http://xolightfinance.com/js/x24spike.php

additional dl
http://shg-lawyer.com/5787478_74.php
http://kovasrot.cz/tmp/1
http://kovasrot.cz/tmp/2
http://www.onlinejobsforgirls.in/wp-includes/sodium_compat/1
http://www.onlinejobsforgirls.in/wp-includes/sodium_compat/2
http://www.russianescortsdelhi.in/blog/wp-admin/1
http://www.russianescortsdelhi.in/blog/wp-admin/2
http://www.snehaarora.in/css/1
http://www.snehaarora.in/css/2
http://www.zarinaescorts.com/wp-admin/js/1
http://www.zarinaescorts.com/wp-admin/js/2

hashes
e95425ead0194d887f64a61a2b109af1fce57f55f5fdf859e2bc145530a93aab  1.dll
a6975cd0a747bf3bade4d057c5c0b795d1a3bc15df35e420389e503bb00317b7  2.dll
98753a44c6af450af79d8c1cd0052ff39368b7faa8da99f641c0e7f705639885  3.exe
244769fc57e6e1f5f5c5571ed65be5b39a838debaf38712c8040837e8cd0e68c  DO393774670137.vbs
49cb613e0241e2a1e3ac064f3465f887403f69d438775c15211a213d208a0f6c  pgb.txt.dll

hancitor c2
http://diermedir.com/4/forum.php
http://ussismates.ru/4/forum.php
http://wernmicaz.ru/4/forum.php

pony c2
http://diermedir.com/mlu/forum.php
http://ussismates.ru/mlu/forum.php
http://wernmicaz.ru/mlu/forum.php

evilpony c2
http://diermedir.com/d2/about.php
http://ussismates.ru/d2/about.php
http://wernmicaz.ru/d2/about.php