Hancitor Oct 21

manager@kidzpak.ca
http://roverandranger.com/calendar/timbrennan29.php
http://adoniscontest.com/zbydu/robert1325.php
http://independencesafeco.com/nofij3ksa/tjubell.php
http://5dbusiness.com/calendar/weberdental.php

below thanks to @jaythl and @wwp96:
http://5dbusiness.com/calendar/weberdental.php
http://prophysique-uae.com/wp-admin/zubairseiendom.ph
http://expresslajmi.xyz/cgi-bin/technoemporium.php
http://independencesafeco.com/nofij3ksa/tjubell.php
http://lechy-kuda-hochy.ru/wp-admin/yuki_chan2004jp.php
http://gljyptj.com/tmp/roydsingh.php
http://neulat.com/libraries/robby_hanshaw.php
http://13moonscollective.com/wp-admin/thehornet1.php
http://test.funane.com/wp-admin/stormnz54.php
http://roverandranger.com/calendar/timbrennan29.php
http://tecnologias.uptlax.edu.mx/wp-admin/samurai40w.php
http://lechy-kuda-hochy.ru/wp-admin/yuki_chan2004jp.php
http://13moonscollective.com/wp-admin/thehornet1.php
http://eco-gardening.ru/manager/zubairseiendom.php
http://gljyptj.com/tmp/roydsingh.php
http://independencesafeco.com/nofij3ksa/tjubell.php
http://mukuljoshi.co.in/wp-includes/rvk.php
http://prophysique-uae.com/wp-admin/zubairseiendom.php
http://tecnologias.uptlax.edu.mx/wp-admin/samurai40w.php

per smart people:
Initial Download
http://boatattorney.com/122.php

hashes
c56b0690c6f74c69f31bec64caca8b70bfc39029a8222044a6730bad18495de7  1.dll
eab276a49106cb9344e56ad18b6dda73748a5000673945f0bfa2bf9b6a2841a1  2.exe
2cccdc51aea02049dc7f96f510a13311f112096a7d870a97d70232356ddef42b  3.exe
e983ff1ad296e43fcd39206c7f7bd18d54a5801f58a4a3c87ab89b5e2979a19b  №_jo_8774746138154.vbs
7c47bbde3b7be7101810f9bdb8eaa8fb31b1800c4fffdc1e087855a715d26119  message__D599184D_42B428D2_kidzpak_ca_.eml
ce2570dda3b92d0adfadfe00ee18302e98a0b9611ca1043954290961cd2fe8a8  xzfhhLEa.txt.dll

additional dl
http://aco-finance.nl/includes/phpInputFilter/1
http://aco-finance.nl/includes/phpInputFilter/2
http://alebarbosa.com.br/wp-content/plugins/wp-multibyte-patch/1
http://alebarbosa.com.br/wp-content/plugins/wp-multibyte-patch/2
http://dokucenter.optitime.de/wp-content/plugins/auto-more-tag/1
http://dokucenter.optitime.de/wp-content/plugins/auto-more-tag/2
http://jointings.org/eng/wp-content/plugins/featurific-for-wordpress/1
http://jointings.org/eng/wp-content/plugins/featurific-for-wordpress/2

hancitor c2
http://keramenzakt.com/4/forum.php
http://linglentelevox.ru/4/forum.php
http://mdistellerryck.ru/4/forum.php

pony c2
http://keramenzakt.com/mlu/forum.php
http://linglentelevox.ru/mlu/forum.php
http://mdistellerryck.ru/mlu/forum.php

evilpony c2
http://keramenzakt.com/d2/about.php
http://linglentelevox.ru/d2/about.php
http://mdistellerryck.ru/d2/about.php