Hancitor Feb 25

http://underwork.co
additional dl
http://martingr.com/wp-content/plugins/thefox_cp/m.exe

http://andrewmac.ca/wp-content/plugins/iSEO/1
http://andrewmac.ca/wp-content/plugins/iSEO/2
http://andrewmac.ca/wp-content/plugins/iSEO/3
http://blackwingjournals.com/wp-admin/includes/1
http://blackwingjournals.com/wp-admin/includes/2
http://blackwingjournals.com/wp-admin/includes/3
http://greenscreenguy.com/wp-admin/includes/1
http://greenscreenguy.com/wp-admin/includes/2
http://greenscreenguy.com/wp-admin/includes/3
http://greyliquid.com/wp-content/themes/twentyfourteen/1
http://greyliquid.com/wp-content/themes/twentyfourteen/2
http://greyliquid.com/wp-content/themes/twentyfourteen/3
http://veggymart.com/wp-content/plugins/iSEO/1
http://veggymart.com/wp-content/plugins/iSEO/2
http://veggymart.com/wp-content/plugins/iSEO/3

hashes
21cfbf03a4d1cc26af2290edc01f77b31c4af2d341b5c53bdb15fc5d8c79ae36  1.dll
e48de338539d741ea7557180a235a96a2bfb243dbe895cdeda1710b9418a4fb5  2.exe
d5fe93661b1bf142cdda1716dfa032ba8c7e98ae7c52be20e13056f6effbf00c  3.exe
88b8d1e2f314a82c68dd106fc233231e2dffd05653d4a8ce57341fd611940fe4  invoice_157117.xls
81ebc53905826f9edb4960d3a678196038f5be2f0c145468f8391232ed6793c6  m.exe

hancitor c2
http://toffithatwith.com/4/forum.php
http://howdirena.ru/4/forum.php
http://tosinheet.ru/4/forum.php

pony c2
http://toffithatwith.com/mlu/forum.php
http://howdirena.ru/mlu/forum.php
http://tosinheet.ru/mlu/forum.php

evilpony c2
http://toffithatwith.com/d2/about.php
http://howdirena.ru/d2/about.php
http://tosinheet.ru/d2/about.php

gozi stuff
2000
Gwe9HMygngWe8kPK
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
ax.ikobut.at/webstore
beetfeetlife.bit/webstore
foo.avaregio.at/webstore
api.hamanana.at/webstore
api.ikobut.at/webstore
supp.zapkopw.at/webstore
cdn.avaregio.at/webstore
193.183.98.66
91.217.137.37
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222