Hancitor Oct 3

additional dl
http://clevereducation.com.au/wp-includes/widgets/1
http://clevereducation.com.au/wp-includes/widgets/2
http://clevereducation.com.au/wp-includes/widgets/3
http://ecareph.org/wp-content/plugins/bbpowerpack/includes/1
http://ecareph.org/wp-content/plugins/bbpowerpack/includes/2
http://ecareph.org/wp-content/plugins/bbpowerpack/includes/3
http://material-nerud.ru/wp-includes/pomo/1
http://material-nerud.ru/wp-includes/pomo/2
http://material-nerud.ru/wp-includes/pomo/3
http://www.onedigibox.com/wp-content/plugins/smart-slider-3/includes/1
http://www.onedigibox.com/wp-content/plugins/smart-slider-3/includes/2
http://www.onedigibox.com/wp-content/plugins/smart-slider-3/includes/3
http://www.thc-annex.com/wp-content/1
http://www.thc-annex.com/wp-content/2
http://www.thc-annex.com/wp-content/3
below thanks to @jaythl
csinashville.com/ok.html
cowandchickens.com/ok.html
chateaumorritt.ca/ok.html
thegbar.net/ok.html
thegbars.us/ok.html
thegbars.net/ok.html
fedtoner.com/ok.html

hancitor c2
http://spausence.com/4/forum.php
http://wortionce.ru/4/forum.php
http://knoweent.ru/4/forum.php

pony c2
http://spausence.com/mlu/forum.php
http://wortionce.ru/mlu/forum.php
http://knoweent.ru/mlu/forum.php

evilpony c2
http://spausence.com/d2/about.php
http://wortionce.ru/d2/about.php
http://knoweent.ru/d2/about.php

hashes
db2a19a665492db15405aafa46ffbac30679bbda3e8f991e1f43d5eb231a99af  1.dll
d93039550209f0f28991efce551d0368b0d00cd177ae4eed963d7fe7969c9f0e  2.exe
4d733ed3acce445e397e6563fbc007d1217cb7dc07e4972b580f055d7c388dc2  3.exe
ff56b798b2a40b66a13c918cc9eaa4d7d2eda8739f7db40f9bbcb417ec657e9e  file.docm
067d89c1270799d20eecb3b91e644a634adacb154cf2a1c186c0f58b74090f43  hancitor.dll
c3857c72711bea7a6a0d3aacf3bfaabe893bd378f50bd07d2a4edfc87bdd5796  ok.html

Ursnif info
Sep  2 2019
2000
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
has.votaritar.at/webstore
192.71.245.208
8.8.8.8
51.15.98.97
172.104.136.243
193.183.98.66