Hancitor May 21

additional dl
thanks to @mesa_matt for the initial info!
http://aspenswimspa.uk/h7843u.xlsx
http://aclcnational.com/wp-content/plugins/gallery-images/1
http://aclcnational.com/wp-content/plugins/gallery-images/3
http://bajaringan-tegal.com/wp-content/plugins/really-simple-ssl/1
http://bajaringan-tegal.com/wp-content/plugins/really-simple-ssl/3
http://hitrovka-studio.ru/1
http://hitrovka-studio.ru/3
http://honestlywoman.com.au/wp-includes/customize/1
http://honestlywoman.com.au/wp-includes/customize/3
http://lagoscentralbaptist.org/1
http://lagoscentralbaptist.org/3

hashes
ca5161ae261251f185bf2b82551e8b7f1b473cf9a9ebbb88ca78b7214228bf8e  1.dll
6d1452e0dd2789d6e8322aa0f03d84b96fa5a0540e20e5b924c2e794ba5796ad  3.exe
78030746edebb36cc6a7e42456e5186fc9fe317ae9f39d0ec03da91262c49bab  h7843u.xlsx.exe

hancitor c2
http://andninglethe.ru/4/forum.php
http://dofoheuse.ru/4/forum.php
http://littmejecand.com/4/forum.php

pony c2
http://andninglethe.ru/mlu/forum.php
http://dofoheuse.ru/mlu/forum.php
http://littmejecand.com/mlu/forum.php

ursnif info
Mar 14 2019
2000
Gwe9HMygngWe8kPK
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
api.hartino.at/webstore
voip.hartino.at/webstore

172.104.136.243
8.8.8.8
176.126.70.119
51.15.98.97
193.183.98.66