Hancitor Mar 14

https://app.any.run/tasks/309ea751-7947-43be-a698-0cf6b22bda19
https://www.hybrid-analysis.com/sample/5782c7ade207fd4415c35bd1e98bad7c3fcaef206fa60f142b8d1062e7103670?environmentId=100

hancitor c2
http://duketofrob.com/ls5/forum.php
http://rithesforhep.ru/ls5/forum.php
http://witlyrenco.ru/ls5/forum.php

additional payload dl
http://completestreetsathens.com/wp-content/plugins/contact-bank/lib/1
http://completestreetsathens.com/wp-content/plugins/contact-bank/lib/2
http://completestreetsathens.com/wp-content/plugins/contact-bank/lib/3
http://ibesthoteldeals.eu/wp-content/plugins/Auto-Tube-Pro/1
http://ibesthoteldeals.eu/wp-content/plugins/Auto-Tube-Pro/2
http://ibesthoteldeals.eu/wp-content/plugins/Auto-Tube-Pro/3
http://onlineprofitscoach.com/wp-content/plugins/social-count-plus/includes/1
http://onlineprofitscoach.com/wp-content/plugins/social-count-plus/includes/2
http://onlineprofitscoach.com/wp-content/plugins/social-count-plus/includes/3
http://streetfoodandtraveltvindia.com/wp-content/themes/twentyfifteen/1
http://streetfoodandtraveltvindia.com/wp-content/themes/twentyfifteen/2
http://streetfoodandtraveltvindia.com/wp-content/themes/twentyfifteen/3
http://winecountryuncorked.com/wp-content/themes/twentythirteen/inc/1
http://winecountryuncorked.com/wp-content/themes/twentythirteen/inc/2
http://winecountryuncorked.com/wp-content/themes/twentythirteen/inc/3

pony c2
http://duketofrob.com/mlu/forum.php
http://rithesforhep.ru/mlu/forum.php
http://witlyrenco.ru/mlu/forum.php

evil-pony c2
http://duketofrob.com/d2/about.php
http://rithesforhep.ru/d2/about.php
http://witlyrenco.ru/d2/about.php

pandabanker domain
hattalbutla.com