Hancitor Dec 10

http://hpmamerica.com/wp-admin/sjmod5.php
below thanks to @wwp96
http://gilbertohair.com/wp-content/rpoc.php

additional dl
http://mayerhood.com/89623_3247.php
http://m.peneszmentes.hu/wp-content/themes/sketch/1
http://m.peneszmentes.hu/wp-content/themes/sketch/2
http://sezmakzimpara.com/wp-content/themes/sketch/1
http://sezmakzimpara.com/wp-content/themes/sketch/2
http://ursreklam.com/wp-content/themes/sketch/1
http://ursreklam.com/wp-content/themes/sketch/2
http://vuillaumesophrologie.fr/wp-content/themes/sketch/1
http://vuillaumesophrologie.fr/wp-content/themes/sketch/2
http://wiwi-cloud.htw-saarland.de/wordpress/wp-content/themes/sketch/1
http://wiwi-cloud.htw-saarland.de/wordpress/wp-content/themes/sketch/2

hashes
40f62a95d68c73ca086abd53658ea3528cb92bd8b005deb31a7c97fae47f39cc  1.dll
e9bf317465aa3f6ca3de01aa712f845923b13249399c5733bc69c174cc50c3b8  2.exe
5c30867e49e1350f29abaf39bfc847aa7fed196c250b82125f71b7e0e06211df  bjjSXNb.txt.dll
7641dcb8266066638c88d7bc43e4e967273337f1b71f4c500706877e49b52268  THE_473292240999201.vbs

hancitor c2
http://lappoing.com/4/forum.php
http://theirchus.ru/4/forum.php
http://andalicur.ru/4/forum.php

pony c2
http://lappoing.com/mlu/forum.php
http://theirchus.ru/mlu/forum.php
http://andalicur.ru/mlu/forum.php

evilpony c2
http://lappoing.com/d2/about.php
http://theirchus.ru/d2/about.php
http://andalicur.ru/d2/about.php

ursnif
Dec  4 2019
2000
550
Gwe9HMygngWe8kPK
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
foo.fulldin.at/webstore
bat.fulldin.at/webstore
8.8.8.8
195.10.195.195
8.8.4.4
193.183.98.66
172.104.136.243
94.247.43.254