Hancitor Dec 20

http://marylandrxcoupon.com
additional doc dl below thanks to @JayTHL
mainerxcoupon.com
indianarxcoupon.com
iowarxcoupon.com
louisianarxcoupon.com
minnesotarxcoupon.com
montanarxcoupon.com
mississippirxcoupon.com
airxllc.com
marylandrxcoupon.com
kentuckyrxcoupon.com
idahorxcoupon.com
kansasrxcoupon.com
michiganrxcoupon.com

additional dl
http://mercurysroadie.com/wp-content/plugins/contact-widgets/1
http://mercurysroadie.com/wp-content/plugins/contact-widgets/2
http://mercurysroadie.com/wp-content/plugins/contact-widgets/3
http://mercurysroadie.com/wp-content/plugins/contact-widgets/4
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/1
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/2
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/3
http://mytest.alessioatzeni.com/wp-content/plugins/post-types-order/4
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/1
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/2
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/3
http://peruonfilm.com/wp-content/plugins/ml-slider/inc/4
http://www.artizanat.online/errpage/1
http://www.artizanat.online/errpage/2
http://www.artizanat.online/errpage/3
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/1
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/2
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/3
http://yeccusa.com/wp-content/plugins/disable-wordpress-updates/4

hancitor c2
http://torsgotuldrat.com/4/forum.php
http://rowthenrettof.ru/4/forum.php
http://hedtnorobran.ru/4/forum.php

pony c2
http://torsgotuldrat.com/mlu/forum.php
http://rowthenrettof.ru/mlu/forum.php
http://hedtnorobran.ru/mlu/forum.php

evilpony c2
http://torsgotuldrat.com/d2/about.php
http://rowthenrettof.ru/d2/about.php
http://hedtnorobran.ru/d2/about.php

gozi/isfb domains
beetfeetlife.bit
api2.doter.at
extermas.at
in.extermas.at

smokeloader c2
http://righbeheckma.com/qwart/

drops
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/3000.exe

additional exe's on the site
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/tt.exe
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/1812.exe
http://tacloban.gov.ph/wp-content/plugins/kopa-nictitate-toolkit/l.exe