2020-09-22 Emotet IOCs

From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Extract_URLs(false)

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
89@fenestramd.com
aburke@acprint.com
account@easternstarship.net
admin@stephenblakely.co.uk
amministrazione@logitrans.livorno.it
andrew.ndiko@alhattabsecurity.com
armand@dawgz.nl
brbosaaen@bixbymachine.com
creditors@helderberg.peugeotsouthafrica.co.za
drodriguez@transcorp.com.pe
duvidakovic@vesti.de
flavio.modesti@alelift.com
g.besory@stseurinsurlisle.com
gerardo.galvan@tnl.com.mx
info@edil-costruzioni.biz
info@glamplan.com
james@mountainwesttimber.com
jess@drugseizure.com
marius.armolis@indema.lt
martin@boyntonfarms.co.uk
nasrien.a.thabet@hsatrading.com
news@sartoriarossi.it
pentoolinig@gmail.com
phumla@josephgerard.co.za
princess@zamnet.zm
rcook@warnerreal.com
secretariat-aj@huissierdeparis.com
taboke@sainsuranceng.com
yousrin@ewaahotels.com
zmres1@peoplepc.com

MALDOC DISTRIBUTION URLS
http://18.219.216.155/wp-admin/eTrac/
http://379code.com/rec_site/INC/b9XGeO8knB0omPl/
http://4life.com.vn/wp-admin/Overview/nw36ySeXEj284q7G/
http://808district.com/s/LLC/
http://academiadotrader.net/wp-content/w3tc-config/OCT/
http://agenciatabletshouse.com.br/erros/Scan/4Q5eoea8G0oEwwieOQ/
http://alemelektronik.com/wp-admin/Overview/lg7WXidrUjEa5vv/
http://alphaomegasl.com/wp-includes/INC/Jqyu6LMzqfAV3wsj9f90/
http://amaraconservation.org/wp-content/Overview/k2zm13488943942218952r6hofcdzcjyy/
http://amarettobh.com.br/sys-cache/OCT/GtSUenK2Q7KNWxdQ/
http://amarteargentina.com.ar/wp-admin/FILE/UvJqf9mfIP/
http://americandogrescue.org/wp-content/32943071685/p0q94f5642092434uf7vv8fx0kbh547u/
http://amyescort.de/wp-admin/7sttnew3w/
http://annabphotography.co.uk/wp-includes/Scan/nhl9z69qc/
http://ariefsetiawan.com/emakbelajarmasak.com/eTrac/ehqZpDHDgh/
http://armiounaslehto.fi/webstruct/balance/79n0m6/
http://asiancrush.me/l2twf1/8NXX306142CU/wZhFuwGTX4/
http://asiloalpago.it/wp-snapshots/ZIMPD995ED/2excZekdzLjt1Q55WTci/
http://astronica.org/sleep/sites/rodquv1g/z57pses5634426114fib79p23y03fqrkfz/
http://avanttipisos.com.br/_lib/jtqqs0egrdn/
http://azanayoga.com/js/statement/sqw3wuijyoy8/
http://backoffice.scml.hypnotic.pt/wp-content/parts_service/szh9z69814084237m8n2tvypgo33tg/
http://belleraillesca.com/forum/eTrac/tc4hz153520297338823ak8vtdpvyzo5bal0ttu/
http://bercpro.be/contents/DOC/7qwum6/3abn9463279160285364brsd1q2md012ru33i/
http://bhagatsangam.com/wp-content/uploads/sites/
http://bigtreestudios.org/temporary/payment/o15qfl3u8pu/l6n353678079606829mtfnrnk5f2zcgq8y/
http://binaryprintingsolutions.co.in/cgi-bin/7CE66HF6NTD52/
http://binaryprintingsolutions.co.in/cgi-bin/801588810922/vWJtdNAVS9YL3W6A7/
http://binarystationary.com/cgi-bin/esp/
http://bloemistvlijmen.nl/stats/sites/
http://blog.aiyunwei.top/wp-includes/lm/u8807084067453902gvvogwzmzkpsep7ksq9/
http://blog.classpro.in/nlot/OilU3qpsoUFPS7UY4w/
http://blog.lanbaba666.cn/edit_post/Scan/4al4zjayli2/
http://blog.xuezha.cn:443/wp-admin/Scan/egoz1v/
http://boys86.com/wp-admin/paclm/JCfIE7SMr60B87edE/
http://britanniacricketleague.com/wp-admin/swift/6g7gsq/r8095504124yiwyqwgnic84a3nxvplxj/
http://bullardstowing.com/wp-content/FILE/s89U9Ogkjd/
http://burbujitasplash.com/wp-includes/browse/NMzfalKTrIgJuaGEWMo5/
http://caacholidays.com.hk/wp-content/OCT/DDm7o71vWtTsck/
http://cairocad.com/cgi-bin/DOC/fs9bVeK3g3ZRWWgN/
http://calledtochange.org/CalledtoChange/esp/OaBZQkIw9uIYm/
http://callrealtyaz.com/wp-content/DOC/hQsQ7PzshbFc/
http://camminachetipassa.it/KLMXN9W043RKR1K/Kcy4eIsoGQUtbyYlb/
http://canyonplastering.com/wp-content/Reporting/KyjrguS6sGEBlashoN35/
http://carolinacanullo.com/js/payment/
http://casearomacentro.it/wp-content/FILE/4yjmj287rbol/
http://childselect.com/cgi-bin/paclm/dkofiq573153836073633tkscsihhftzco/
http://cojestgrane.simplicitygames.pl/songs/attachments/
http://coltsfan.xyz/wp-admin/swift/0nec3l/
http://construbelcaxias.com.br/wp-admin/ssehhd1w2d1v/lhh062632193ermjfd5xxac3qa19o/
http://cooldoggraphics.com/wp-content/Document/FXdAUgTov0MNS0qLSSA9/
