Hancitor Dec 19

http://artifyindia.in/css/robertbeaumont.php
http://dnyaneshwaricncinstitute.com/webfonts/romanbanking.php
below initial links thanks to @ww96
http://coderaman.in/wp-content/welldoc7.php
below initial links thanks to @malware_traffic
http://geocolor.ru/wp-content/richarmc1.php
http://prof-leto.ru/wp-admin/rogerpoitras7.php

additional dl
http://schulmanlegalgroup.com/563289_6723.php
http://goji-actives.net/1
http://goji-actives.net/2
http://goji-actives.net/3
http://goji-actives.net/aa
http://material-nerud.ru/wp-includes/pomo/1
http://material-nerud.ru/wp-includes/pomo/2
http://material-nerud.ru/wp-includes/pomo/3
http://material-nerud.ru/wp-includes/pomo/aa
http://wp.quercus.palustris.dk/wp-content/plugins/ultimate-tinymce/includes/1
http://wp.quercus.palustris.dk/wp-content/plugins/ultimate-tinymce/includes/2
http://wp.quercus.palustris.dk/wp-content/plugins/ultimate-tinymce/includes/3
http://wp.quercus.palustris.dk/wp-content/plugins/ultimate-tinymce/includes/aa
http://www.gruenbaum.com.br/wp-content/plugins/qtranslate/1
http://www.gruenbaum.com.br/wp-content/plugins/qtranslate/2
http://www.gruenbaum.com.br/wp-content/plugins/qtranslate/3
http://www.gruenbaum.com.br/wp-content/plugins/qtranslate/aa
http://www.thc-annex.com/wp-content/1
http://www.thc-annex.com/wp-content/2
http://www.thc-annex.com/wp-content/3
http://www.thc-annex.com/wp-content/aa
below additional dl thanks to @jaythl
http://wp.quercus.palustris.dk/wp-content/plugins/ultimate-tinymce/includes/32.exe
http://thc-annex.com/wp-content/32.exe

hashes
575bdd77e813d1ff39fe335af843e9cd3c9af81cf86172958202d4094072ee2b  1.dll
66122a12527f563e784d5cf437f997173f71871e50e1eec7c81d54c68f02b010  2.exe
4d733ed3acce445e397e6563fbc007d1217cb7dc07e4972b580f055d7c388dc2  3.exe
ecc8442d71e5f124b3f368e351a6d5bb094a2f64ecb7618dc233c3fbaae31cb3  3-1.exe
38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d  32.exe
c90209651c24c6433123ce89a025b5ba3869f32fc048825ccfa287dd6f518143  aa.exe
c1cbc33ffd320ea7657a732db883c989370e501fd902dcabfc8a1924b9e4d16b  gYYmmIrGtk.txt.dll
6c5c3231654cb1c4236fc25a81d0fed8f5a93e5834ac968ca456d26b84682910  Tracking#8173137349186.vbs

hancitor c2
http://howeelyzuq.com/4/forum.php
http://thriondery.ru/4/forum.php
http://craledlopj.ru/4/forum.php

pony c2
http://howeelyzuq.com/mlu/forum.php
http://thriondery.ru/mlu/forum.php
http://craledlopj.ru/mlu/forum.php

evilpony c2
http://howeelyzuq.com/d2/about.php
http://thriondery.ru/d2/about.php
http://craledlopj.ru/d2/about.php

cobalt strike info
http://31.44.184.125/tYX7
http://31.44.184.125/updates.rss

sendsafe c2
31.44.184.32

ursnif info 1
Sep  2 2019
2000
550
Gwe9HMygngWe8kPK
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
has.votaritar.at/webstore
192.71.245.208
8.8.8.8
51.15.98.97
172.104.136.243
193.183.98.66

ursnif info 2
Dec 11 2019
2000
550
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
foo.fulldin.at/webstore
bat.fulldin.at/webstore
193.183.98.66
89.40.116.230
94.247.43.254
195.10.195.195
8.8.8.8