Hancitor Dec 20

http://marylandrxcoupon.com
additional doc dl below thanks to @JayTHL
mainerxcoupon.com
indianarxcoupon.com
iowarxcoupon.com
louisianarxcoupon.com
minnesotarxcoupon.com
montanarxcoupon.com
mississippirxcoupon.com
airxllc.com
marylandrxcoupon.com
kentuckyrxcoupon.com
idahorxcoupon.com
kansasrxcoupon.com
michiganrxcoupon.com

6208efa04ff906fc9d93365c84ffbf5e17548f4655d8c8bf7e50a7e8d2c8fb31  1.dll
32ec8a2c0abe4586d98bf615c6e9e226db5a50c7992b319dc4215679e8c5f2b0  2.exe
5061f35b959d1a36808515a9ef02fa92b54bd0448e38c5d9eeab3a89d5c5e97a  3.exe
d797df921fa015b4b8db8d8a33f248bb62a6515bb60792802bc96ba094ee25b0  4.exe
f6bfb82eb8bd80cb7f45d9d67f4c2ccf68340be0008fadc8381d75643a61c8e2  invoice_680219.xls


additional dl
http://mercurysroadie.com/wp-content/plugins/contact-widgets/1
http://mercurysroadie.com/wp-content/plugins/contact-widgets/2
http://mercurysroadie.com/wp-content/plugins/contact-widgets/3
http://mercurysroadie.com/wp-content/plugins/contact-widgets/4
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/1
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/2
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/3
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/4
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/1
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/2
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/3
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/4
http://www.artizanat.online/errpage/1
http://www.artizanat.online/errpage/2
http://www.artizanat.online/errpage/3
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/1
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/2
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/3
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/4

hancitor c2
http://torsgotuldrat.com/4/forum.php
http://rowthenrettof.ru/4/forum.php
http://hedtnorobran.ru/4/forum.php

pony c2
http://torsgotuldrat.com/mlu/forum.php
http://rowthenrettof.ru/mlu/forum.php
http://hedtnorobran.ru/mlu/forum.php

evilpony c2
http://torsgotuldrat.com/d2/about.php
http://rowthenrettof.ru/d2/about.php
http://hedtnorobran.ru/d2/about.php

gozi/isfb domains
beetfeetlife.bit
api2.doter.at
extermas.at
in.extermas.at

smokeloader c2
http://righbeheckma.com/qwart/

drops
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/3000.exe

additional exe's on the site
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/tt.exe
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/1812.exe
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/l.exe