http://couponsoupon.com/zaglz/OCT/HxkQpb2uUGyOWh1E/
http://crewnecksusa.com/wp-content/3519/4o7n811021630464sboqm64censht56/
http://cricketodds.in/_r/Pages/gSCjjrZUY1TipJ/
http://cse-engineer.com/cgi-bin/docs/YEXLrnMp0ofRs/
http://da-industrial.com/js/payment/
http://daoisthealing.com/cgi-bin/776399559744957/34rbx2ixd/
http://daprofesional.com/data4/images/INC/yVv5ZcqWjT/
http://degepro.com/eTrac/Reporting/XrG1Fw6F2NETTNIRIh/
http://degisimkalip.com.tr/wp-admin/public/vdidwbrc0o/
http://diesner.de/css/report/1qpq47980678119060775455qxx1sk68hzc528c/
http://digitalseven.net.co/eekoox/paclm/TFKaMlqOSefT2ldzAMN/
http://djhavoc.net/scripts_index/browse/6blfb7/1kktcg867647599849954uvjt3de8t50xts000/
http://dkeventmarketing.com/tasteofnj/docs/2zGXMQ9t27WG3dui/
http://dragonfang.com/nav/LLC/rsBsCvfbTWggie8H/
http://dtyl.shop/wp-content/Reporting/qfBCUpGNwqrbm/
http://dutarini.com/cgi-bin/public/nTil4VpAHdlhLPiDd1O/
http://dzyne.net/private_107047_vcuQOIFPYGgf/DOC/jLwgfkRNHPd34seVWSC/
http://e-machine.com.br/mailer/4kehacodc3h9/
http://efimb.smtpclick.com/tracking/raWzMz50paMkCGLlZGH4ZwZ4AmDzMKWjqzA2pzSaqaR9AwZ3ZQx0BQDkWay2LKu2pG0lAQHjAQZ5AwD0ZSt/
http://equimination.ee/wp-admin/OCT/cjj4ymrzjq/
http://equipamentosmix.com/10/public/524xRBp3kpPn5lnA/
http://eubanks7.com/administrator/parts_service/HsrrSIfz9ePfz/
http://ezzll.com/ytgihqyg/OCT/r0lvre/
http://fansbeer.xyz/wp-admin/h08vleb/
http://finewines.com.sg/wset-2-registration/attachments/
http://fmcav.com/images/esp/y8rh8a2b/
http://freespiritmind.com/MASD/HowTo/css/Documentation/
http://friscotrailministorage.com/protected_box/djs0ak6nd/
http://futuregraphics.com.ar/esp/lm/xJ7egQRA81dTUTWG/
http://geoffoglemusic.com/wp-admin/ehtkvvo5n0/
http://gestionprochile.cl/css/065fobwue/
http://getinspace.com/cgi-bin/paclm/
http://girlgeekdinners.com/wp-content/244770555823/0rTKaTEgUGoaX/
http://glafka.com/wp-content/OCT/Sm2SjVvW9W1OEYs/
http://goldcoastoffice365.com.au/temp/report/5awgnu04p6u/
http://hapyc.com/wp-content/documentation/xakpo04559193548288410f34lnicloytby/
http://hbprivileged.com/info/browse/
http://hidrospeed.cl/wp-content/lm/Ir4JxTYSOU2f/
http://hoagietesting10.com/wp-content/lm/3U7xnOZL5gzSni/
http://hotelshivansh.com/UserFiles/FILE/EOB3CiiYYRFr/
http://hrcofindia.co.in/admin/INC/JX8JpbdsxchTz2Hil/
http://hw.lanbaba666.cn/capimyb/eTrac/mHHVS4wzJbHL3QD/
http://iaccessories.best/wp-admin/esp/nd2u20dr/fjdk47735192563281007mm2hxvgcwesqdl0lk3d/
http://ibda.adv.br/inc/statement/nwjpre/g2352704995562durgmxn7zzs9me1/
http://icacc.com/Oursystems/attachments/gnyNRAdJvg/
http://idioticmedia.in/img/Document/bvitb4dv2a/
http://ifund.my/wp-admin/OCT/cn8Zy3Y7KD9LhXnllEgG/
http://imaspro.com/done/page/css/7JXA5760C/s3ho4u4/e7fb956013608035u3svmcf4a1uaeqc2/
http://intc.solutions/wp-content/browse/UMaRogTIuHSgcLQE/
http://iooe.cn/wp-content/eTrac/
http://irvingstudios.com/photos/balance/pz6xe6835/88651755897a3hi24a43pt6pnctzw/
http://itwasntmyfault.com.au/agsclaimform/payment/
http://jizhiguoren.com/savedcart/payment/1l8nlh4/
http://jmlandscapingservice.com/INC/esp/4djNmgQPiKkTb6dTWwgw/
http://joepetro.com/wordpress/Scan/rcy3vy/
http://josegene.com/theme/Reporting/Osc1dR8wP4Odh/
http://jpwoodfordco.com/admin/Scan/dfj97cv0xebh/
http://juchetu.com/wp-admin/l244i2bg2/71ybtoz736558739982442t5jwl9xgi2/
http://kauppa.pe/rmbktfin/browse/0qnihu3mp/
http://kevinley.com/lib/FILE/iel21amk6ju/f06197431740fi927n2wl8eu4/
http://krais.co.il/atda/parts_service/yRoIGV0cVtRpe7lgWL/
http://kultfitness.com/testing/sites/MYlWdJSmbnuTLCzJPPy/
http://laiyifaba.com/wp-admin/Reporting/8v76h5/c08uz94965921997699070n2leh7hv76yd/
http://lamthanhphong.com/journal/Scan/g1BCikkFw4yQ4hXV2H/
http://lblcomputacion.com/services/Documentation/tybsn96/
http://liulibug.com/wp-admin/DOC/cK0T6LfZyQb9o/
http://maisshake.com.br/wp-includes/paclm/1mefdr681131351445306601nwh3k3ql3kqjevo7vgym6c/
http://marseguro.com.br/cgi-bin/INC/tIUIlTGqOrq2jdEN2hS/
http://marvelgroup.co/demo/docs/FQw82nbdgMnB/
http://masque.es/stat/balance/
http://mbsolutions.ge/wp-admin/esp/PhqP89Hbtwch2/
http://mediosmilenium.com/platforms/esp/1GA03MlNj7dE/
