b668cd8
d0fecdb94ca7fadbc8d0bfd9ad3ddc201b2eba2870ce6368ecec4b37d6fc4d8d
e1f4390e510636f2839c6c0a92a7c19382891a6ccbe71d3d834956e79f873c86
fa2642e0ead60859fcb35af7b436d49c8b3f8fce3d54c0f554351746eb2f3c47
1d39d1ab9415bacb33905d68c833cb04b624550335f7b4f7d7b619dc7f77fc62
6eeebfd2c3e7cebfb0ef3cd6c9bd6515e945949d60834ce9db5359d1b2cbd154
18b40536f8ed42f64ed6b44d0468ecc23fe62408b92252a3947ce7450b7bc775
864879f271ba4fd6d692a6c9f8fcc1501aaa1d926069b5298e67d361c22af0a1
c1b57a6234db39d0c47ce6372f84597760f4d52f590b27e99517640f99a8dcb8
d22bffb7e8a881cba16900d1be715a8dff6cd31c778196a746872faf35bdf391
94b72e750cc565c4650fb9ff9844f9d9d832c116dbfe8ff0f019297828d638db
22f4c05690b0c87f42c97368e1549adf6c9b1ebcd678de87133a64f0ed58bdf4
cc87c57ccb3f5d944820ca82c4e0e383c9cfff8101091bf827b5b9c177f5c71e
5037f222c4821a1ca16da559b67fe4726cddd66ce8c46d1d2bb057f296afcc36
9ea2e061957180cecdce92228019497541101aa2e3b2cc91d37d2e3c0bf569c1

http://www.mancavedudes.net/K2WZ_GMBP8VtJ/
http://www.masjidbaiturrozaq.com/Xjp_a6M0A/
http://www.institutojc.com/WHKNWG5I_bqvYApi/
http://www.quangcaovnstar.vn/wp-admin/z1QfRWkZ_LWUT/
http://www.1040expressdallas.com/EH1CbBG_hYypTq/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 12/19-20/18 ####
```

b6a0d5f05544a17a80a7f9fcc643646ce8d800980c91d157fb90819b8bf49fb6
2a8ddcc75636c1065831c3ec6d978723db54285d98bff783d04916c534964c61
589ac66068de1f08149e663aaa321b223b5903f5307a65b019deca531bdb64d5
46d6a5521d3ecf751bdfc5c78816ef6d5f8b612031dca83194ff4a2beb9d0b27
9e282173aec8d15ab167d8c20056faaf7495e572390f3feb71efedb6cad49b8c
1125464c9e98ad5df91f0ae5a46a1bb8224d9f11f8bc3d42b659888eb3172408
787b027cf2cc3a6dee2f381e86f026af3242b8a70de423ee3714c61bd8c7bade
19ee66efc7e0bcaa3fe7912dca983ff4554a10c8c535ff35a9418d5ee93bc11e
ce1a60e2b9cda595396cebf7f849b2a2d7895aa406ef501d66839000224a5360
f4ee396cb0bb096028bcebf4dae3f0707452a97cf8350a7f89ef079b172d2597
39cddd228d859312addcfef55ab8305045e67160f0ecaffff435f7acb859520f
f5146b1b1b5858c3a1602890246dffa0674f830ebb79bf9b487ea329fbf2c67b
648e4a382717f8f06d40591d16cb0b725c6066168594014174aa39f128be3774
96c573b4ba9a0e77de3c4ee5f6a7f2f8f9425dc9cd119ad48c04815f6a31e480
a86ff3e586d98f85fed941018f336a321fdc84cca666f4971a9fb6741fdbf6be
96c3ae3e145e7d748586a27657c2e9e474211420d551c1ddeb95289f921910a9
60ee60aa9abbeb69fab362550925990bb30fec3407126ee5ddddcae459c2ceb2
2dd557ca11e90633e5c9f77293803605ce045697a9b77158a329cf734a151634
054cad1744dbeaa8b60c1ca1271cef88644ccd0c84e010a95f392521baecd20b
a5da1da9037c21d08a1489c36e31498392e6e42c504f45690a0dfbe62c415e27
fbf13df92aab6a1a253ff62deb392567c9f91a22b327868553b78c1164a32328
891f32a851f66fcd45cd67cc19976ab51a74d6814357a1fc19a30d5920c0ccca
88dd9e7a1d96850f2d979ff1edc278bc1e7b99c97ed181f6af05bdbe1494069a
29eba7f6d462cf3829d2eccf44adc3e740020fe1d69b6c8f32604e243922ee6a
01109376a1cca76fb3407f7f5afd21f5a5c7fe875ab313eb5f4dd8d6e95fa759
24f5745e2c6f75ca32c0d2255a4d5f1db2b99c62a33fc94596efd43354ced4b6
10c3f056f7ffcbc348169dea12b3f34ecac4e6acdeaebc53a3fd4d178d2d1ab7
6471c6bb88234fdf7a47f378c92136b808d4c8bd78584206235fea83b6060874
24dca71173df1041b4001384ca041a43e13175ed76289269babb0dc99e0967bc
960dee55de17d81e055ead98eb1d864aae69e0e4c1732e29451fb48f9d7621f5
c88541230e89104817ce75363b31046f54b6bda44818330dcc5cae445d2983d9
4351997cac5515c936f357f7d0954e54774c62ecdb46f959ca6af1245a711f0e
091f45880342ab24bf77dc1fdf9b8e3ce0781b9be995d6827f56d5749cac5b3c
bb24d9d2d9e313d364311e455abe2443bc6ea46d1a49d7e67673978129cdccfb
7eba255c926e9d59c8f344b7b167cbe78f475ae16384d27f8c29e37c559787fc
e844b9daf0f12ed8c1a46a7a3b52dd928ddebffec3beaea4d4d8e236161b9dbe
37eebb40d4f04bee15e938d3c10a2f8c1e6a6f3c687a361c7deaa5bd85d5da75
a0627bc2a81332f9eea9ad8492f0f0d6c45cd50444ef0b488d09107dcf3e1663
b1bd5edc8893121cc37675019fe6993d816c7f40728f6dc3985d615d84a8217e
fbf72ef7c25856b2e8bdb6ccf4df162c7b998a4cc0fdc24506ff6def6c2c1b03

