Hancitor Apr 18

IRS Notice to the Taxpayer

https://www.hybrid-analysis.com/sample/006f7fd56fa89fa576fa95221bdf16422d66787ca366e57816ff6d8a957d7de5
https://app.any.run/tasks/b89d540d-32a3-4188-97c8-ee7174f65d2c

hancitor c2
herstantosu.ru/4/forum.php
sacetothad.ru/4/forum.php
ettoldketru.com/4/forum.php

additional payload dl
below thanks to @techhelplistcom
http://bestbodyrace.com/wp-content/plugins/evonapluginconfig/1
http://itsonlyem.com/1
http://agor-engineering.com/wp-content/plugins/really-simple-captcha/1
http://australiancollectablesfair.com/wp-content/plugins/wordpress-importer/1
http://grosirmebelmurah.com/wp-content/plugins/alexa-intsdernet/1

http://bestbodyrace.com/wp-content/plugins/evonapluginconfig/2
http://itsonlyem.com/2
http://agor-engineering.com/wp-content/plugins/really-simple-captcha/2
http://australiancollectablesfair.com/wp-content/plugins/wordpress-importer/2
http://grosirmebelmurah.com/wp-content/plugins/alexa-intsdernet/2

http://bestbodyrace.com/wp-content/plugins/evonapluginconfig/3
http://itsonlyem.com/3
http://agor-engineering.com/wp-content/plugins/really-simple-captcha/3
http://australiancollectablesfair.com/wp-content/plugins/wordpress-importer/3
http://grosirmebelmurah.com/wp-content/plugins/alexa-intsdernet/3

pandabanker domain
lyrintedba.com