Hancitor Dec 18

http://maas-global.com/wp-admin/zykejeanclaude.php
below initial links thanks to @ww96
http://pay2help.club/js/rob_r1.php
http://ivnenterprises.in/css/willhaworth2.php
below initial links thanks to @malware_traffic
alphatennisacademy.com/wp-admin/wtomnelson.php
equitytravelsolutions.com/equity/wco3520.php
mayagardengroup.com/fonts/wyckoff1012.php
newwordconsultancy.com/js/rogerpoitras7.php
studentsadvisory.com/images/terri.stiles.php
www.nvbvdev.com/engl/yemionibudo.php
zerodegree.ae/video/sa_shaffer.php

additional dl
http://freshwaterpearls.ru/wp-content/plugins/force-regenerate-thumbnails/1
http://freshwaterpearls.ru/wp-content/plugins/force-regenerate-thumbnails/2
http://freshwaterpearls.ru/wp-content/plugins/force-regenerate-thumbnails/3
http://jewelry-guide.ru/wp-content/plugins/regenerate-thumbnails/1
http://jewelry-guide.ru/wp-content/plugins/regenerate-thumbnails/2
http://jewelry-guide.ru/wp-content/plugins/regenerate-thumbnails/3
http://neu.x-sait.de/wp-content/plugins/mce-table-buttons/1
http://neu.x-sait.de/wp-content/plugins/mce-table-buttons/2
http://neu.x-sait.de/wp-content/plugins/mce-table-buttons/3
http://pervomaiskaja.com/wp-content/plugins/photo-gallery/framework/1
http://pervomaiskaja.com/wp-content/plugins/photo-gallery/framework/2
http://pervomaiskaja.com/wp-content/plugins/photo-gallery/framework/3
http://weddingjewelry.ru/wp-content/plugins/jquery-updater/1
http://weddingjewelry.ru/wp-content/plugins/jquery-updater/2
http://weddingjewelry.ru/wp-content/plugins/jquery-updater/3

hashes
2779f1a9c62ae9fa96f5b1c1d4d37fb8a09d9dc92cdf204467df6b1e4beea1b6  1.dll
edccfd72b8ad1f48129dd92b34f13c8f980637d364923dc4f9f2e099457cc22f  2.exe
b2f31da11f71b09e608ed26ea753f9902c34bfe3aab10564c32b0e18807b0d80  3.exe
c90209651c24c6433123ce89a025b5ba3869f32fc048825ccfa287dd6f518143  aa.exe
a694c9081cf430f5902b818c0de821a3116cd315c0a5272bd8297655f6087f46  JuMPHi.txt.dll
2eba2dac08dddb8b5c2591d3a0ca33233070204acee715c396f6d2f28de04034  Tracking#6105583815874.vbs

hancitor c2
http://unceliet.com/4/forum.php
http://fitiondice.ru/4/forum.php
http://wordlegromin.ru/4/forum.php

pony c2
http://unceliet.com/mlu/forum.php
http://fitiondice.ru/mlu/forum.php
http://wordlegromin.ru/mlu/forum.php

evilpony c2
http://unceliet.com/d2/about.php
http://fitiondice.ru/d2/about.php
http://wordlegromin.ru/d2/about.php

cobaltstrike c2
http://31.44.184.125/tYX7
http://31.44.184.125/updates.rss

ursnif info
Dec 11 2019
constitution.org/usdeclar.txt
0x4eb7d2ca
2000
550
com ru org
Gwe9HMygngWe8kPK
foo.fulldin.at/webstore
bat.fulldin.at/webstore
one.ahah100.at/webstore
api.ahah100.at/webstore
193.183.98.66
89.40.116.230
94.247.43.254
195.10.195.195
8.8.8.8