Hancitor Sep 27

https://www.virustotal.com/file/42e3fcad33e3d94b416578c86446be7762136c7707d6da08adc8075c3bd3ce61/analysis/1506525824/
https://packettotal.com/cgi-bin/view-analysis.cgi?id=2b1c78eff36f470e3e07a3eb3288d1f6

doc dl links:
http://HOPPHOME.COM/ds.php?vdr=
http://maycompanybuilding.com/ds.php?hbt=
http://IFEELGREATNOW.COM/ds.php?csy=

dl links:
http://markimicrowave.com/blog/wp-content/themes/twentyfourteen/1
http://markimicrowave.com/blog/wp-content/themes/twentyfourteen/2
http://markimicrowave.com/blog/wp-content/themes/twentyfourteen/3

hancitor c2:
http://oneonreugh.com/ls5/forum.php
http://sotyterny.ru/ls5/forum.php
http://recsihedri.ru/ls5/forum.php

evil-pony c2:
http://oneonreugh.com/d2/about.php
http://sotyterny.ru/d2/about.php
http://recsihedri.ru/d2/about.php

pony c2:
http://oneonreugh.com/mlu/forum.php
http://sotyterny.ru/mlu/forum.php
http://recsihedri.ru/mlu/forum.php

zloader c2:
http://arlesinfor.com/bdl/gate.php
http://dinghowrephi.com/bdl/gate.php

zloader RC4 key
TyweJ848wWb7o0JfQMfY6pyd6YEp0pI2