Hancitor Oct 31

http://www.diamondegy.com/wp-content/wretchedchild5.php
http://www.duongdanganh.com/videodetails/uniprofissionais.php
below thanks to @hj751
http://www.elimagchurch.org/.quarantine/sjmartin821.php
sender address: [email protected]

below thanks to @jaythl
damcoservices.com/34894385_4378.php
additional dl
http://newwell.studio/1
http://newwell.studio/2
http://phtmierzwa.com/plugins/content/apismtp/1
http://phtmierzwa.com/plugins/content/apismtp/2
http://quangcao23h.com/1
http://uppmfkunsri.com/1
http://zakihashmiradiobroadcastingservices.com/1
http://zakihashmiradiobroadcastingservices.com/2
below appear incorrect
http://hurampronand.com/d2/about.php
http://probominku.ru/d2/about.php
http://theintrughe.ru/d2/about.php

hash
8f2ec76a8c82b115482a1bfae1c6d022c4008c992ccaf07d0a100e109ce8a67e  1.dll
5dfa2e753c361f6dbb894af358b6f399c516e2102a7c4c2b3b9ae03f066c3550  2.exe
5572d4ad38c44ff9f0e3183d3bec3e6f5bc9b8316878197352e132680161740b  GABRIEL-18642_GA.vbs
fbb36ee42131e3545bea06688e4a4a78e54d713b250c4d30bc0858df1d963746  KHObrzJqa.txt.dll

hancitor c2
http://hurampronand.com/4/forum.php
http://probominku.ru/4/forum.php
http://theintrughe.ru/4/forum.php

pony c2
http://hurampronand.com/mlu/forum.php
http://probominku.ru/mlu/forum.php
http://theintrughe.ru/mlu/forum.php

evilpony c2
http://hurampronand.com/d2/about.php
http://probominku.ru/d2/about.php
http://theintrughe.ru/d2/about.php