hancitor 02-12-18

sender: accounting@klenzamerica.com
subject: Invoice Attached

hancitor doc dl:
hxxp://burgowerandrainwater.com
hxxp://marksheard.com
hxxp://productivitymo.com
hxxp://avpenergy.com
hxxp://burgowerrainwater.co
hxxp://burgowerrainwater.info
hxxp://lamplighteracres.com
hxxp://burgowerrainwater.net
hxxp://srba.us
hxxp://sheard.ca

hancitor c2:
histyleftreb.com/ls5/forum.php
fortarcaly.ru/ls5/forum.php
uncelighone.ru/ls5/forum.php

payload links:
hxxp://www.rohau.sk/wp-content/plugins/post-types-order/include/1
hxxp://el-sexy.com/wp-content/plugins/google-calendar-events/includes/1
hxxp://mywowtv.com/wp-content/plugins/plugin-organizer/lib/1
hxxp://www.izgigroup.com/wp-content/plugins/Login-wall-LWD/1
hxxp://ashutosh.net/wp-content/plugins/optinmonster/includes/1

hxxp://www.rohau.sk/wp-content/plugins/post-types-order/include/2
hxxp://el-sexy.com/wp-content/plugins/google-calendar-events/includes/2
hxxp://mywowtv.com/wp-content/plugins/plugin-organizer/lib/2
hxxp://www.izgigroup.com/wp-content/plugins/Login-wall-LWD/2
hxxp://ashutosh.net/wp-content/plugins/optinmonster/includes/2

hxxp://www.rohau.sk/wp-content/plugins/post-types-order/include/3
hxxp://el-sexy.com/wp-content/plugins/google-calendar-events/includes/3
hxxp://mywowtv.com/wp-content/plugins/plugin-organizer/lib/3
hxxp://www.izgigroup.com/wp-content/plugins/Login-wall-LWD/3
hxxp://ashutosh.net/wp-content/plugins/optinmonster/includes/3

pony c2:
histyleftreb.com/mlu/forum.php

evilpony c2:
histyleftreb.com/d2/forum.php