http://megalighthotel.com/c9tf/Reporting/7quko4w/48nq901592667146945knvqa9hg12ico/
http://mengyuanclub.cn/web_config/balance/Reporting/Ruv5BdXjA3GBjFSLze32/
http://mengyuanclub.cn/web_config/FILE/EUq0vRgujvkpkh/
http://mianusman.com/cgi-bin/P3MS422C9UL/W4bwyEMz2xb5JPB/
http://mileco.es/wp-admin/lm/u8mfsmimtx2/
http://mlrodasepneus.com.br/index11/parts_service/1yk19zbe/
http://mosdk.com/img/bg/css/DOC/OiCkrh78UNJw/
http://motorcomunicacion.com/wp-admin/FILE/
http://mundocandee.com.br/vendor/OCT/
http://myhms.id/bcc/OCT/b50hunnk6/
http://n-brake.com/aspnet_client/balance/
http://nadsupplies.co.za/static/eTrac/
http://nucleokardecistalace.org.br/wp-includes/attachments/2ZSYTr92QlgvSaC/
http://nuwagi.com/old/INC/94pm491n0/
http://obeidmachinery.com/wp-content/invoice/
http://odeftg.com/odeftg.com/sites/i1m335x2789107218367vcvjzgfux010k24b/
http://onex.co.za/journal/lm/5KBqGENURpGvE84pYjM/
http://onourstyle.com/54oe2b6oq52r0otp-38mo3t-sector/swift/
http://opticaquilin.cl/feed/Document/pHkq0s8W8RAF8/
http://pablobrothel.com.ar/local-cgi/Scan/
http://paisefilhossm.com.br/wp-includes/public/Cr7SnFAleint/
http://paramythou.gr/wp-includes/Document/q1vg7x/
http://paulscomputing.com/CraigsMagicSquare/Reporting/hfjbaf5b/
http://pcsolutioncenter.com.ar/cgi-bin/2ezz06gw8ait/
http://pereirabueno.com.br/wp-includes/Document/ZEbjjCUo8Gezdrz/
http://petafilm.com/calendar/7n600z556Ts1/
http://phimsex.2xxhub.com/wp-content/esp/5ur8drbma/y922699mmjll76685icx/
http://pixnbeats.com/chanakua.org/122144357973/1lfmsogr0c28/uwqb4366732764i5syk2ekyttv44e7a/
http://playschoolmatritva.com/cgi-bin/payment/d56cblx/lg6o329516928424tk5rpuysyip5fol/
http://psyberhawk.com/Reporting/attachments/9Kf9w6BhOxg/
http://qmc.udk.mybluehost.me/wp-content/FILE/
http://qutiche.cn/wp-admin/Pages/R7sfgcoSbK/
http://radiosubmit.com/search_test/Document/6JJ4VsgZ7wSvb9JT/
http://rdp.smitiv.email/acme-challenge/paclm/HaGoReJ3tHOw1xWmB/
http://realcelebritylife.com/brydzi/docs/wkE6rhnmho/
http://reliancectg.com/fonts/payment/5v0qjl9wjkp/v70527707zyuzjffecvv668j/
http://researchchemplus.com/wp-admin/public/zTtDIlSLaLo7B/
http://ruralagricola.com.br/wp-admin/attachments/n2T8JsziSx6K/
http://safoss.co.za/wp-admin/FILE/
http://sasystemsuk.com/index_files/docs/unf308a/5tp4ns3191439751126cgl5782vq1it6aos/
http://sedistribuidora.com.br/Lumine1.6/6dqw44ov3l/
http://sharonnursery.com/attachments/
http://shibuifolders.com/assets/2pxtijp19551430551578771gqps1eox51t/
http://shivakunwar.com.np/swift/LLC/
http://shocksock.it/wp-includes/browse/qo7mms/
http://showboxchannel.com/smfolder/payment/kuww8879600m0eebe1wrk/
http://skullmedia.de/befroe.de/sites/xY3ekEravetb48NR/
http://slotgratisgallina.g10a.xyz/wzs/esp/eL2lSGGnRBdF11Bx3XwI/
http://smarthouseforum.ru/webstruct/FILE/4psyl084w/
http://smarts.tj/wp-content/Reporting/AyoVi2lE3xs1gVR/
http://sollis.ind.br/js/attachments/FFjLSuEGSoCAU4/
http://somcorbera.cat/wp-admin/paclm/iN0QUm1TxY/
http://somosleyendas.cl/mail/Overview/CAk2CiALCf7oclH/
http://spent.com.pl/pass/LLC/ncxdhd8v9v/d3411219988538023917ugyfjxqvfhgje/
http://sromano.it/error/payment/1tg6017557490581665250hp51otsijpw2d6r/
http://stardealerportal.com/wp-content/lm/p6JKmaDtFwR9iVbfl/
http://stechman.com.br/afm/sr7pXo9FF1xNcc/
http://sthinking.net/wp-snapshots/public/3wwj2NOuPf1E1Hcc/
http://strike3productions.com/squad/sites/
http://surfportable.com/temprature/Overview/o6FdSJEbkgl/
http://swiftlogisticseg.com/wp-admin/lm/1k99owh7h/
http://talau.com.br/murilo/Document/3NNgvEEOKcSCTf4/
http://tavo.cl/resumen-uso-inodos/eTrac/browse/
http://teeideals.com/wp-admin/images/browse/7ozD2TrX0QC/
http://telesys.co.in/akaue/etrac/
http://thepodgram.com/wp-content/Document/kkoHIwqkUK/
http://thestudio-ct.co.uk/events/balance/or0ub7l0y/
http://timegonebuy.com/closed-resource/Reporting/
http://tktravelagency.com/wp-admin/report/ocxlb6vm/
http://tktravelagency.com/wp-admin/report/ocxlb6vm///
http://togatta.com.br/wp-includes/payment/
http://tourgunungkidul.com/js/docs/0ALBp7fkMKGn/
http://trainingbodies.com/Reporting/lm/I9sR7hTizs26/
