Hancitor Nov 6

https://www.hybrid-analysis.com/sample/d6e48036f714c0a357213ae7d75230b876b31a481223cd1cd845a46d03b48d1c?environmentId=100
https://www.threatcrowd.org/ip.php?ip=45.77.130.71
https://www.threatcrowd.org/ip.php?ip=184.168.221.49
https://www.threatcrowd.org/domain.php?domain=linghogolac.ru
https://packettotal.com/cgi-bin/view-analysis.cgi?id=c621031e1694764993d2ce241be962ef

doc dl:
http://focus-pointe.net
http://fpgcares.us
http://focuspointe.co

hancitor c2:
http://pathathifi.com/ls5/forum.php
http://wronthatsitdi.ru/ls5/forum.php
http://orsaledthen.ru/ls5/forum.php

payload dl:
momncare.com/wp-content/plugins/mce-table-buttons/1
momncare.com/wp-content/plugins/mce-table-buttons/2
momncare.com/wp-content/plugins/mce-table-buttons/3
thanks to @cheapbyte for the below:
http://motocicleteyamaha.ro/3
http://meubles-italien.com/wp-content/themes/twentyten/languages/3
http://cornwallisbusinesscentre.co.uk/wp-content/plugins/tinymce-advanced/mce/advlist/3
http://ateaseresidence.com/wp-content/plugins/cryout-theme-settings/3

pony c2:
pathathifi.com/mlu/forum.php

evil-pony c2:
pathathifi.com/d2/about.php

panda banker additional dl site:
https://linghogolac.ru/webinjects.dat
https://linghogolac.ru/1weakwageiqysgabutali.dat
https://linghogolac.ru/1weakwageiqysgabutali.exe
https://linghogolac.ru/webinject32.bin
https://linghogolac.ru/grabber.bin
https://linghogolac.ru/vnc32.bin
https://linghogolac.ru/backsocks.bin
https://linghogolac.ru/keylogger.bin
https://linghogolac.ru/webinject32.bin