Hancitor Nov 8

http://wwdirectories.com
http://attorneylove.com
thanks to @fletchsec for the below:
http://phonefix.repair
http://captainspeedy.com

hancitor c2:
http://parhecotevent.com/ls5/forum.php
http://downmoloret.ru/ls5/forum.php
http://fysorannot.ru/ls5/forum.php

additional dl:
bamrungrak.ac.th/wp-content/plugins/disable-comments/1
bamrungrak.ac.th/wp-content/plugins/disable-comments/2
bamrungrak.ac.th/wp-content/plugins/disable-comments/3
below thanks to @cheapbyte:
http://avvocatolucaingolotti.it/wp-content/plugins/contact-form-7/includes/2
http://trullidasogno.it/wp-content/plugins/better-wp-security/lib/2
http://thesoutheasternbodyshop.com/wp-content/plugins/limit-login-attempts/2
http://planejamentopublico.com.br/wp-content/plugins/icegram-rainmaker/3

pony c2:
parhecotevent.com/mlu/forum.php

evil-pony c2:
parhecotevent.com/d2/about.php

pandabanker dl:
henfobuthis.com
https://henfobuthis.com/2qoacciguowezocampaov.dat
https://henfobuthis.com/webinjects.dat
https://henfobuthis.com/2qoacciguowezocampaov.exe
https://henfobuthis.com/webinject32.bin
https://henfobuthis.com/grabber.bin
https://henfobuthis.com/webinjects.dat
https://henfobuthis.com/vnc32.bin
https://henfobuthis.com/backsocks.bin
https://henfobuthis.com/keylogger.bin
https://henfobuthis.com/grabber.bin