Hancitor Apr 16

campcorral.net
below domains thanks to @wwp96
campcorral.info
goldencorral.club
goldencorralonthego.net
gcfbeta.com
yourfreegoldencorral.com
campcorral.co
goldencoral.com
campcorral.us

additional dl
http://mygoldencorral.net/n43sdoi.exe
http://culturensk.ru/includes/1
http://culturensk.ru/includes/2
http://culturensk.ru/includes/3
http://embracecode.com/wp-content/themes/twentytwelve/1
http://embracecode.com/wp-content/themes/twentytwelve/2
http://embracecode.com/wp-content/themes/twentytwelve/3
http://iby.ro/wp-admin/1
http://iby.ro/wp-admin/2
http://iby.ro/wp-admin/3
http://kidsinbalance.nl/wp-content/plugins/contact-form-plugin/1
http://kidsinbalance.nl/wp-content/plugins/contact-form-plugin/2
http://kidsinbalance.nl/wp-content/plugins/contact-form-plugin/3
http://recht-und-geld.info/wp-content/plugins/akismet/1
http://recht-und-geld.info/wp-content/plugins/akismet/2
http://recht-und-geld.info/wp-content/plugins/akismet/3
http://wisconsin-coffee.com/wp-content/plugins/wp-super-cache/1
http://wisconsin-coffee.com/wp-content/plugins/wp-super-cache/2
http://wisconsin-coffee.com/wp-content/plugins/wp-super-cache/3

hashes
127a6a03ce78a83f6522a23b2680cc1a80d8e1087e638b5fad911c085f46da7b  1.dll
c495b6dbca25162655f75dd20070cd23aae9ec6b40242471ce2146bf9dd450d4  2.exe
72849b756ec0fa220e10f4e0e6f0961c456dbe38e40c63d75b321bc082cc7510  3.exe
e4072e5922b814433894d4ec96ed0890ba3551dc27906c04e9d52c414b23ee7d  invoice_211434.xls
70d16fb632ff6b12eb08d873bee35d27a82df9f76ec4a21a1c09df7befa6ca8c  n43sdoi.exe

hancitor c2
http://gumousethat.com/4/forum.php
http://henletlighny.ru/4/forum.php
http://kethentantit.ru/4/forum.php

pony c2
http://gumousethat.com/mlu/forum.php
http://henletlighny.ru/mlu/forum.php
http://kethentantit.ru/mlu/forum.php

evilpony c2
http://gumousethat.com/d2/about.php
http://henletlighny.ru/d2/about.php
http://kethentantit.ru/d2/about.php

ursnif info
217072
Mar 14 2019
2000
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK

c2
beetfeetlife.bit/webstore
api.sorna.at/webstore
supp.rivier.at/webstore

dns servers
193.183.98.66
91.217.137.37
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222