Hancitor Apr 11

https://www.hybrid-analysis.com/sample/d60dbc150c1ad9f052e4ed8c73d2dbcedf95ca02706697bb87b142afdc9351b6

doc dl domains
ourversionscents.com
ourversionfragrances.com
fleamarketfragrances.com
estimating.training
knockoffcologne.com
virtualdrywallexpo.com
drywallexpo.com
finishtradeexpo.com
166e61.com
gurwitz.com

additional payload dl
http://contentsuperstar.com/wp-content/languages/plugins/1
http://contentsuperstar.com/wp-content/languages/plugins/4
http://contentsuperstar.com/wp-content/languages/plugins/5
http://image-a.com/wp/wp-content/plugins/easy-media-gallery/includes/1
http://image-a.com/wp/wp-content/plugins/easy-media-gallery/includes/4
http://image-a.com/wp/wp-content/plugins/easy-media-gallery/includes/5
http://kuchingsupplies.com/wp-content/plugins/gallery-by-supsystic/vendor/Twig/1
http://kuchingsupplies.com/wp-content/plugins/gallery-by-supsystic/vendor/Twig/4
http://kuchingsupplies.com/wp-content/plugins/gallery-by-supsystic/vendor/Twig/5

hancitor c2
http://gotsurievent.com/ls5/forum.php
http://henfetanug.ru/ls5/forum.php
http://saortonsjohn.ru/ls5/forum.php

pony c2
http://gotsurievent.com/mlu/forum.php
http://henfetanug.ru/mlu/forum.php
http://saortonsjohn.ru/mlu/forum.php

evilpony c2
http://gotsurievent.com/d2/about.php
http://henfetanug.ru/d2/forum.php
http://saortonsjohn.ru/d2/forum.php

pandabanker links
https://lyrintedba.com/1irwisetoxuutufnevyeq.dat
https://lyrintedba.com/rMAY8/L/7ht3/sM/ZS/sLaS0vihTrBxQ