Hancitor Apr 9

domains thanks to @mesa_matt below:
datascienceexcellence.com
datascienceexcellence.net
datascienceexcellence.org
evidentpower.com
income95.ca
income95.info
lewisandclarkford.net
lindaodnokon.com
plan95.ca
startupprofiler.com
tradingpartneredi.com

additional dl
http://parallaxinsights.com/h.exe
http://atelierbcn.com/wp-content/plugins/social-autho-bio/1
http://atelierbcn.com/wp-content/plugins/social-autho-bio/2
http://atelierbcn.com/wp-content/plugins/social-autho-bio/3
http://fiveborofund.org/wp-content/plugins/wp-mail-smtp/1
http://fiveborofund.org/wp-content/plugins/wp-mail-smtp/2
http://fiveborofund.org/wp-content/plugins/wp-mail-smtp/3
http://igna.com.br/wp-content/plugins/wp-email-capture/1
http://igna.com.br/wp-content/plugins/wp-email-capture/2
http://igna.com.br/wp-content/plugins/wp-email-capture/3
http://lgservis.net/wp-content/plugins/soliloquy-lite/1
http://lgservis.net/wp-content/plugins/soliloquy-lite/2
http://lgservis.net/wp-content/plugins/soliloquy-lite/3
http://www.bodyandsoul-balance.at/wp-content/plugins/widget-logic/1
http://www.bodyandsoul-balance.at/wp-content/plugins/widget-logic/2
http://www.bodyandsoul-balance.at/wp-content/plugins/widget-logic/3
http://zaragozamarketing.com/wp-content/plugins/gocodes/1
http://zaragozamarketing.com/wp-content/plugins/gocodes/2
http://zaragozamarketing.com/wp-content/plugins/gocodes/3

hashes
4defaa9c3d7dd6941d6950d48f726bed5c7f4aadbc829e769e0a5a277e4a121d  1.dll
db400593aae689de3b4b6b98d900e3e0b65563d3497ab79477f622e36d2ba1a0  2.exe
d5d4f92faa17f50fb41882b2bc11c1d06f58502172408a6d7eec2c67bb1c9380  3.exe
4064ac41dbf2e965456b48d605e61387fbe7ba624b6dec7d8755d8040c17f171  h.exe
711edfd408ab82cc45e4595a11e22eb2b5b179b50316f2303d0bfa704edd3837  invoice_955515.doc

hancitor c2
http://reprathechim.com/4/forum.php
http://nothatribab.ru/4/forum.php
http://vetibutrew.ru/4/forum.php

pony c2
http://reprathechim.com/mlu/forum.php
http://nothatribab.ru/mlu/forum.php
http://vetibutrew.ru/mlu/forum.php

evilpony c2
http://reprathechim.com/d2/about.php
http://nothatribab.ru/d2/about.php
http://vetibutrew.ru/d2/about.php

gozi/ursnif info
2000
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
beetfeetlife.bit/webstore
api.sorna.at/webstore
supp.rivier.at/webstore

dns servers
193.183.98.66
91.217.137.37
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222