hancitor 03-08-18

Senders:
yourinvoice@medirestinc.com
yourinvoice@thanasi.com

Subjects:
OnlineInvoices Automatic Service Message
OnlineInvoices Electronic Service Notice
OnlineInvoices Service Message
OnlineInvoices Service Notification
OnlineInvoices Automatic Service Notification
OnlineInvoices Automated Service Notification

Download Domains:
http://corpcaterersdublin.com/?...3LUw
http://danstruckersblend.com/?...3LUw
http://corpcatererscolumbus.com/?...3LUw
http://thecapebretontradingcompany.com/?...3LUw
http://corpcatererscinci.com/?...YCQi
http://capebretontrading.com/?...YCQi
http://corpcaterersdayton.com/?...YCQi
http://corpcatererscleveland.com/?...3CQi

Hancitor C2s:
http://herttannarit.com/ls5/forum.php
http://sarattatit.ru/ls5/forum.php
http://uldminyran.ru/ls5/forum.php

Payloads:
http://sergioleyva.udem.edu.ni/wp-content/plugins/newstatpress/includes/1
http://tstwatcheshk.com/wp-content/plugins/disable-comments/1
http://yogasphering.com/wp-content/plugins/google-sitemap-plugin/1
http://yasaminsaffaran.com/wp-content/plugins/so-widgets-bundle/compat/1
http://szinv.ru/wp-content/plugins/ml-slider/inc/1

http://sergioleyva.udem.edu.ni/wp-content/plugins/newstatpress/includes/2
http://tstwatcheshk.com/wp-content/plugins/disable-comments/2
http://yogasphering.com/wp-content/plugins/google-sitemap-plugin/2
http://yasaminsaffaran.com/wp-content/plugins/so-widgets-bundle/compat/2
http://szinv.ru/wp-content/plugins/ml-slider/inc/2

http://sergioleyva.udem.edu.ni/wp-content/plugins/newstatpress/includes/3
http://tstwatcheshk.com/wp-content/plugins/disable-comments/3
http://yogasphering.com/wp-content/plugins/google-sitemap-plugin/3
http://yasaminsaffaran.com/wp-content/plugins/so-widgets-bundle/compat/3
http://szinv.ru/wp-content/plugins/ml-slider/inc/3