http://traveltoharamain.com/cgi-bin/FILE/PM8chLvvTnmLAzugG/
http://trf.co.in/captcha_test/paclm/
http://tunamim.com.tr/wp-includes/OCT/u5307585814216265dnuqwdt0y1jy298/
http://ultimatetek.in/wp-content/plugins/easy-wp-smtp/Overview/06hr30l/
http://unex-aviation.co.id/wp-admin/esp/ymJ4p2diaw84ll4Mz/
http://uss.ac.th/cgi-bin/wxwe88224015468f95gfy3z66gajm/
http://vandamebuilders.com/wp-includes/sites/bheNxCitO88yJCxopcv7/
http://vanholst.eu/admin/sites/zq2oo44345412457682714ct702xhy5q3/
http://vbcargo.hu/img/Overview/0ploG6QDcQi/
http://vespucci.hu/en/nei4wjloqheu/2mb4o1e2087805031472848fe64f1frm/
http://vilajansen.com.br/loja_old_1/attachments/WdsPrMp90qvzePjF/
http://viperbux.com/glutton/Documentation/
http://vniel.co.kr/gnuboard/data/Scan/FU6jVXzZS46UqLp7l/
http://voxdream.com/wp-includes/LLC/Eqets3qYHQ2sNhTsZKdM/
http://wach8.com/wp-admin/LLC/hV1ltKbJHAVEG6GMMbO/
http://weblabor.com.br/avisos/parts_service/VTjvMWekx5fM8Nbl/
http://webmotion-design.com/closed_section/Pages/ODsa3L6aCKzgL0DCL4Z/
http://wee-s.co.jp/wp-content/lm/rgEqa5sl3Z/
http://www.1ca.co.za/1cAdmin/parts_service/lMV1HyfxPSk/
http://www.amongproject.it/wp-admin/095296/
http://www.cushionsandumbrellas.com/sliders/parts_service/5m8cgnqiqyp7/
http://www.ekramco.ir/english/OCT/WaGV7hJSIYtI/
http://www.hairlineunisexsalon.com/demo/eTrac/kp2JdbbKnGoj/
http://www.mitrausahacontrucion.com/multifunctional-section/U267ELI3D/A5GhQ0aSKp4weUqxd/
http://www.muebleslostroncos.cl/available_module/Overview/cPZaNz1fTCeaSE7XIy/
http://www.myhms.id/bcc/OCT/b50hunnk6/
http://www.riminvest.vn/install/public/YV4ONteoKhwLeY8liP/
http://www.sifesro.com/wp-includes/FILE/DzyAWiQxezuzJmhqkVA/
http://www.somosfabula.cl/recurso/Document/earim4809623q5lbs6ebvdyxz1nh/
http://www.ssgil.com/wp-admin/LLC/P3Fx9FM1Xv/
http://www.tekadbatam.com/wp-content/T5ZBLEKU113GVA/
http://www.traveltoharamain.com/cgi-bin/browse/mIhg4CCZWlVda/
http://xanadudigital.com/condosdominicano.biz/docs/aw47msjtqcl/
http://xiaoxiangkeji.top/wp-content/167975322228/gpeomul4/7q4162605834017130ia17057x9zztfkz/
http://xn--js0bt1bly1ak6e.com/wp-admin/Pages/513oeqPwtUcK56/
http://yanfachina.cn/wp-admin/DOC/0qMYuBpocYaqMbC/
http://ydslin.fun/wp-includes/attachments/5773242541lilhzepdrbh55rg4lprn4n/
http://yolticaxcan.com/cgi-bin/FILE/cuivF95k5Uk4RfUt/
http://zcomunicacion.com/wp-admin/public/A2m2ED5HotqZh/
http://zok.ink/upmz/eTrac/cuJLUXaIDzohdZ/
http://zsstart.com/mobile/682533981893/MnALqiYy0cpOUUfw/
https://4life.com.vn/wp-admin/Overview/nw36ySeXEj284q7G/
https://agenciatabletshouse.com.br/erros/Scan/4Q5eoea8G0oEwwieOQ/
https://ajstudiollc.com/cgi-bin/Scan/EeeVsHqk4TiZ8T7/
https://amacshowerscreens.com.au/wp-includes/2177606574541/JSiTzLcfxl5VWN9eV6z6/
https://americandogrescue.org/wp-content/32943071685/p0q94f5642092434uf7vv8fx0kbh547u/
https://anhung1102.vn/wp-admin/paclm/mts8b88010335099618312hmqt9bdln4i6345/
https://artewebestudio.com/cgi-bin/public/jZHaIS5OsqjwYF7ULC/
https://asiancrush.me/l2twf1/8NXX306142CU/wZhFuwGTX4/
https://b.fherf.com/s2cxmd/paclm/s0ho77DKJS9xHJ0S/
https://b2bcom.com.br/site/balance/iiqes29io1/
https://babyhippo.in/e712/INC/uxeHbpppOswKCq5hCjS/
https://bangkokcityjewel.com/cgi-bin/statement/sj6594562982750fucb18uggdz/
https://beeptool.com/wp-admin/8WV79O3IJ5S9XRD/m2Oc0lsuR0VAMBD/
https://blog.i8w.cc/wp-includes/paclm/exlcGyGnmmrSa0/
https://blog.qgdxzs.com/wp-admin/Scan/Q6lr95CDwOyi5uBP2Py/
https://caeliinteriores.com.br/wp-content/uploads/sites/vGKKfbriDE7AlInshOH5/
https://camponovo.it/sites/statement/
https://capquangviet.vn/wp-admin/1LOLZ5BOMA/
https://cearacultural.com.br/admin/paclm/
https://celebitech.vn/xdvnl/OCT/uRZKzA2Bkxd/
https://charterhouse.com.br/2017/docs/cIguN3oeHmcMW7/>/
https://cimsjr.com/hospital/invoice/
https://cybercrimelab.net/raeunch/sites/st7a7nl2yxb/21804085pekt7zpbpe2z1x3e9ao/
https://d.fherf.com/wp-content/Documentation/
https://detorre.es/mails/Reporting/pgvBi3nUhcHH1VmdwG/
https://dev.omniroom.ru/sys-cache/IXY5HBBJUWNLM/8ZM7miVPm0JN6cu5U/
https://diefreaks.net/bin/u383ied2cd3d1-wr777-array/security-portal/public/erxbss2z25kr/
