Hancitor Dec 9

http://theodoremontgomery.com/wp-content/willghonda.php

additional dl
http://xriots.net/43785_435345.php
http://buildupbaby.com/1
http://buildupbaby.com/2
http://erickrodriguesmartins.online/1
http://erickrodriguesmartins.online/2
http://etherealcommunityrecords.com/1
http://etherealcommunityrecords.com/2
http://nassapun.in.rs/wp-content/plugins/toloim2/2

hashes
22fd50b3b0fabece827d4c7988eea130ff6be43f3adcc41d80d4a1498129989b  1.dll
594f8c3ffc3ce9a3881cf676729b50be241036b3d273174e6a174ddf0baba8f1  2.exe
e1f4d040facb013bd8d698ffb0f7b4a67f5ccc0cf18171d6493ec60b5855068a  BOR_1022438086216112.vbs
52fd49a35294a4de460bb34687c7423528ebe5e6016cf4a5889828d2ba9a26ab  LgRCYfyHxzwER.dll

hancitor c2
http://featicent.com/4/forum.php
http://whysturprom.ru/4/forum.php
http://usseleteria.ru/4/forum.php

pony c2
http://featicent.com/mlu/forum.php
http://whysturprom.ru/mlu/forum.php
http://usseleteria.ru/mlu/forum.php

evilpony c2
http://featicent.com/d2/about.php
http://whysturprom.ru/d2/about.php
http://usseleteria.ru/d2/about.php