Hancitor Oct 23

http://searchmarket.in/COPYRIGHT/thetafly.php
http://punjabmilitarystore.in/font/rickyv319.php

below thanks to @jaythl
2wheelrider.com/123_123123.php
http://adidevtourandtravel.in.net/images/sasshm.php
http://akashmehandi.co.in/admin/zaki.php
http://banarasimehndiart.in.net/css/ykootss.php
http://dewdropenterprises.in.net/js/scottyw36.php
http://easycleanservices.in.net/mail/waynerice816.php
http://hemantzone.in/ajax/sjj53.php
http://kaamwalebande.in/css/ywingitt.php
http://mayurtenthouse.in.net/css/ron_penfold.php
http://meettourandtravel.in.net/images/robert.hicks.php
http://newgarudatoursandtravels.com/wp-json/rgovett.php
http://omenterpriseslko.com/vimal-img/vmpereira.php
http://ommagencies.in.net/cgi-bin/wjtconsult.php
http://panghaltourandtravel.in.net/assets/westharbour.php
http://puneetplumber.in.net/img/scooby6060.php
http://punjabmilitarystore.in/font/rickyv319.php
http://rajeshcraneservices.in.net/mail/wschnei106.php
below thanks to @wwp96
hxxp://mpholidaystrip.co.in/cgi-bin/storme.cosgrave.php
hxxp://punjabmilitarystore.in/font/rickyv319.php
hxxp://kaamwalebande.in/css/ywingitt.php
hxxp://kanshikatourtravel.in.net/css/tstanis5.php
hxxp://puneetplumber.in.net/img/scooby6060.php
hxxp://bawasecurityservices.in/cgi-bin/rhf26.php
hxxp://akashmehandi.co.in/admin/zaki.php

additional dl
http://allstarautoins.org/1
http://allstarautoins.org/2
http://arvoreazul.com.br/1
http://arvoreazul.com.br/2
http://asianetworkconsult.com/wp-includes/1
http://asianetworkconsult.com/wp-includes/2
http://masterserviceltda.com/wp-content/plugins/download-monitor/1
http://masterserviceltda.com/wp-content/plugins/download-monitor/2
http://pmk-55.ru/wp-includes/1
http://pmk-55.ru/wp-includes/2
http://wcfamlaw.com/wp-content/themes/wcfamlaw/artvnch.exe

hashes
1d14858eac254ae5dca530a5e9db43b28cc900eb8dcd44fec5fc80fd3aaf1960  1.dll
fdce1e87e468d019ab7d8d2fa1f42115ad24b9b9a4d695bda22703c3c950f4aa  2.exe
0abfde7b2c2678b3fafcd42a9a7f5f21452cd25bda5764598dba8a0de51e862d  35695622001544-SP_7372.zip
7f1e5446c2f1e68a3b98ef49bedc8a54597962cf9d50058c2ff37eb42adda402  35695622001544-SP.vbs
86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78  nubVuqte.log.dll
f4c8ba53f0553a22fce68a67b1eea725bf854ad91aeccabaa032e4197c9c570a  artvnch.exe

hancitor c2
http://sagitecheadle.com/4/forum.php
http://durestuasben.ru/4/forum.php
http://vladiondul.ru/4/forum.php

pony c2
http://sagitecheadle.com/mlu/forum.php
http://durestuasben.ru/mlu/forum.php
http://vladiondul.ru/mlu/forum.php

evilpony c2
http://sagitecheadle.com/d2/about.php
http://durestuasben.ru/d2/about.php
http://vladiondul.ru/d2/about.php

cobaltstrike c2:
http://31.44.184.160:8080/Sx8Y