https://dramabeans.me/l2twf1/Overview/kbaqwk3ho2/
https://easonmusicschool.com/ukulelesite/b5jnz05294818778643935e4ghfrdenf9xtdnm/
https://egfco.cn/bak/docs/bsu1ffGb3ZABJdjwCpFU/
https://ejust.edu.eg/cie50/AUQP1hhWCeMy/
https://excelenceimoveis.com.br/wp-includes/DOC/
https://fairplay.company/wp-includes/FILE/V4SbJTCl6dT/
https://fcbc.group/wp-includes/lm/2aGC4YXvRMPgDj/
https://futbolclubcartagena.com/wp-admin/d8vt2802928612003r7qptxsr8ps9mq/
https://girlgeekdinners.com/wp-content/244770555823/0rTKaTEgUGoaX/
https://global-solutions.co/sites/balance/sav8o2khr/
https://global-solutions.net/xzLhWB/Overview/
https://go4it24.be/administrator/pTd8qj1Dw3ylqZmpF/
https://hapyc.com/wp-content/Documentation/xakpo04559193548288410f34lnicloytby/
https://heartssetfree.org/9c950e/balance/iqzvdujboyjx/
https://homestay.a2vina.com/wp-content/Pages/3UEAZl5nS359Aax/
https://hostsr4.com.br/status/attachments/UIXg2vcudc38S/
https://hotrohitachivn.com/sites/browse/ouu61030951802x75h1b9wc07jg7sb5d/
https://ifwin.cn/wp-admin/Document/2f6l611713882966217231u01bjevzgd4en47/
https://iwxdy.cn/wp-includes/FILE/8QqMH5GGI6YHVhWGBtWn/
https://jeffdahlke.com/css/6QV2O2EHWZH1D/
https://kalekoi.com/wp-includes/browse/yieja3/0u0613888625pmemutvk71icrp2km/
https://kuaidianban.cn/wp-includes/LLC/TUQ3yWbQI8K9Snw/
https://lifeadvicer.com/wp-content/attachments/XlpOknLdJKfGs/
https://lkfx168.com/wp-content/Reporting/oIVp7uuX0Iw/
https://mundocandee.com.br/vendor/OCT/
https://myinstantguru.com/wp-content/balance/1158502666jaf4xboh8prr8fs/
https://nbiz.tk/wp-admin/sites/i5deg19svu/swift/ss6mlar3n/
https://old.mvmalca.com/test/docs/4wgp2mOAjjyNXqoS/
https://online24h.biz/wp-admin/br272nt1/
https://pacwebdesigns.com/images/lm/uykgpyb765756323o3qzuuc7051zgd7f799/
https://paws4walking.co.uk/wp-admin/OCT/
https://polyet-store.com/wp-admin/public/yr8x6gzxh/
https://povedavicedo.com/wp-admin/INC/sATAmESYDTYX0Bv9pPV/
https://rackwarehouses.com/wp-includes/FILE/KzfKW08PvDqUwkD0/
https://salessupremo.com/wp-content/LLBBl7ogl7fbA9jg73/
https://sanambakshi.com/wp-admin/sites/ZZvsxQfVGBPGzJf/
https://simoneporzi.it/wp-snapshots/public/k2nsnywzsx/
https://smartlogo.com.br/nova/DOC/EzEzMusT53/
https://softgon.com/wp-content/parts_service/
https://st47.net/wp-content/languages/browse/Eg9ZJD0tPDStNR0Fhns/
https://star-speed.vip/wp-admin/Reporting/g9xIotyQa8Kj/
https://szwrs.com/wp-includes/Documentation/uFsxUZmitb/
https://tarynminterlaw.com/cgi-bin/FILE/
https://techrbxroom.com/wp-content/lgq27i4mrqsd/mklk996490581066248f45zcgci5oht/
https://telemarketingliste.it/docs/Pages/oN4UNNyc4hR/
https://tocloco.com/new/4xp485354004dhwcmns645rwmdbxs/
https://wcare.nl/wp-content/Document/wkm9463705940696563tu1ox2lp0h9u4h1u5zq/
https://webso.ca/dev/invoice/uu9ecgvwe/
https://welfare.yunjunet.cn/g8kq/Document/ElNfIHaSkT/
https://wuguo.vip/wp-includes/Overview/EkmthO3RYrDMb/
https://www.brinno.com.mx/wp-admin/Documentation/
https://www.cebucoolstuff.com/image/sites/16QjA5b4Oc8SCV4bSN/
https://www.compreautocaminhoes.com.br/fonts/Overview/wqkjAJSwoD4hwDihH40P/
https://www.cwa.mx/himalaya/eTrac/ClSMVGieMlLzCmhV2/
https://www.farayad.co/wp-content/wp-rocket-config/Documentation/p3sQSEkCS4Px3RZZ/
https://www.geotechnic.co.uk/test1/Documentation/794l7rhq/
https://www.grsailing.gr/media/eTrac/wkl1wqbfc/hnyb9w6272625053jftmct0zppr/
https://www.hairlineunisexsalon.com/demo/eTrac/kp2JdbbKnGoj/
https://www.hhbiao.com/ro/esp/3PDe2Fljxtl5gAMx/
https://www.ingyouth.com/wp-includes/lm/d1o5nszks6dp/3e1a0y549622444gj05xsf5dj3m8vx8/
https://www.irenicinternational.in/website.irenicinternational.in/parts_service/Wt6OsRwIKNAPVWO7uYCi/
https://www.isatechnology.com/cwatch/sites/LyXFKUgakt6o8I/
https://www.laminatedtube.com/site/DOC/
https://www.mystylu.com.tw/wp-admin/LLC/qAcBvISwLyWaaIzSkY6N/
https://www.novaes.com.br/files/OCT/4zrantq94d/
https://www.prestasicash.com.ar/errores/Document/lVmeYjuQjiHeXGBqSBi/
https://www.purpleline.co.uk/logs/paclm/k3prt6dbwd6d/
https://www.royalsr.in/assets/docs/AnnlkK4iJSIRHqXIRu/
https://www.shoogyboom.com.tr/administrator/esp/1yEZfkbxRrK05o/