```
#### Epoch 1 C2s ####
```
(Port is 80 unless noted)

1.22.119.250
105.225.76.76:22
109.104.79.48:8080
133.242.208.183:8080
138.68.139.199:443
144.76.117.247:8080
159.65.76.245:443
165.227.213.173:8080
177.226.75.31:443
177.231.56.40
177.240.208.251
177.242.215.230:7080
177.243.144.248:465
181.168.80.87:8080
181.63.199.17:7080
185.86.148.222:8080
186.176.140.255
186.177.126.252:8080
186.3.223.3:443
186.4.4.161:53
187.131.47.157:465
187.150.211.115:20
187.153.105.212:465
187.241.18.251:8080
187.243.70.172:8080
187.250.133.125:22
189.157.57.135:22
189.163.1.225:20
189.205.249.209:20
189.218.186.138
189.222.245.247
189.225.148.250:8080
189.226.214.129:8080
189.253.56.145:465
190.117.161.108:465
190.130.152.209
190.146.169.53:20
190.182.134.41:8080
190.240.175.190
191.103.109.235:990
192.155.90.90:7080
197.211.244.219:465
198.61.196.18:8080
200.115.53.210
200.124.225.32
200.194.14.232:20
201.102.7.208:8443
201.110.250.76:53
201.248.199.100:443
210.2.86.72:8080
213.14.139.81:20
219.94.254.93:8080
23.254.203.51:8080
49.212.135.76:443
5.9.128.163:8080
70.80.135.35:8443
84.173.140.231:443
87.225.109.55:8090
92.48.118.27:8080

