Hancitor Jul 25

a3dcb7ce40ba7b282359ff6838ff0b241ee383c96ff8a64e6694ce045a9f8d4e  12928130497_878408533.vbs
32efa6241b1597b9f749d49e9b95ac97d2abd62890c1aad91f0b5713f489a530  xIzbUJlt.exe

amadey c2:
http://codeotso.com/f5lkB/index.php
http://fordifortti.ru/f5lkB/index.php
http://todratsake.ru/f5lkB/index.php

below thanks to @malware_traffic:
dobresmaki.eu/wp-content/plugins/duplicate-post/art.exe <- cobaltstrike dropper
dobresmaki.eu/wp-content/plugins/duplicate-post/3.exe <- ursnif
material-nerud.ru/wp-includes/pomo/p.exe <- pony