Hancitor Jan 22

http://davidgvideo.com/liberty/tomm711.php
below sites thanks to @jaythl
http://salaries-de-la-fabrication-d-habillement.fr/plugins/senmotomajin.php
http://salaries-de-la-fabrication-de-cuirs-et-peaux.fr/images/shellie.php
http://salaries-de-la-grande-distribution.fr/plugins/tbconsulting.php
http://salaries-des-commerces-et-services-medico-techniques.fr/installation.done/robohip1.php
http://salaries-des-espaces-de-loisirs.fr/log/wildpitch.php
http://salaries-des-grossistes-de-tissus-tapis-et-linge-de-maison.fr/administrator/sboles7.php
http://salaries-entreprise-d-interim.fr/administrator/willieotero13.php
http://salaries-office-de-tourisme.fr/logs/topsprop1.php
http://sommerfest-deko.de/tmp/rolfanderson.php
http://vityaz19.ru/kids/thomasautomotive.php

additional dl
http://altitudesurfacesolutions.com/7834_2378.php
http://dl-rw.com/wp-content/plugins/background-image-cropper/1
http://dl-rw.com/wp-content/plugins/background-image-cropper/2
http://drewcanole.com/1
http://drewcanole.com/2
http://edwardmills.co.uk/wp-content/themes/bm_boilerplate/1
http://edwardmills.co.uk/wp-content/themes/bm_boilerplate/2
http://san-odbor.org/wp-content/plugins/one_click_seo/1
http://san-odbor.org/wp-content/plugins/one_click_seo/2
http://www.next-post.com/1
http://www.next-post.com/2
below thanks to @malware_traffic:
http://wp.quercus.palustris.dk/wp-content/plugins/ultimate-tinymce/includes/3
http://www.thc-annex.com/wp-content/3

hashes
a2693ba9590991c13ccbf8aa50cf99bff29711cdf9da6270f470854eda028642  157a.exe
e9a3dfd565cd8a1f6e551c115c377dbebfe1cfda2b7713524cccdb2772d7f6c7  1.dll
97262e61d6f12b0324aa534edf70cf6276df3520a0a2faa31764acab5fabd22a  2.dll
e8975ce0d2b7847259ed2fa13eb9e9fff3a0751b5e4a3fba68610bc13dd06131  3.exe
9d25796fbe6413963830b0dcbf68fa525a3b9acf8c61c4d121185a8a068a1e0d  SENOR347597.vbs
fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b  yoZp.txt.dll

hancitor c2
http://hourtschem.com/4/forum.php
http://thicatlies.ru/4/forum.php
http://cousidrebn.ru/4/forum.php

pony c2
http://hourtschem.com/mlu/forum.php
http://thicatlies.ru/mlu/forum.php
http://cousidrebn.ru/mlu/forum.php

evilpony c2
http://hourtschem.com/d2/about.php
http://thicatlies.ru/d2/about.php
http://cousidrebn.ru/d2/about.php

ursnif info
550
2000
Gwe9HMygngWe8kPK
constitution.org/usdeclar.txt
0x4eb7d2ca
com ru org
Gwe9HMygngWe8kPK
foo.fulldin.at/webstore
bat.fulldin.at/webstore
193.183.98.66
89.40.116.230
94.247.43.254
195.10.195.195
8.8.8.8