```
#### Spam/Stealer C2s ####
```

Pending

```
#### Epoch 2 C2s ####
```
(Port is 80 unless noted)

115.71.233.127:443
117.3.39.85:8090
171.101.153.12:990
173.255.196.209:8080
178.254.31.162:8080
181.167.31.88:20
181.189.221.172:995
181.27.124.18:20
185.20.104.238:8080
186.114.143.12:990
186.170.25.122:20
186.179.80.101:443
186.20.248.146
186.33.185.229:8080
186.4.172.5:20
189.148.190.37:50000
189.209.255.52
189.213.120.20:20
190.202.173.244:465
190.55.209.82
190.95.116.116:22
198.74.58.47:443
2.86.188.27:8443
200.126.171.119:22
201.152.93.218:995
201.97.99.39:20
201.97.99.39:22
211.115.111.19:443
217.13.106.160:7080
219.92.81.149:7080
220.130.37.13:465
222.97.149.122:443
45.123.3.54:443
5.230.147.179:8080
60.212.12.177:20
67.205.149.117:443
69.195.223.154:7080
69.198.17.7:8080
75.99.13.124:7080
83.169.36.58:8080
83.222.124.62:8080
91.236.245.65:8080
95.141.175.240:443
98.142.208.27:443

```
#### Epoch 2 - Spam/Stealer C2s ####
```

192.186.96.123:8080
205.186.154.130:8080
212.227.135.224:8080
221.158.167.47
64.228.75.36:8090
80.209.143.171
95.210.114.148:443

```
#### Credits and Notes Section ####
```
Updated 7/13/18
WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!

What is Epoch 1 and Epoch 2?
Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now.
Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version
of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change
payloads every 3-6 hours now and payload hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100%
sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the
other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the
other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch
as far as I have seen.

```
#### Community Lists ####
```

https://pastebin.com/QpV2Habf - @pollo290987
https://pastebin.com/heSktKp6 - @James_inthe_box
https://pastebin.com/nnz6HAYh - @James_inthe_box\@fewatoms
https://pastebin.com/QaZFYUFF - @pollo290987
https://pastebin.com/bfBkFmRb - @executemalware

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)
Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic, @0xtadavie,
@Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @leunammejii, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
C2 info - @unixronin, @MalwareTechBlog, @ps66uk, @JayTHL, @pollo290987, @malware_traffic, @0xtadavie, @devnullnoop, @gorimpthon,
@Racco42
Payloads - @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz, @pollo290987, @malware_traffic, @JayTHL,
@Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey
Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!

Very special thanks to @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!

```
#### Daily Log ####
```

I was out of commission yesterday but we saw some interesting changes for Emotet. There was a run on both epochs with macros executing on close.
This was noted by @pollo290987 yesterday and it was the final two payload sets for both epochs for the day.
https://twitter.com/pollo290987/status/1075532374778306560
I have noted them above with the (language - colors) section above.

As always, the community had things covered yesterday(@james_inthe_box, @jcarndt, @ps66uk, @herbiezimmerman, @pollo290987, @gorimpthon and
@papa_anniekey to name a few). I want to give special thanks to @unixronin for the excellent work on his automation scripting on all of this. :)

I saw mostly invoice spam in German as well as some Spanish Christmas cards and the typical English Invoice spam garbage.
There was a few ATT and banking templates mixed in for good measure on E2. Nothing really new other than the macros on close.
Yesterday was light for me with under 50 malspams. Today was heavier with nearly 200.

@raashidbhatt made a cool bot for Slack that is posting the latest spam and other module C2s. I was able to get the spam module C2s for E2 from this. Very awesome Raashid! Thanks!

We keep seeing the C2s inside of both epochs have strange spikes of new IPs bringing the counts to 50-60 total and then going back down to normal numbers of 35-40. Not sure what is going on this week but this is a new behavior.

Till tomorrow.

```
#### Sandbox 12/19-20/18 ####
(all with fakenet and MITM unless spam/secondary infection)
```
Epoch 1 C2 run on 12/20/18 at 23:59 https://app.any.run/tasks/640465fc-545a-4cb5-9c50-9ad9fcfd727b
```

```
Epoch 2 C2 run at 12/21/18 at 00:10 https://app.any.run/tasks/9a2f4584-4693-4343-83d1-b237a385a768
```