Emotet 4/5-6/18

Docs:
http://knoc.org/OX-28191133/
http://schlangenaugen.de/WIRE-FORM/SP-5958952712733/
http://wko-web.de/ACH-FORM/IA-152456703/
http://pulko.de/WIRE-FORM/XYM-640954/
http://gradt.de/JSO-4455835/
http://pulko.de/WIRE-FORM/XYM-640954/
http://panorama-lodge.com/INV/WN-71383699240260/
http://assumptionofmorris.org/KW-4423132/
http://fireblood.com/INVOICE/YZN-770764607111/
http://doc-japan.com/doc-site/INVOICE/MKD-421515219243313/
http://digitaloffice.co.jp/wordpress/ACH-FORM/KOL-47017427723/
http://www.areia.pb.gov.br/ACH-FORM/SO-3971117511/
http://tobiaswuehr.de/WIRE-FORM/RRD-139857754091922/
http://virtual-power.de/ACH-FORM/RTZ-8597/
http://vinka-gmbh.de/INV/TRD-921020526297/
http://roeder-treppen.de/INVOICE/TPP-06349/
http://ready4success.de/ACH-FORM/PEJ-85532528685710/
http://matuff.de/INV/AKR-835794650/
http://louisa-martin.com/WIRE-FORM/SU-6570496036/
http://kjg-schiefbahn.de/ACH-FORM/GB-2754706353267/
http://hagenheide.de/INV/FRF-5541686/
http://berny.com.mx/ACH-FORM/WJR-4109505/
http://ck-finanzberatung.de/FM-334183399187863/
http://das-team.tv/QDS-20433690/
http://joedee.co.za/INV/HD-5487407874249/
http://interwort.com/INV/DBT-5428184637973/
http://elektro-magdeburg.de/WIRE-FORM/ZWZ-88785635041/
http://hertoginstyling.nl/INV/KZ-0170535/
http://fbi-park.de/INV/CQY-197615803735725/
http://mittel.sk/ACH-FORM/NSQ-17803/
http://causeandfx.com/ACH-FORM/JL-793102446/
http://fischfreunde.net/INVOICE/CTB-0453299/
http://www.diamondig.com/OIL-2928053047/
http://schipull.com/INV/QZC-871048477/
http://thomas-winkel.de/INV/IP-0509627635/
http://slytec.com/WIRE-FORM/AXH-126687048/
http://wichmann-gmbh.eu/INVOICE/UI-64595141706/
http://trellini.it/INV/MI-8010351208290/
http://smehlik.net/INVOICE/QZW-121699116839940/
http://w-wolf.de/QT-17668959520463/
http://tvgestaltung.de/INV/RQ-854013733677/
http://vadonka.com/INV/ME-7600494562895/
http://pendoric.biz/INVOICE/QKC-7142813269/
http://maslonka.fr/INVOICE/OZX-6347043/
http://tobiaswuehr.de/WIRE-FORM/RRD-139857754091922/
http://rlpromotion.com/WIRE-FORM/SA-74859/
http://t-kinami.com/INVOICE/ZR-97334494848402/
http://kolny.cz/WV-640606434165481/
http://med-dent-apo.de/WIRE-FORM/GGX-419100277/
http://radio-paranoid.net/WIRE-FORM/YL-526440802/
http://mekea.de/DM-084666330048463/
http://pralong.net/INV/WA-35124717/
http://poppensieker.org/ACH-FORM/JN-6179836/
http://pcp-cl.cz/INV/WP-8225976/
http://joedee.co.za/INV/HD-5487407874249/
http://paramount.edu/JU-4843734/
http://opoj.eu/ZE-8070822513/
http://intoday.nl/INVOICE/UFM-1915183/
http://metal-on-metal.com/WIRE-FORM/RXF-1978/
http://messebau-pahl.com/WIRE-FORM/DKG-21716107/
http://lbm-net.eu/INVOICE/IR-385657293606793/
http://gips-walkenried.de/JG-20698704380290/
http://gattiri.net/ACH-FORM/ZK-134912168/
http://ibk-dresden.net/INV/FI-80387/
http://kommunikationstechnik-kuhl.de/WIRE-FORM/KCH-98841/
http://kkservice.cz/ACH-FORM/CR-357648/
http://hangonyipizzeria.hu/INVOICE/OP-521340037805/
http://fukusin.jp/INV/OTA-5563664/
http://gries-whv.de/IF-70433685/
http://alpineinternet.com.au/ZU-68713968223277/
http://dirwil.com/ACH-FORM/EES-89626681051904/
http://eskimue.de/INVOICE/BS-344733601140174/
http://engdahldata.dk/INV/AZ-70231801858/
http://engenhodeideias.com.br/ACH-FORM/GI-58276617680426/
http://elmes.de/ACH-FORM/VK-35582/
http://debrinkjes.nl/ACH-FORM/OD-067172844/
http://digitalcenter.es/IQN-0376276969007/
http://eierwiese.de/ACH-FORM/EOM-8406146/
http://eastracing.de/ACH-FORM/DEH-661340696378/
http://diretodoceu.com.br/INVOICE/XSZ-72211986964/
http://ck-finanzberatung.de/FM-334183399187863/
http://cutile.com/INVOICE/TWE-32739/
http://cupspoiler.com/typo3conf/ACH-FORM/UHS-673056024477816/
http://deheld100.nl/WIRE-FORM/UOS-1299/
http://carbow.org/ACH-FORM/GZ-4546768648795/
http://das-team.tv/QDS-20433690/
http://boudak.net/WIRE-FORM/KY-301455908956/
http://beurse.nl/ACH-FORM/NKV-292883425463174/
http://bohrensmoving.com/INV/YQC-87116690/
http://assist-k.com/IJ-083854532021185/
http://blacktail-enterprises.com/zapgovno/ZJV-547731381391163/
http://bicfun.nl/INVOICE/BYN-5347/
http://berlincorvette.de/INVOICE/ZF-61594/
http://artwhore.com/INV/IL-776380601/
http://angelawulf.de/JNK-082402047594/
http://altanlaraluminyum.com/INVOICE/XG-3036144239831/
http://a-g-s-s.com/PA-9060413241/
http://24-stunden-pc-notdienst.de/INV/ALU-9518566561770/
http://ahrensgrabenhorst.de/INVOICE/LY-44598718/
http://1a-werbeagentur.de/INV/OW-662610428/
http://diretodoceu.com.br/INVOICE/XSZ-72211986964/
http://adaptservices.net/WJT-460461333702698/
http://modusconsult-ulm.de/WIRE-FORM/AX-34153392/
http://detonator.jp/INV/LQ-167038881782077/
http://hillje.net/INVOICE/DLF-47713726265/
http://3music.net/INV/IR-159372008/
http://sandwichpicker.com/AMA-493956174139762/
http://eqwolf.com/INV/EW-2814104515369/
http://jogise.eu/WIRE-FORM/NWO-2785491/

Payloads:
http://ijdema.net/bPwS/
http://beenonline.com/WZPYMHd/
http://liebner.de/foBW0bL/
http://anatexis.de/RXDWHpi/
http://bittabi.net/z0IvVB/
http://gooddot.com/MgsF/
http://iidl.info/ZYafR/
http://mimis-world.de/LCJUkq/
http://shoppingcat.net/UyQQ/
http://sizov.de/cqjz/
http://moritzmebesius.de/U38x6d/
http://destroit.eu/Lh7EO/
http://moritzmebesius.de/U38x6d/

C2:
http://205.186.133.51:8080/
http://158.69.249.236:4143/
http://23.239.28.4:8080/
http://87.106.37.146:8080/