Hancitor Dec 6

http://hrhprincessleith.com?hUCaNEq=
http://artsforglobalpeaceandhealing.org?YXuaj34yD38YUZ=

Thanks to @techhelplistcom for the payload links and hancitor c2 as well as doc sample:
https://www.virustotal.com/#/file/39e5933d46bcdc90baeee09b4ea2419f872cfce5ff7b64f0dbabd13372d4067c/community

pony c2
torsharucal.com/mlu/forum.php

evilpony c2
torsharucal.com/d2/about.php

icedid c2
camorata.com
dorothyle.net

icedid link structures POST'd
/forum/viewtopic.php?a=0&b=0<hex>5C&d=0&e=51&f=0&g=0&h=0&r=0&i=85&j=1