Some payload URLs pulled from Emotet Word Documents.

Method:
1. oledump.py -s 16 -v OutstandingInvoice.doc | re-search.py -n str-eu | sets.py join ""
2. From the resulting script, remove the ^ symbol (DOSfuscation)
3. Copy the base64 string from the script results in step 2. into CyberChef (https://gchq.github.io/CyberChef)
4. Apply recipes in the following order:
	Reverse
	From Base64
	Decode Text - Select UTF16LE (1200)
	Split (Split Delimiter = @ / Join Delimiter = \n)

EMOTET PAYLOAD URLS
http://5ccmyoung.com/rKEh
http://theiro.com/Stkv
http://sv-konstanz.info/n
http://moschee-wil.ch/kex
http://mport.org/uLff7

http://puntoyaparteseguros.com/I
http://infolierepvc.ro/z6OFthrp
http://mzep.ru/xGKS
http://grafobox.com/S
http://haldeman.info/Zw