Hashes:

0cbc40baea499758a01ad897cfc6beb54dc1cbbad56eedcf5197f42a141c0188 | 
149599673311b49302568fcde7dc7ef95e0d37bba1316b88cafb5c68f56e7f1c | W2_and_1095A_PDF.jar
1fb25bf59dc8228f2af4b181f39c24cee593bebfd09df5a7877c6b144a81637f | 
2d8bcc30fb2c2b56677e29d7f3750ea7378869e992f3fefd3f4c4bb855185cfb | 1095-A_PDF.jar_
2f155b4502ffc933cecb3e1d182ba39b92498406b8084435114f9a27ea4a9825 | 
30787ef4c9be53e9f4caea0517e36b76a2e6aeddbeee1f5f5110c49518594020 | Efin-reports_PDF.jar
35d02b928a0c7641e4d128bb63c704116c5ee6b43c07eab0d24832eb98f5a165 | 
35ed386b65b34d4fd2369039c916bacddafd7d1af5e5eb9fdc62a34a9ccd4dc0 | Nancy1099-cpark3.html
41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919 | W2_and_1095A_PDF.jar, 178.jar, java.util-41a0.jar
51d16310665c4ed69a4c18f07e927e4542520cf1c506b991776fc347757d26ff | recent_activitylist_pdf.jar
b0b73b1fc6326699c6eaea17b05be9a26b1efd9f9ce66828e60de468c44aac74 | Recent_ActivityList_PDF.zip
82841ef1d4cd8089520b4b57e6fc1f56b0e9dc39db814c5b3c5607fea5c4fd1e |
d2697131be331f87cc0760e04bfebb7f116c16756110a311bb92e0bb271e4877 | 
3eb419b3c1993a4027c88b2c7758067fe9040173782e00c8a94e7d3b7c6b9fab | 
83113087e77d0a6bceeec33e6d043838e8f2bc5d0cc722e937b160ad0a1e9c79 | Efin_Reports_PDF.jar
693684406dd4102f97af2cf276fcee80f85182b589281edd53c1da2570346364 | jre-8-startup-managers.jar
51023526da90e068469593de68a439be2c4f239c59f7f0314ef10825d079e8fc | 
9055f4dd85136e6b051569b8f7d039117af487e8ebba78fc484e4256b79746b7 | o.jar.inf
0b283193f0e2c3d9fe8e07ecb1716b869581d73fdf9b9fc18130fa15c244e48d | Mary1099-businesstax.html
bf93e1ceb17206a742dd4f85700ef75f55ad76b04ca8a601c4d2a515151840aa | W2_and_1095A.zip
83cf9fb418ead6b97f8bcaea08a824ab312c47471cc2134b15aeb977fd7671a1

Network Activity:
ountains.web.app | Download Server
sacomu.web.app  | Download Server
smionsa.web.app | Download Server for .zip file
masfokmhg.web.app | Download Server

http://dynamic.russia-games.eu/download/binaries.txt
http://lille.russia-games.eu/download/tweaker-v6.jar
http://lille.russia-games.eu/download/tweaker-registries.jar
http://giulianilex.com/178.jar | Download Server for the DynamicRAT payload

178.18.255.246 | C2 Server
185.250.37.168 | Potential older C2 Server
193.142.146.220 | C2 Server