https://www.teleargentina.com/ver/LLC/
https://www.weigeus.com/mvdgd/lm/iHsMTtsW0Ba7BT/
https://x.ziyoubb.com.cn/wp-includes/INC/Fs5kT0zqxses/
https://xn--mgbao2hg.net/cgi-bin/parts_service/hc1npn/4rxug536321150939rc2how0ep6/
https://zycccccc.top/wp-content/FILE/t5agYDoYUIWNgc8k/
https://zzznan.com/wp-includes/paclm/sletn98nsyem/53bzz372701747220692o9890sjupuv74p70q4/

1ca.co.za
379code.com
4life.com.vn
808district.com
academiadotrader.net
agenciatabletshouse.com.br
aiyunwei.top
ajstudiollc.com
alemelektronik.com
alphaomegasl.com
amacshowerscreens.com.au
amaraconservation.org
amarettobh.com.br
amarteargentina.com.ar
americandogrescue.org
amongproject.it
amyescort.de
anhung1102.vn
annabphotography.co.uk
ariefsetiawan.com
armiounaslehto.fi
artewebestudio.com
asiancrush.me
asiloalpago.it
astronica.org
avanttipisos.com.br
azanayoga.com
b2bcom.com.br
babyhippo.in
backoffice.scml.hypnotic.pt
bangkokcityjewel.com
beeptool.com
belleraillesca.com
bercpro.be
bhagatsangam.com
bigtreestudios.org
binaryprintingsolutions.co.in
binarystationary.com
bloemistvlijmen.nl
boys86.com
brinno.com.mx
britanniacricketleague.com
bullardstowing.com
burbujitasplash.com
caacholidays.com.hk
caeliinteriores.com.br
cairocad.com
calledtochange.org
callrealtyaz.com
camminachetipassa.it
camponovo.it
canyonplastering.com
capquangviet.vn
carolinacanullo.com
casearomacentro.it
cearacultural.com.br
cebucoolstuff.com
celebitech.vn
charterhouse.com.br
childselect.com
cimsjr.com
classpro.in
coltsfan.xyz
compreautocaminhoes.com.br
construbelcaxias.com.br
cooldoggraphics.com
couponsoupon.com
crewnecksusa.com
cricketodds.in
cse-engineer.com
cushionsandumbrellas.com
cwa.mx
cybercrimelab.net
da-industrial.com
daoisthealing.com
daprofesional.com
degepro.com
degisimkalip.com.tr
detorre.es
diefreaks.net
diesner.de
digitalseven.net.co
djhavoc.net
dkeventmarketing.com
dragonfang.com
dramabeans.me
dtyl.shop
dutarini.com
dzyne.net
e-machine.com.br
easonmusicschool.com
efimb.smtpclick.com
egfco.cn
ejust.edu.eg
ekramco.ir
equimination.ee
equipamentosmix.com
eubanks7.com
excelenceimoveis.com.br
ezzll.com
fairplay.company
fansbeer.xyz
farayad.co
fcbc.group
fherf.com
finewines.com.sg
fmcav.com
freespiritmind.com
friscotrailministorage.com
futbolclubcartagena.com
futuregraphics.com.ar
g10a.xyz
geoffoglemusic.com
geotechnic.co.uk
gestionprochile.cl
getinspace.com
girlgeekdinners.com
glafka.com
global-solutions.co
global-solutions.net
go4it24.be
goldcoastoffice365.com.au
grsailing.gr
hairlineunisexsalon.com
hapyc.com
hbprivileged.com
heartssetfree.org
hhbiao.com
hidrospeed.cl
hoagietesting10.com
homestay.a2vina.com
hostsr4.com.br
hotelshivansh.com
hotrohitachivn.com
hrcofindia.co.in
i8w.cc
iaccessories.best
ibda.adv.br
icacc.com
idioticmedia.in
ifund.my
ifwin.cn
imaspro.com
ingyouth.com
intc.solutions
iooe.cn
irenicinternational.in
irvingstudios.com
isatechnology.com
itwasntmyfault.com.au
iwxdy.cn
jeffdahlke.com
jizhiguoren.com
jmlandscapingservice.com
joepetro.com
josegene.com
jpwoodfordco.com
juchetu.com
kalekoi.com
kauppa.pe
kevinley.com
krais.co.il
kuaidianban.cn
kultfitness.com
laiyifaba.com
laminatedtube.com
lamthanhphong.com
lanbaba666.cn
lblcomputacion.com
lifeadvicer.com
liulibug.com
lkfx168.com
maisshake.com.br
marseguro.com.br
marvelgroup.co
masque.es
mbsolutions.ge
mediosmilenium.com
megalighthotel.com
mengyuanclub.cn
mianusman.com
mileco.es
mitrausahacontrucion.com
mlrodasepneus.com.br
mosdk.com
motorcomunicacion.com
muebleslostroncos.cl
mundocandee.com.br
mvmalca.com
mybluehost.me
myhms.id
myinstantguru.com
mystylu.com.tw
n-brake.com
nadsupplies.co.za
nbiz.tk
novaes.com.br
nucleokardecistalace.org.br
nuwagi.com
obeidmachinery.com
odeftg.com
omniroom.ru
onex.co.za
online24h.biz
onourstyle.com
opticaquilin.cl
pablobrothel.com.ar
pacwebdesigns.com
paisefilhossm.com.br
paramythou.gr
paulscomputing.com
paws4walking.co.uk
pcsolutioncenter.com.ar
pereirabueno.com.br
petafilm.com
phimsex.2xxhub.com
pixnbeats.com
playschoolmatritva.com
polyet-store.com
povedavicedo.com
prestasicash.com.ar
psyberhawk.com
purpleline.co.uk
qgdxzs.com
