Hancitor Jul 3

pmninc.org
below thanks to @JayTHL
lenznermedicalsvcs.com
cohen-nicoleau.com
johnbetcher.com
sstileroofco.com
njbrightstar.com
anchoryt.com
cochiseclinicalresearch.com
benbrookdentist.com

additional dl
http://aznetsolutions.com/wp-content/plugins/whmcs-bridge/includes/1
http://aznetsolutions.com/wp-content/plugins/whmcs-bridge/includes/3
http://cameriabakeshop.com/wp-content/plugins/ubermenu/1
http://cameriabakeshop.com/wp-content/plugins/ubermenu/3
http://pmk-55.ru/wp-includes/1
http://pmk-55.ru/wp-includes/3
http://turginovo.ru/wp-includes/pomo/1
http://turginovo.ru/wp-includes/pomo/3
http://vorota-v-rb.ru/manager/1
http://vorota-v-rb.ru/manager/3

hashes
6d843b3bdd5494571a23e56da74558fb790353e549ec0420700cf30d74160543  1.dll
70122581d9b59f96ec5c6f837665314e7a4af6eb4573a7cb44e9bb0be5f464eb  3.exe
52df163363942aebfddb8252b9fde1bc9e5e633a77e2cb6d4533e822a96929a8  bill_486633.vbs
5fb99412ea57178c18f2fcb8ece502ca9101e25fddb0801c3baa54725a276079  XpaNsZ.bin

hancitor c2
http://tonsruhatbab.com/4/forum.php
http://oftroondidn.ru/4/forum.php
http://sparnyretligh.ru/4/forum.php

pony c2
http://tonsruhatbab.com/mlu/forum.php
http://oftroondidn.ru/mlu/forum.php
http://sparnyretligh.ru/mlu/forum.php