Hancitor Nov 26

http://myservices.rise-n-step.org/notiwek3j/vancewl.php
below links thanks to @jaythl and @wwp96
http://amarsite.hol.es/test/wdavidmajor.php
http://balldropview.esy.es/wp-content/rjyoung007.php
http://bellevietowns.com/notiwek3j/zab4ksnk.php
http://carlositaliano.com/notiwek3j/willieotero13.php
http://didarmedia.ir/cgi-bin/wbferguson.php
http://divnyisad.ekspress-kuban.ru/gl35/roberto.rubbiani.php
http://douknow.com/wp-includes/willid5223.php
http://feed.ihiphop.com/cache_old/slamduncker.php
http://georreferenciandoideias.com.br/calendar/shogin1.php
http://gherit.com/wp-content/rojas5439.php
http://globalginseng.com/cn/steveswanson22.php
http://kyankapp.com/wp-content/rglennn.php
http://lescoeursvaillants.ma/wp-admin/tmoen3.php
http://m-preview.com/property/sd37667.php
http://myservices.rise-n-step.org/notiwek3j/vancewl.php
http://omarelfarouk.ma/Maintenance/rick.php
http://omarelfarouk.ma/maintenance/rick.php
http://phelieuanphat.com/wp-content/yazanmoussa.php
http://revelrygroup.ca/wp-content/sfcw1.php
http://vapz.com/calendar/wheatstiger.php
http://www.thebagpackers.in/wp-includes/tonypkeeling.php
http://xldzh.com/data/ryanzeitler.php

additional dl
http://brighter-homes.com/78435_347823.php
http://3dpixelstudio.co/1
http://3dpixelstudio.co/2
http://3dpixelstudio.co/3
http://amtours.net/1
http://amtours.net/2
http://amtours.net/3
http://bbhs.org.ng/1
http://bbhs.org.ng/2
http://bbhs.org.ng/3
http://businessmarker.ro/1
http://businessmarker.ro/2
http://businessmarker.ro/3
http://caddyhk.com/1
http://caddyhk.com/2
http://caddyhk.com/3
http://businessmarker.ro/aa

hashes
f81f4cc8bf1ea7d13ddd6f6b2a8f980286f26d3bed5e190a013b737549b3b8ad  1.dll
5e821ec6df6dc7e9808476f2a17c5fec2571c5db16cc967651d8410988e75682  2.exe
eb6e58109dcc9b27df53ab47747be246eb6dcd299424f3dafd8be1f605659aa5  A6500955093295785_1471.zip
58a538c9a2f80e25ce438a16870e689b04f8eb0c620c9445bbe2a6a0fceef5a4  ALE_6500955093295785.vbs
f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac  CqEGpHD.txt.dll
116b8f1d97f683b0e4b5694a26916ede2178a70183877f2c81f92685aa219084  3.exe
c90209651c24c6433123ce89a025b5ba3869f32fc048825ccfa287dd6f518143  aa.exe

hancitor c2
http://hismosedkaj.com/4/forum.php
http://consenhary.ru/4/forum.php
http://prolighmev.ru/4/forum.php

pony c2
http://hismosedkaj.com/mlu/forum.php
http://consenhary.ru/mlu/forum.php
http://prolighmev.ru/mlu/forum.php

evilpony c2
http://hismosedkaj.com/d2/about.php
http://consenhary.ru/d2/about.php
http://prolighmev.ru/d2/about.php

ursnif info:
Oct 31 2019
2000
550
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
has.votaritar.at/webstore
8.8.8.8
195.10.195.195
8.8.4.4
95.216.174.175
193.30.123.44
94.247.43.254

below thanks to @shotgunner101
cobalt strike c2
http://31.44.184.125/tYX7
http://31.44.184.125/updates.rss