Some Emotet URLs and file hashes on 2018-07-17

hxxp://202.90.198.214/tobbxieue/Facturation/
hxxp://ac.hostjob.ro/newsletter/En_us/Payment-and-address/Invoice-347577/
hxxp://canadry.ca/files/En_us/Order/Invoice/
hxxp://debenedictis.co.uk/Facturation-17-07/
hxxp://eldruidaylashierbas.com/Jul2018/EN_en/Client/invoice/
hxxp://ferrazemprestimos.com.br/sites/EN_en/Jul2018/Past-Due-invoice/
hxxp://flyblog.flypadcorp.com/Borradores-contratos/
hxxp://glynngs.com/pdf/EN_en/INVOICE-STATUS/Past-Due-invoice/
hxxp://gsgsc.com/newsletter/US_us/Client/Invoice-98137288046-07-17-2018/
hxxp://industriadosom.com.br/Fatture-aperte/
hxxp://iroproductions.com/newsletter/En/Client/Direct-Deposit-Notice/
hxxp://jainternational.co.in/newsletter/En_us/Client/INV92236472329639948/
hxxp://k-truhlarstvi.cz/images/files/US/STATUS/invoice/
hxxp://linggahotel.co.id/Fattura-Vendita/
hxxp://meulocal.com.br/Facture/
hxxp://modtech.us/Documentos-nuevos/
hxxp://oceankings.com/Acuerdos-07/
hxxp://phamtuan.net/sites/US_us/New-Order-Upcoming/invoice/
hxxp://pn-kedirikab.go.id/Vos-factures-impayees/
hxxp://podstrigis.com/pdf/En_us/DOC/Invoice/
hxxp://poertners.com/doc/EN_en/ACCOUNT/Invoice-0475101288-07-17-2018/
hxxp://rbailoni.com.br/doc/En_us/FILE/Invoice-2180402/
hxxp://servplus24.ru/doc/EN_en/OVERDUE-ACCOUNT/Auditor-of-State-Notification-of-EFT-Deposit/
hxxp://shoppnonclin.com/newsletter/En_us/ACCOUNT/Invoice-1369027/
hxxp://supnet.com.br/Jul2018/En/Statement/Invoice-334087537-071718/
hxxp://taxngain.com/sites/En/Order/Invoice-4721724/
hxxp://uninegocios.com.br/doc/En/Jul2018/Pay-Invoice/
hxxp://www.bloomspor.com/files/EN_en/Jul2018/Invoice-525904/
hxxp://www.brands2life.b2ldigitalprojects.com/wp-content/uploads/2017/files/En_us/Order/011562/
hxxp://www.communic.at/pdf/En/STATUS/Order-33160493422/
hxxp://www.dwarikesh.com/files/En_us/Order/Invoice-80890238-071718/
hxxp://www.egiticicd.com/files/US_us/Jul2018/Customer-Invoice-VN-7208479/
hxxp://www.haticeonal.com/sites/EN_en/INVOICE-STATUS/Pay-Invoice/
hxxp://www.ingetrol.cl/newsletter/En/Client/Invoice-2770217
hxxp://www.theoryofseasons.com/Jul2018/En/Payment-and-address/INV36063214972/
hxxp://yesejimo.free.wtbidccdn50.cn/default/US_us/Client/invoice/
hxxp://zsolyomi.com/wp-content/plugins/files/EN_en/Purchase/204569/

URLS FOR THE FOLLOW-UP EMOTET EXECUTABLE:

hxxp://alwaysaway.co.uk/yl90/
hxxp://ecigz.com.au/PTrtj/
hxxp://elc-ua.com/khhyI/
hxxp://europeansleepcenter.fr/Q/
hxxp://infeduc.com.br/HdmvjrU/
hxxp://mfronza.com.br/rtkBL2D/
hxxp://oldwillysforum.com/PHYozoBB/
hxxp://ooosmart-ekb.ru/sn/
hxxp://rivana.eu/lNEjji/
hxxp://share.mn/wp-content/uploads/AD/
hxxp://tranz2000.net/images/cheesephotos/rUmv4a/
hxxp://turnercustomdesign.com/C8Xsn/
hxxp://uppum.ru/oWLFZ/
hxxp://www.assist-tunisie.com/Cs/
hxxp://www.karteksogutma.com.tr/T/

SHA256 HASHES FOR THE INITIAL WORD DOCUMENT:

471d40b6df9e40c64f49eb73903840a6d01a6a5a8df5350a89312c6355fc5f28
5882597ea9a067f3d05f78112b8609127ba2260f603fcfa67bb19952d11c3a97
79e76199f13d7b9ce9ecd21bbf2dba3adf2b4cc25c93ae104e92fe7902462901

SHA256 HASHES FOR THE FOLLOW-UP EMOTET EXECUTABLE:

35a59417d526e97187461624586c01e30cc1ddaa4dd3c1740b077899a3c2f0c8
6a1cd2af82faf40a8908c539f6fd086502c8a401e078cd041a53c6080d82de0d