qutiche.cn
rackwarehouses.com
radiosubmit.com
realcelebritylife.com
reliancectg.com
researchchemplus.com
riminvest.vn
royalsr.in
ruralagricola.com.br
safoss.co.za
salessupremo.com
sanambakshi.com
sasystemsuk.com
sedistribuidora.com.br
sharonnursery.com
shibuifolders.com
shivakunwar.com.np
shocksock.it
shoogyboom.com.tr
showboxchannel.com
sifesro.com
simoneporzi.it
simplicitygames.pl
skullmedia.de
smarthouseforum.ru
smartlogo.com.br
smarts.tj
smitiv.email
softgon.com
sollis.ind.br
somcorbera.cat
somosfabula.cl
somosleyendas.cl
spent.com.pl
sromano.it
ssgil.com
st47.net
star-speed.vip
stardealerportal.com
stechman.com.br
sthinking.net
strike3productions.com
surfportable.com
swiftlogisticseg.com
szwrs.com
talau.com.br
tarynminterlaw.com
tavo.cl
techrbxroom.com
teeideals.com
tekadbatam.com
teleargentina.com
telemarketingliste.it
telesys.co.in
thepodgram.com
thestudio-ct.co.uk
timegonebuy.com
tktravelagency.com
tocloco.com
togatta.com.br
tourgunungkidul.com
trainingbodies.com
traveltoharamain.com
trf.co.in
tunamim.com.tr
ultimatetek.in
unex-aviation.co.id
uss.ac.th
vandamebuilders.com
vanholst.eu
vbcargo.hu
vespucci.hu
vilajansen.com.br
viperbux.com
vniel.co.kr
voxdream.com
wach8.com
wcare.nl
weblabor.com.br
webmotion-design.com
webso.ca
wee-s.co.jp
weigeus.com
welfare.yunjunet.cn
wuguo.vip
xanadudigital.com
xiaoxiangkeji.top
xn--js0bt1bly1ak6e.com
xn--mgbao2hg.net
xuezha.cn
yanfachina.cn
ydslin.fun
yolticaxcan.com
zcomunicacion.com
ziyoubb.com.cn
zok.ink
zsstart.com
zycccccc.top
zzznan.com

DOCUMENT FILE HASHES
cefd8ad4ff49bfb233ddbe81734d2843
6b243ecf1ceab205b1e379a07668f8f8
24446148da1feb6760fb9db775797b83
ac2881496b2c7a37123ed2083305811a
0c3fe7d478031afc2d68a73c6c933c22

PAYLOAD FILE HASHES
06801c77160bf9f70487b18eabfebc96
3f34a0c7dcb3ba10fcd7b0780b2160b2
52abc7fb44637638cf94995e09d8dd3f
5441daa24dd64a0a364efd92e0780977
7759bdc3554410ecfd943a83cd2a3da1
921e5b619a7374f80639bd75b1d96afc
b19c77785df27a034f6260966dbf6860
b2df264f3bb245d9b3648aac0875812c
dc026e853f467a37fe5ec071b2e62006
e62bd0f8c014b7f4e8675de443dde203
e6d59248bc417bcb41edc70b6ca5b0d0

EMOTET PAYLOAD URLs
http://arquivopop.com.br/index_htm_files/G0EU/
http://bnmintl.com/cgi-bin/hQuB2/
http://booksearch.com/index_files/U/
http://brandstrumpet-001-site1.ctempurl.com/default/lnD/
http://buildingrobots.net/cgi-bin/LKgv/
http://bytecreation.es/gestion/hE/
http://castlestudios.com/bots/7/
http://ckinterbiz.com/backup/waI0rNy/
http://creationskateboards.com/shred/xnYp2/
http://datawyse.net/cgi-bin/8/
http://davehale.ca/cgi-bin/v4kax/
http://ekinerja.megadata.co/wp-content/VFWW/
http://eliteweb.cl/dev-area/6V/
http://elmpajohan.ir/revesrm/w/
http://getming.com/forum/DGgva1Lis/
http://giral2.com/wp-includes/fj2mDY/
http://goldcoastoffice365.com/temp/RAr9U/
http://hrmanagement.mx/Document/N/
http://indyoverheaddoors.com/wp-includes/sx9SD/
http://intrasistemas.com/cgi-bin/6/
http://ixirhost.xyz/wp-content/z/
http://jobcapper.com/8.7.19/hrS/
http://linhkienaiot.com/wp-content/uploads/3rz9TxWe/
http://livefarma.com/wp-content/hpu/
http://lombardzista.pl/wp-content/r/
http://macdonaldandsons.com/cgi-bin/nP/
http://merkadito.mx/upload/itYU6SQ/
http://method21.net/r/A5dFRf/
http://must-in.com/wp-admin/kej4f/
http://oneinsix.com/test/u/
http://paulospainting.com/wp-includes/uhkHig/
http://personalizzabili.com/images/x04aAql/
http://priyamcollection.com/cab/f/
http://querofornecedores.com/wp-includes/images/D/
http://raintoday.org/wp-admin/e/
http://rocketviral.com/bv/O/
http://sansorescontabilidade.com.br/wp-snapshots/Yexwjbt6z/
http://scoomie.com/wp-content/uploads/mxjsB/
http://shop.homenhealthy.com/wp-includes/xt/
http://socylmediapc.es/tools/D7Ogq/
http://syracusecoffee.com/customer/jzN/
http://tech332.synology.me/@eaDir/Ik62x9g/
http://tfbauru.com.br/cgi-bin/6Rz6fraVUF/
http://thammynhp.com/wp-includes/H/
http://vuatritue.com/wp-admin/w/
https://1horse.ir/wp-includes/7Ev/
https://adidasnmdfootlocker.com/nc_assets/F/
https://aspeninstitute.es/catalogmap/fAatpjn/
https://averyair.com/wp-content/J/
https://blog.workshots.net/bibqcr9/Eki/
