Hancitor Dec 11

http://whitestarindia.com/wp-admin/rmulli.php
below links thanks to @DodgeThisSecurity
http://drdaviscourse.com/wp-admin/wrecker49.php
http://starsteeth.com/access/xingqi729.php
http://thenutrifresh.com/uploads/timkillen4343.php
http://teamweddingvows.com/cgi-bin/wbirckh364.php
http://terra-sw.com/ppnoft/smoke6780.php
http://wordofhemp.com/wp-content/taylorsdm.php

below all thanks to @jayhtl

additional dl
http://xroadsiot.com/7832647_786209.php
http://jh-internacional.rs/wp-content/themes/sketch/1
http://jh-internacional.rs/wp-content/themes/sketch/2
http://mrsoscience.com/wp-content/themes/sketch/1
http://mrsoscience.com/wp-content/themes/sketch/2
http://sezmakzimpara.com/wp-content/themes/sketch/aa
http://sezmakzimpara.com/wp-content/themes/sketch/aa
http://thamidicksonmedia.co.za/wp/wp-content/themes/sketch/1
http://thamidicksonmedia.co.za/wp/wp-content/themes/sketch/2
http://ursreklam.com/wp-content/themes/sketch/aa
http://ursreklam.com/wp-content/themes/sketch/aa
http://wiwi-cloud.htw-saarland.de/wordpress/wp-content/themes/sketch/aa
http://wiwi-cloud.htw-saarland.de/wordpress/wp-content/themes/sketch/aa
http://www.fastwaylogistic.com/artvnch.exe
http://www.jkui.top/wp-content/themes/sketch/1
http://www.jkui.top/wp-content/themes/sketch/2
http://www.winchance.co.th/wp-content/themes/sketch/1
http://www.winchance.co.th/wp-content/themes/sketch/2

hashes
5a8528b562aa86079e107c896635dc65e1bd909859615736a19ac38a85000e6b  1.dll
73ea6a8acddfd9133a034e32e78fda21541f5c10ee3d376eb7a8dd821cb6af5b  2.exe
5ec0c6ce05a5c9275fa695812f6f51105f390dd07e0dc8cb574f47ba8f54d9b2  569993152.vbs
c90209651c24c6433123ce89a025b5ba3869f32fc048825ccfa287dd6f518143  aa.exe
2d038b20eaf05bb8d673542f1dbab6a376abb05bf10d38b04f163cfd6c2a7252  artvnch.exe
3f1be0bf22eb9c01ecfd1a9d8a9fbe46ce103567a3876d9c28ab8b2b21feddfc  luhJHr.txt.dll

hancitor c2
http://adinend.ru/4/forum.php
http://boutimsami.ru/4/forum.php
http://magenvire.com/4/forum.php

pony c2
http://adinend.ru/mly/forum.php
http://boutimsami.ru/mlu/forum.php
http://magenvire.com/mlu/forum.php

evilpony c2
http://adinend.ru/d2/forum.php
http://boutimsami.ru/d2/forum.php
http://magenvire.com/d2/forum.php

cobaltstrike c2
http://31.44.184.125/updates.rss
http://31.44.184.125/tYX7

ursnif
Dec  4 2019
550
2000
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
foo.fulldin.at/webstore
bat.fulldin.at/webstore
8.8.8.8
195.10.195.195
8.8.4.4
193.183.98.66
172.104.136.243
94.247.43.254
http://one.ahah100.at/jvassets/o1/s64.dat
http://api.ahah100.at/webstore