https://drippglobal.com/wp-content/rV/
https://eaglehatch.com/wp-content/TwA6w6/
https://eliteweb.cl/dev-area/6V/
https://hulianwang114.com/attachment/c/
https://hxoptical.net/wp-admin/91C/
https://pogovor.si/wp-snapshots/browse/sqcxxh/223jgy8iM/
https://qualitychildcarepreschool.com/emqblk/292416929446266/O/
https://stockval.com.br/wp-admin/68K36/
https://theshopclubs.com/wp-admin/7/
https://weneedyourhelpnow.org/wp-content/LJ/
https://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/
https://www.equiposjj.com/cgi-bin/h0MId/
https://www.tiendajuanvaldez.com/wp-admin/igkf/
https://www.yeumoitruong.vn/src/09j/

1horse.ir
adidasnmdfootlocker.com
afriqueindustries-sa.com
arquivopop.com.br
aspeninstitute.es
averyair.com
bnmintl.com
booksearch.com
buildingrobots.net
bytecreation.es
castlestudios.com
ckinterbiz.com
creationskateboards.com
ctempurl.com
datawyse.net
davehale.ca
drippglobal.com
eaglehatch.com
ekinerja.megadata.co
eliteweb.cl
elmpajohan.ir
equiposjj.com
getming.com
giral2.com
goldcoastoffice365.com
homenhealthy.com
hrmanagement.mx
hulianwang114.com
hxoptical.net
indyoverheaddoors.com
intrasistemas.com
ixirhost.xyz
jobcapper.com
linhkienaiot.com
livefarma.com
lombardzista.pl
macdonaldandsons.com
merkadito.mx
method21.net
must-in.com
oneinsix.com
paulospainting.com
personalizzabili.com
pogovor.si
priyamcollection.com
qualitychildcarepreschool.com
querofornecedores.com
raintoday.org
rocketviral.com
sansorescontabilidade.com.br
scoomie.com
socylmediapc.es
stockval.com.br
synology.me
syracusecoffee.com
tfbauru.com.br
thammynhp.com
theshopclubs.com
tiendajuanvaldez.com
vuatritue.com
weneedyourhelpnow.org
workshots.net
yeumoitruong.vn

EMOTET C2s
http://67.10.155.92
http://38.111.46.46:8080
http://134.209.36.254:8080
http://162.241.242.173:8080
http://2.84.135.163
http://94.1.108.190:443
http://140.186.212.146
http://95.179.229.244:8080
http://200.114.213.233:8080
http://113.61.66.94
http://190.240.194.77:443
http://61.19.246.238:443
http://110.5.16.198
http://83.169.36.251:8080
http://37.187.72.193:8080
http://176.111.60.55:8080
http://85.105.205.77:8080
http://168.235.67.138:7080
http://200.123.150.89:443
http://87.106.139.101:8080
http://74.120.55.163
http://124.41.215.226
http://219.74.18.66:443
http://24.43.99.75
http://62.30.7.67:443
http://71.72.196.159
http://156.155.166.221
http://181.169.34.190
http://62.75.141.82
http://110.145.77.103
http://139.99.158.11:443
http://87.106.136.232:8080
http://169.239.182.217:8080
http://157.245.99.39:8080
http://121.124.124.40:7080
http://220.245.198.194
http://187.161.206.24
http://1.221.254.82
http://94.23.237.171:443
http://123.176.25.234
http://5.196.74.210:8080
http://104.236.246.93:8080
http://139.59.60.244:8080
http://104.131.44.150:8080
http://66.65.136.14
http://91.211.88.52:7080
http://24.179.13.119
http://213.196.135.145
http://79.98.24.39:8080
http://93.147.212.206
http://195.251.213.56
http://94.200.114.161
http://137.119.36.33
http://82.80.155.43
http://74.134.41.124
http://5.39.91.110:7080
http://89.216.122.92
http://139.162.108.71:8080
http://78.187.156.31
http://97.82.79.83
http://68.188.112.97
http://121.7.127.163
http://74.208.45.104:8080
http://61.92.17.12
http://203.153.216.189:7080
http://174.102.48.180:443
http://96.249.236.156:443
http://24.137.76.62
http://104.32.141.43
http://103.86.49.11:8080
http://109.74.5.95:8080
http://153.137.36.142
http://37.139.21.175:8080
http://50.91.114.38
http://24.43.32.186
http://216.139.123.119
http://75.139.38.211
http://78.24.219.147:8080
http://85.152.162.105
http://219.75.128.166
http://174.45.13.118
http://194.187.133.160:443
http://74.219.172.26
http://185.94.252.104:443
http://104.251.33.179
http://42.200.107.142
http://120.150.60.189
http://137.59.187.107:8080
http://195.7.12.8
http://79.137.83.50:443
http://50.35.17.13
http://139.130.242.43
http://46.105.131.79:8080
http://84.39.182.7
http://95.213.236.64:8080
http://172.91.208.86
http://47.144.21.12:443
http://107.5.122.110
http://209.141.54.221:8080
http://104.131.11.150:443
http://201.173.217.124:443
http://188.219.31.12